API tools faq
paste
Advertisement
joemccray

Nmap 4 da r00kies

joemccray
Jul 5th, 2016
1,700
0
Never
Add comment
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
text 9.24 KB | None | 0 0
raw download clone embed print report
  1. #########################################
  2. # Teaching the r00kies NMap NSE #
  3. # By Joe McCray #
  4. #########################################
  5.  
  6.  
  7. Let's have you connect to the VPN. I wanted to make sure that I did some of the stuff on my local virtual machines because I want you to do the hunting for vulnerable hosts to attack. If I attack the live targets in the lab then I'll end up giving away a lot of the little secrets that I want you to discover.
  8.  
  9. So, let's start with some lab fun (just a little bit)...lol. Here are the instructions for connecting to the VPN:
  10. https://s3.amazonaws.com/StrategicSec-Files/Strategic-Security-2016-VPN-Info.pdf
  11.  
  12. sudo nmap -sP 10.0.0.0/24
  13.  
  14. sudo nmap -sL 10.0.0.0/24
  15.  
  16. cd ~/toolz
  17.  
  18. wget --no-check-certificate https://raw.githubusercontent.com/BenDrysdale/ipcrawl/master/ipcrawl.c
  19.  
  20. gcc ipcrawl.c -o ipcrawl
  21.  
  22. chmod 777 ipcrawl
  23.  
  24. ./ipcrawl 10.0.0.1 10.0.0.254
  25.  
  26.  
  27.  
  28. wget --no-check-certificate https://dl.packetstormsecurity.net/UNIX/scanners/propecia.c
  29.  
  30. gcc propecia.c propecia
  31.  
  32. sudo cp propecia /bin
  33.  
  34. propecia 10.0.0 22
  35.  
  36. propecia 10.0.0 3389
  37.  
  38. nmap -Pn -sV -T 5 -oG - -p 21,22,80,443,1433,3389 10.0.0.* | grep open
  39.  
  40. nmap -Pn -sV -T 5 -oG - -p 21,22,80,443,1433,3389 10.0.0.* | awk '/open/{print $2 " " $3}'
  41.  
  42. nmap -Pn -sV -T 5 -oG - -p 21,22,80,443,1433,3389 10.0.0.* | awk '/open/{print $2}' | wc -l
  43.  
  44. nmap -Pn -sV -T 5 -oG - -p 21,22,80,443,1433,3389 10.0.0.* | awk '/open/{print $2}'
  45.  
  46. nmap -Pn -sV -T 5 -oG - -p 21,22,80,443,1433,3389 10.0.0.* | awk '/open/{print $2}' > ~/labnet-ip-list.txt
  47.  
  48.  
  49. ##########################
  50. # Playing with Nmap NSE #
  51. ##########################
  52.  
  53. nmap -Pn -p80 --script ip-geolocation-* strategicsec.com
  54.  
  55. nmap -p80 --script dns-brute strategicsec.com
  56.  
  57. nmap --script http-robtex-reverse-ip secore.info
  58.  
  59. nmap -Pn -p80 --script=http-headers strategicsec.com
  60.  
  61.  
  62. ls /usr/share/nmap/scripts | grep http
  63. nmap -Pn -p80 --script=http-* strategicsec.com
  64.  
  65. cd ~/toolz
  66. wget http://wkhtmltopdf.googlecode.com/files/wkhtmltoimage-0.11.0_rc1-static-i386.tar.bz2
  67. tar -jxvf wkhtmltoimage-0.11.0_rc1-static-i386.tar.bz2
  68. sudo cp wkhtmltoimage-i386 /usr/local/bin/
  69.  
  70. git clone git://github.com/SpiderLabs/Nmap-Tools.git
  71. cd Nmap-Tools/NSE/
  72. sudo cp http-screenshot.nse /usr/share/nmap/scripts/
  73. sudo nmap --script-updatedb
  74.  
  75. cd ~/toolz/
  76. mkdir labscreenshots
  77. cd labscreenshots/
  78.  
  79. sudo nmap -Pn -T 5 -p 80 -A --script=http-screenshot 10.0.0.0/24 -iL /home/strategicsec/labnet-ip-list.txt
  80.  
  81.  
  82.  
  83.  
  84. vi screenshots.sh
  85.  
  86. #!/bin/bash
  87. printf "<HTML><BODY><BR>" > labnet-port-80-screenshots.html
  88. ls -1 *.png | awk -F : '{ print $1":"$2"\n<BR><IMG SRC=\""$1"%3A"$2"\" width=400><BR><BR>"}' >> labnet-port-80-screenshots.html
  89. printf "</BODY></HTML>" >> labnet-port-80-screenshots.html
  90.  
