# Name Disclosure Date Rank Check Description - ---- --------------- ---- ----- ----------- 0 auxiliary/admin/appletv/appletv_display_image normal No Apple TV Image Remote Control 1 auxiliary/admin/appletv/appletv_display_video normal No Apple TV Video Remote Control 2 auxiliary/admin/smb/check_dir_file normal No SMB Scanner Check File/Directory Utility 3 auxiliary/admin/teradata/teradata_odbc_sql 2018-03-29 normal No Teradata ODBC SQL Query Module ... 588 auxiliary/scanner/wproxy/att_open_proxy 2017-08-31 normal No Open WAN-to-LAN proxy on AT&T routers 589 auxiliary/scanner/wsdd/wsdd_query normal No WS-Discovery Information Discovery 590 auxiliary/scanner/x11/open_x11 normal No X11 No-Auth Scanner
Name Current Setting Required Description ---- --------------- -------- ----------- INTERFACE no The name of the interface RHOSTS yes The target host(s), range CIDR identifier, or hosts file with syntax 'file:<path>' SHOST no Source IP Address SMAC no Source MAC Address THREADS 1 yes The number of concurrent threads (max one per host) TIMEOUT 5 yes The number of seconds to wait for new data
msf6 auxiliary(scanner/discovery/arp_sweep) > set RHOSTS 172.17.0.0/24 RHOSTS => 172.17.0.0/24 msf6 auxiliary(scanner/discovery/arp_sweep) > exploit SIOCSIFFLAGS: Operation not permitted
[+] 172.17.0.1 appears to be up (UNKNOWN). [*] Scanned 256 of 256 hosts (100% complete) [*] Auxiliary module execution completed
Name Current Setting Required Description ‐‐‐‐ ‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐ ‐‐‐‐‐‐‐‐ ‐‐‐‐‐‐‐‐‐‐‐ BATCHSIZE 256 yes The number of hosts to probe in each set RHOSTS 192.168.1.0/24 yes The target address range or CIDR identifier THREADS 50 yes The number of concurrent threads
Name Current Setting Required Description ‐‐‐‐ ‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐ ‐‐‐‐‐‐‐‐ ‐‐‐‐‐‐‐‐‐‐‐ CHOST no The local client address RHOSTS 192.168.1.0/24 yes The target address range or CIDR identifier THREADS 50 yes The number of concurrent threads
Name Current Setting Required Description ‐‐‐‐ ‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐ ‐‐‐‐‐‐‐‐ ‐‐‐‐‐‐‐‐‐‐‐ BATCHSIZE 256 yes The number of hosts to probe in each set DOMAINNAME isc.org yes Domain to use for the DNS request FILTER no The filter string for capturing traffic INTERFACE no The name of the interface PCAPFILE no The name of the PCAP capture file to process QUERYTYPE ANY yes Query type(A, NS, SOA, MX, TXT, AAAA, RRSIG, DNSKEY, ANY) RHOSTS 192.168.1.0/24 yes The target address range or CIDR identifier RPORT 53 yes The target port (UDP) SNAPLEN 65535 yes The number of bytes to capture THREADS 50 yes The number of concurrent threads TIMEOUT 500 yes The number of seconds to wait for new data
msf auxiliary(scanner/dns/dns_amp) > exploit
[*] Sending DNS probes to 192.168.1.0‐>192.168.1.255 (256 hosts) [*] Sending 67 bytes to each host using the IN ANY isc.org request [+] 192.168.1.1:53 ‐ Response is 530 bytes [7.91x Amplification] [*] Scanned 256 of 256 hosts (100% complete) [*] Auxiliary module execution completed
Name Current Setting Required Description ‐‐‐‐ ‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐ ‐‐‐‐‐‐‐‐ ‐‐‐‐‐‐‐‐‐‐‐ Proxies no A proxy chain of format type:host:port[,type:host:port] [...] RHOSTS 192.168.1.0/24 yes The target address range or CIDR identifier RPORT 80 yes The target port (TCP) SSL false no Negotiate SSL/TLS for outgoing connections THREADS 20 yes The number of concurrent threads VHOST no HTTP server virtual host
