macosでnmapをつかってみる の変更点
技術情報2SecurityTool
/ nmap / mac の変更点
- ソース を表示
- SecurityTool/nmap/mac へ行く。
現: 2019-11-26 (火) 19:47:56 nobuaki   |
|||
|---|---|---|---|
| Line 1: | Line 1: | ||
| + | *macosでnmapをつかってみる [#l0657cc7] | ||
| + | **はじめに [#ze3cf5ae] | ||
| + | |||
| + | masscanをネットワークスキャナとして使って見たけれど，TCPのみという制限があるので，UDPにも対応しているnmapを使って見る．Linuxだとnmapはインストールされているような気がするけれど，macには入ってないのでインストールするところから． | ||
| + | |||
| + | **nmapのインストール [#k9256523] | ||
| + | |||
| + | HomeBrewなので難しいことはないです． | ||
| + | まずは情報を確認． | ||
| + | |||
| + | $ brew info nmap🆑 | ||
| + | nmap: stable 7.80 (bottled), HEAD | ||
| + | Port scanning utility for large networks | ||
| + | https://nmap.org/ | ||
| + | Conflicts with: | ||
| + | ndiff (because both install `ndiff` binaries) | ||
| + | Not installed | ||
| + | From: https://github.com/Homebrew/homebrew-core/blob/master/Formula/nmap.rb | ||
| + | ==> Dependencies | ||
| + | Required: openssl@1.1 ✔ | ||
| + | ==> Options | ||
| + | --HEAD | ||
| + | Install HEAD version | ||
| + | ==> Analytics | ||
| + | install: 29,327 (30 days), 117,613 (90 days), 345,479 (365 days) | ||
| + | install-on-request: 27,643 (30 days), 107,355 (90 days), 324,715 (365 days) | ||
| + | build-error: 0 (30 days) | ||
| + | $ | ||
| + | 現在のバージョンは7.80とのこと．次にインストール． | ||
| + | |||
| + | $ brew install nmap🆑 | ||
| + | Updating Homebrew... | ||
| + | ==> Auto-updated Homebrew! | ||
| + | Updated Homebrew from 99a8f15fb to 83d851351. | ||
| + | Updated 2 taps (homebrew/core and homebrew/cask). | ||
| + | ==> New Formulae | ||
| + | onnxruntime tio vale | ||
| + | ==> Updated Formulae | ||
| + | libidn2 ✔ gjs parallel | ||
| + | abcl goreleaser pdns | ||
| + | abcmidi grafana pgbouncer | ||
| + | alexjs grakn pgpool-ii | ||
| + | ammonite-repl haproxy pianobar | ||
| + | ansiweather hyperfine pianod | ||
| + | antlr4-cpp-runtime i386-elf-binutils pylint | ||
| + | apache-arrow imapsync pypy | ||
| + | arm-linux-gnueabihf-binutils imlib2 pypy3 | ||
| + | arp-scan include-what-you-use sbt | ||
| + | audacious jailkit scipy | ||
| + | azure-cli jenkins stress-ng | ||
| + | babeld jmeter swiftformat | ||
| + | bind kepubify thrift | ||
| + | binutils libcoap todoman | ||
| + | bitcoin libgusb transmission-cli | ||
| + | cheat librsvg ttyd | ||
| + | clamav mono-libgdiplus ungit | ||
| + | clojure node urbit | ||
| + | dafny orc-tools urh | ||
| + | eslint osquery vice | ||
| + | fauna-shell pachi xapian | ||
| + | freeradius-server pandoc z3 | ||
| + | fs-uae pandoc-citeproc | ||
| + | gcc@7 pandoc-crossref | ||
| + | |||
| + | ==> Downloading https://homebrew.bintray.com/bottles/nmap-7.80_1.high_sierra.bottle.tar.gz | ||
