Smb/pipe auditor
De www.metasploit-es.com.ar
El escaneador "pipe_auditor" determinara que tuberias nombradas estan disponibles sobre SMB. En la fase de obtencion de informacion, esto puede proveerte de cierta penetracion a algunos de los servicios que se estan ejecutando en el sistema remoto.
msf > use auxiliary/scanner/smb/pipe_auditor msf auxiliary(pipe_auditor) > show options Module options: Name Current Setting Required Description ---- --------------- -------- ----------- RHOSTS yes The target address range or CIDR identifier SMBDomain WORKGROUP no The Windows domain to use for authentication SMBPass no The password for the specified username SMBUser no The username to authenticate as THREADS 1 yes The number of concurrent threads msf auxiliary(pipe_auditor) >
Para ejecutar el escaneador, solamente pasa, como minimo, el valor RHOSTS al modulo y ejecutalo.
msf auxiliary(pipe_auditor) > set RHOSTS 192.168.1.150-160 RHOSTS => 192.168.1.150-160 msf auxiliary(pipe_auditor) > set THREADS 11 THREADS => 11 msf auxiliary(pipe_auditor) > run [*] 192.168.1.150 - Pipes: \browser [*] 192.168.1.160 - Pipes: \browser [*] Scanned 02 of 11 hosts (018% complete) [*] Scanned 10 of 11 hosts (090% complete) [*] Scanned 11 of 11 hosts (100% complete) [*] Auxiliary module execution completed
Podemos ver que ejecutando el escaneador sin credenciales no devuelve demasiada informacion. Si, sin embargo, has proporcionado las credenciales como parte del test de penetracion, encontraras que el escaneador "pipe_auditor" devuelve mucha mas informacion.
msf auxiliary(pipe_auditor) > set SMBPass s3cr3t SMBPass => s3cr3t msf auxiliary(pipe_auditor) > set SMBUser Administrator SMBUser => Administrator msf auxiliary(pipe_auditor) > run [*] 192.168.1.150 - Pipes: \netlogon, \lsarpc, \samr, \browser, \atsvc, \DAV RPC SERVICE, \epmapper, \eventlog, \InitShutdown, \keysvc, \lsass, \ntsvcs, \protected_storage, \scerpc, \srvsvc, \trkwks, \wkssvc [*] Scanned 02 of 11 hosts (018% complete) [*] 192.168.1.160 - Pipes: \netlogon, \lsarpc, \samr, \browser, \atsvc, \DAV RPC SERVICE, \epmapper, \eventlog, \InitShutdown, \keysvc, \lsass, \ntsvcs, \protected_storage, \router, \scerpc, \srvsvc, \trkwks, \wkssvc [*] Scanned 04 of 11 hosts (036% complete) [*] Scanned 08 of 11 hosts (072% complete) [*] Scanned 09 of 11 hosts (081% complete) [*] Scanned 11 of 11 hosts (100% complete) [*] Auxiliary module execution completed msf auxiliary(pipe_auditor) >
© Offensive Security 2009
Original de www.offensive-security.com Traducido por cbk999
