Name Current Setting Required Description ---- --------------- -------- ----------- Proxies no A proxy chain of format type:host:port[,type:host:port][...] RHOSTS 192.168.1.0/24 yes The target address range or CIDR identifier RPORT 80 yes The target port (TCP) SSL false no Negotiate SSL/TLS for outgoing connections THREADS 1 yes The number of concurrent threads VHOST no HTTP server virtual host
msf5 auxiliary(scanner/http/http_version) > set rhosts 192.168.1.0/24 rhosts => 192.168.1.0/24 msf5 auxiliary(scanner/http/http_version) > set rport 80 rport => 80
Name Current Setting Required Description ---- --------------- -------- ----------- RHOSTS 192.168.1.0/24 yes The target address range or CIDR identifier SMBDomain . no The Windows domain to use for authentication SMBPass no The password for the specified username SMBUser no The username to authenticate as THREADS 10 yes The number of concurrent threads
msf5 auxiliary(scanner/smb/smb_version) > set rhosts 192.168.1.0/24 rhosts => 192.168.1.0/24 msf5 auxiliary(scanner/smb/smb_version) > set threads 10 threads => 10
msf5 auxiliary(scanner/smb/smb_version) > exploit [+] 192.168.1.2:445 - Host is running Windows 10 China (name:lyshark) (workgroup:lyshark) [*] 192.168.1.7:445 - Host could not be identified: Windows 6.1 (Samba 4.8.3) [*] 192.168.1.0/24:445 - Scanned 26 of 256 hosts (10% complete) [*] 192.168.1.0/24:445 - Caught interrupt from the console... [*] Auxiliary module execution completed
发现FTP服务: 基于scanner/ftp/ftp_version发现FTP服务
msf5 > use scanner/ftp/ftp_version msf5 auxiliary(scanner/ftp/ftp_version) > show options
Name Current Setting Required Description ---- --------------- -------- ----------- FTPPASS mozilla@example.com no The password for the specified username FTPUSER anonymous no The username to authenticate as RHOSTS 192.168.1.0/24 yes The target address range or CIDR identifier RPORT 21 yes The target port (TCP) THREADS 10 yes The number of concurrent threads
msf5 auxiliary(scanner/ftp/ftp_version) > set rhosts 192.168.1.0/24 rhosts => 192.168.1.0/24 msf5 auxiliary(scanner/ftp/ftp_version) > set threads 10 threads => 10
Name Current Setting Required Description ---- --------------- -------- ----------- RHOSTS 192.168.1.0/24 yes The target address range or CIDR identifier RPORT 22 yes The target port (TCP) THREADS 10 yes The number of concurrent threads TIMEOUT 30 yes Timeout for the SSH probe
msf5 auxiliary(scanner/ssh/ssh_version) > set rhosts 192.168.1.0/24 rhosts => 192.168.1.0/24 msf5 auxiliary(scanner/ssh/ssh_version) > set threads 10 threads => 10
msf5 auxiliary(scanner/ssh/ssh_version) > exploit
[+] 192.168.1.7:22 - SSH server version: SSH-2.0-OpenSSH_7.4 ( service.version=7.4 service.vendor=OpenBSD service.family=OpenSSH service.product=OpenSSH service.cpe23=cpe:/a:openbsd:openssh:7.4 service.protocol=ssh fingerprint_db=ssh.banner ) [*] 192.168.1.0/24:22 - Caught interrupt from the console... [*] Auxiliary module execution completed
Name Current Setting Required Description ---- --------------- -------- ----------- PASSWORD no The password for the specified username RHOSTS 192.168.1.0/24 yes The target address range or CIDR identifier RPORT 23 yes The target port (TCP) THREADS 10 yes The number of concurrent threads TIMEOUT 30 yes Timeout for the Telnet probe USERNAME no The username to authenticate as
[-] 192.168.1.1:23 - A network issue has occurred: The connection was refused by the remote host (192.168.1.1:23). [-] 192.168.1.7:23 - A network issue has occurred: The connection was refused by the remote host (192.168.1.7:23). [-] 192.168.1.0:23 - A network issue has occurred: The host (192.168.1.0:23) was unreachable. [-] 192.168.1.10:23 - A network issue has occurred: The connection was refused by the remote host (192.168.1.10:23). [-] 192.168.1.3:23 - A network issue has occurred: The connection was refused by the remote host (192.168.1.3:23). [-] 192.168.1.5:23 - A network issue has occurred: The host (192.168.1.5:23) was unreachable. [*] 192.168.1.0/24:23 - Caught interrupt from the console... [*] Auxiliary module execution completed
Name Current Setting Required Description ---- --------------- -------- ----------- RHOSTS 192.168.1.7 yes The target address range or CIDR identifier RPORT 3306 yes The target port (TCP) THREADS 1 yes The number of concurrent threads
[*] 192.168.1.7:3306 - 192.168.1.7:3306 is running MySQL, but responds with an error: \x04Host '192.168.1.7' is not allowed to connect to this MariaDB server [*] 192.168.1.7:3306 - Scanned 1 of 1 hosts (100% complete) [*] Auxiliary module execution completed
Name Current Setting Required Description ---- --------------- -------- ----------- PASSWORD no The password for the specified username RHOSTS 192.168.1.0/24 yes The target address range or CIDR identifier TDSENCRYPTION falseyes Use TLS/SSL for TDS data "Force Encryption" THREADS 10 yes The number of concurrent threads USERNAME sa no The username to authenticate as USE_WINDOWS_AUTHENT falseyes Use windows authentification (requires DOMAIN option set)
msf5 auxiliary(scanner/mssql/mssql_ping) > set rhosts 192.168.1.0/24 rhosts => 192.168.1.0/24 msf5 auxiliary(scanner/mssql/mssql_ping) > set threads 10 threads => 10
Name Current Setting Required Description ---- --------------- -------- ----------- RHOSTS 192.168.1.0/24 yes The target address range or CIDR identifier RPORT 1521 yes The target port (TCP) THREADS 10 yes The number of concurrent threads
msf5 auxiliary(scanner/oracle/tnslsnr_version) > set rhosts 192.168.1.0/24 rhosts => 192.168.1.0/24 msf5 auxiliary(scanner/oracle/tnslsnr_version) > set threads 10 threads => 10 msf5 auxiliary(scanner/oracle/tnslsnr_version) > run
Name Current Setting Required Description ---- --------------- -------- ----------- INTERFACE no The name of the interface RHOSTS 192.168.1.0/24 yes The target address range or CIDR identifier SHOST no Source IP Address SMAC no Source MAC Address THREADS 10 yes The number of concurrent threads TIMEOUT 5 yes The number of seconds to waitfor new data
msf5 auxiliary(scanner/discovery/arp_sweep) > set rhosts 192.168.1.0/24 rhosts => 192.168.1.0/24 msf5 auxiliary(scanner/discovery/arp_sweep) > set threads 10 threads => 10
[+] 192.168.1.1 appears to be up (UNKNOWN). [+] 192.168.1.2 appears to be up (UNKNOWN). [+] 192.168.1.2 appears to be up (UNKNOWN). [+] 192.168.1.1 appears to be up (UNKNOWN). [*] Scanned 256 of 256 hosts (100% complete) [*] Auxiliary module execution completed
UDP发现内网主机: 基于scanner/discovery/udp_sweep发现内网存活主机.
