Metasploit的攻击实例讲解----辅助扫描工具

小灰灰 2021-09-29 11:44 950阅读 0赞

不多说，直接上干货！

![855959-20170519222512994-1796254525.png][]

怎么弹出来这个呢，连续按两次tab。

![855959-20170519223533525-1976153430.png][]

![855959-20170519223610463-85873316.png][]

msf > use auxiliary/scanner/
    Display all 485 possibilities? (y or n)
    use auxiliary/scanner/acpp/login
    use auxiliary/scanner/afp/afp_login
    use auxiliary/scanner/afp/afp_server_info
    use auxiliary/scanner/backdoor/energizer_duo_detect
    use auxiliary/scanner/chargen/chargen_probe
    use auxiliary/scanner/couchdb/couchdb_enum
    use auxiliary/scanner/couchdb/couchdb_login
    use auxiliary/scanner/db2/db2_auth
    use auxiliary/scanner/db2/db2_version
    use auxiliary/scanner/db2/discovery
    use auxiliary/scanner/dcerpc/endpoint_mapper
    use auxiliary/scanner/dcerpc/hidden
    use auxiliary/scanner/dcerpc/management
    use auxiliary/scanner/dcerpc/tcp_dcerpc_auditor
    use auxiliary/scanner/dcerpc/windows_deployment_services
    use auxiliary/scanner/dect/call_scanner
    use auxiliary/scanner/dect/station_scanner
    use auxiliary/scanner/discovery/arp_sweep
    use auxiliary/scanner/discovery/empty_udp
    use auxiliary/scanner/discovery/ipv6_multicast_ping
    use auxiliary/scanner/discovery/ipv6_neighbor
    use auxiliary/scanner/discovery/ipv6_neighbor_router_advertisement
    use auxiliary/scanner/discovery/udp_probe
    use auxiliary/scanner/discovery/udp_sweep
    use auxiliary/scanner/dlsw/dlsw_leak_capture
    use auxiliary/scanner/dns/dns_amp
    use auxiliary/scanner/elasticsearch/indices_enum
    use auxiliary/scanner/emc/alphastor_devicemanager
    use auxiliary/scanner/emc/alphastor_librarymanager
    use auxiliary/scanner/finger/finger_users
    use auxiliary/scanner/ftp/anonymous
    use auxiliary/scanner/ftp/bison_ftp_traversal
    use auxiliary/scanner/ftp/colorado_ftp_traversal
    use auxiliary/scanner/ftp/ftp_login
    use auxiliary/scanner/ftp/ftp_version
    use auxiliary/scanner/ftp/konica_ftp_traversal
    use auxiliary/scanner/ftp/pcman_ftp_traversal
    use auxiliary/scanner/ftp/titanftp_xcrc_traversal
    use auxiliary/scanner/h323/h323_version
    use auxiliary/scanner/http/a10networks_ax_directory_traversal
    use auxiliary/scanner/http/accellion_fta_statecode_file_read
    use auxiliary/scanner/http/adobe_xml_inject
    use auxiliary/scanner/http/allegro_rompager_misfortune_cookie
    use auxiliary/scanner/http/apache_activemq_source_disclosure
    use auxiliary/scanner/http/apache_activemq_traversal
    use auxiliary/scanner/http/apache_mod_cgi_bash_env
    use auxiliary/scanner/http/apache_userdir_enum
    use auxiliary/scanner/http/appletv_login
    use auxiliary/scanner/http/atlassian_crowd_fileaccess
    use auxiliary/scanner/http/axis_local_file_include
    use auxiliary/scanner/http/axis_login
    use auxiliary/scanner/http/backup_file
    use auxiliary/scanner/http/barracuda_directory_traversal
    use auxiliary/scanner/http/bitweaver_overlay_type_traversal
    use auxiliary/scanner/http/blind_sql_query
    use auxiliary/scanner/http/bmc_trackit_passwd_reset
    use auxiliary/scanner/http/brute_dirs
    use auxiliary/scanner/http/buffalo_login
    use auxiliary/scanner/http/caidao_bruteforce_login
    use auxiliary/scanner/http/canon_wireless
    use auxiliary/scanner/http/cert
    use auxiliary/scanner/http/chef_webui_login
    use auxiliary/scanner/http/chromecast_webserver
    use auxiliary/scanner/http/cisco_asa_asdm
    use auxiliary/scanner/http/cisco_device_manager
