SMB扫描
Server Message Block 协议。与其他标准的TCP/IP协议不同，SMB协议是一种复杂的协议，因为随着Windows计算机的开发，越来越多的功能被加入到协议中去了，很难区分哪些概念和功能应该属于Windows操作系统本身，哪些概念应该属于SMB 协议。因为该协议很复杂，所以是微软历史上出现安全问题最多的协议。
1、Nmap
最简单的方法：扫描其固定开放的端口139,445，但是无法准确判断其为windows系统
root@kali:~# <strong>nmap -v -p139,445 192.168.1.0/24 #-v显示更详细的信息</strong> Starting Nmap 7.01 ( https://nmap.org ) at 2016-09-12 15:35 CST Initiating ARP Ping Scan at 15:35 Scanning 255 hosts [1 port/host] Completed ARP Ping Scan at 15:35, 1.70s elapsed (255 total hosts) Initiating Parallel DNS resolution of 255 hosts. at 15:35 Completed Parallel DNS resolution of 255 hosts. at 15:35, 0.01s elapsed Nmap scan report for 192.168.1.0 [host down] Nmap scan report for 192.168.1.2 [host down] Nmap scan report for 192.168.1.3 [host down] Nmap scan report for 192.168.1.4 [host down] ………………………………………… Nmap scan report for 192.168.1.255 [host down] Initiating Parallel DNS resolution of 1 host. at 15:35 Completed Parallel DNS resolution of 1 host. at 15:35, 0.00s elapsed Initiating SYN Stealth Scan at 15:35 Scanning 4 hosts [2 ports/host] Discovered open port 445/tcp on 192.168.1.141 Discovered open port 139/tcp on 192.168.1.141 Discovered open port 445/tcp on 192.168.1.107 Discovered open port 139/tcp on 192.168.1.107 Completed SYN Stealth Scan at 15:35, 0.05s elapsed (8 total ports) Nmap scan report for DD-WRT (192.168.1.1) Host is up (0.0088s latency). PORT STATE SERVICE 139/tcp closed netbios-ssn 445/tcp closed microsoft-ds MAC Address: 1C:BD:B9:27:D5:32 (D-Link International) Nmap scan report for 192.168.1.107 Host is up (0.0011s latency). PORT STATE SERVICE 139/tcp open netbios-ssn 445/tcp open microsoft-ds MAC Address: 08:00:27:EB:1D:BC (Oracle VirtualBox virtual NIC) Nmap scan report for DESKTOP-TA5DCRJ (192.168.1.141) Host is up (0.0027s latency). PORT STATE SERVICE 139/tcp open netbios-ssn 445/tcp open microsoft-ds MAC Address: 2C:6E:85:C4:0D:5B (Intel Corporate) Nmap scan report for kali (192.168.1.143) Host is up (0.0032s latency). PORT STATE SERVICE 139/tcp closed netbios-ssn 445/tcp closed microsoft-ds MAC Address: 08:00:27:CA:63:99 (Oracle VirtualBox virtual NIC) Initiating SYN Stealth Scan at 15:35 Scanning 192.168.1.127 [2 ports] Completed SYN Stealth Scan at 15:35, 0.06s elapsed (2 total ports) Nmap scan report for 192.168.1.127 Host is up (0.00015s latency). PORT STATE SERVICE 139/tcp closed netbios-ssn 445/tcp closed microsoft-ds Read data files from: /usr/bin/../share/nmap Nmap done: 256 IP addresses (5 hosts up) scanned in 2.03 seconds Raw packets sent: 516 (14.608KB) | Rcvd: 16 (616B)高级扫描
1.发现开放smb协议的windows系统
root@kali:~# nmap 192.168.1.141 -p139,445 <strong>--script=smb-os-discovery.nse #用于发现smb协议的脚本</strong> Starting Nmap 7.01 ( https://nmap.org ) at 2016-09-12 15:43 CST Nmap scan report for DESKTOP-TA5DCRJ (192.168.1.141) Host is up (0.00030s latency). PORT STATE SERVICE 139/tcp open netbios-ssn 445/tcp open microsoft-ds MAC Address: 2C:6E:85:C4:0D:5B (Intel Corporate) Host script results: | smb-os-discovery: | OS: Windows 10 Home China 10586 (Windows 10 Home China 6.3) | OS CPE: cpe:/o:microsoft:windows_10::- | NetBIOS computer name: DESKTOP-TA5DCRJ | Workgroup: WORKGROUP |_ System time: 2016-09-12T15:43:52+08:00 Nmap done: 1 IP address (1 host up) scanned in 0.59 seconds2.扫描windows系统smb协议是否有漏洞
