渗透测试工具--Nmap的使用

什么是Nmap

nmap是一个网络连接端扫描软件，用来扫描网上电脑开放的网络连接端。确定哪些服务运行在哪些连接端，并且推断计算机运行哪个操作系统。

Nmap的作用

• Creating a network inventory （搜集网络资产）
• Checking for live hosts（检查活动主机）
• Determining operating systems（确定操作系统的类型）
• Determining running services and their version（运行的服务及其版本）
• Identifying vulnerabilities on a host （标识主机的漏洞）
• Detectingsniffers （检测是否有嗅探者）
• Determining whether a firewall is present on a network（检查网络中是否有防火墙）

用法

nmap属于kali自带工具，位置如下：

┌──(root?kali)-[~/work/exam/nmap]
└─# which nmap 
/usr/bin/nmap

Nmap- -主机发现

┌──(root?kali)-[~/work/exam/nmap]
└─# which nmap 
/usr/bin/nmap

PS：主机发现

• 二层（数据链路层）
  ARP协议
  工具：arping
  条件：本地网络，当两台主机在同一个网段下，且目标主机开启了防火墙，这时候ping不通目标主机，可使用arping命令探测主机是否在线。
• 三层（网络层）
  ping基于ICMP协议
• 四层（传输层）

  • TCP SYN ping -PS
    一个新发起的连接 SYN＝１ ACK=0，如果目标主机的80端口是关闭的，则目标主机会响应一个RST报文，如果目标主机的80端口是开放的，则目标主机会响应一个SYN／ACK报文来尝试建立连接，之后攻击机会发送一个RST报文来释放连接。
    

    命令:nmap -sn -PS <target>

  • TCP ACK ping -PA
    场景：防火墙会阻止SYN报文(新发起的连接)、ICMP请求报文，但TCP ACK ping不会被传统的防火墙阻止，但可能会被状态检测防火墙(记录数据包的连接状态)阻止，因为发送的ACK包是伪造的，默认以80端口作为主机发现，namp直接发送一个ACK的报文到目标IP，目标IP响应RST报文,说明主机存活。
    

    命令:nmap -sn -PA <target>

  • UDP ping -PU
    优势：绕过防火墙对TCP报文的过滤 发送一个空的UDP报文到40125端口，如果主机在线，会返回一个ICMP端口不可达的错误消息，如果主机不在线，返回各种ICMP的报错消息。
    

    命令:nmap -sn -PU <target>

【案例】
nmap -sn 192.168.137.0/24 执行ping扫描，而不做端口扫描

┌──(root?kali)-[~/work/exam/nmap]
└─# nmap -sn 192.168.137.0/24                                                                                                                                                      130 ⨯
Starting Nmap 7.92 ( https://nmap.org ) at 2022-03-17 03:15 EDT
Nmap scan report for 192.168.137.1
Host is up (0.00047s latency).
MAC Address: 00:50:56:C0:00:08 (VMware)
Nmap scan report for 192.168.137.2
Host is up (0.00015s latency).
MAC Address: 00:50:56:F2:52:44 (VMware)
Nmap scan report for 192.168.137.254
Host is up (0.00014s latency).
MAC Address: 00:50:56:F3:88:4E (VMware)
Nmap scan report for 192.168.137.128
Host is up.
Nmap done: 256 IP addresses (4 hosts up) scanned in 1.97 seconds

借助wireshark发现在同一个网段下nmap通过ARP协议进行扫描，不同网端通过IMCP协议进行扫描

Nmap- -脚本引擎

脚本存放位置：/usr/share/nmap/scripts
作用：

• Discovery 发现，获取目标的深度信息
• External 扩展，支持一些开源情报探测（OSINT）
• Intrusive 入侵检测
• Malware 恶意软件检查，如后门（backdoor）
• safe 安全检查，检测是否被入侵
• vuln 漏洞检查
  用法：
• 1. –script 类别
     nmap --script malware <target>
• 2. –script 具体的脚本
     ls /usr/share/nmap/scripts | grep ms08-067(微软08年发布的第67个漏洞)
     namp --script smb-vuln-ms08-067 <target>

查看某一个脚本的用法nmap --script-help 具体的脚本

【实例】nmap -sn --script dns-brute qq.com使用dns-brute脚本扫描qq.com的子域名

┌──(root?kali)-[~/work/exam]
└─# nmap -sn --script dns-brute qq.com                                     
Starting Nmap 7.92 ( https://nmap.org ) at 2022-03-18 04:59 EDT
Nmap scan report for qq.com (61.129.7.47)
Host is up (0.0015s latency).
Other addresses for qq.com (not scanned): 183.3.226.35 123.151.137.18