    use auxiliary/scanner/http/cisco_ios_auth_bypass
    use auxiliary/scanner/http/cisco_ironport_enum
    use auxiliary/scanner/http/cisco_nac_manager_traversal
    use auxiliary/scanner/http/cisco_ssl_vpn
    use auxiliary/scanner/http/cisco_ssl_vpn_priv_esc
    use auxiliary/scanner/http/clansphere_traversal
    use auxiliary/scanner/http/coldfusion_locale_traversal
    use auxiliary/scanner/http/coldfusion_version
    use auxiliary/scanner/http/concrete5_member_list
    use auxiliary/scanner/http/copy_of_file
    use auxiliary/scanner/http/crawler
    use auxiliary/scanner/http/dell_idrac
    use auxiliary/scanner/http/dir_listing
    use auxiliary/scanner/http/dir_scanner
    use auxiliary/scanner/http/dir_webdav_unicode_bypass
    use auxiliary/scanner/http/dlink_dir_300_615_http_login
    use auxiliary/scanner/http/dlink_dir_615h_http_login
    use auxiliary/scanner/http/dlink_dir_session_cgi_http_login
    use auxiliary/scanner/http/dlink_user_agent_backdoor
    use auxiliary/scanner/http/dolibarr_login
    use auxiliary/scanner/http/drupal_views_user_enum
    use auxiliary/scanner/http/ektron_cms400net
    use auxiliary/scanner/http/elasticsearch_traversal
    use auxiliary/scanner/http/enum_wayback
    use auxiliary/scanner/http/error_sql_injection
    use auxiliary/scanner/http/etherpad_duo_login
    use auxiliary/scanner/http/f5_bigip_virtual_server
    use auxiliary/scanner/http/f5_mgmt_scanner
    use auxiliary/scanner/http/file_same_name_dir
    use auxiliary/scanner/http/files_dir
    use auxiliary/scanner/http/frontpage_login
    use auxiliary/scanner/http/git_scanner
    use auxiliary/scanner/http/gitlab_login
    use auxiliary/scanner/http/gitlab_user_enum
    use auxiliary/scanner/http/glassfish_login
    use auxiliary/scanner/http/goahead_traversal
    use auxiliary/scanner/http/groupwise_agents_http_traversal
    use auxiliary/scanner/http/host_header_injection
    use auxiliary/scanner/http/hp_imc_bims_downloadservlet_traversal
    use auxiliary/scanner/http/hp_imc_faultdownloadservlet_traversal
    use auxiliary/scanner/http/hp_imc_ictdownloadservlet_traversal
    use auxiliary/scanner/http/hp_imc_reportimgservlt_traversal
    use auxiliary/scanner/http/hp_imc_som_file_download
    use auxiliary/scanner/http/hp_sitescope_getfileinternal_fileaccess
    use auxiliary/scanner/http/hp_sitescope_getsitescopeconfiguration
    use auxiliary/scanner/http/hp_sitescope_loadfilecontent_fileaccess
    use auxiliary/scanner/http/hp_sys_mgmt_login
    use auxiliary/scanner/http/http_header
    use auxiliary/scanner/http/http_hsts
    use auxiliary/scanner/http/http_login
    use auxiliary/scanner/http/http_put
    use auxiliary/scanner/http/http_traversal
    use auxiliary/scanner/http/http_version
    use auxiliary/scanner/http/httpbl_lookup
    use auxiliary/scanner/http/iis_internal_ip
    use auxiliary/scanner/http/influxdb_enum
    use auxiliary/scanner/http/infovista_enum
    use auxiliary/scanner/http/ipboard_login
    use auxiliary/scanner/http/jboss_status
    use auxiliary/scanner/http/jboss_vulnscan
    use auxiliary/scanner/http/jenkins_command
    use auxiliary/scanner/http/jenkins_enum
    use auxiliary/scanner/http/jenkins_login
    use auxiliary/scanner/http/joomla_bruteforce_login
    use auxiliary/scanner/http/joomla_ecommercewd_sqli_scanner
    use auxiliary/scanner/http/joomla_gallerywd_sqli_scanner
    use auxiliary/scanner/http/joomla_pages
    use auxiliary/scanner/http/joomla_plugins
    use auxiliary/scanner/http/joomla_version
    use auxiliary/scanner/http/linknat_vos_traversal