Name Current Setting Required Description ‐‐‐‐ ‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐ ‐‐‐‐‐‐‐‐ ‐‐‐‐‐‐‐‐‐‐‐ FTPPASS mozilla@example.com no The password for the specified username FTPUSER anonymous no The username to authenticate as RHOSTS 192.168.1.0/24 yes The target address range or CIDR identifier RPORT 21 yes The target port (TCP) THREADS 50 yes The number of concurrent threads
msf auxiliary(scanner/ftp/ftp_version) > exploit
[*] Scanned 51 of 256 hosts (19% complete) [*] Scanned 52 of 256 hosts (20% complete) [*] Scanned 100 of 256 hosts (39% complete) [+] 192.168.1.119:21 ‐ FTP Banner: '220 Microsoft FTP Service\x0d\x0a' [*] Scanned 103 of 256 hosts (40% complete) [*] Scanned 133 of 256 hosts (51% complete) [*] Scanned 183 of 256 hosts (71% complete) [*] Scanned 197 of 256 hosts (76% complete) [*] Scanned 229 of 256 hosts (89% complete) [*] Scanned 231 of 256 hosts (90% complete) [*] Scanned 256 of 256 hosts (100% complete) [*] Auxiliary module execution completed
Name Current Setting Required Description ‐‐‐‐ ‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐ ‐‐‐‐‐‐‐‐ ‐‐‐‐‐‐‐‐‐‐‐ RHOSTS 192.168.1.0/24 yes The target address range or CIDR identifier SMBDomain . no The Windows domain to use for authentication SMBPass no The password for the specified username SMBUser no The username to authenticate as THREADS 20 yes The number of concurrent threads
msf auxiliary(scanner/smb/smb_version) > exploit
[+] 192.168.1.2:445 ‐ Host is running Windows 7 Ultimate SP1 (build:7601) (name:JOHN‐PC) (workgroup:WORKGROUP ) [*] Scanned 40 of 256 hosts (15% complete) [*] Scanned 60 of 256 hosts (23% complete) [*] Scanned 79 of 256 hosts (30% complete) [+] 192.168.1.119:445 ‐ Host is running Windows 2003 R2 SP2 (build:3790) (name:WIN03X64) [*] Scanned 103 of 256 hosts (40% complete) [*] Scanned 128 of 256 hosts (50% complete) [*] Scanned 154 of 256 hosts (60% complete) [*] Scanned 181 of 256 hosts (70% complete) [*] Scanned 206 of 256 hosts (80% complete) [*] Scanned 231 of 256 hosts (90% complete) [*] Scanned 256 of 256 hosts (100% complete) [*] Auxiliary module execution completed
Name Current Setting Required Description ‐‐‐‐ ‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐ ‐‐‐‐‐‐‐‐ ‐‐‐‐‐‐‐‐‐‐‐ RHOSTS 192.168.1.0/24 yes The target address range or CIDR identifier RPORT 22 yes The target port (TCP) THREADS 50 yes The number of concurrent threads TIMEOUT 30 yes Timeout for the SSH probe
msf auxiliary(scanner/ssh/ssh_version) > exploit
[+] 192.168.1.5:22 ‐ SSH server version: SSH‐2.0‐OpenSSH_7.9p1 Debian‐5 ( service.version=7.9p1 openssh.comment=Debian‐5 service.vendor=OpenBSD service.family=OpenSSH service.product=OpenSSH service.cpe23=cpe:/a:openb sd:openssh:7.9p1 os.vendor=Debian os.family=Linux os.product=Linux os.cpe 23=cpe:/o:debian:debian_linux:‐ service.protocol=ssh fingerprint_db=ssh.banner ) [*] Scanned 52 of 256 hosts (20% complete) [*] Scanned 95 of 256 hosts (37% complete) [*] Scanned 100 of 256 hosts (39% complete) [*] Scanned 103 of 256 hosts (40% complete) [*] Scanned 131 of 256 hosts (51% complete) [*] Scanned 154 of 256 hosts (60% complete) [*] Scanned 180 of 256 hosts (70% complete) [*] Scanned 206 of 256 hosts (80% complete) [*] Scanned 235 of 256 hosts (91% complete) [*] Scanned 256 of 256 hosts (100% complete) [*] Auxiliary module execution completed
0x0A auxiliary/scanner/telnet/telnet_version
该模块用于探测内网的TELNET服务。
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18
msf auxiliary(scanner/telnet/telnet_version) > show options
