SecurityTool​/nmap​/mac をテンプレートにして作成 :: UJP

開始行:
*macosでnmapをつかってみる **はじめに 　masscanをネットワークスキャナとして使って見たけれど，TC... **nmapのインストール 　HomeBrewなので難しいことはないです． 　まずは情報を確認． $ brew info nmap🆑 nmap: stable 7.80 (bottled), HEAD Port scanning utility for large networks https://nmap.org/ Conflicts with: ndiff (because both install `ndiff` binaries) Not installed From: https://github.com/Homebrew/homebrew-core/blob/mas... ==> Dependencies Required: openssl@1.1 ✔ ==> Options --HEAD Install HEAD version ==> Analytics install: 29,327 (30 days), 117,613 (90 days), 345,479 (3... install-on-request: 27,643 (30 days), 107,355 (90 days),... build-error: 0 (30 days) $ 　現在のバージョンは7.80とのこと．次にインストール． $ brew install nmap🆑 Updating Homebrew... ==> Auto-updated Homebrew! Updated Homebrew from 99a8f15fb to 83d851351. Updated 2 taps (homebrew/core and homebrew/cask). ==> New Formulae onnxruntime tio ... ==> Updated Formulae libidn2 ✔ gjs ... abcl goreleaser ... abcmidi grafana ... alexjs grakn ... ammonite-repl haproxy ... ansiweather hyperfine ... antlr4-cpp-runtime i386-elf-binutils ... apache-arrow imapsync ... arm-linux-gnueabihf-binutils imlib2 ... arp-scan include-what-you-us... audacious jailkit ... azure-cli jenkins ... babeld jmeter ... bind kepubify ... binutils libcoap ... bitcoin libgusb ... cheat librsvg ... clamav mono-libgdiplus ... clojure node ... dafny orc-tools ... eslint osquery ... fauna-shell pachi ... freeradius-server pandoc ... fs-uae pandoc-citeproc gcc@7 pandoc-crossref ==> Downloading https://homebrew.bintray.com/bottles/nma... ==> Downloading from https://akamai.bintray.com/3c/3cbc9... ########################################################... ==> Pouring nmap-7.80_1.high_sierra.bottle.tar.gz 🍺 /usr/local/Cellar/nmap/7.80_1: 821 files, 27.0MB $ **nmapを使ってローカルマシンをスキャンする 　まずは，自分自身をスキャンして見る． $ /usr/local/bin/nmap 192.168.20.32🆑 Starting Nmap 7.80 ( https://nmap.org ) at 2019-11-26 18... Nmap scan report for 192.168.20.32 Host is up (0.00017s latency). Not shown: 969 closed ports, 30 filtered ports PORT STATE SERVICE 3283/tcp open netassistant🈁 Nmap done: 1 IP address (1 host up) scanned in 5.45 seco... $ 　5秒で完了．masscanより速いなぁ．デフォルトでスキャンす... 　空いているポートについて，今回の場合3283ポートがnetassi... **nmapでポートとプロトコルを指定してスキャン 　次にプロトコルをTCP限定，ポートを1から1024までのwelknow... $ /usr/local/bin/nmap -sT -p 1-1024 192.168.20.30 Starting Nmap 7.80 ( https://nmap.org ) at 2019-11-26 18... Nmap scan report for 192.168.20.30 Host is up (0.0011s latency). Not shown: 991 closed ports, 30 filtered ports PORT STATE SERVICE 22/tcp open ssh 88/tcp open kerberos-sec 445/tcp open microsoft-ds Nmap done: 1 IP address (1 host up) scanned in 5.46 seco... $ 　この結果も5.46なので，nmapのポートを指定しない場合のス... **全ポートスキャンを１台のマシンに対して実行して見る 　ウェルノウンポートだけだと5秒強で終わりましたが，全ポー... $ /usr/local/bin/nmap -sT -p 1-65535 192.168.20.30🆑 Starting Nmap 7.80 ( https://nmap.org ) at 2019-11-26 18... Nmap scan report for 192.168.20.30 Host is up (0.00047s latency). Not shown: 65527 closed ports PORT STATE SERVICE 22/tcp open ssh 88/tcp open kerberos-sec 445/tcp open microsoft-ds 3283/tcp open netassistant 3689/tcp open rendezvous 5900/tcp open vnc 49190/tcp open unknown 57027/tcp open unknown Nmap done: 1 IP address (1 host up) scanned in 687.87 se... $ 　約688秒なので11分程度ですね．ちょっとわからないものもた... 　ちなみに，Windows 10のマシン（Surface Pro 2）にスキャン... $ /usr/local/bin/nmap -sT -p 1-65535 192.168.20.149🆑 Starting Nmap 7.80 ( https://nmap.org ) at 2019-11-26 19... Note: Host seems down. If it is really up, but blocking ... Nmap done: 1 IP address (0 hosts up) scanned in 3.05 sec... $ 　これはWindows Firewallが稼働しているから，速攻で拒否さ... 　ping(ICMP)も通りません． $ ping 192.168.20.149🆑 PING 192.168.20.149 (192.168.20.149): 56 data bytes Request timeout for icmp_seq 0 Request timeout for icmp_seq 1 Request timeout for icmp_seq 2 Request timeout for icmp_seq 3 ^C --- 192.168.20.149 ping statistics --- 5 packets transmitted, 0 packets received, 100.0% packet... $ **スキャン相手のFirewall有無を調べる 　オプションに-sAをつけると，ファイアウォールの有無を調べ... 　まずは，先に検査してFirewallが稼働してないことが明らか... $ nmap -sA 192.168.20.32🆑 Starting Nmap 7.80 ( https://nmap.org ) at 2019-11-26 19... Nmap scan report for 192.168.20.32 Host is up (0.000047s latency). All 1000 scanned ports on 192.168.20.32 are unfiltered🈁 Nmap done: 1 IP address (1 host up) scanned in 9.71 seco... $ 　unfilteredとでているので，フィルタ＝ファイアウォールで... 　そして次に，Windows 10のマシンをスキャンしてみる． $ nmap -sA 192.168.20.149🆑 Starting Nmap 7.80 ( https://nmap.org ) at 2019-11-26 19... Nmap scan report for 192.168.20.149 Host is up (0.096s latency). All 1000 scanned ports on 192.168.20.149 are filtered🆑 MAC Address: 28:18:78:C6:XX:XX (Microsoft) Nmap done: 1 IP address (1 host up) scanned in 98.21 sec... $ 　今回はfilteredとでた．100秒近くかかっている． **nmapを使って対象マシンのOSを調べる 　TCP/IPの通信において，RFCとかで規定されているけれどOSに... 　nmapのオプションで-O(オー)を使うとOSがわかるというので... 　まずは，macOS 10.14(Mojave)のマシンを． $ nmap -O 192.168.20.30🆑 Starting Nmap 7.80 ( https://nmap.org ) at 2019-11-26 19... Nmap scan report for 192.168.20.30 Host is up (0.00038s latency). Not shown: 995 closed ports PORT STATE SERVICE 22/tcp open ssh 445/tcp open microsoft-ds 3283/tcp open netassistant 3689/tcp open rendezvous 5900/tcp open vnc MAC Address: 40:6C:8F:42:XX:XX (Apple) No exact OS matches for host (If you know what OS is run... https://nmap.org/submit/ ). TCP/IP fingerprint: OS:SCAN(V=7.80%E=4%D=11/26%OT=22%CT=1%CU=44071%PV=Y%DS=1... OS:TM=5DDCFF23%P=x86_64-apple-darwin17.7.0)SEQ(SP=106%GC... OS:=RD%II=RI%TS=A)OPS(O1=M5B4NW6NNT11SLL%O2=M5B4NW6NNT11... OS:%O4=M5B4NW6NNT11SLL%O5=M5B4NW6NNT11SLL%O6=M5B4NNT11SL... OS:FF%W3=FFFF%W4=FFFF%W5=FFFF%W6=FFFF)ECN(R=Y%DF=Y%T=40%... Network