    use auxiliary/scanner/http/linksys_e1500_traversal
    use auxiliary/scanner/http/litespeed_source_disclosure
    use auxiliary/scanner/http/lucky_punch
    use auxiliary/scanner/http/majordomo2_directory_traversal
    use auxiliary/scanner/http/manageengine_desktop_central_login
    use auxiliary/scanner/http/manageengine_deviceexpert_traversal
    use auxiliary/scanner/http/manageengine_deviceexpert_user_creds
    use auxiliary/scanner/http/manageengine_securitymanager_traversal
    use auxiliary/scanner/http/mediawiki_svg_fileaccess
    use auxiliary/scanner/http/mod_negotiation_brute
    use auxiliary/scanner/http/mod_negotiation_scanner
    use auxiliary/scanner/http/ms09_020_webdav_unicode_bypass
    use auxiliary/scanner/http/ms15_034_http_sys_memory_dump
    use auxiliary/scanner/http/mybook_live_login
    use auxiliary/scanner/http/netdecision_traversal
    use auxiliary/scanner/http/netgear_sph200d_traversal
    use auxiliary/scanner/http/nginx_source_disclosure
    use auxiliary/scanner/http/novell_file_reporter_fsfui_fileaccess
    use auxiliary/scanner/http/novell_file_reporter_srs_fileaccess
    use auxiliary/scanner/http/novell_mdm_creds
    use auxiliary/scanner/http/ntlm_info_enumeration
    use auxiliary/scanner/http/octopusdeploy_login
    use auxiliary/scanner/http/open_proxy
    use auxiliary/scanner/http/openmind_messageos_login
    use auxiliary/scanner/http/options
    use auxiliary/scanner/http/oracle_demantra_database_credentials_leak
    use auxiliary/scanner/http/oracle_demantra_file_retrieval
    use auxiliary/scanner/http/oracle_ilom_login
    use auxiliary/scanner/http/owa_ews_login
    use auxiliary/scanner/http/owa_iis_internal_ip
    use auxiliary/scanner/http/owa_login
    use auxiliary/scanner/http/pocketpad_login
    use auxiliary/scanner/http/prev_dir_same_name_file
    use auxiliary/scanner/http/radware_appdirector_enum
    use auxiliary/scanner/http/rails_json_yaml_scanner
    use auxiliary/scanner/http/rails_mass_assignment
    use auxiliary/scanner/http/rails_xml_yaml_scanner
    use auxiliary/scanner/http/replace_ext
    use auxiliary/scanner/http/rewrite_proxy_bypass
    use auxiliary/scanner/http/rfcode_reader_enum
    use auxiliary/scanner/http/rips_traversal
    use auxiliary/scanner/http/robots_txt
    use auxiliary/scanner/http/s40_traversal
    use auxiliary/scanner/http/sap_businessobjects_user_brute
    use auxiliary/scanner/http/sap_businessobjects_user_brute_web
    use auxiliary/scanner/http/sap_businessobjects_user_enum
    use auxiliary/scanner/http/sap_businessobjects_version_enum
    use auxiliary/scanner/http/scraper
    use auxiliary/scanner/http/sentry_cdu_enum
    use auxiliary/scanner/http/servicedesk_plus_traversal
    use auxiliary/scanner/http/sevone_enum
    use auxiliary/scanner/http/simple_webserver_traversal
    use auxiliary/scanner/http/smt_ipmi_49152_exposure
    use auxiliary/scanner/http/smt_ipmi_cgi_scanner
    use auxiliary/scanner/http/smt_ipmi_static_cert_scanner
    use auxiliary/scanner/http/smt_ipmi_url_redirect_traversal
    use auxiliary/scanner/http/soap_xml
    use auxiliary/scanner/http/sockso_traversal
    use auxiliary/scanner/http/splunk_web_login
    use auxiliary/scanner/http/squid_pivot_scanning
    use auxiliary/scanner/http/squiz_matrix_user_enum
    use auxiliary/scanner/http/ssl
    use auxiliary/scanner/http/ssl_version
    use auxiliary/scanner/http/support_center_plus_directory_traversal
    use auxiliary/scanner/http/svn_scanner
    use auxiliary/scanner/http/svn_wcdb_scanner