由于从NMAP 6.49beta6开始，smb-check-vulns.nse脚本被取消了。它被分为smb-vuln-conficker、•smb-vuln-cve2009-3103、smb-vuln-ms06-025、smb-vuln-ms07-029、smb-vuln-regsvc-dos、smb-vuln-ms08-067这六个脚本。用户根据需要选择对应的脚本。如果不确定执行哪一个，可以使用smb-vuln-*.nse来指定所有的脚本文件，进行全扫描。root@kali:~# nmap -v -p139,445 --script=smb-vuln-*.nse --script-args=unsafe=1 192.168.1.115 -Pn <strong>#unsafe=1：高强度扫描，可能造成宕机，可选为0（安全扫描） #-Pn：有防火墙过滤包，也继续进行扫描</strong> Starting Nmap 7.01 ( https://nmap.org ) at 2016-09-12 19:59 CST NSE: Loaded 8 scripts for scanning. NSE: Script Pre-scanning. Initiating NSE at 19:59 Completed NSE at 19:59, 0.00s elapsed Initiating ARP Ping Scan at 19:59 Scanning 192.168.1.115 [1 port] Completed ARP Ping Scan at 19:59, 0.09s elapsed (1 total hosts) Initiating Parallel DNS resolution of 1 host. at 19:59 Completed Parallel DNS resolution of 1 host. at 19:59, 0.01s elapsed Initiating SYN Stealth Scan at 19:59 Scanning PC (192.168.1.115) [2 ports] Discovered open port 139/tcp on 192.168.1.115 Discovered open port 445/tcp on 192.168.1.115 Completed SYN Stealth Scan at 19:59, 0.04s elapsed (2 total ports) NSE: Script scanning 192.168.1.115. Initiating NSE at 19:59 Completed NSE at 19:59, 5.00s elapsed Nmap scan report for PC (192.168.1.115) Host is up (0.00028s latency). PORT STATE SERVICE 139/tcp open netbios-ssn 445/tcp open microsoft-ds MAC Address: 08:00:27:2B:32:0F (Oracle VirtualBox virtual NIC) Host script results: | smb-vuln-cve2009-3103: | VULNERABLE: | SMBv2 exploit (CVE-2009-3103, Microsoft Security Advisory 975497) | State: VULNERABLE | IDs: CVE:CVE-2009-3103 | Array index error in the SMBv2 protocol implementation in srv2.sys in Microsoft Windows Vista Gold, SP1, and SP2, | Windows Server 2008 Gold and SP2, and Windows 7 RC allows remote attackers to execute arbitrary code or cause a | denial of service (system crash) via an & (ampersand) character in a Process ID High header field in a NEGOTIATE | PROTOCOL REQUEST packet, which triggers an attempted dereference of an out-of-bounds memory location, | aka "SMBv2 Negotiation Vulnerability." | | Disclosure date: 2009-09-08 | References: | http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-3103 |_ https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-3103 |_smb-vuln-ms10-054: ERROR: Script execution failed (use -d to debug) |_smb-vuln-ms10-061: NT_STATUS_ACCESS_DENIED NSE: Script Post-scanning. Initiating NSE at 19:59 Completed NSE at 19:59, 0.00s elapsed Read data files from: /usr/bin/../share/nmap Nmap done: 1 IP address (1 host up) scanned in 5.47 seconds Raw packets sent: 3 (116B) | Rcvd: 3 (116B)
2、Nbtscan
#-R:使用本地端口137，兼容性好，可发现老版本的系统，扫描结果最全
#支持网段扫描
优点：可跨网段扫描mac地址，如果防火墙过滤不够好的话
IP address NetBIOS Name Server User MAC address ------------------------------------------------------------------------------ 192.168.1.0 Sendto failed: Permission denied 192.168.1.127 <unknown> <unknown> 192.168.1.107 METASPLOITABLE <server> METASPLOITABLE 00:00:00:00:00:00 192.168.1.141 DESKTOP-TA5DCRJ <server> <unknown> 2c:6e:85:c4:0d:5b 192.168.1.115 PC <server> <unknown> 08:00:27:2b:32:0f 192.168.1.255 Sendto failed: Permission denied
3、enum4linux
在linux系统下枚举出windows系统，不支持网段扫描，但结果非常详细
root@kali:~# enum4linux -a 192.168.1.141 Starting enum4linux v0.8.9 ( http://labs.portcullis.co.uk/application/enum4linux/ ) on Mon Sep 12 20:22:19 2016 ========================== | Target Information | ========================== Target ........... 192.168.1.141 RID Range ........ 