Name Current Setting Required Description ‐‐‐‐ ‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐ ‐‐‐‐‐‐‐‐ ‐‐‐‐‐‐‐‐‐‐‐ PASSWORD no The password for the specified username RHOSTS 192.168.1.119 yes The target address range or CIDR identifier RPORT 23 yes The target port (TCP) THREADS 50 yes The number of concurrent threads TIMEOUT 30 yes Timeout for the Telnet probe USERNAME no The username to authenticate as
Name Current Setting Required Description ‐‐‐‐ ‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐ ‐‐‐‐‐‐‐‐ ‐‐‐‐‐‐‐‐‐‐‐ RHOSTS 192.168.1.115 yes The target address range or CIDR identifier RPORT 3306 yes The target port (TCP) THREADS 50 yes The number of concurrent threads
Name Current Setting Required Description ‐‐‐‐ ‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐ ‐‐‐‐‐‐‐‐ ‐‐‐‐‐‐‐‐‐‐‐ BATCHSIZE 256 yes The number of hosts to probe in each set RHOSTS 192.168.1.0/24 yes The target address range or CIDR identifier RPORT 137 yes The target port (UDP) THREADS 50 yes The number of concurrent threads
Name Current Setting Required Description ‐‐‐‐ ‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐ ‐‐‐‐‐‐‐‐ ‐‐‐‐‐‐‐‐‐‐‐ Proxies no A proxy chain of format type:host:port[,type:host:port] [...] RHOSTS 192.168.1.115,119 yes The target address range or CIDR identifier RPORT 80 yes The target port (TCP) SHOW_TITLES true yes Show the titles on the console as they are grabbed SSL false no Negotiate SSL/TLS for outgoing connections STORE_NOTES true yes Store the captured information in notes. Use "no tes‐t http.title" to view TARGETURI / yes The base path THREADS 50 yes The number of concurrent threads
Name Current Setting Required Description ‐‐‐‐ ‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐ ‐‐‐‐‐‐‐‐ ‐‐‐‐‐‐‐‐‐‐‐ DATABASE toolsdb yes The name of the target database RHOSTS 192.168.1.0/24 yes The target address range or CIDR identifier RPORT 50000 yes The target port (TCP) THREADS 50 yes The number of concurrent threads TIMEOUT 5 yes Timeout for the DB2 probe
msf auxiliary(scanner/portscan/ack) > show options
Module options (auxiliary/scanner/portscan/ack):
Name Current Setting Required Description ‐‐‐‐ ‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐ ‐‐‐‐‐‐‐‐ ‐‐‐‐‐‐‐‐‐‐‐ BATCHSIZE 256 yes The number of hosts to scan per set DELAY 0 yes The delay between connections, per thread, in milliseconds INTERFACE no The name of the interface JITTER 0 yes The delay jitter factor (maximum value by which to +/‐ DELAY) in milliseconds. PORTS 445 yes Ports to scan (e.g. 22‐25,80,110‐900) RHOSTS 192.168.1.115,119 yes The target address range or CIDR identifier SNAPLEN 65535 yes The number of bytes to capture THREADS 50 yes The number of concurrent threads TIMEOUT 500 yes The reply read timeout in milliseconds
msf auxiliary(scanner/portscan/tcp) > show options
Module options (auxiliary/scanner/portscan/tcp):
Name Current Setting Required Description ‐‐‐‐ ‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐ ‐‐‐‐‐‐‐‐ ‐‐‐‐‐‐‐‐‐‐‐ CONCURRENCY 10 yes The number of concurrent ports to check per host DELAY 0 yes The delay between connections, per thread, in milliseconds JITTER 0 yes The delay jitter factor (maximum value by which to +/‐ DELAY) in milliseconds. PORTS 445 yes Ports to scan (e.g. 22‐25,80,110‐900) RHOSTS 192.168.1.115,119,2 yes The target address range or CIDR identifier THREADS 50 yes The number of concurrent threads TIMEOUT 1000 yes The socket connect timeout in milliseconds
msf auxiliary(scanner/portscan/tcp) > exploit
[+] 192.168.1.2: ‐ 192.168.1.2:445 ‐ TCP OPEN [*] Scanned 1 of 3 hosts (33% complete) [+] 192.168.1.119: ‐ 192.168.1.119:445 ‐ TCP OPEN [+] 192.168.1.115: ‐ 192.168.1.115:445 ‐ TCP OPEN [*] Scanned 3 of 3 hosts (100% complete) [*] Auxiliary module execution completed