    use auxiliary/scanner/http/sybase_easerver_traversal
    use auxiliary/scanner/http/symantec_brightmail_ldapcreds
    use auxiliary/scanner/http/symantec_brightmail_logfile
    use auxiliary/scanner/http/symantec_web_gateway_login
    use auxiliary/scanner/http/titan_ftp_admin_pwd
    use auxiliary/scanner/http/title
    use auxiliary/scanner/http/tomcat_enum
    use auxiliary/scanner/http/tomcat_mgr_login
    use auxiliary/scanner/http/tplink_traversal_noauth
    use auxiliary/scanner/http/trace
    use auxiliary/scanner/http/trace_axd
    use auxiliary/scanner/http/typo3_bruteforce
    use auxiliary/scanner/http/vcms_login
    use auxiliary/scanner/http/verb_auth_bypass
    use auxiliary/scanner/http/vhost_scanner
    use auxiliary/scanner/http/wangkongbao_traversal
    use auxiliary/scanner/http/web_vulndb
    use auxiliary/scanner/http/webdav_internal_ip
    use auxiliary/scanner/http/webdav_scanner
    use auxiliary/scanner/http/webdav_website_content
    use auxiliary/scanner/http/webpagetest_traversal
    use auxiliary/scanner/http/wildfly_traversal
    use auxiliary/scanner/http/wordpress_cp_calendar_sqli
    use auxiliary/scanner/http/wordpress_ghost_scanner
    use auxiliary/scanner/http/wordpress_login_enum
    use auxiliary/scanner/http/wordpress_multicall_creds
    use auxiliary/scanner/http/wordpress_pingback_access
    use auxiliary/scanner/http/wordpress_scanner
    use auxiliary/scanner/http/wordpress_xmlrpc_login
    use auxiliary/scanner/http/wp_contus_video_gallery_sqli
    use auxiliary/scanner/http/wp_dukapress_file_read
    use auxiliary/scanner/http/wp_gimedia_library_file_read
    use auxiliary/scanner/http/wp_mobile_pack_info_disclosure
    use auxiliary/scanner/http/wp_mobileedition_file_read
    use auxiliary/scanner/http/wp_nextgen_galley_file_read
    use auxiliary/scanner/http/wp_simple_backup_file_read
    use auxiliary/scanner/http/wp_subscribe_comments_file_read
    use auxiliary/scanner/http/xpath
    use auxiliary/scanner/http/yaws_traversal
    use auxiliary/scanner/http/zabbix_login
    use auxiliary/scanner/http/zenworks_assetmanagement_fileaccess
    use auxiliary/scanner/http/zenworks_assetmanagement_getconfig
    use auxiliary/scanner/ike/cisco_ike_benigncertain
    use auxiliary/scanner/imap/imap_version
    use auxiliary/scanner/ip/ipidseq
    use auxiliary/scanner/ipmi/ipmi_cipher_zero
    use auxiliary/scanner/ipmi/ipmi_dumphashes
    use auxiliary/scanner/ipmi/ipmi_version
    use auxiliary/scanner/jenkins/jenkins_udp_broadcast_enum
    use auxiliary/scanner/kademlia/server_info
    use auxiliary/scanner/llmnr/query
    use auxiliary/scanner/lotus/lotus_domino_hashes
    use auxiliary/scanner/lotus/lotus_domino_login
    use auxiliary/scanner/lotus/lotus_domino_version
    use auxiliary/scanner/mdns/query
    use auxiliary/scanner/misc/cctv_dvr_login
    use auxiliary/scanner/misc/clamav_control
    use auxiliary/scanner/misc/dahua_dvr_auth_bypass
    use auxiliary/scanner/misc/dvr_config_disclosure
    use auxiliary/scanner/misc/easycafe_server_fileaccess
    use auxiliary/scanner/misc/ib_service_mgr_info
    use auxiliary/scanner/misc/java_rmi_server
    use auxiliary/scanner/misc/oki_scanner
    use auxiliary/scanner/misc/poisonivy_control_scanner
    use auxiliary/scanner/misc/raysharp_dvr_passwords
    use auxiliary/scanner/misc/rosewill_rxs3211_passwords
    use auxiliary/scanner/misc/sercomm_backdoor_scanner
    use auxiliary/scanner/misc/sunrpc_portmapper
    use auxiliary/scanner/misc/zenworks_preboot_fileaccess