| + | ==> Downloading from https://akamai.bintray.com/3c/3cbc937428a7db08be8fa106b3a70ffad16f4a4d80808d2113490dd9ab60 | ||
| + | ######################################################################## 100.0% | ||
| + | ==> Pouring nmap-7.80_1.high_sierra.bottle.tar.gz | ||
| + | 🍺 /usr/local/Cellar/nmap/7.80_1: 821 files, 27.0MB | ||
| + | $ | ||
| + | |||
| + | **nmapを使ってローカルマシンをスキャンする [#la85b162] | ||
| + | |||
| + | まずは，自分自身をスキャンして見る． | ||
| + | |||
| + | $ /usr/local/bin/nmap 192.168.20.32🆑 | ||
| + | Starting Nmap 7.80 ( https://nmap.org ) at 2019-11-26 18:44 JST | ||
| + | Nmap scan report for 192.168.20.32 | ||
| + | Host is up (0.00017s latency). | ||
| + | Not shown: 969 closed ports, 30 filtered ports | ||
| + | PORT STATE SERVICE | ||
| + | 3283/tcp open netassistant🈁 | ||
| + | |||
| + | Nmap done: 1 IP address (1 host up) scanned in 5.45 seconds | ||
| + | $ | ||
| + | |||
| + | 5秒で完了．masscanより速いなぁ．デフォルトでスキャンする対象ポートが違う野田ロイと想像． | ||
| + | 空いているポートについて，今回の場合3283ポートがnetassistantが使っているという風に，masscanより情報が多いのは好印象． | ||
| + | |||
| + | **nmapでポートとプロトコルを指定してスキャン [#jbaad294] | ||
| + | |||
| + | 次にプロトコルをTCP限定，ポートを1から1024までのwelknownポートのみで，別のマシンをスキャンしてみる． | ||
| + | |||
| + | $ /usr/local/bin/nmap -sT -p 1-1024 192.168.20.30 | ||
| + | Starting Nmap 7.80 ( https://nmap.org ) at 2019-11-26 18:50 JST | ||
| + | Nmap scan report for 192.168.20.30 | ||
| + | Host is up (0.0011s latency). | ||
| + | Not shown: 991 closed ports, 30 filtered ports | ||
| + | PORT STATE SERVICE | ||
| + | 22/tcp open ssh | ||
| + | 88/tcp open kerberos-sec | ||
| + | 445/tcp open microsoft-ds | ||
| + | |||
| + | Nmap done: 1 IP address (1 host up) scanned in 5.46 seconds | ||
| + | $ | ||
| + | |||
| + | この結果も5.46なので，nmapのポートを指定しない場合のスキャンはこのパターンでしょう．マニュアルを見ないで言っているけど．．． | ||
| + | |||
| + | **全ポートスキャンを１台のマシンに対して実行して見る [#l7a0c8c8] | ||
| + | |||
| + | ウェルノウンポートだけだと5秒強で終わりましたが，全ポートで実行するとどうなるか． | ||
| + | |||
| + | $ /usr/local/bin/nmap -sT -p 1-65535 192.168.20.30🆑 | ||
| + | Starting Nmap 7.80 ( https://nmap.org ) at 2019-11-26 18:58 JST | ||
| + | Nmap scan report for 192.168.20.30 | ||
| + | Host is up (0.00047s latency). | ||
| + | Not shown: 65527 closed ports | ||
| + | PORT STATE SERVICE | ||
| + | 22/tcp open ssh | ||
| + | 88/tcp open kerberos-sec | ||
| + | 445/tcp open microsoft-ds | ||
| + | 3283/tcp open netassistant | ||
| + | 3689/tcp open rendezvous | ||
| + | 5900/tcp open vnc | ||
| + | 49190/tcp open unknown | ||
| + | 57027/tcp open unknown | ||
| + | |||
| + | Nmap done: 1 IP address (1 host up) scanned in 687.87 seconds | ||
| + | $ | ||
| + | |||
| + | 約688秒なので11分程度ですね．ちょっとわからないものもたくさん出てきましたが，ちなみこのスキャン対象マシンはmacOS 10.14(Mojave)です． | ||
| + | ちなみに，Windows 10のマシン（Surface Pro 2）にスキャンして見ました． | ||
| + | |||
| + | $ /usr/local/bin/nmap -sT -p 1-65535 192.168.20.149🆑 | ||
| + | Starting Nmap 7.80 ( https://nmap.org ) at 2019-11-26 19:14 JST | ||
| + | Note: Host seems down. If it is really up, but blocking our ping probes, try -Pn | ||
| + | Nmap done: 1 IP address (0 hosts up) scanned in 3.05 seconds | ||
| + | $ | ||
| + | これはWindows Firewallが稼働しているから，速攻で拒否されています． | ||
| + | ping(ICMP)も通りません． | ||
| + | |||
| + | $ ping 192.168.20.149🆑 | ||
| + | PING 192.168.20.149 (192.168.20.149): 56 data bytes | ||
| + | Request timeout for icmp_seq 0 | ||
| + | Request timeout for icmp_seq 1 | ||
| + | Request timeout for icmp_seq 2 | ||
| + | Request timeout for icmp_seq 3 | ||
| + | ^C | ||
| + | --- 192.168.20.149 ping statistics --- | ||
| + | 5 packets transmitted, 0 packets received, 100.0% packet loss | ||
| + | $ | ||
| + | |||
| + | **スキャン相手のFirewall有無を調べる [#qc9d3a78] | ||
| + | |||
| + | オプションに-sAをつけると，ファイアウォールの有無を調べられるというので，実行して見る． | ||
| + | まずは，先に検査してFirewallが稼働してないことが明らかなmacOSを対象に． | ||
| + | |||
| + | $ nmap -sA 192.168.20.32🆑 | ||
| + | Starting Nmap 7.80 ( https://nmap.org ) at 2019-11-26 19:03 JST | ||
| + | Nmap scan report for 192.168.20.32 | ||
| + | Host is up (0.000047s latency). | ||
| + | All 1000 scanned ports on 192.168.20.32 are unfiltered🈁 | ||
| + | |||
| + | Nmap done: 1 IP address (1 host up) scanned in 9.71 seconds | ||
| + | $ | ||
| + | unfilteredとでているので，フィルタ＝ファイアウォールでブロックされてないと判断されている．1000個のポートをスキャンしているとあるけれど，1-1024のウェルノウンポートで5秒強だったのが10秒近くかかっているので，より代表的なポートを使ってスキャンしていると思われる． | ||
| + | そして次に，Windows 10のマシンをスキャンしてみる． | ||
| + | |||
| + | $ nmap -sA 192.168.20.149🆑 | ||
| + | Starting Nmap 7.80 ( https://nmap.org ) at 2019-11-26 19:08 JST | ||
| + | Nmap scan report for 192.168.20.149 | ||
| + | Host is up (0.096s latency). | ||
| + | All 1000 scanned ports on 192.168.20.149 are filtered🆑 | ||
| + | MAC Address: 28:18:78:C6:XX:XX (Microsoft) | ||
| + | |||
| + | Nmap done: 1 IP address (1 host up) scanned in 98.21 seconds | ||
| + | $ | ||
| + | 今回はfilteredとでた．100秒近くかかっている． | ||
| + | |||
| + | **nmapを使って対象マシンのOSを調べる [#k0f39171] | ||
| + | |||
| + | TCP/IPの通信において，RFCとかで規定されているけれどOSによってやっぱり手順に特徴があったりとかで，その違いを観察すればOSの違いがわかると聞いたことがある． | ||
| + | nmapのオプションで-O(オー)を使うとOSがわかるというので実行して見た． | ||
| + | |||
| + | まずは，macOS 10.14(Mojave)のマシンを． | ||
| + | |||
| + | $ nmap -O 192.168.20.30🆑 | ||
| + | Starting Nmap 7.80 ( https://nmap.org ) at 2019-11-26 19:31 JST | ||
| + | Nmap scan report for 192.168.20.30 | ||
| + | Host is up (0.00038s latency). | ||
| + | Not shown: 995 closed ports | ||
| + | PORT STATE SERVICE | ||
| + | 22/tcp open ssh | ||
| + | 445/tcp open microsoft-ds | ||
| + | 3283/tcp open netassistant | ||
