rpcclient

最新推荐文章于 2024-09-04 14:33:06 发布

weixin_34380781

最新推荐文章于 2024-09-04 14:33:06 发布

阅读量738

点赞数

文章标签： python

原文链接：https://my.oschina.net/sincoder/blog/127355

版权

2019独角兽企业重金招聘Python工程师标准>>>

samba 工具包里面的一个工具。。。。可以远程登录 windows 然后执行一些操作前提是需要系统的密码。。。

[root@centos ~]# rpcclient xx.xx.117.68 -U administrator
Enter administrator's password:
Cannot connect to server. Error was NT_STATUS_ACCOUNT_DISABLED //账户被禁用了对方应该是 windows7 的机器

[root@centos ~]# rpcclient xx.xx.117.42 -U administrator
Enter administrator's password:
Cannot connect to server. Error was NT_STATUS_ACCOUNT_RESTRICTION //不允许空密码登录的 windows 的为了加强安全性禁用了空密码登录

[root@centos ~]# rpcclient 192.168.56.101 --user=administrator%sincoder
rpcclient $> getusername //得到当前的登录用户名
Account Name: Guest, Authority Name: F07OKKGJOFAX2BS

枚举远程系统的用户名

rpcclient $> lsaenumsid
found 12 SIDs

S-1-5-6
S-1-5-4
S-1-5-32-555
S-1-5-32-551
S-1-5-32-547
S-1-5-32-545
S-1-5-32-544
S-1-5-21-2152472544-1540806776-311459245-501
S-1-5-21-2152472544-1540806776-311459245-1001
S-1-5-20
S-1-5-19
S-1-1-0
rpcclient $> lookupsids S-1-5-21-2152472544-1540806776-311459245-501
S-1-5-21-2152472544-1540806776-311459245-501 F07OKKGJOFAX2BS\Guest (1)
rpcclient $> lookupsids S-1-5-21-2152472544-1540806776-311459245-1001
S-1-5-21-2152472544-1540806776-311459245-1001 F07OKKGJOFAX2BS\ASPNET (1)
rpcclient $> lookupsids S-1-1-0
S-1-1-0 \Everyone (5)
rpcclient $> lookupsids S-1-5-6
S-1-5-6 NT AUTHORITY\SERVICE (5)
rpcclient $> lookupsids S-1-5-32-555
S-1-5-32-555 BUILTIN\Remote Desktop Users (4)

。。。。。

如果发现windows机器的 RPC 服务无法使用那么应该先运行下网络安装向导

rpcclient $> enumdomusers
user:[Administrator] rid:[0x1f4]
user:[Guest] rid:[0x1f5]
user:[libvod107] rid:[0x3ec]
user:[SQLDebugger] rid:[0x3eb]
user:[SUPPORT_388945a0] rid:[0x3e9]
rpcclient $> queryuserinfo
command not found: queryuserinfo
rpcclient $> queryuserinfo
command not found: queryuserinfo

//得到帐户信息。。。
rpcclient $> queryuser 0x1f4
   User Name   :   Administrator
   Full Name   :
   Home Drive :
   Dir Drive   :
   Profile Path:
   Logon Script:
   Description :   管理计算机(域)的内置帐户
   Workstations:
   Comment     :
   Remote Dial :
   Logon Time               :   Wed, 27 Mar 2013 09:42:00 CST
   Logoff Time              :   Thu, 01 Jan 1970 08:00:00 CST
   Kickoff Time             :   never
   Password last set Time   :   Wed, 12 Jan 2011 13:17:37 CST
   Password can change Time :   Wed, 12 Jan 2011 13:17:37 CST
   Password must change Time:   never
   unknown_2[0..31]...
   user_rid :   0x1f4
   group_rid:   0x201
   acb_info :   0x00000210
   fields_present:   0x00ffffff
   logon_divs:   168
   bad_password_count:   0x00000000
   logon_count:   0x000001e4
   padding1[0..7]...
   logon_hrs[0..21]...