    use auxiliary/scanner/mongodb/mongodb_login
    use auxiliary/scanner/motorola/timbuktu_udp
    use auxiliary/scanner/msf/msf_rpc_login
    use auxiliary/scanner/msf/msf_web_login
    use auxiliary/scanner/mssql/mssql_hashdump
    use auxiliary/scanner/mssql/mssql_login
    use auxiliary/scanner/mssql/mssql_ping
    use auxiliary/scanner/mssql/mssql_schemadump
    use auxiliary/scanner/mysql/mysql_authbypass_hashdump
    use auxiliary/scanner/mysql/mysql_file_enum
    use auxiliary/scanner/mysql/mysql_hashdump
    use auxiliary/scanner/mysql/mysql_login
    use auxiliary/scanner/mysql/mysql_schemadump
    use auxiliary/scanner/mysql/mysql_version
    use auxiliary/scanner/mysql/mysql_writable_dirs
    use auxiliary/scanner/natpmp/natpmp_portscan
    use auxiliary/scanner/nessus/nessus_ntp_login
    use auxiliary/scanner/nessus/nessus_rest_login
    use auxiliary/scanner/nessus/nessus_xmlrpc_login
    use auxiliary/scanner/nessus/nessus_xmlrpc_ping
    use auxiliary/scanner/netbios/nbname
    use auxiliary/scanner/nexpose/nexpose_api_login
    use auxiliary/scanner/nfs/nfsmount
    use auxiliary/scanner/ntp/ntp_monlist
    use auxiliary/scanner/ntp/ntp_nak_to_the_future
    use auxiliary/scanner/ntp/ntp_peer_list_dos
    use auxiliary/scanner/ntp/ntp_peer_list_sum_dos
    use auxiliary/scanner/ntp/ntp_readvar
    use auxiliary/scanner/ntp/ntp_req_nonce_dos
    use auxiliary/scanner/ntp/ntp_reslist_dos
    use auxiliary/scanner/ntp/ntp_unsettrap_dos
    use auxiliary/scanner/openvas/openvas_gsad_login
    use auxiliary/scanner/openvas/openvas_omp_login
    use auxiliary/scanner/openvas/openvas_otp_login
    use auxiliary/scanner/oracle/emc_sid
    use auxiliary/scanner/oracle/isqlplus_login
    use auxiliary/scanner/oracle/isqlplus_sidbrute
    use auxiliary/scanner/oracle/oracle_hashdump
    use auxiliary/scanner/oracle/oracle_login
    use auxiliary/scanner/oracle/sid_brute
    use auxiliary/scanner/oracle/sid_enum
    use auxiliary/scanner/oracle/spy_sid
    use auxiliary/scanner/oracle/tnslsnr_version
    use auxiliary/scanner/oracle/tnspoison_checker
    use auxiliary/scanner/oracle/xdb_sid
    use auxiliary/scanner/oracle/xdb_sid_brute
    use auxiliary/scanner/pcanywhere/pcanywhere_login
    use auxiliary/scanner/pcanywhere/pcanywhere_tcp
    use auxiliary/scanner/pcanywhere/pcanywhere_udp
    use auxiliary/scanner/pop3/pop3_login
    use auxiliary/scanner/pop3/pop3_version
    use auxiliary/scanner/portmap/portmap_amp
    use auxiliary/scanner/portscan/ack
    use auxiliary/scanner/portscan/ftpbounce
    use auxiliary/scanner/portscan/syn
    use auxiliary/scanner/portscan/tcp
    use auxiliary/scanner/portscan/xmas
    use auxiliary/scanner/postgres/postgres_dbname_flag_injection
    use auxiliary/scanner/postgres/postgres_hashdump
    use auxiliary/scanner/postgres/postgres_login
    use auxiliary/scanner/postgres/postgres_schemadump
    use auxiliary/scanner/postgres/postgres_version
    use auxiliary/scanner/printer/canon_iradv_pwd_extract
    use auxiliary/scanner/printer/printer_delete_file
    use auxiliary/scanner/printer/printer_download_file
    use auxiliary/scanner/printer/printer_env_vars
    use auxiliary/scanner/printer/printer_list_dir
    use auxiliary/scanner/printer/printer_list_volumes
    use auxiliary/scanner/printer/printer_ready_message
    use auxiliary/scanner/printer/printer_upload_file
    use auxiliary/scanner/printer/printer_version_info
    use auxiliary/scanner/quake/server_info
    use auxiliary/scanner/rdp/ms12_020_check