Host script results:
| dns-brute: 
|   DNS Brute-force hostnames: 
|     mx.qq.com - 0.0.0.1
|     http.qq.com - 0.0.0.1
|     mx0.qq.com - 0.0.0.1
|     id.qq.com - 14.215.158.24
|   ........
|_    home.qq.com - 0.0.0.1
Nmap done: 1 IP address (1 host up) scanned in 11.79 seconds

【实例】nmap -sn --script broadcast-ping 192.168.137.0/24广播ping

┌──(root?kali)-[~/work/exam]
└─# nmap -sn --script broadcast-ping 192.168.137.0/24
Starting Nmap 7.92 ( https://nmap.org ) at 2022-03-18 05:26 EDT
Pre-scan script results:
| broadcast-ping: 
|   IP: 192.168.137.2  MAC: 00:50:56:f2:52:44
|_  Use --script-args=newtargets to add the results as targets
Nmap scan report for 192.168.137.1
Host is up (0.00067s latency).
MAC Address: 00:50:56:C0:00:08 (VMware)

Nmap scan report for 192.168.137.2
Host is up (0.000098s latency).
MAC Address: 00:50:56:F2:52:44 (VMware)

Nmap scan report for 192.168.137.254
Host is up (0.000096s latency).
MAC Address: 00:50:56:F3:88:4E (VMware)

Nmap scan report for 192.168.137.128
Host is up.

Nmap done: 256 IP addresses (4 hosts up) scanned in 5.56 seconds

【案例】利用SMB协议发现目标操作系统的类型
nmap --script smb-os-discovery <target>
【案例】利用DNS区域传输漏洞（实验已经做不成功，不允许区域传输）
nmap --script dns-zone-transfer -p 53 <target域名服务器>

Nmap- -目标（target）指定方法

【案例】 nmap -sn -iL <filename>

┌──(root?kali)-[~/work/exam/nmap]
└─# nmap -sn -iL local_ip.txt  
Starting Nmap 7.92 ( https://nmap.org ) at 2022-03-22 03:14 EDT
Nmap scan report for 192.168.137.1
Host is up (0.00021s latency).
MAC Address: 00:50:56:C0:00:08 (VMware)
Nmap scan report for 192.168.137.2
Host is up (0.00033s latency).
MAC Address: 00:50:56:F2:52:44 (VMware)
Nmap scan report for 192.168.137.254
Host is up (0.000060s latency).
MAC Address: 00:50:56:F3:88:4E (VMware)
Nmap scan report for 192.168.137.128
Host is up.
Nmap done: 4 IP addresses (4 hosts up) scanned in 0.23 seconds

PS:文件的格式支持以下写法

• 192.168.1.2
• 192.168.1.10-20

Nmap- -端口扫描

Nmap扫描流量评估

工具：iptables(Linux系统下的防火墙管理工具，Centos7版本之后，有一个新的防火墙管理工具Firewall-cmd)
iptables -I INPUT 1 -s 172.16.146.253 -j ACCEPT
iptables -I OUTPUT 1 -d 172.16.146.253 -j ACCEPT
PS：iptables -L -n 查看防火墙的默认规则（默认的表：filter表- -数据包）

• -I 插入，默许是第一条规则
• -s 指定源地址（source）
• -d 指定目标地址（destinations）
• F 清空所有规则
• -D 删除某一条规则
• Z 清除所有数据流量包的统计
• -j 指对数据包处理的动作，场见动作有
  • ACCEPT 接受
  • DROP 丢弃
  • REJECT 弹回

┌──(root?kali)-[~/work/exam/nmap]
└─# iptables -I INPUT 1 -s 172.16.146.253 -j ACCEPT  
                                                                                                                       
┌──(root?kali)-[~/work/exam/nmap]
└─# iptables -I OUTPUT 1 -d 172.16.146.253 -j ACCEPT 
                                                                                                                       
┌──(root?kali)-[~/work/exam/nmap]
└─# nmap -p 1-65535 172.16.146.253
Starting Nmap 7.92 ( https://nmap.org ) at 2022-03-22 06:57 EDT

                                                                                                                       
┌──(root?kali)-[~/work/exam/nmap]
└─# iptables -vn -L 
Chain INPUT (policy ACCEPT 0 packets, 0 bytes)
pkts bytes target     prot opt in     out     source               destination         
48834 1954K ACCEPT     all  --  *      *       172.16.146.253       0.0.0.0/0 //由于终止扫描，故流量只有2000K左右

Chain FORWARD (policy ACCEPT 0 packets, 0 bytes)
pkts bytes target     prot opt in     out     source               destination         

Chain OUTPUT (policy ACCEPT 0 packets, 0 bytes)
pkts bytes target     prot opt in     out     source               destination         
48865 2150K ACCEPT     all  --  *      *       0.0.0.0/0            172.16.146.253 

Nmap- -秘密扫描

nmap -sS -p 80 172.16.146.253扫描目标主机80端口是否开放

┌──(root?kali)-[~/work/exam/nmap]
└─# nmap -sS -p 80 172.16.146.253                                                                                 130 ⨯
Starting Nmap 7.92 ( https://nmap.org ) at 2022-03-22 07:14 EDT
Nmap scan report for 172.16.146.253
Host is up (0.00076s latency).

