利用Nmap扫描并识别服务
利用 Nmap 扫描并识别服务 配合使用特定脚本和利用特定漏洞： · 可以用来识别活动主机 · 扫描 TCP 和 UDP 的开发端口 · 检测防火墙 · 获取运行在远程主机上的服务版本和事件 实施步骤 启动 Vulnerable_VM 靶机 在安装 KALI 系统的攻击机上 检测 Vulnerable_VM 是否活动，使用 nmap 扫描工具： nmap -sn idea.lanyus.com 参数说明： -sn | Ping Scan - 关闭端口扫描 root@kali:~# nmap -sn 192.168.150.143 Starting Nmap 7.01 ( https://nmap.org ) at 2016-07-17 23:50 CST Nmap scan report for bogon (192.168.150.143) Host is up (0.00028s latency). MAC Address: 00:0C:29:8F:CA:00 (VMware) Nmap done: 1 IP address (1 host up) scanned in 0.09 seconds 检测 Vulnerable_VM 开放的端口 root@kali:~# nmap idea.lanyus.com Starting Nmap 7.01 ( https://nmap.org ) at 2016-07-17 18:33 CST Nmap scan report for idea.lanyus.com (120.52.29.220) Host is up (0.0072s latency). Not shown: 997 filtered ports PORT STATE SERVICE 80/tcp open http 443/tcp open https 8080/tcp open http-proxy Nmap done: 1 IP address (1 host up) scanned in 49.01 seconds 下面的命令扫描靶机上的1000以内的端口 root@kali:~# nmap 192.168.150.143 Starting Nmap 7.01 ( https://nmap.org ) at 2016-07-17 23:53 CST Nmap scan report for bogon (192.168.150.143) Host is up (0.00028s latency). Not shown: 991 closed ports PORT STATE SERVICE 22/tcp open ssh 80/tcp open http 139/tcp open netbios-ssn 143/tcp open imap 443/tcp open https 445/tcp open microsoft-ds 5001/tcp open commplex-link 8080/tcp open http-proxy 8081/tcp open blackice-icecap MAC Address: 00:0C:29:8F:CA:00 (VMware) Nmap done: 1 IP address (1 host up) scanned in 0.20 seconds 扫描靶机运行的服务的版本号，并基于此判断靶机系统类型 nmap -sV -O idea.lanyus.com 参数说明： -sV | Probe open ports to determine service/version info root@kali:~# nmap -sV -O idea.lanyus.com Starting Nmap 7.01 ( https://nmap.org ) at 2016-07-17 23:47 CST Nmap scan report for idea.lanyus.com (120.52.29.220) Host is up (0.035s latency). Not shown: 997 filtered ports PORT STATE SERVICE VERSION 80/tcp open http cloudflare-nginx 443/tcp open ssl/https? 8080/tcp open http cloudflare-nginx Warning: OSScan results may be unreliable because we could not find at least 1 open and 1 closed port Device type: WAP|general purpose Running: Actiontec embedded， Linux 2.4.X|3.X， Microsoft Windows 7|2012 OS CPE: cpe:/h:actiontec:mi424wr-gen3i cpe:/o:linux:linux_kernel cpe:/o:linux:linux_kernel:2.4.37 cpe:/o:linux:linux_kernel:3.2 cpe:/o:microsoft:windows_7 cpe:/o:microsoft:windows_server_2012 OS details: Actiontec MI424WR-GEN3I WAP， DD-WRT v24-sp2 (Linux 2.4.37)， Linux 3.2， Microsoft Windows 7 or Windows Server 2012 OS and Service detection performed. Please report any incorrect results at https://nmap.org/submit/ . Nmap done: 1 IP address (1 host up) scanned in 72.32 seconds下面的命令可以扫描出靶机运行服务的版本和操作系统版本 root@kali:~# nmap -sV -O 192.168.150.143 Starting Nmap 7.01 ( https://nmap.org ) at 2016-07-17 23:55 CST Nmap scan report for bogon (192.168.150.143) Host is up (0.00067s latency). Not shown: 991 closed ports PORT STATE SERVICE VERSION 22/tcp open ssh OpenSSH 5.3p1 Debian 3ubuntu4 (Ubuntu Linux; protocol 2.0) 80/tcp open http Apache httpd 2.2.14 ((Ubuntu) mod_mono/2.4.3 PHP/5.3.2-1ubuntu4.30 with Suhosin-Patch proxy_html/3.0.1 mod_python/3.3.1 Python/2.6.5 mod_ssl/2.2.14 OpenSSL...) 139/tcp open netbios-ssn Samba smbd 3.X (workgroup: WORKGROUP) 143/tcp open imap Courier Imapd (released 2008) 443/tcp open ssl/http Apache httpd 2.2.14 ((Ubuntu) mod_mono/2.4.3 PHP/5.3.2-1ubuntu4.30 with Suhosin-Patch proxy_html/3.0.1 mod_python/3.3.1 Python/2.6.5 mod_ssl/2.2.14 OpenSSL...) 445/tcp open netbios-ssn Samba smbd 3.X (workgroup: WORKGROUP) 5001/tcp open java-rmi Java RMI 8080/tcp open http Apache Tomcat/Coyote JSP engine 1.1 8081/tcp open http Jetty 6.1.25 1 service unrecognized despite returning data. If you know the service/version， please submit the following fingerprint at https://nmap.org/cgi-bin/submit.cgi?new-service : SF-Port5001-TCP:V=7.01%I=7%D=7/17%Time=578BAA72%P=x86_64-pc-linux-gnu%r(NU SF:LL，4，"xacxedx05"); MAC Address: 00:0C:29:8F:CA:00 (VMware) Device type: general purpose Running: Linux 2.6.X OS CPE: cpe:/o:linux:linux_kernel:2.6 OS details: Linux 2.6.17 - 2.6.36 Network Distance: 1 hop Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel OS and Service detection performed. Please report any incorrect results at https://nmap.org/submit/ . Nmap done: 1 IP address (1 host up) scanned in 22.47 seconds 上面的扫描结果中，我们可以看出，靶机的操作系统是 Linux 2.6.X，使用了 Apache httpd 2.2.14 + PHP/5.3.2的 WEB 服务，以及其他一些信息。 Nmap 是一个端口扫描器，它会发送一堆报文到靶机的一系列端口中，检查响应内容。如果有响应，则该端口有对应服务在运行。 在使用 Nmap 扫描过程中，还有其他很多有用的参数： -sT | 该参数下，使用 SYN 扫描，这个参数下我们使用的是 Full Connect 扫描。这种模式，速度慢而且会在靶机中留下访问日志。 -Pn | 如过已经确认靶机为活动状态或无法Ping通靶机，我们使用该参数跳过 Ping 扫描，直接假定靶机活动，进行完整扫描。 -v | 这个参数会尽可能显示详细的扫描过程和靶机响应信息。 -p N1，N2，...Nn | 扫描指定端口，例如只扫描端口21，80到85，90，那么使用命令 nmap -p 21，80-85，90。 --script=script_name | Nmap 包含很多用于漏洞的检查、扫描、识别、登陆测试、命令执行、用户枚举等功能的脚本。使用这个参数可以在靶机的特定端口上执行脚本，详细用法参见：https://nmap.org/nsedoc/scripts/