msf5 > use scanner/discovery/udp_sweep msf5 auxiliary(scanner/discovery/udp_sweep) > show options
Name Current Setting Required Description ---- --------------- -------- ----------- BATCHSIZE 256 yes The number of hosts to probe in each set RHOSTS 192.168.1.0/24 yes The target address range or CIDR identifier THREADS 10 yes The number of concurrent threads
msf5 > use auxiliary/scanner/portscan/ack msf5 auxiliary(scanner/portscan/ack) > show options
Module options (auxiliary/scanner/portscan/ack):
Name Current Setting Required Description ---- --------------- -------- ----------- BATCHSIZE 256 yes The number of hosts to scan per set DELAY 0 yes The delay between connections, per thread, in milliseconds INTERFACE no The name of the interface JITTER 0 yes The delay jitter factor (maximum value by which to +/- DELAY) in milliseconds. PORTS 1-10000 yes Ports to scan (e.g. 22-25,80,110-900) RHOSTS 192.168.1.7 yes The target address range or CIDR identifier SNAPLEN 65535 yes The number of bytes to capture THREADS 10 yes The number of concurrent threads TIMEOUT 500 yes The reply readtimeoutin milliseconds
msf5 auxiliary(scanner/portscan/ack) > set rhosts 192.168.1.7 rhosts => 192.168.1.7 msf5 auxiliary(scanner/portscan/ack) > set threads 10 threads => 10
msf5 > use auxiliary/scanner/portscan/syn msf5 auxiliary(scanner/portscan/syn) > show options
Module options (auxiliary/scanner/portscan/syn):
Name Current Setting Required Description ---- --------------- -------- ----------- BATCHSIZE 256 yes The number of hosts to scan per set DELAY 0 yes The delay between connections, per thread, in milliseconds INTERFACE no The name of the interface JITTER 0 yes The delay jitter factor (maximum value by which to +/- DELAY) in milliseconds. PORTS 1-1024 yes Ports to scan (e.g. 22-25,80,110-900) RHOSTS 192.168.1.7 yes The target address range or CIDR identifier SNAPLEN 65535 yes The number of bytes to capture THREADS 10 yes The number of concurrent threads TIMEOUT 500 yes The reply readtimeoutin milliseconds
msf5 auxiliary(scanner/portscan/syn) > set rhosts 192.168.1.7 rhosts => 192.168.1.7 msf5 auxiliary(scanner/portscan/syn) > set threads 10 threads => 10 msf5 auxiliary(scanner/portscan/syn) > run
msf5 > use auxiliary/scanner/portscan/tcp msf5 auxiliary(scanner/portscan/tcp) > show options
Module options (auxiliary/scanner/portscan/tcp):
Name Current Setting Required Description ---- --------------- -------- ----------- CONCURRENCY 10 yes The number of concurrent ports to check per host DELAY 0 yes The delay between connections, per thread, in milliseconds JITTER 0 yes The delay jitter factor (maximum value by which to +/- DELAY) in milliseconds. PORTS 1-10000 yes Ports to scan (e.g. 22-25,80,110-900) RHOSTS 192.168.1.7 yes The target address range or CIDR identifier THREADS 10 yes The number of concurrent threads TIMEOUT 1000 yes The socket connect timeoutin milliseconds
msf5 auxiliary(scanner/portscan/tcp) > set rhosts 192.168.1.7 rhosts => 192.168.1.7 msf5 auxiliary(scanner/portscan/tcp) > set threads 10 threads => 10 msf5 auxiliary(scanner/portscan/tcp) > run
[+] 192.168.1.7: - 192.168.1.7:21 - TCP OPEN [+] 192.168.1.7: - 192.168.1.7:22 - TCP OPEN [+] 192.168.1.7: - 192.168.1.7:80 - TCP OPEN [+] 192.168.1.7: - 192.168.1.7:139 - TCP OPEN [+] 192.168.1.7: - 192.168.1.7:445 - TCP OPEN [*] 192.168.1.7: - Scanned 1 of 1 hosts (100% complete) [*] Auxiliary module execution completed