主机名: DELL OS 名称: Microsoft Windows 10 企业版 OS 版本: 10.0.17763 暂缺 Build 17763 OS 制造商: Microsoft Corporation OS 配置: 独立工作站 OS 构件类型: Multiprocessor Free 注册的所有人: LyShark 注册的组织: 暂缺 产品 ID: 00425-00000-00002-AA474 初始安装日期: 2019/8/21, 19:53:20 系统启动时间: 2019/8/24, 7:31:16 系统制造商: Dell Inc. 系统型号: Inspiron 系统类型: x64-based PC 处理器: 安装了 1 个处理器。
wmic share： 查看共享
C:\>wmic share get name,path,status Name Path Status ADMIN$ C:\Windows OK C$ C:\ OK D$ D:\ OK E$ E:\ OK IPC$ OK
C:\>reg save HKLM\Security sec.hive 操作成功完成。 C:\>reg save HKLM\System sys.hive 操作成功完成。 C:\>reg save HKLM\SAM sam.hive 操作成功完成。
net： 命令大合集。
net user /domain 查看域用户 net view /domain 查询域列表 net group /domain 查看域里面的工作组 net group "domain admins" /domain 查询域管理员用户组 net localgroup administrators /domain 查询登录本机的域管理员 net group "domain controllers" /domain 查看域控制器 net time /domain 判断主域，主域服务器都做时间服务器 net config workstation 查询当前登录域 net share 查看共享文件路径 net view 查询同一域内机器列表 net view \\ip 查询某IP共享 net view /domain:test.com 查看test域中计算机列表
80/tcp open http 100/tcp open newacct 135/tcp open msrpc 139/tcp open netbios-ssn 443/tcp open https 902/tcp open iss-realsecure 912/tcp open apex-mesh
root@kali:~# nmap -O 192.168.1.3 | grep "Running" Running: Google Android 5.X|6.X, Linux 3.X
root@kali:~# nmap -O 192.168.1.10 | grep "Running" Running: Microsoft Windows XP
服务识别： 识别目标主机常用端口开放服务的具体版本，仅供参考。
root@kali:~# nmap -sV 192.168.1.10 | grep "open"
80/tcp open http Apache httpd 2.4.18 ((Win32) OpenSSL/1.0.2e mod_fcgid/2.3.9) 135/tcp open msrpc Microsoft Windows RPC 139/tcp open netbios-ssn Microsoft Windows netbios-ssn 443/tcp open ssl/https? 902/tcp open nagios-nsca Nagios NSCA 912/tcp open vmware-auth VMware Authentication Daemon 1.0 (Uses VNC, SOAP) 1433/tcp open ms-sql-s Microsoft SQL Server 2000 8.00.2039; SP4 2869/tcp open http Microsoft HTTPAPI httpd 1.0 (SSDP/UPnP) 3306/tcp open mysql MySQL (unauthorized)
Starting Nmap 7.70 ( https://nmap.org ) at 2019-08-24 19:32 CST Nmap scan report for 192.168.1.10 Host is up (0.00022s latency).
PORT STATE SERVICE VERSION 139/udp closed netbios-ssn MAC Address: ZZ:9C:PP:3A:11 (Elitegroup Computer Systems)
Service detection performed. Please report any incorrect results at https://nmap.org/submit/ . Nmap done: 1 IP address (1 host up) scanned in 0.91 seconds
通过NetBios发现主机： 使用script指定一个脚本，-p指定端口。
root@kali:~# nmap -sU --script nbstat.nse -p137 192.168.1.10 -T4 Starting Nmap 7.70 ( https://nmap.org ) at 2019-08-24 19:40 CST Nmap scan report for 192.168.1.10 Host is up (0.00022s latency).
root@kali:~# nmap -sn -PR 192.168.1.0/24 Starting Nmap 7.70 ( https://nmap.org ) at 2019-08-24 19:41 CST Nmap scan report for 192.168.1.1 Host is up (0.00039s latency). Nmap scan report for 192.168.1.2 Host is up (0.00020s latency). Nmap scan report for 192.168.1.10 Host is up (0.00010s latency). Nmap scan report for 192.168.1.40 Host is up. Nmap done: 256 IP addresses (4 hosts up) scanned in 2.06 seconds
root@kali:~# nmap --script=broadcast 192.168.1.10 Starting Nmap 7.70 ( https://nmap.org ) at 2019-08-24 19:56 CST Pre-scan script results: | broadcast-dhcp-discover: | Response 1 of 1: | IP Offered: 192.168.1.7 | Server Identifier: 192.168.1.1 | Subnet Mask: 255.255.255.0 | Router: 192.168.1.1 |_ Domain Name Server: 192.168.1.1 ...More...
vuln检测漏洞： 用于检测系统常见漏洞，并有相应的解释。
root@kali:~# nmap --script=vuln 192.168.1.10
Starting Nmap 7.70 ( https://nmap.org ) at 2019-08-24 20:00 CST Host script results: | smb-vuln-cve2009-3103: | VULNERABLE: | SMBv2 exploit (CVE-2009-3103, Microsoft Security Advisory 975497) | State: VULNERABLE | IDs: CVE:CVE-2009-3103 | Array index error in the SMBv2 protocol implementation in srv2.sys in Microsoft Windows Vista Gold, SP1, and SP2, | Windows Server 2008 Gold and SP2, and Windows 7 RC allows remote attackers to execute arbitrary code or cause a | denial of service (system crash) via an & (ampersand) character in a Process ID High header field in a NEGOTIATE | PROTOCOL REQUEST packet, which triggers an attempted dereference of an out-of-bounds memory location, | aka "SMBv2 Negotiation Vulnerability." | | Disclosure date: 2009-09-08 | References: | https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-3103 |_ http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-3103
searchsploit： 通过本地漏洞数据库，查询漏洞的详细描述和使用方法。
root@kali:~# searchsploit ms17-010 --------------------------------------------------------------------------------------------- ---------------------------------------- Exploit Title | Path | (/usr/share/exploitdb/) --------------------------------------------------------------------------------------------- ---------------------------------------- Microsoft Windows - 'EternalRomance'/'EternalSynergy'/'EternalChampion' SMB Remote Code Exec | exploits/windows/remote/43970.rb Microsoft Windows - SMB Remote Code Execution Scanner (MS17-010) (Metasploit) | exploits/windows/dos/41891.rb