    use auxiliary/scanner/redis/file_upload
    use auxiliary/scanner/redis/redis_login
    use auxiliary/scanner/redis/redis_server
    use auxiliary/scanner/rogue/rogue_recv
    use auxiliary/scanner/rogue/rogue_send
    use auxiliary/scanner/rservices/rexec_login
    use auxiliary/scanner/rservices/rlogin_login
    use auxiliary/scanner/rservices/rsh_login
    use auxiliary/scanner/rsync/modules_list
    use auxiliary/scanner/sap/sap_ctc_verb_tampering_user_mgmt
    use auxiliary/scanner/sap/sap_hostctrl_getcomputersystem
    use auxiliary/scanner/sap/sap_icf_public_info
    use auxiliary/scanner/sap/sap_icm_urlscan
    use auxiliary/scanner/sap/sap_mgmt_con_abaplog
    use auxiliary/scanner/sap/sap_mgmt_con_brute_login
    use auxiliary/scanner/sap/sap_mgmt_con_extractusers
    use auxiliary/scanner/sap/sap_mgmt_con_getaccesspoints
    use auxiliary/scanner/sap/sap_mgmt_con_getenv
    use auxiliary/scanner/sap/sap_mgmt_con_getlogfiles
    use auxiliary/scanner/sap/sap_mgmt_con_getprocesslist
    use auxiliary/scanner/sap/sap_mgmt_con_getprocessparameter
    use auxiliary/scanner/sap/sap_mgmt_con_instanceproperties
    use auxiliary/scanner/sap/sap_mgmt_con_listlogfiles
    use auxiliary/scanner/sap/sap_mgmt_con_startprofile
    use auxiliary/scanner/sap/sap_mgmt_con_version
    use auxiliary/scanner/sap/sap_router_info_request
    use auxiliary/scanner/sap/sap_router_portscanner
    use auxiliary/scanner/sap/sap_service_discovery
    use auxiliary/scanner/sap/sap_smb_relay
    use auxiliary/scanner/sap/sap_soap_bapi_user_create1
    use auxiliary/scanner/sap/sap_soap_rfc_brute_login
    use auxiliary/scanner/sap/sap_soap_rfc_dbmcli_sxpg_call_system_command_exec
    use auxiliary/scanner/sap/sap_soap_rfc_dbmcli_sxpg_command_exec
    use auxiliary/scanner/sap/sap_soap_rfc_eps_get_directory_listing
    use auxiliary/scanner/sap/sap_soap_rfc_pfl_check_os_file_existence
    use auxiliary/scanner/sap/sap_soap_rfc_ping
    use auxiliary/scanner/sap/sap_soap_rfc_read_table
    use auxiliary/scanner/sap/sap_soap_rfc_rzl_read_dir
    use auxiliary/scanner/sap/sap_soap_rfc_susr_rfc_user_interface
    use auxiliary/scanner/sap/sap_soap_rfc_sxpg_call_system_exec
    use auxiliary/scanner/sap/sap_soap_rfc_sxpg_command_exec
    use auxiliary/scanner/sap/sap_soap_rfc_system_info
    use auxiliary/scanner/sap/sap_soap_th_saprel_disclosure
    use auxiliary/scanner/sap/sap_web_gui_brute_login
    use auxiliary/scanner/scada/digi_addp_reboot
    use auxiliary/scanner/scada/digi_addp_version
    use auxiliary/scanner/scada/digi_realport_serialport_scan
    use auxiliary/scanner/scada/digi_realport_version
    use auxiliary/scanner/scada/indusoft_ntwebserver_fileaccess
    use auxiliary/scanner/scada/koyo_login
    use auxiliary/scanner/scada/modbus_findunitid
    use auxiliary/scanner/scada/modbusclient
    use auxiliary/scanner/scada/modbusdetect
    use auxiliary/scanner/scada/profinet_siemens
    use auxiliary/scanner/scada/sielco_winlog_fileaccess
    use auxiliary/scanner/sip/enumerator
    use auxiliary/scanner/sip/enumerator_tcp
    use auxiliary/scanner/sip/options
    use auxiliary/scanner/sip/options_tcp
    use auxiliary/scanner/sip/sipdroid_ext_enum
    use auxiliary/scanner/smb/pipe_auditor
    use auxiliary/scanner/smb/pipe_dcerpc_auditor
    use auxiliary/scanner/smb/psexec_loggedin_users
    use auxiliary/scanner/smb/smb2
    use auxiliary/scanner/smb/smb_enum_gpp
    use auxiliary/scanner/smb/smb_enumshares
    use auxiliary/scanner/smb/smb_enumusers
    use auxiliary/scanner/smb/smb_enumusers_domain