Distance: 1 hop OS detection performed. Please report any incorrect resu... https://nmap.org/submit/ . Nmap done: 1 IP address (1 host up) scanned in 26.78 sec... $ 　これをみると，FingerprintにApple-darwin17.7.0とあるが，... $ uname -a🆑 Darwin MBA2013.local 18.6.0 Darwin Kernel Version 18.6.0:🈁 Thu Apr 25 23:16:27 PDT 2019; root:xnu-4903.261.4~2/REL... x86_64 i386 MacBookAir6,2 Darwin $ 　少し異なる模様． 　次に，windows 10のマシンで試して見る． $ nmap -O 192.168.20.149🆑 Starting Nmap 7.80 ( https://nmap.org ) at 2019-11-26 19... Nmap scan report for 192.168.20.149 Host is up (0.0072s latency). Not shown: 999 filtered ports PORT STATE SERVICE 3389/tcp open ms-wbt-server MAC Address: 28:18:78:C6:57:F1 (Microsoft) Warning: OSScan results may be unreliable because we cou... least 1 open and 1 closed port Device type: specialized|general purpose Running (JUST GUESSING): AVtech embedded (87%), Microsof... OS CPE: cpe:/o:microsoft:windows_xp::sp2 Aggressive OS guesses: AVtech Room Alert 26W environment... Microsoft Windows XP SP2 (87%) No exact OS matches for host (test conditions non-ideal). Network Distance: 1 hop OS detection performed. Please report any incorrect resu... https://nmap.org/submit/ . Nmap done: 1 IP address (1 host up) scanned in 16.08 sec... $ 　推測するにWindows XP SP2らしい．Firewallで通信が止めら...

終了行:
*macosでnmapをつかってみる **はじめに 　masscanをネットワークスキャナとして使って見たけれど，TC... **nmapのインストール 　HomeBrewなので難しいことはないです． 　まずは情報を確認． $ brew info nmap🆑 nmap: stable 7.80 (bottled), HEAD Port scanning utility for large networks https://nmap.org/ Conflicts with: ndiff (because both install `ndiff` binaries) Not installed From: https://github.com/Homebrew/homebrew-core/blob/mas... ==> Dependencies Required: openssl@1.1 ✔ ==> Options --HEAD Install HEAD version ==> Analytics install: 29,327 (30 days), 117,613 (90 days), 345,479 (3... install-on-request: 27,643 (30 days), 107,355 (90 days),... build-error: 0 (30 days) $ 　現在のバージョンは7.80とのこと．次にインストール． $ brew install nmap🆑 Updating Homebrew... ==> Auto-updated Homebrew! Updated Homebrew from 99a8f15fb to 83d851351. Updated 2 taps (homebrew/core and homebrew/cask). ==> New Formulae onnxruntime tio ... ==> Updated Formulae libidn2 ✔ gjs ... abcl goreleaser ... abcmidi grafana ... alexjs grakn ... ammonite-repl haproxy ... ansiweather hyperfine ... antlr4-cpp-runtime i386-elf-binutils ... apache-arrow imapsync ... arm-linux-gnueabihf-binutils imlib2 ... arp-scan include-what-you-us... audacious jailkit ... azure-cli jenkins ... babeld jmeter ... bind kepubify ... binutils libcoap ... bitcoin libgusb ... cheat librsvg ... clamav mono-libgdiplus ... clojure node ... dafny orc-tools ... eslint osquery ... fauna-shell pachi ... freeradius-server pandoc ... fs-uae pandoc-citeproc gcc@7 pandoc-crossref ==> Downloading https://homebrew.bintray.com/bottles/nma... ==> Downloading from https://akamai.bintray.com/3c/3cbc9... ########################################################... ==> Pouring nmap-7.80_1.high_sierra.bottle.tar.gz 🍺 /usr/local/Cellar/nmap/7.80_1: 821 files, 27.0MB $ **nmapを使ってローカルマシンをスキャンする 　まずは，自分自身をスキャンして見る． $ /usr/local/bin/nmap 192.168.20.32🆑 Starting Nmap 7.80 ( https://nmap.org ) at 2019-11-26 18... Nmap scan report for 192.168.20.32 Host is up (0.00017s latency). Not shown: 969 closed ports, 30 filtered ports PORT STATE SERVICE 3283/tcp open netassistant🈁 Nmap done: 1 IP address (1 host up) scanned in 5.45 seco... $ 　5秒で完了．masscanより速いなぁ．デフォルトでスキャンす... 　空いているポートについて，今回の場合3283ポートがnetassi... **nmapでポートとプロトコルを指定してスキャン 　次にプロトコルをTCP限定，ポートを1から1024までのwelknow... $ /usr/local/bin/nmap -sT -p 1-1024 192.168.20.30 Starting Nmap 7.80 ( https://nmap.org ) at 2019-11-26 18... Nmap scan report for 192.168.20.30 Host is up (0.0011s latency). Not shown: 991 closed ports, 30 filtered ports PORT STATE SERVICE 22/tcp open ssh 88/tcp open kerberos-sec 445/tcp open microsoft-ds Nmap done: 1 IP address (1 host up) scanned in 5.46 seco... $ 　この結果も5.46なので，nmapのポートを指定しない場合のス... **全ポートスキャンを１台のマシンに対して実行して見る 　ウェルノウンポートだけだと5秒強で終わりましたが，全ポー... $ /usr/local/bin/nmap -sT -p 1-65535 192.168.20.30🆑 Starting Nmap 7.80 ( https://nmap.org ) at 2019-11-26 18... Nmap scan report for 192.168.20.30 Host is up (0.00047s latency). Not shown: 65527 closed ports PORT STATE SERVICE 22/tcp open ssh 88/tcp open kerberos-sec 445/tcp open microsoft-ds 3283/tcp open netassistant 3689/tcp open rendezvous 5900/tcp open vnc 49190/tcp open unknown 57027/tcp open unknown Nmap done: 1 IP address (1 host up) scanned in 687.87 se... $ 　約688秒なので11分程度ですね．ちょっとわからないものもた... 　ちなみに，Windows 10のマシン（Surface Pro 2）にスキャン... $ /usr/local/bin/nmap -sT -p 1-65535 192.168.20.149🆑 Starting Nmap 7.80 ( https://nmap.org ) at 2019-11-26 19... Note: Host seems down. If it is really up, but blocking ... Nmap done: 1 IP address (0 hosts up) scanned in 3.05 sec... $ 　これはWindows Firewallが稼働しているから，速攻で拒否さ... 　ping(ICMP)も通りません． $ ping 192.168.20.149🆑 PING 192.168.20.149 (192.168.20.149): 56 data bytes Request timeout for icmp_seq 0 Request timeout for icmp_seq 1 Request timeout for icmp_seq 2 Request timeout for icmp_seq 3 ^C --- 192.168.20.149 ping statistics --- 5 packets transmitted, 0 packets received, 100.0% packet... $ **スキャン相手のFirewall有無を調べる 　オプションに-sAをつけると，ファイアウォールの有無を調べ... 　