CEH Chap 12. Metasploit를 이용한 다양한 네트워크의 스캔

MSFconsole에서 Nmap 돌리기

msfbook 데이타베이스로 연결을 알아보겠다.

msf > db_connect postgres:toor@127.0.0.1/msf3

msfconsole에서 db_nmap 명령을 통해서 nmap을 사용할 수 있다.

msf > db_nmap -sS -A 172.16.32.131
Warning: Traceroute does not support idle or connect scan, disabling...
Nmap scan report for 172.16.32.131
Host is up (0.00056s latency).
Not shown: 990 closed ports
PORT STATE SERVICE VERSION
21/tcp ..open ftp Microsoft ftpd
25/tcp open smtp Microsoft ESMTP 6.0.2600.2180 ..
80/tcp open http Microsoft IIS webserver 5.1
|_html-title:
135/tcp open msrpc Microsoft Windows RPC
139/tcp open netbios-ssn
443/tcp open https?
445/tcp open microsoft-ds Microsoft Windows XP microsoft-ds
1025/tcp open msrpc Microsoft Windows RPC
1433/tcp open ms-sql-s Microsoft SQL Server 2005 9.00.1399; RTM
3389/tcp open microsoft-rdp Microsoft Terminal Service
MAC Address: 00:0C:29:EA:26:7C (VMware)
Device type: general purpose
Running: Microsoft Windows XP|2003 ..
OS details: Microsoft Windows XP Professional SP2 or Windows Server 2003
Network Distance: 1 hop
Service Info: Host: ihazsecurity; OS: Windows
Host script results:
|_nbstat: NetBIOS name: IHAZSECURITY, NetBIOS user: <unknown>, NetBIOS MAC: 00:0c:29:ea:26:7c
| smb-os-discovery:
| OS: Windows XP (Windows 2000 LAN Manager)
| Name: WORKGROUP\IHAZSECURITY
|_smbv2-enabled: Server doesn't support SMBv2 protocol
OS and Service detection performed. Please report any incorrect results at http://nmap.org/submit/.
Nmap done: 1 IP address (1 host up) scanned in 33.51 seconds

이런 스캔을 통해서 db_services를 통해서 데이타베이스에 저장된 스캔결과값을 알 수 있다.

msf > db_services
Services
========
host port proto name state info
---- ---- ----- ---- ----- ----
172.16.32.131 135 tcp msrpc open Microsoft Windows RPC
172.16.32.131 139 tcp netbios-ssn open
172.16.32.131 445 tcp microsoft-ds open Microsoft Windows XP microsoft-ds
172.16.32.131 777 tcp unknown open
172.16.32.131 1433 tcp ms-sql-s open Microsoft SQL Server 2005 9.00.1399; RTM

Metasploit를 이용한 포트 스캔

Nmap의 스캐닝 기능뿐만 아니라 Metasploit에 관한 포트스캐너에 대해도 알아보겠다. 이 스캐닝 기능을 통해서 타겟 호스트의 접근과 공격등 다양한 방법을 제시한다.

msf > search portscan

프토스캔의 리스트를 통해 scanner/portscan/syn에서 192.168.1.155을 스캔해보겠다.

msf > use scanner/portscan/syn
msf auxiliary(syn) > set RHOSTS 192.168.1.155
RHOSTS => 192.168.1.155
msf auxiliary(syn) > set THREADS 50
THREADS => 50
26 Chapter 3
msf auxiliary(syn) > run
 [*] TCP OPEN 192.168.1.155:135
[*] TCP OPEN 192.168.1.155:139
[*] TCP OPEN 192.168.1.155:445
[*] Scanned 1 of 1 hosts (100% complete)
[*] Auxiliary module execution completed
msf auxiliary(syn) >msf > use scanner/portscan/syn
msf auxiliary(syn) > set RHOSTS 192.168.1.155
RHOSTS => 192.168.1.155
msf auxiliary(syn) > set THREADS 50
THREADS => 50
26 Chapter 3
msf auxiliary(syn) > run
[*] TCP OPEN 192.168.1.155:135
[*] TCP OPEN 192.168.1.155:139
[*] TCP OPEN 192.168.1.155:445
[*] Scanned 1 of 1 hosts (100% complete)
[*] Auxiliary module execution completed
msf auxiliary(syn) >

135, 139 그리고 445의 포트가 열려있음을 볼 수 있다.