    use auxiliary/scanner/smb/smb_login
    use auxiliary/scanner/smb/smb_lookupsid
    use auxiliary/scanner/smb/smb_uninit_cred
    use auxiliary/scanner/smb/smb_version
    use auxiliary/scanner/smtp/smtp_enum
    use auxiliary/scanner/smtp/smtp_ntlm_domain
    use auxiliary/scanner/smtp/smtp_relay
    use auxiliary/scanner/smtp/smtp_version
    use auxiliary/scanner/snmp/aix_version
    use auxiliary/scanner/snmp/arris_dg950
    use auxiliary/scanner/snmp/brocade_enumhash
    use auxiliary/scanner/snmp/cisco_config_tftp
    use auxiliary/scanner/snmp/cisco_upload_file
    use auxiliary/scanner/snmp/netopia_enum
    use auxiliary/scanner/snmp/sbg6580_enum
    use auxiliary/scanner/snmp/snmp_enum
    use auxiliary/scanner/snmp/snmp_enum_hp_laserjet
    use auxiliary/scanner/snmp/snmp_enumshares
    use auxiliary/scanner/snmp/snmp_enumusers
    use auxiliary/scanner/snmp/snmp_login
    use auxiliary/scanner/snmp/snmp_set
    use auxiliary/scanner/snmp/ubee_ddw3611
    use auxiliary/scanner/snmp/xerox_workcentre_enumusers
    use auxiliary/scanner/ssh/apache_karaf_command_execution
    use auxiliary/scanner/ssh/cerberus_sftp_enumusers
    use auxiliary/scanner/ssh/detect_kippo
    use auxiliary/scanner/ssh/fortinet_backdoor
    use auxiliary/scanner/ssh/juniper_backdoor
    use auxiliary/scanner/ssh/karaf_login
    use auxiliary/scanner/ssh/ssh_enumusers
    use auxiliary/scanner/ssh/ssh_identify_pubkeys
    use auxiliary/scanner/ssh/ssh_login
    use auxiliary/scanner/ssh/ssh_login_pubkey
    use auxiliary/scanner/ssh/ssh_version
    use auxiliary/scanner/ssl/openssl_ccs
    use auxiliary/scanner/ssl/openssl_heartbleed
    use auxiliary/scanner/steam/server_info
    use auxiliary/scanner/telephony/wardial
    use auxiliary/scanner/telnet/brocade_enable_login
    use auxiliary/scanner/telnet/lantronix_telnet_password
    use auxiliary/scanner/telnet/lantronix_telnet_version
    use auxiliary/scanner/telnet/telnet_encrypt_overflow
    use auxiliary/scanner/telnet/telnet_login
    use auxiliary/scanner/telnet/telnet_ruggedcom
    use auxiliary/scanner/telnet/telnet_version
    use auxiliary/scanner/tftp/ipswitch_whatsupgold_tftp
    use auxiliary/scanner/tftp/netdecision_tftp
    use auxiliary/scanner/tftp/tftpbrute
    use auxiliary/scanner/udp/udp_amplification
    use auxiliary/scanner/udp_scanner_template
    use auxiliary/scanner/upnp/ssdp_amp
    use auxiliary/scanner/upnp/ssdp_msearch
    use auxiliary/scanner/vmware/esx_fingerprint
    use auxiliary/scanner/vmware/vmauthd_login
    use auxiliary/scanner/vmware/vmauthd_version
    use auxiliary/scanner/vmware/vmware_enum_permissions
    use auxiliary/scanner/vmware/vmware_enum_sessions
    use auxiliary/scanner/vmware/vmware_enum_users
    use auxiliary/scanner/vmware/vmware_enum_vms
    use auxiliary/scanner/vmware/vmware_host_details
    use auxiliary/scanner/vmware/vmware_http_login
    use auxiliary/scanner/vmware/vmware_screenshot_stealer
    use auxiliary/scanner/vmware/vmware_server_dir_trav
    use auxiliary/scanner/vmware/vmware_update_manager_traversal
    use auxiliary/scanner/vnc/vnc_login
    use auxiliary/scanner/vnc/vnc_none_auth
    use auxiliary/scanner/voice/recorder
    use auxiliary/scanner/vxworks/wdbrpc_bootline
    use auxiliary/scanner/vxworks/wdbrpc_version
    use auxiliary/scanner/winrm/winrm_auth_methods
    use auxiliary/scanner/winrm/winrm_cmd
    use auxiliary/scanner/winrm/winrm_login
    use auxiliary/scanner/winrm/winrm_wql
    use auxiliary/scanner/x11/open_x11
    msf > use auxiliary/scanner/