500-550,1000-1050 Username ......... '' Password ......... '' Known Usernames .. administrator, guest, krbtgt, domain admins, root, bin, none ===================================================== | Enumerating Workgroup/Domain on 192.168.1.141 | ===================================================== [+] Got domain/workgroup name: WORKGROUP ============================================= | Nbtstat Information for 192.168.1.141 | ============================================= Looking up status of 192.168.1.141 DESKTOP-TA5DCRJ <00> - B <ACTIVE> Workstation Service DESKTOP-TA5DCRJ <20> - B <ACTIVE> File Server Service WORKGROUP <00> - <GROUP> B <ACTIVE> Domain/Workgroup Name MAC Address = 2C-6E-85-C4-0D-5B ====================================== | Session Check on 192.168.1.141 | ====================================== [+] Server 192.168.1.141 allows sessions using username '', password '' <strong>#尝试建立空连接 </strong> ============================================ | Getting domain SID for 192.168.1.141 | ============================================ could not initialise lsa pipe. Error was NT_STATUS_ACCESS_DENIED could not obtain sid for domain WORKGROUP error: NT_STATUS_ACCESS_DENIED [+] Can't determine if host is part of domain or part of a workgroup ======================================= | OS information on 192.168.1.141 | ======================================= [+] Got OS info for 192.168.1.141 from smbclient: Domain=[DESKTOP-TA5DCRJ] OS=[Windows 10 Home China 10586] Server=[Windows 10 Home China 6.3] [E] Can't get OS info with srvinfo: NT_STATUS_ACCESS_DENIED ============================== | Users on 192.168.1.141 | ============================== [E] Couldn't find users using querydispinfo: NT_STATUS_ACCESS_DENIED [E] Couldn't find users using enumdomusers: NT_STATUS_ACCESS_DENIED ========================================== | Share Enumeration on 192.168.1.141 | ========================================== [E] Can't list shares: NT_STATUS_ACCESS_DENIED [+] Attempting to map shares on 192.168.1.141 ===================================================== | Password Policy Information for 192.168.1.141 | ===================================================== [E] Unexpected error from polenum: [+] Attaching to 192.168.1.141 using a NULL share [+] Trying protocol 445/SMB... [!] Protocol failed: SMB SessionError: STATUS_ACCESS_DENIED({Access Denied} A process has requested access to an object but has not been granted those access rights.) [+] Trying protocol 139/SMB... [!] Protocol failed: SMB SessionError: STATUS_ACCESS_DENIED({Access Denied} A process has requested access to an object but has not been granted those access rights.) [E] Failed to get password policy with rpcclient =============================== | Groups on 192.168.1.141 | =============================== [+] Getting builtin groups: [E] Can't get builtin groups: NT_STATUS_ACCESS_DENIED [+] Getting builtin group memberships: [+] Getting local groups: [E] Can't get local groups: NT_STATUS_ACCESS_DENIED [+] Getting local group memberships: [+] Getting domain groups: [E] Can't get domain groups: NT_STATUS_ACCESS_DENIED [+] Getting domain group memberships: ======================================================================== | Users on 192.168.1.141 via RID cycling (RIDS: 500-550,1000-1050) | ======================================================================== [E] Couldn't get SID: NT_STATUS_ACCESS_DENIED. RID cycling not possible. ============================================== | Getting printer info for 192.168.1.141 | ============================================== could not initialise lsa pipe. Error was NT_STATUS_ACCESS_DENIED could not obtain sid for domain WORKGROUP error: NT_STATUS_ACCESS_DENIED enum4linux complete on Mon Sep 12 20:22:20 2016<strong> </strong>
小白日记，未完待续……