1
PORT    STATE SERVICE
2
22/tcp  open  ssh
3
80/tcp  open  http
4
139/tcp open  netbios-ssn
5
445/tcp open  microsoft-ds

1
Nmap scan report for 192.168.200.157
2
Host is up (0.00031s latency).
3

4
PORT    STATE SERVICE     VERSION
5
22/tcp  open  ssh         OpenSSH 6.6.1p1 Ubuntu 2ubuntu2.13 (Ubuntu Linux; protocol 2.0)
6
| ssh-hostkey:
7
|   1024 6f:ee:95:91:9c:62:b2:14:cd:63:0a:3e:f8:10:9e:da (DSA)
8
|   2048 10:45:94:fe:a7:2f:02:8a:9b:21:1a:31:c5:03:30:48 (RSA)
9
|   256 97:94:17:86:18:e2:8e:7a:73:8e:41:20:76:ba:51:73 (ECDSA)
10
|_  256 23:81:c7:76:bb:37:78:ee:3b:73:e2:55:ad:81:32:72 (ED25519)
11
80/tcp  open  http        Apache httpd 2.4.7 ((Ubuntu))
12
|_http-server-header: Apache/2.4.7 (Ubuntu)
13
|_http-title: Site doesn't have a title (text/html).
14
139/tcp open  netbios-ssn Samba smbd 3.X - 4.X (workgroup: WORKGROUP)
15
445/tcp open  netbios-ssn Samba smbd 4.3.11-Ubuntu (workgroup: WORKGROUP)
16
MAC Address: 00:0C:29:A8:7A:D8 (VMware)
17
Warning: OSScan results may be unreliable because we could not find at least 1 open and 1 closed port
18
Device type: general purpose
19
Running: Linux 3.X|4.X
20
OS CPE: cpe:/o:linux:linux_kernel:3 cpe:/o:linux:linux_kernel:4
21
OS details: Linux 3.2 - 4.14, Linux 3.8 - 3.16
22
Network Distance: 1 hop
23
Service Info: Host: WESTWILD; OS: Linux; CPE: cpe:/o:linux:linux_kernel
24

25
Host script results:
26
| smb-security-mode:
27
|   account_used: guest
28
|   authentication_level: user
29
|   challenge_response: supported
30
|_  message_signing: disabled (dangerous, but default)
31
| smb-os-discovery:
32
|   OS: Windows 6.1 (Samba 4.3.11-Ubuntu)
33
|   Computer name: westwild
34
|   NetBIOS computer name: WESTWILD\x00
35
|   Domain name: \x00
36
|   FQDN: westwild
37
|_  System time: 2026-05-06T08:20:37+03:00
38
|_clock-skew: mean: -1h00m00s, deviation: 1h43m55s, median: 0s
39
| smb2-security-mode:
40
|   3:1:1:
41
|_    Message signing enabled but not required
42
| smb2-time:
43
|   date: 2026-05-06T05:20:37
44
|_  start_date: N/A
45
|_nbstat: NetBIOS name: WESTWILD, NetBIOS user: <unknown>, NetBIOS MAC: <unknown> (unknown)

1
Nmap scan report for 192.168.200.157
2
Host is up (0.00023s latency).
3

4
PORT    STATE SERVICE
5
22/tcp  open  ssh
6
80/tcp  open  http
7
|_http-dombased-xss: Couldn't find any DOM based XSS.
8
| http-slowloris-check:
9
|   VULNERABLE:
10
|   Slowloris DOS attack
11
|     State: LIKELY VULNERABLE
12
|     IDs:  CVE:CVE-2007-6750
13
|       Slowloris tries to keep many connections to the target web server open and hold
14
|       them open as long as possible.  It accomplishes this by opening connections to
15
|       the target web server and sending a partial request. By doing so, it starves
16
|       the http server's resources causing Denial Of Service.
17
|
18
|     Disclosure date: 2009-09-17
19
|     References:
20
|       https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-6750
21
|_      http://ha.ckers.org/slowloris/
22
|_http-csrf: Couldn't find any CSRF vulnerabilities.
23
|_http-stored-xss: Couldn't find any stored XSS vulnerabilities.
24
139/tcp open  netbios-ssn
25
445/tcp open  microsoft-ds
26
MAC Address: 00:0C:29:A8:7A:D8 (VMware)
27

28
Host script results:
29
| smb-vuln-regsvc-dos:
30
|   VULNERABLE:
31
|   Service regsvc in Microsoft Windows systems vulnerable to denial of service
32
|     State: VULNERABLE
33
|       The service regsvc in Microsoft Windows 2000 systems is vulnerable to denial of service caused by a null deference
34
|       pointer. This script will crash the service if it is vulnerable. This vulnerability was discovered by Ron Bowes
35
|       while working on smb-enum-sessions.
36
|_
37
|_smb-vuln-ms10-054: false
38
|_smb-vuln-ms10-061: false

1
# 连接共享（guest 用户）
2
smbclient //192.168.200.157/共享名 -N
3

4
# 指定连接用户
5
smbclient //192.168.200.157/共享名 -U 用户名
6

7
# 进入后的常用命令：
8
ls                        # 查看文件列表
9
cd 目录名                  # 进入目录
10
get 文件名                 # 下载单个文件
11
get 文件名 /本地/保存路径   # 下载到指定位置
12
mget *.txt                # 批量下载（支持通配符）