use auxiliary/scanner/portscan/syn

受害机器ip是192.168.1.103

![855959-20170519230708103-1496125920.png][]

这里，选择好模块后，如果我们只需要扫描一台机器的话，则直接写一个ip既可。

msf  >   set RHOSTS   192.168.1.0/24   即扫描整个网段的机器。

msf  >   set RHOSTS   192.168.1.103   即扫描这一台机器（受害机器）。

![855959-20170519231002010-1932161653.png][]

设置好远程机器（受害机器）的ip和线程数。

![855959-20170519231046150-1879165966.png][]

**use auxiliary/scanner/smb/smb\_version**

受害机器ip是192.168.1.103

![855959-20170519231230432-486560535.png][]

设置好远程机器（受害机器）的ip和线程数。

use auxiliary/scanner/ftp/ftp_login

受害机器ip是192.168.1.103

一般，对于这样的登录扫描的话，则会有一个字典参数。

![855959-20170519231608822-760579248.png][]

![855959-20170519231833666-1191280463.png][]

use auxiliary/scanner/mssql/mssql_login 受害机器ip是192.168.1.106

![855959-20170519231928994-629380717.png][]

设置好远程机器（受害机器）的ip和线程数、用户字典。
    
    
    
    这个字典，可以包括单独的用户字典，也可以是用户和密码的字典。一般要用到字典的话，则就需要我们自己先生成一个。如下（另外开一个窗口）
    比如，我们在/etc下（这里，用到密码字典）

![855959-20170519232339572-124143078.png][]

![855959-20170519232803416-1282770618.png][]

![855959-20170519232812682-2132253638.png][]

![855959-20170519232843900-1375757056.png][]

![855959-20170519233115822-1918560776.png][]

use auxiliary/scanner/mysql/mysql_hashdump

受害机器ip是192.168.1.106

![855959-20170519233359557-1866148858.png][]

这里，作为攻击者，是随便输入用户名和密码。压根不知道受害机器上SQL Server的用户名和密码。（当然作为测试，其实，它那边的用户名和密码均为sa）

即，可以提取到受害机器的SQL Server上的所有用户名和密码。前面是用户名，后面是加密的密码，hash值。
    
    
    
    
    
    
    　　那，得到这样的hash值密码，该怎么破解呢？教大家！

http://www.cmd5.com/

![855959-20170519233735135-1493933820.png][]

![855959-20170519233854463-1820566076.png][]

![855959-20170519233911197-302649681.png][]

转载于:https://www.cnblogs.com/zlslch/p/6880638.html

[855959-20170519222512994-1796254525.png]: /images/20210725/546a551756f54713901f9b105b86fb7f.png
[855959-20170519223533525-1976153430.png]: /images/20210725/09501055c4f6457fbd36125a70d1dc2d.png
[855959-20170519223610463-85873316.png]: /images/20210725/0caa372e0eb7412dab2e2a922a7a301d.png
[855959-20170519230708103-1496125920.png]: /images/20210725/94306ce35d0c4e97a2a6dec549399a9d.png
[855959-20170519231002010-1932161653.png]: /images/20210725/e7b7acc15ebe403a85f1d70ea234e06a.png
[855959-20170519231046150-1879165966.png]: /images/20210725/23bc8c816be74b798744675eeca56e43.png
[855959-20170519231230432-486560535.png]: /images/20210725/290121f91f42449eac1f8eff20994289.png
[855959-20170519231608822-760579248.png]: /images/20210725/8f4a55ad855a46b28da798faac3b5e39.png
[855959-20170519231833666-1191280463.png]: /images/20210725/a2afbe5bffa4451d82057b8a77fe0921.png
[855959-20170519231928994-629380717.png]: /images/20210725/b336e04e6b07433a8405e490e7a68dca.png
[855959-20170519232339572-124143078.png]: /images/20210725/2e6e666aa717433cac484df9ee3c0be6.png
[855959-20170519232803416-1282770618.png]: /images/20210725/9df5ed3f28ae4dd58063364d81aeefaf.png
[855959-20170519232812682-2132253638.png]: /images/20210725/31db8bdf6e444bdb820825ea2abca040.png
[855959-20170519232843900-1375757056.png]: /images/20210725/f7f002cad0f84027aae2fc9f9bd7bdac.png
[855959-20170519233115822-1918560776.png]: /images/20210725/d4b7cf04365a4865b7df5b926546652b.png
[855959-20170519233359557-1866148858.png]: /images/20210725/8a1b67241aec44c790ba585743353a64.png
[855959-20170519233735135-1493933820.png]: /images/20210725/0baa4c5e23d740608d8374019e9caf0c.png
[855959-20170519233854463-1820566076.png]: /images/20210725/25415cef138b4c3da8e743668d8f1804.png
[855959-20170519233911197-302649681.png]: /images/20210725/d109bd740843433d9719bc01d970a7f5.png