まずは，先に検査してFirewallが稼働してないことが明らか... $ nmap -sA 192.168.20.32🆑 Starting Nmap 7.80 ( https://nmap.org ) at 2019-11-26 19... Nmap scan report for 192.168.20.32 Host is up (0.000047s latency). All 1000 scanned ports on 192.168.20.32 are unfiltered🈁 Nmap done: 1 IP address (1 host up) scanned in 9.71 seco... $ 　unfilteredとでているので，フィルタ＝ファイアウォールで... 　そして次に，Windows 10のマシンをスキャンしてみる． $ nmap -sA 192.168.20.149🆑 Starting Nmap 7.80 ( https://nmap.org ) at 2019-11-26 19... Nmap scan report for 192.168.20.149 Host is up (0.096s latency). All 1000 scanned ports on 192.168.20.149 are filtered🆑 MAC Address: 28:18:78:C6:XX:XX (Microsoft) Nmap done: 1 IP address (1 host up) scanned in 98.21 sec... $ 　今回はfilteredとでた．100秒近くかかっている． **nmapを使って対象マシンのOSを調べる 　TCP/IPの通信において，RFCとかで規定されているけれどOSに... 　nmapのオプションで-O(オー)を使うとOSがわかるというので... 　まずは，macOS 10.14(Mojave)のマシンを． $ nmap -O 192.168.20.30🆑 Starting Nmap 7.80 ( https://nmap.org ) at 2019-11-26 19... Nmap scan report for 192.168.20.30 Host is up (0.00038s latency). Not shown: 995 closed ports PORT STATE SERVICE 22/tcp open ssh 445/tcp open microsoft-ds 3283/tcp open netassistant 3689/tcp open rendezvous 5900/tcp open vnc MAC Address: 40:6C:8F:42:XX:XX (Apple) No exact OS matches for host (If you know what OS is run... https://nmap.org/submit/ ). TCP/IP fingerprint: OS:SCAN(V=7.80%E=4%D=11/26%OT=22%CT=1%CU=44071%PV=Y%DS=1... OS:TM=5DDCFF23%P=x86_64-apple-darwin17.7.0)SEQ(SP=106%GC... OS:=RD%II=RI%TS=A)OPS(O1=M5B4NW6NNT11SLL%O2=M5B4NW6NNT11... OS:%O4=M5B4NW6NNT11SLL%O5=M5B4NW6NNT11SLL%O6=M5B4NNT11SL... OS:FF%W3=FFFF%W4=FFFF%W5=FFFF%W6=FFFF)ECN(R=Y%DF=Y%T=40%... Network Distance: 1 hop OS detection performed. Please report any incorrect resu... https://nmap.org/submit/ . Nmap done: 1 IP address (1 host up) scanned in 26.78 sec... $ 　これをみると，FingerprintにApple-darwin17.7.0とあるが，... $ uname -a🆑 Darwin MBA2013.local 18.6.0 Darwin Kernel Version 18.6.0:🈁 Thu Apr 25 23:16:27 PDT 2019; root:xnu-4903.261.4~2/REL... x86_64 i386 MacBookAir6,2 Darwin $ 　少し異なる模様． 　次に，windows 10のマシンで試して見る． $ nmap -O 192.168.20.149🆑 Starting Nmap 7.80 ( https://nmap.org ) at 2019-11-26 19... Nmap scan report for 192.168.20.149 Host is up (0.0072s latency). Not shown: 999 filtered ports PORT STATE SERVICE 3389/tcp open ms-wbt-server MAC Address: 28:18:78:C6:57:F1 (Microsoft) Warning: OSScan results may be unreliable because we cou... least 1 open and 1 closed port Device type: specialized|general purpose Running (JUST GUESSING): AVtech embedded (87%), Microsof... OS CPE: cpe:/o:microsoft:windows_xp::sp2 Aggressive OS guesses: AVtech Room Alert 26W environment... Microsoft Windows XP SP2 (87%) No exact OS matches for host (test conditions non-ideal). Network Distance: 1 hop OS detection performed. Please report any incorrect resu... https://nmap.org/submit/ . Nmap done: 1 IP address (1 host up) scanned in 16.08 sec... $ 　推測するにWindows XP SP2らしい．Firewallで通信が止めら...

ページ名: