smb-enum-processes
脚本使用类型:
hostrule
脚本所属分类:
discovery, intrusive
脚本下载地址: http://nmap.org/svn/scripts/smb-enum-processes.nse
Pulls a list of processes from the remote server over SMB. This will determine all running processes, their process IDs, and their parent processes. It is done by querying the remote registry service, which is disabled by default on Vista; on all other Windows versions, it requires Administrator privileges.
Since this requires administrator privileges, it isn't especially useful for a penetration tester, since they can effectively do the same thing with metasploit or other tools. It does, however, provide for a quick way to get process lists for a bunch of systems at the same time.
WARNING: I have experienced crashes in regsvc.exe
while making registry calls
against a fully patched Windows 2000 system; I've fixed the issue that caused
it, but there's no guarantee that it (or a similar vulnerability in the same code) won't
show up again. Since the process automatically restarts, it doesn't negatively
impact the system, besides showing a message box to the user.
执行格式
nmap --script smb-enum-processes.nse -p445 <host> sudo nmap -sU -sS --script smb-enum-processes.nse -p U:137,T:139 <host>
Host script results: | smb-enum-processes: |_ |_ Idle, System, smss, csrss, winlogon, services, logon.scr, lsass, spoolsv, msdtc, VMwareService, svchost, alg, explorer, VMwareTray, VMwareUser, wmiprvse -- Host script results: | smb-enum-processes: | `+-Idle | | `-System | | `-smss | | `+-csrss | | `-winlogon | | `+-services | | | `+-spoolsv | | | +-msdtc | | | +-VMwareService | | | +-svchost | | | `-alg | | +-logon.scr | | `-lsass | +-explorer | | `+-VMwareTray | | `-VMwareUser |_ `-wmiprvse -- Host script results: | smb-enum-processes: | PID PPID Priority Threads Handles | ----- ----- -------- ------- ------- | 0 0 0 1 0 `+-Idle | 4 0 8 49 395 | `-System | 252 4 11 3 19 | `-smss | 300 252 13 10 338 | `+-csrss | 324 252 13 18 513 | `-winlogon | 372 324 9 16 272 | `+-services | 872 372 8 12 121 | | `+-spoolsv | 896 372 8 13 151 | | +-msdtc | 1172 372 13 3 53 | | +-VMwareService | 1336 372 8 20 158 | | +-svchost | 1476 372 8 6 90 | | `-alg | 376 324 4 1 22 | +-logon.scr | 384 324 9 23 394 | `-lsass | 1720 1684 8 9 259 +-explorer | 1796 1720 8 1 42 | `+-VMwareTray | 1808 1720 8 1 44 | `-VMwareUser |_ 1992 580 8 7 179 `-wmiprvse
Author: Ron Bowes
License: VER007 整理 http://www.ver007.com