小白日记10:kali渗透测试之端口扫描-UDP、TCP、僵尸扫描、隐蔽扫描

端口扫描

二三四层发现的目的只是为了准确发现所有活着主机IP,确定攻击面,端口扫描即发现攻击点,发现开放端口。端口对应网络服务及应用端程序,服务端程序的漏洞通过端口攻入。【所有的扫描结果,都不要完全相信】
 
一个端口就是一个潜在的通信通道,也就是一个入侵通道。对目标计算机进行端口扫描,能得到许多有用的信息。进行扫描的方法很多,可以是手工进行扫描,也可以用端口扫描软件进行扫描。在手工进行扫描时,需要熟悉各种命令。对命令执行后的输出进行分析。用扫描软件进行扫描时,许多扫描器软件都有分析数据的功能。通过端口扫描,可以得到许多有用的信息,从而发现系统的安全漏洞。
对端口扫描中出现的服务结果,不要相信,那只是一个惯例,并不准确
 
 
UDP端口扫描【ports off:回应】
完整的UDP应用层请求,准确高,但耗时大,相比TCP还是会比较快。了解每一种基于UDP的应用包头结构,构造专门基于应用层的协议包,结果会更准确。
scapy 
#!/usr/bin/python

import logging
logging.getLogger("scapy.runtime").setLevel(logging.ERROR)
from scapy.all import*
import time
import sys if len( sys.argv ) !=4:
print "Usage - ./udp_scan.py [Target.IP] [First Port] [Last Port]"
print "Example - ./udp_scan.py 1.1.1.1 1 100"
print "Example will UDP port scan ports 1 through 100 on 1.1.1.1"
sys.exit() ip=sys.argv[1]
start=int(sys.argv[2])
end=int(sys.argv[3]) for port in range(start,end):
a=sr1(IP(dst=ip)/UDP(dport=port),timeout=5,verbose=0)
time.sleep(1) #防止因扫描过快,造成误判
if a==None:
print port
else:
pass

Nmap

root@kali:~# nmap 192.168.1.1 -sU -p 53,67   #默认不加-p,扫描1000常用端口

Starting Nmap 7.01 ( https://nmap.org ) at 2016-09-11 11:39 CST
Nmap scan report for DD-WRT (192.168.1.1)
Host is up (0.0048s latency).
PORT STATE SERVICE
53/udp open domain
67/udp open|filtered dhcps
MAC Address: 1C:BD:B9:27:D5:32 (D-Link International) Nmap done: 1 IP address (1 host up) scanned in 1.50 seconds

指定地址列表

nmap -iL iplist.txt -sU -p 1-200
 
 
TCP端口扫描

1、全连接扫描——SYN、SYN+ACK、ACK

建立完整TCP三次连接,结果最最准确不需要任何权限,系统中的任何用户都有权利使用这个调用,而且速度快,但容易被发觉。
scapy对全连接扫描比较困难
若直接给目标系统发SYN+ACK/ACK,dst会认为是异常包,回应RST
TCP扫描:
【操作系统内核,会认为没建立完整的连接,会返回一个RST,表示请求断开连接】需要避免接受此包,以免混淆后续操作。让RST包不产生
iptables,linux防火墙,工作位置在内核之前
使用策略:iptables -A OUTPUT -p tcp --tcp-flags RST RST -d 192.168.20.2 -j DROP
再运行脚本
#!/usr/bin/python

import logging
logging.getLogger("scapy.runtime").setLevel(logging.ERROR)
from scapy.all import* SYN=IP(dst="1.1.1.1")/TCP(doprt=80,flags="S") print"-- SENT --"
SYN.display() print"\n\n-- REVEIED"
response=sr1(SYN,timeout=1,verbose=0)
response.diplay() if int(response[TCP],flags)==18:
print "\n\n-- SENT --"
A=IP(dst="192.168.1.134")/TCP(dport=25,flags="A",ack=(response[TCP].seq+1))
A.display()
print"\n\n-- RECEIVED --"
response2=sr1(A,timeout=1,verbose=0)
response2.display()
else:
print "SYN-ACK not returned"

nmap   #-sT tcp连接

root@kali:~# nmap -sT 192.168.1.115 -p 100-200         

Starting Nmap 7.01 ( https://nmap.org ) at 2016-09-11 10:56 CST
Nmap scan report for PC (192.168.1.115)
Host is up (0.41s latency).
Not shown: 99 closed ports
PORT STATE SERVICE
135/tcp open msrpc
139/tcp open netbios-ssn
MAC Address: 08:00:27:2B:32:0F (Oracle VirtualBox virtual NIC) Nmap done: 1 IP address (1 host up) scanned in 5.02 seconds