  91.  
  92.  
  93.  
  94.  
  95. sh screenshots.sh
  96.  
  97.  
  98.  
  99.  
  100. ##########################
  101. # Nmap NSE tricks to try #
  102. ##########################
  103. sudo nmap -Pn -n --open -p21 --script=banner,ftp-anon,ftp-bounce,ftp-proftpd-backdoor,ftp-vsftpd-backdoor 10.0.0.0/24
  104.  
  105. sudo nmap -Pn -n --open -p22 --script=sshv1,ssh2-enum-algos 10.0.0.0/24
  106.  
  107. sudo nmap -Pn -n -sU --open -p53 --script=dns-blacklist,dns-cache-snoop,dns-nsec-enum,dns-nsid,dns-random-srcport,dns-random-txid,dns-recursion,dns-service-discovery,dns-update,dns-zeustracker,dns-zone-transfer 10.0.0.0/24
  108.  
  109. sudo nmap -Pn -n --open -p111 --script=nfs-ls,nfs-showmount,nfs-statfs,rpcinfo 10.0.0.0/24
  110.  
  111. sudo nmap -Pn -n --open -p445 --script=msrpc-enum,smb-enum-domains,smb-enum-groups,smb-enum-processes,smb-enum-sessions,smb-enum-shares,smb-enum-users,smb-mbenum,smb-os-discovery,smb-security-mode,smb-server-stats,smb-system-info,smbv2-enabled,stuxnet-detect 10.0.0.0/24
  112.  
  113. sudo nmap -Pn -n --open -p1433 --script=ms-sql-dump-hashes,ms-sql-empty-password,ms-sql-info 10.0.0.0/24
  114.  
  115. sudo nmap -Pn -n --open -p1521 --script=oracle-sid-brute --script oracle-enum-users --script-args oracle-enum-users.sid=ORCL,userdb=orausers.txt 10.0.0.0/24
  116.  
  117. sudo nmap -Pn -n --open -p3306 --script=mysql-databases,mysql-empty-password,mysql-info,mysql-users,mysql-variables 10.0.0.0/24
  118.  
  119. sudo nmap -Pn -n --open -p3389 --script=rdp-vuln-ms12-020,rdp-enum-encryption 10.0.0.0/24
  120.  
  121. sudo nmap -Pn -n --open -p5900 --script=realvnc-auth-bypass,vnc-info 10.0.0.0/24
  122.  
  123. sudo nmap -Pn -n --open -p6000-6005 --script=x11-access 10.0.0.0/24
  124.  
  125. sudo nmap -Pn -n --open -p27017 --script=mongodb-databases,mongodb-info 10.0.0.0/24
  126.  
  127.  
  128.  
  129.  
  130. #####################################
  131. # Writing Your Own Nmap NSE Scripts #
  132. #####################################
  133.  
  134. - Reference for this tutorial is:
  135. https://thesprawl.org/research/writing-nse-scripts-for-vulnerability-scanning/
  136.  
  137. ----------------------------------------------------------------------
  138. sudo vi /usr/share/nmap/scripts/intro-nse.nse
  139.  
  140. -- The Head Section --
  141. -- The Rule Section --
  142. portrule = function(host, port)
  143. return port.protocol == "tcp"
  144. and port.number == 80
  145. and port.state == "open"
  146. end
  147.  
  148. -- The Action Section --
  149. action = function(host, port)
  150. return "Advanced Pentester Night School!"
  151. end
  152. ----------------------------------------------------------------------
  153.  
  154. - Ok, now that we've made that change let's run the script
  155. sudo nmap --script=/usr/share/nmap/scripts/intro-nse.nse strategicsec.com -p 22,80,443
  156.  
  157.  
  158.  
  159.  
  160.  
  161.  
  162. ----------------------------------------------------------------------
  163. sudo vi /usr/share/nmap/scripts/intro-nse.nse
  164.  
  165. -- The Head Section --
  166. local shortport = require "shortport"
  167.  
  168. -- The Rule Section --
  169. portrule = shortport.http
  170.  
  171.  
  172. -- The Action Section --
  173. action = function(host, port)
  174. return "Advanced Pentester Night School!"
  175. end
  176. ----------------------------------------------------------------------
  177.  
  178. - Ok, now that we've made that change let's run the script
  179. sudo nmap --script=/usr/share/nmap/scripts/intro-nse.nse strategicsec.com -p 22,80,443
  180.  