msf auxiliary(scanner/portscan/syn) > show options
Module options (auxiliary/scanner/portscan/syn):
Name Current Setting Required Description ‐‐‐‐ ‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐ ‐‐‐‐‐‐‐‐ ‐‐‐‐‐‐‐‐‐‐‐ BATCHSIZE 256 yes The number of hosts to scan per set DELAY 0 yes The delay between connections, per thread, in millisecond s INTERFACE no The name of the interface JITTER 0 yes The delay jitter factor (maximum value by which to +/‐ DELAY) in milliseconds. PORTS 445 yes Ports to scan (e.g. 22‐25,80,110‐900) RHOSTS 192.168.1.115 yes The target address range or CIDR identifier SNAPLEN 65535 yes The number of bytes to capture THREADS 50 yes The number of concurrent threads TIMEOUT 500 yes The reply read timeout in milliseconds
Name Current Setting Required Description ‐‐‐‐ ‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐ ‐‐‐‐‐‐‐‐ ‐‐‐‐‐‐‐‐‐‐‐ BOUNCEHOST 192.168.1.119 yes FTP relay host BOUNCEPORT 21 yes FTP relay port DELAY 0 yes The delay between connections, per thread, in millisecond s FTPPASS mozilla@example.com no The password for the specified usernam e FTPUSER anonymous no The username to authenticate as JITTER 0 yes The delay jitter factor (maximum value by which to +/‐ DELAY) in milliseconds. PORTS 22‐25 yes Ports to scan (e.g. 22‐25,80,110‐900) RHOSTS 192.168.1.119 yes The target address range or CIDR identifier THREADS 50 yes The number of concurrent threads
[+] 192.168.1.119:21 ‐ TCP OPEN 192.168.1.119:22 [+] 192.168.1.119:21 ‐ TCP OPEN 192.168.1.119:23 [+] 192.168.1.119:21 ‐ TCP OPEN 192.168.1.119:24 [+] 192.168.1.119:21 ‐ TCP OPEN 192.168.1.119:25 [*] 192.168.1.119:21 ‐ Scanned 1 of 1 hosts (100% complete) [*] Auxiliary module execution completed
0x13 auxiliary/scanner/portscan/xmas
该模块是基于TCP Xmax扫描来发现内网存活主机。
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17
msf auxiliary(scanner/portscan/xmas) > show options
Module options (auxiliary/scanner/portscan/xmas):
Name Current Setting Required Description ‐‐‐‐ ‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐ ‐‐‐‐‐‐‐‐ ‐‐‐‐‐‐‐‐‐‐‐ BATCHSIZE 256 yes The number of hosts to scan per set DELAY 0 yes The delay between connections, per thread, in millisecond s INTERFACE no The name of the interface JITTER 0 yes The delay jitter factor (maximum value by which to +/‐ DELAY) in milliseconds. PORTS 80 yes Ports to scan (e.g. 22‐25,80,110‐900) RHOSTS 192.168.1.119 yes The target address range or CIDR identifier SNAPLEN 65535 yes The number of bytes to capture THREADS 50 yes The number of concurrent threads TIMEOUT 500 yes The reply read timeout in milliseconds
Name Current Setting Required Description ‐‐‐‐ ‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐ ‐‐‐‐‐‐‐‐ ‐‐‐‐‐‐‐‐‐‐‐ CredSSP true yes Whether or not to request CredSSP EarlyUser false yes Whether to support Earlier User Authorization Result PDU RHOSTS 192.168.1.2,115,119 yes The target address range or CIDR identifier RPORT 3389 yes The target port (TCP) THREADS 50 yes The number of concurrent threads TLS true yes Wheter or not request TLS security
Name Current Setting Required Description ‐‐‐‐ ‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐ ‐‐‐‐‐‐‐‐ ‐‐‐‐‐‐‐‐‐‐‐ RHOSTS 192.168.1.5 yes The target address range or CIDR identifier RPORT 25 yes The target port (TCP) THREADS 50 yes The number of concurrent threads
Name Current Setting Required Description ‐‐‐‐ ‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐ ‐‐‐‐‐‐‐‐ ‐‐‐‐‐‐‐‐‐‐‐ RHOSTS 192.168.1.110‐120 yes The target address range or CIDR identifier RPORT 110 yes The target port (TCP) THREADS 50 yes The number of concurrent threads