【不加-p,会扫描1000个常用端口】

Dmitry
用来查询IP或域名WHOIS信息,但是不能判断出这个网络范围
root@kali:~# dmitry
Deepmagic Information Gathering Tool
"There be some deep magic going on" Usage: dmitry [-winsepfb] [-t 0-9] [-o %host.txt] host
-o Save output to %host.txt or to file specified by -o file
-i Perform a whois lookup on the IP address of a host
-w Perform a whois lookup on the domain name of a host
-n Retrieve Netcraft.com information on a host
-s Perform a search for possible subdomains
-e Perform a search for possible email addresses
-p Perform a TCP port scan on a host #执行TCP的端口扫描
* -f Perform a TCP port scan on a host showing output reporting filtered ports
* -b Read in the banner received from the scanned port
* -t 0-9 Set the TTL in seconds when scanning a TCP port ( Default 2 )
*Requires the -p flagged to be passed

NC

root@kali:~# nc -nv -w 1 -z 192.168.1.115 100-200                                                                             #-nv:n表示跟数字内容,v不做域名解析 -w超时时间  -z使用扫描模式
(UNKNOWN) [192.168.1.115] 139 (netbios-ssn) open
(UNKNOWN) [192.168.1.115] 135 (loc-srv) open
 

for x in $(seq 20 30); do nc -nv -w 1 -z 1.1.1.1 $x; done | grep open

for x in $(seq 1 254); do nc -nv -w 1 -z 1.1.1.$x 80; done

2、隐蔽扫描(SYN足够准确,除非极其特殊情况)

不建立完整的TCP连接,不在应用层留痕,只能在网络层有些迹像可循
 
1.只发SYN包,若收到SYN+ACK,则端口开放;若收到R+A,端口关闭
>>> a=sr1(IP(dst="192.168.1.1")/TCP(flags="S"),timeout=1,verbose=0)  #默认80
>>> a.display()
###[ IP ]###
version= 4L
ihl= 5L
tos= 0x0
len= 44
id= 0
flags= DF
frag= 0L
ttl= 64
proto= tcp
chksum= 0xb6fb
src= 192.168.1.1
dst= 192.168.1.127
\options\
###[ TCP ]###
sport= http
dport= ftp_data
seq= 3205019844
ack= 1
dataofs= 6L
reserved= 0L
flags= SA #SYN+ACK
window= 5840
chksum= 0x8543
urgptr= 0
options= [('MSS', 1460)]
###[ Padding ]###
load= '\x00\x00'
>>> a=sr1(IP(dst="192.168.1.1")/TCP(flags="S",dport=22222),timeout=1,verbose=0)
>>> a.display()
###[ IP ]###
version= 4L
ihl= 5L
tos= 0x0
len= 40
id= 0
flags= DF
frag= 0L
ttl= 64
proto= tcp
chksum= 0xb6ff
src= 192.168.1.1
dst= 192.168.1.127
\options\
###[ TCP ]###
sport= 22222
dport= ftp_data
seq= 0
ack= 1
dataofs= 5L
reserved= 0L <strong style="font-family: Arial, Helvetica, sans-serif; white-space: normal; "></strong><pre name="code" class="plain"> flags= RA #RST+ACK <strong style="font-family: Arial, Helvetica, sans-serif; "></strong><pre name="code" class="plain" style="display: inline !important;"><strong style="font-family: Arial, Helvetica, sans-serif; white-space: normal; "></strong><pre name="code" class="plain" style="display: inline !important;"><span style="color:#ff0000;">windows系统默认100以下端口不开放,若开着防火墙,也只会应答RA</span>


window= 0 chksum= 0xd51c urgptr= 0 options= {}###[ Padding ]### load= '\x00\x00\x00\x00\x00\x00'>>>


可用python脚本实现
#!/usr/bin/python

import logging
import subprocess
logging.getLogger("scapy.runtime").setLevel(logging.ERROR)
from scapy.all import*
import sys if len( sys.argv ) !=4:
print "Usage - ./syn_scan.py [Target.IP] [StartPort] [End Port]"
print "Example - ./syn_scan.py 1.1.1.1 1 100"
print "Example will TCP SYN scan ports 1 through 100 on 1.1.1.1"
sys.exit() ip = str(sys.argv[1])
start = int(sys.argv[2])
end = int(sys.argv[3]) for port in range(start,end):
a=sr1(IP(dst=ip)/TCP(dport=port),timeout=0.1,verbose=0)
if a ==None:
pass
else:
if int(a[TCP].flags)==18:
print port
else:
pass
 
若不会或没功夫写脚本,可以用nmap

2、Nmap

syn(乱序扫描)

root@kali:~# nmap 192.168.1.115 -p100-200                   #默认-sS(SYN)

Starting Nmap 7.01 ( https://nmap.org ) at 2016-09-11 09:46 CST
Nmap scan report for PC (192.168.1.115)
Host is up (0.0010s latency).
Not shown: 99 closed ports
PORT STATE SERVICE
135/tcp open msrpc
139/tcp open netbios-ssn
MAC Address: 08:00:27:2B:32:0F (Oracle VirtualBox virtual NIC) Nmap done: 1 IP address (1 host up) scanned in 1.41 seconds
root@kali:~# nmap 192.168.1.115 -p100-200 --open       <span style="color:#ff0000;">#若目标主机在防火墙保护</span>下,--open可过滤杂项