  181.  
  182.  
  183.  
  184.  
  185.  
  186.  
  187. OK, now let's have some fun with my buddy Carlos Perez's website which you should have been looking at quite a lot if you were trying to get Ruby 2.1.5 working last year.
  188.  
  189. ----------------------------------------------------------------------
  190. sudo vi /usr/share/nmap/scripts/intro-nse.nse
  191.  
  192. -- The Head Section --
  193. local shortport = require "shortport"
  194. local http = require "http"
  195.  
  196. -- The Rule Section --
  197. portrule = shortport.http
  198.  
  199. -- The Action Section --
  200. action = function(host, port)
  201.  
  202. local uri = "/installing-metasploit-in-ubunt/"
  203. local response = http.get(host, port, uri)
  204. return response.status
  205.  
  206. end
  207. ----------------------------------------------------------------------
  208.  
  209. - Ok, now that we've made that change let's run the script
  210. sudo nmap --script=/usr/share/nmap/scripts/intro-nse.nse darkoperator.com -p 22,80,443
  211.  
  212.  
  213.  
  214.  
  215. ----------------------------------------------------------------------
  216. sudo vi /usr/share/nmap/scripts/intro-nse.nse
  217.  
  218. -- The Head Section --
  219. local shortport = require "shortport"
  220. local http = require "http"
  221.  
  222. -- The Rule Section --
  223. portrule = shortport.http
  224.  
  225. -- The Action Section --
  226. action = function(host, port)
  227.  
  228. local uri = "/installing-metasploit-in-ubunt/"
  229. local response = http.get(host, port, uri)
  230.  
  231. if ( response.status == 200 ) then
  232. return response.body
  233. end
  234.  
  235. end
  236. ----------------------------------------------------------------------
  237.  
  238. - Ok, now that we've made that change let's run the script
  239. sudo nmap --script=/usr/share/nmap/scripts/intro-nse.nse darkoperator.com -p 22,80,443
  240.  
  241.  
  242.  
  243.  
  244.  
  245.  
  246.  
  247.  
  248.  
  249. ----------------------------------------------------------------------
  250. sudo vi /usr/share/nmap/scripts/intro-nse.nse
  251.  
  252. -- The Head Section --
  253. local shortport = require "shortport"
  254. local http = require "http"
  255. local string = require "string"
  256.  
  257. -- The Rule Section --
  258. portrule = shortport.http
  259.  
  260. -- The Action Section --
  261. action = function(host, port)
  262.  
  263. local uri = "/installing-metasploit-in-ubunt/"
  264. local response = http.get(host, port, uri)
  265.  
  266. if ( response.status == 200 ) then
  267. local title = string.match(response.body, "Installing Metasploit in Ubuntu and Debian")
  268. return title
  269. end
  270.  
  271. end
  272. ----------------------------------------------------------------------
  273.  
  274. - Ok, now that we've made that change let's run the script
  275. sudo nmap --script=/usr/share/nmap/scripts/intro-nse.nse darkoperator.com -p 22,80,443
  276.  
  277.  
  278.  
  279.  
  280.  
  281.  
  282.  
  283. ----------------------------------------------------------------------
  284. sudo vi /usr/share/nmap/scripts/intro-nse.nse
  285.  
  286. -- The Head Section --
  287. local shortport = require "shortport"
  288. local http = require "http"
  289. local string = require "string"
  290.  
  291. -- The Rule Section --
  292. portrule = shortport.http
  293.  
  294. -- The Action Section --
  295. action = function(host, port)
  296.  
  297. local uri = "/installing-metasploit-in-ubunt/"
  298. local response = http.get(host, port, uri)
  299.  
  300. if ( response.status == 200 ) then
  301. local title = string.match(response.body, "Installing Metasploit in Ubuntu and Debian")
  302.  
  303. if (title) then
  304. return "Vulnerable"
  305. else
  306. return "Not Vulnerable"
  307. end
  308. end
  309. end
  310.  
  311. ----------------------------------------------------------------------
  312.  
  313. - Ok, now that we've made that change let's run the script
  314. sudo nmap --script=/usr/share/nmap/scripts/intro-nse.nse darkoperator.com -p 22,80,443
Advertisement
Add Comment
Please, Sign In to add comment
Advertisement
Public Pastes
Advertisement
We use cookies for various purposes including analytics. By continuing to use Pastebin, you agree to our use of cookies as described in the Cookies Policy.  OK, I Understand
Not a member of Pastebin yet?
Sign Up, it unlocks many cool features!