Name Current Setting Required Description ‐‐‐‐ ‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐ ‐‐‐‐‐‐‐‐ ‐‐‐‐‐‐‐‐‐‐‐ DATABASE template1 yes The database to authenticate against PASSWORD msf no The password for the specified username. Leave blank for a random password. RHOSTS 127.0.0.1 yes The target address range or CIDR identifier RPORT 5432 yes The target port THREADS 50 yes The number of concurrent threads USERNAME msf yes The username to authenticate as VERBOSE false no Enable verbose output
msf auxiliary(scanner/ftp/anonymous) > show options
Module options (auxiliary/scanner/ftp/anonymous):
Name Current Setting Required Description ‐‐‐‐ ‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐ ‐‐‐‐‐‐‐‐ ‐‐‐‐‐‐‐‐‐‐‐ FTPPASS mozilla@example.com no The password for the specified username FTPUSER anonymous no The username to authenticate as RHOSTS 192.168.1.100‐120 yes The target address range or CIDR identifier RPORT 21 yes The target port (TCP) THREADS 50 yes The number of concurrent threads
msf exploit(multi/handler) > db_nmap ‐p 445 ‐T4 ‐sT 192.168.1.115‐120 ‐‐open [*] Nmap: Starting Nmap 7.70 ( https://nmap.org ) at 2019‐02‐17 15:17 EST [*] Nmap: Nmap scan report for 192.168.1.115 [*] Nmap: Host is up (0.0025s latency). [*] Nmap: PORT STATE SERVICE [*] Nmap: 445/tcp open microsoft‐ds [*] Nmap: MAC Address: 00:0C:29:AF:CE:CC (VMware) [*] Nmap: Nmap scan report for 192.168.1.119 [*] Nmap: Host is up (0.0026s latency). [*] Nmap: PORT STATE SERVICE [*] Nmap: 445/tcp open microsoft‐ds [*] Nmap: MAC Address: 00:0C:29:85:D6:7D (VMware) [*] Nmap: Nmap done: 6 IP addresses (2 hosts up) scanned in 13.35 seconds
运行db_nmap命令如果出现Database not connected错误，退出msfconsole并执行以下命令：
1 2 3 4 5 6 7 8
root@kali:/home/kali# msfdb init [+] Starting database [+] Creating database user 'msf' [+] Creating databases 'msf' [+] Creating databases 'msf_test' [+] Creating configuration file '/usr/share/metasploit-framework/config/database.yml' [+] Creating initial database schema /usr/share/metasploit-framework/vendor/bundle/ruby/2.7.0/gems/activerecord-4.2.11.3/lib/active_record/connection_adapters/abstract_adapter.rb:84: warning: deprecated Object#=~ is called on Integer; it always returns nil
OPTIONS: ‐a,‐‐add Add the hosts instead of searching ‐d,‐‐delete Delete the hosts instead of searching ‐c <col1,col2> Only show the given columns (see list below) ‐C <col1,col2> Only show the given columns until the next restart (see list below) ‐h,‐‐help Show this help information ‐u,‐‐up Only show hosts which are up ‐o <file> Send output to a file in csv format ‐O <column> Order rows by specified column number ‐R,‐‐rhosts Set RHOSTS from the results of the search ‐S,‐‐search Search string to filter by ‐i,‐‐info Change the info of a host ‐n,‐‐name Change the name of a host ‐m,‐‐comment Change the comment of a host ‐t,‐‐tag Add or specify a tag to a range of hosts
msf exploit(multi/handler) > hosts ‐S 192
Hosts =====
address mac name os_name os_flavor os_sp purpose info comments ‐‐‐‐‐‐‐ ‐‐‐ ‐‐‐‐ ‐‐‐‐‐‐‐ ‐‐‐‐‐‐‐‐‐ ‐‐‐‐‐ ‐‐‐‐‐‐‐ ‐‐‐‐ ‐‐‐‐‐‐‐‐ 192.168.1.5 JOHN‐PC Windows 7 SP1 client 192.168.1.101 JOHN‐PC Windows 7 Ultimate SP1 client 192.168.1.103 LAPTOP‐9994K8RP Windows 10 client 192.168.1.115 00:0c:29:af:ce:cc VM_2003X86 Windows 2003 SP2 server 192.168.1.116 WIN‐S4H51RDJQ3M Windows 2012 server 192.168.1.119 00:0c:29:85:d6:7d WIN03X64 Windows 2003 SP2 server 192.168.1.254 Unknown device 192.168.50.30 WINDOWS‐G4MMTV8 Windows 7 SP1 client 192.168.100.2 Unknown device 192.168.100.10