Starting Nmap 7.01 ( https://nmap.org ) at 2016-09-11 09:49 CST
Nmap scan report for PC (192.168.1.115)
Host is up (0.00047s latency).
Not shown: 99 closed ports
PORT STATE SERVICE
135/tcp open msrpc
139/tcp open netbios-ssn
MAC Address: 08:00:27:2B:32:0F (Oracle VirtualBox virtual NIC) Nmap done: 1 IP address (1 host up) scanned in 1.33 seconds
root@kali:~# nmap -sS 192.168.1.115 -p100-200 --open     #SYN

Starting Nmap 7.01 ( https://nmap.org ) at 2016-09-11 09:50 CST
Nmap scan report for PC (192.168.1.115)
Host is up (0.00033s latency).
Not shown: 99 closed ports
PORT STATE SERVICE
135/tcp open msrpc
139/tcp open netbios-ssn
MAC Address: 08:00:27:2B:32:0F (Oracle VirtualBox virtual NIC) Nmap done: 1 IP address (1 host up) scanned in 0.27 seconds
root@kali:~# nmap -sS 192.168.1.115 -p100-200,445,3389 --open  #用","分隔指定端口

Starting Nmap 7.01 ( https://nmap.org ) at 2016-09-11 09:50 CST
Nmap scan report for PC (192.168.1.115)
Host is up (0.00021s latency).
Not shown: 100 closed ports
PORT STATE SERVICE
135/tcp open msrpc
139/tcp open netbios-ssn
445/tcp open microsoft-ds
MAC Address: 08:00:27:2B:32:0F (Oracle VirtualBox virtual NIC) Nmap done: 1 IP address (1 host up) scanned in 1.35 seconds

3、Hping(结果比较清晰)

root@kali:~# hping3  192.168.1.115 --scan 100-200 -S     #-S:SYN包
Scanning 192.168.1.115 (192.168.1.115), port 100-200
101 ports to scan, use -V to see all the replies
+----+-----------+---------+---+-----+-----+-----+
|port| serv name | flags |ttl| id | win | len |
+----+-----------+---------+---+-----+-----+-----+
135 loc-srv : .S..A... 128 27139 8192 46
139 netbios-ssn: .S..A... 128 28163 8192 46
All replies received. Done.
Not responding ports:

源地址欺骗

必须有权登陆伪造的IP地址主机,查看回包,或者能在交换机做镜像端口

root@kali:~# hping3 -c 100 -S --spoof 192.168.1.140 -p ++1 192.168.1.1                                                        #-c指定包数量,--spoof伪造IP,src,-p指定端口   dst
HPING 192.168.1.1 (eth0 192.168.1.1): S set, 40 headers + 0 data bytes --- 192.168.1.1 hping statistic ---
100 packets transmitted, 0 packets received, 100% packet loss
round-trip min/avg/max = 0.0/0.0/0.0 ms

僵尸扫描

极度隐蔽,实施条件苛刻,原理:能实现地址伪造(目前边界防火墙基本会过滤),通过僵尸机(闲置系统,系统使用递增PID[只有早期的XP、2000、2003])
 
 
scapy
i=IP()
t=TCP()
rz=(i/t) #僵尸机
rt=(i/t) #目标机
rz[IP].dst=IPz            #僵尸机IP
rz[TCP].dport=445 #windows系统下445都默认开放 #僵尸机需保证端口开放
rz[TCP].flags="SA" #SYN+ACK
rt[IP].src=IPz            #伪造源地址为僵尸机IP
rt[IP].dst=IPt #目标IP
rt[TCP].dport=22
rt[TCP].flags="S" #SYN
</pre><pre name="code" class="plain" style="font-size:24px;">az1=sr1(rz)  /  at=sr1(rt)  /  az2=sr1(rz)
#向僵尸发的第一包 #向目标机器发包,回包是发给僵尸机 #向僵尸机发包
az1.display() / az2.display()

脚本

namp
发现僵尸
nmap -p445 192.168.1.133 --script=ipidseq.nse  ##--script
root@kali:~# nmap -p445 192.168.1.1 --script=ipidseq.nse

Starting Nmap 7.01 ( https://nmap.org ) at 2016-09-11 12:57 CST
Nmap scan report for DD-WRT (192.168.1.1)
Host is up (0.0037s latency).
PORT STATE SERVICE
445/tcp closed microsoft-ds
MAC Address: 1C:BD:B9:27:D5:32 (D-Link International) Host script results:
|_ipidseq: All zeros #全为零,则不能做僵尸机 #incremental为递增,则可 Nmap done: 1 IP address (1 host up) scanned in 0.61 seconds
扫描目标
nmap 172.16.36.135 -sI 172.16.36.134 -Pn -p 0-100 ## [dst] -sI [zome]
 
 
 

小白日记,未完待续……

上一篇:exynos 4412 电源管理芯片PMIC 的配置及使用方法


下一篇:rtc关机闹钟6 AlarmManagerService研究