| + | 3689/tcp open rendezvous | ||
| + | 5900/tcp open vnc | ||
| + | MAC Address: 40:6C:8F:42:XX:XX (Apple) | ||
| + | No exact OS matches for host (If you know what OS is running on it, see | ||
| + | https://nmap.org/submit/ ). | ||
| + | TCP/IP fingerprint: | ||
| + | OS:SCAN(V=7.80%E=4%D=11/26%OT=22%CT=1%CU=44071%PV=Y%DS=1%DC=D%G=Y%M=406C8F% | ||
| + | OS:TM=5DDCFF23%P=x86_64-apple-darwin17.7.0)SEQ(SP=106%GCD=1%ISR=10A%TI=Z%CI | ||
| + | OS:=RD%II=RI%TS=A)OPS(O1=M5B4NW6NNT11SLL%O2=M5B4NW6NNT11SLL%O3=M5B4NW6NNT11 | ||
| + | OS:%O4=M5B4NW6NNT11SLL%O5=M5B4NW6NNT11SLL%O6=M5B4NNT11SLL)WIN(W1=FFFF%W2=FF | ||
| + | OS:FF%W3=FFFF%W4=FFFF%W5=FFFF%W6=FFFF)ECN(R=Y%DF=Y%T=40%W=FFFF%O=M5B4NW6SLL | ||
| + | |||
| + | Network Distance: 1 hop | ||
| + | |||
| + | OS detection performed. Please report any incorrect results at | ||
| + | https://nmap.org/submit/ . | ||
| + | Nmap done: 1 IP address (1 host up) scanned in 26.78 seconds | ||
| + | $ | ||
| + | これをみると，FingerprintにApple-darwin17.7.0とあるが，対象のマシンでカーネルのバージョンを確認するとこんな感じ． | ||
| + | |||
| + | $ uname -a🆑 | ||
| + | Darwin MBA2013.local 18.6.0 Darwin Kernel Version 18.6.0:🈁 | ||
| + | Thu Apr 25 23:16:27 PDT 2019; root:xnu-4903.261.4~2/RELEASE_X86_64 | ||
| + | x86_64 i386 MacBookAir6,2 Darwin | ||
| + | $ | ||
| + | 少し異なる模様． | ||
| + | 次に，windows 10のマシンで試して見る． | ||
| + | |||
| + | $ nmap -O 192.168.20.149🆑 | ||
| + | Starting Nmap 7.80 ( https://nmap.org ) at 2019-11-26 19:31 JST | ||
| + | Nmap scan report for 192.168.20.149 | ||
| + | Host is up (0.0072s latency). | ||
| + | Not shown: 999 filtered ports | ||
| + | PORT STATE SERVICE | ||
| + | 3389/tcp open ms-wbt-server | ||
| + | MAC Address: 28:18:78:C6:57:F1 (Microsoft) | ||
| + | Warning: OSScan results may be unreliable because we could not find at | ||
| + | least 1 open and 1 closed port | ||
| + | Device type: specialized|general purpose | ||
| + | Running (JUST GUESSING): AVtech embedded (87%), Microsoft Windows XP (87%) | ||
| + | OS CPE: cpe:/o:microsoft:windows_xp::sp2 | ||
| + | Aggressive OS guesses: AVtech Room Alert 26W environmental monitor (87%), | ||
| + | Microsoft Windows XP SP2 (87%) | ||
| + | No exact OS matches for host (test conditions non-ideal). | ||
| + | Network Distance: 1 hop | ||
| + | |||
| + | OS detection performed. Please report any incorrect results at | ||
| + | https://nmap.org/submit/ . | ||
| + | Nmap done: 1 IP address (1 host up) scanned in 16.08 seconds | ||
| + | $ | ||
| + | 推測するにWindows XP SP2らしい．Firewallで通信が止められているので，判明できる情報からはそうなるのだろうなぁ．逆にいうとTCP/IPスタックはその頃から変わってないと言えるでかな． | ||
- SecurityTool/nmap/mac のバックアップ差分(No. All)
- 現: 2019-11-26 (火) 19:47:56 nobuaki
Counter: 5612,
today: 1,
yesterday: 2