PORT   STATE SERVICE
80/tcp open  http

Nmap done: 1 IP address (1 host up) scanned in 0.20 seconds

秘密扫描未建立连接，故不会被目标主机日志记录。

Nmap–TCP完全连接扫描

【案例】nmap -sT -p80 172.16.146.253使用完全连接扫描目标主机80端口

┌──(root?kali)-[/home/kali/Desktop]
└─# nmap -sT -p80 172.16.146.253
Starting Nmap 7.92 ( https://nmap.org ) at 2022-03-28 07:02 EDT
Nmap scan report for 172.16.146.253
Host is up (0.00059s latency).

PORT   STATE SERVICE
80/tcp open  http

Nmap done: 1 IP address (1 host up) scanned in 0.14 seconds

[外链图片转存失败,源站可能有防盗链机制,建议将图片保存下来直接上传(img-JdFm7X6S-1648879952163)(C:\Users\admin\Desktop\1648465573(1)].png)

PS：这个选项一般不会使用，因为速度慢，且会被目标主机记录

Nmap–端口状态

Nmap–时序选项

Nmap–UDP扫描

【案例】nmap -sS -sU <target>对目标主机同时进行TCP、UDP扫描

┌──(root?kali)-[/home/kali/Desktop]
└─# nmap -sS -sU 172.16.146.253 

优点：可以得到完整的端口信息

Nmap–输出格式

【案例】nmap -v -sn 192.168.137.1-254 -oG ping-sweep.txt扫描该网段地址存活主机并保存到ping-sweep.txt中

对获得的结果进行文本处理得到存活主机：

┌──(root?kali)-[/home/kali/Desktop]
└─# grep 'Up' ping-sweep.txt | awk '{print $2}'                                 
192.168.137.1
192.168.137.2
192.168.137.254
192.168.137.128

也可使用cut命令来处理:

┌──(root?kali)-[/home/kali/Desktop]
└─# grep 'Up' ping-sweep.txt | cut -d " " -f2 >local_ip.txt

Nmap–操作系统判定

Nmap–服务的枚举

【案例】nmap -sV -sT -A 172.16.146.253对目标主机运行的端口和服务程序进行枚举扫描

┌──(root?kali)-[/home/kali/Desktop]
└─# nmap -sV -sT -A 172.16.146.253                                               
Starting Nmap 7.92 ( https://nmap.org ) at 2022-04-02 01:59 EDT
Nmap scan report for 172.16.146.253
Host is up (0.0010s latency).
Not shown: 995 filtered tcp ports (no-response)
PORT    STATE SERVICE        VERSION
135/tcp open  tcpwrapped
139/tcp open  tcpwrapped
443/tcp open  ssl/tcpwrapped
|_http-title: Site doesn't have a title (text/plain; charset=utf-8).
| ssl-cert: Subject: commonName=VMware/countryName=US
| Not valid before: 2020-11-13T08:55:11
|_Not valid after:  2021-11-13T08:55:11
|_ssl-date: TLS randomness does not represent time
445/tcp open  tcpwrapped
912/tcp open  tcpwrapped
Warning: OSScan results may be unreliable because we could not find at least 1 open and 1 closed port
Device type: general purpose
Running: Microsoft Windows XP|7|2012
OS CPE: cpe:/o:microsoft:windows_xp::sp3 cpe:/o:microsoft:windows_7 cpe:/o:microsoft:windows_server_2012
OS details: Microsoft Windows XP SP3, Microsoft Windows XP SP3 or Windows 7 or Windows Server 2012
Network Distance: 2 hops

Host script results:
| smb2-security-mode: 
|   3.1.1: 
|_    Message signing enabled but not required
| smb2-time: 
|   date: 2022-04-02T05:59:54
|_  start_date: N/A

TRACEROUTE (using proto 1/icmp)
HOP RTT     ADDRESS
1   1.62 ms 192.168.137.2
2   1.65 ms 172.16.146.253

OS and Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 54.91 seconds

得到服务及版本信息之后可进一步进行利用。