Artigo Scaneando com Nmap

[Lipzz]

Galera scaniei um ip com o Nmap e bateu isso :

21/tcp open ftp
22/tcp open ssh
23/tcp open telnet
25/tcp open smtp
53/tcp filtered domain
80/tcp open http
110/tcp open pop3
119/tcp open nntp
135/tcp filtered msrpc
139/tcp filtered netbios-ssn
143/tcp open imap
445/tcp filtered microsoft-ds
465/tcp open smtps
514/tcp filtered shell
563/tcp open snews
587/tcp open submission
593/tcp filtered http-rpc-epmap
993/tcp open imaps
995/tcp open pop3s
1433/tcp filtered ms-sql-s
1434/tcp filtered ms-sql-m
3128/tcp filtered squid-http
4444/tcp filtered krb524
5431/tcp open park-agent
9898/tcp filtered monkeycom
12345/tcp filtered netbus
31337/tcp filtered Elite

Como posso invadir essa maquina se der'; Vlww Obs;{ ja bate uns tuto ae e nem funfo!} vlw!

[Baguio Loko]

Ta com o porta 80 aberta, copia o ip e cola no navegador, se for um site vai abrir normalmente, se for um moden, vai pedir loguin e senha, ai tenta a padrão que é loguin: admin senha: admin, se não der serto, tente achar o nome do moden e procure as senhas parão respectivas a esse moden.

ele esta tambem com a porta 12345, do netbus, que é programa hacker, vc pode baixar ele e tentar se conectar.

mas consertessa é um site.

[Lipzz]

Vlw baguio!

[EduardoMB002]

Parabens... Uma boa
Mais *** concerteZa com Z !

[Baguio Loko]

valeu, agora eu sei, kkkk²

[BrLo0ping]

ele esta tambem com a porta 12345, do netbus, que é programa hacker, vc pode baixar ele e tentar se conectar.

mas consertessa é um site.

Pela porta do 12345 não da para se conectar, pois ela está filtrada.

[SirBagda]

Usa o comando:

nmap -v -A 111.11.11.11

e manda o conteudo!

[Lipzz]

SirBagda Olha o que deu!


Starting Nmap 5.51 ( Apenas usuários registrados e ativados podem ver os links., Clique aqui para se cadastrar... ) at 2011-08-22 22:23 BRT
NSE: Loaded 57 scripts for scanning.
Initiating Ping Scan at 22:23
Scanning xxx.xx.xx.xx [4 ports]
Completed Ping Scan at 22:23, 0.25s elapsed (1 total hosts)
Initiating Parallel DNS resolution of 1 host. at 22:23
Completed Parallel DNS resolution of 1 host. at 22:23, 0.41s elapsed
Initiating SYN Stealth Scan at 22:23
Scanning 18741010077.user.veloxzone.com.br (xxx.xx.xx.xx) [1000 ports]
Discovered open port 110/tcp on 187.41.10.77
Discovered open port 143/tcp on 187.41.10.77
Discovered open port 135/tcp on 187.41.10.77
Discovered open port 993/tcp on 187.41.10.77
Discovered open port 995/tcp on 187.41.10.77
Discovered open port 587/tcp on 187.41.10.77
Discovered open port 25/tcp on 187.41.10.77
Discovered open port 119/tcp on 187.41.10.77
Discovered open port 563/tcp on 187.41.10.77
Increasing send delay for xxx.xx.xx.xx from 0 to 5 due to 88 out of 292 dropped probes since last increase.
SYN Stealth Scan Timing: About 56.67% done; ETC: 22:24 (0:00:31 remaining)

Vlw mermo vey!

[Lipzz]

Usa o comando:

nmap -v -A 111.11.11.11

e manda o conteudo!

olha o que deu SirBagda

SirBagda

Starting Nmap 5.51 ( Apenas usuários registrados e ativados podem ver os links., Clique aqui para se cadastrar... ) at 2011-08-22 22:23 BRT
NSE: Loaded 57 scripts for scanning.
Initiating Ping Scan at 22:23
Scanning xxx.xx.xx.xx [4 ports]
Completed Ping Scan at 22:23, 0.25s elapsed (1 total hosts)
Initiating Parallel DNS resolution of 1 host. at 22:23
Completed Parallel DNS resolution of 1 host. at 22:23, 0.41s elapsed
Initiating SYN Stealth Scan at 22:23
Scanning 18741010077.user.veloxzone.com.br (xxx.xx.xx.xx) [1000 ports]
Discovered open port 110/tcp on 187.41.10.77
Discovered open port 143/tcp on 187.41.10.77
Discovered open port 135/tcp on 187.41.10.77
Discovered open port 993/tcp on 187.41.10.77
Discovered open port 995/tcp on 187.41.10.77
Discovered open port 587/tcp on 187.41.10.77
Discovered open port 25/tcp on 187.41.10.77
Discovered open port 119/tcp on 187.41.10.77
Discovered open port 563/tcp on 187.41.10.77
Increasing send delay for xxx.xx.xx.xx from 0 to 5 due to 88 out of 292 dropped probes since last increase.
SYN Stealth Scan Timing: About 56.67% done; ETC: 22:24 (0:00:31 remaining)

vlw!

[SirBagda]

Cara.... a consulta não terminou ai... estava em continuação ainda...


SYN Stealth Scan Timing: About 56.67% done; ETC: 22:24 (0:00:31 remaining)

Termina todo scan e posta ai novamente... abraço!

[Lipzz]

Sirbagada vlw pela paciencia kkk olha o que deu!

Starting Nmap 5.51 ( Apenas usuários registrados e ativados podem ver os links., Clique aqui para se cadastrar... ) at 2011-08-22 23:05 BRT
NSE: Loaded 57 scripts for scanning.
Initiating Ping Scan at 23:05
Scanning 187.41.10.77 [4 ports]
Completed Ping Scan at 23:05, 0.31s elapsed (1 total hosts)
Initiating Parallel DNS resolution of 1 host. at 23:05
Completed Parallel DNS resolution of 1 host. at 23:05, 0.45s elapsed
Initiating SYN Stealth Scan at 23:05
Scanning 18741010077.user.veloxzone.com.br (187.41.10.77) [1000 ports]
Discovered open port 993/tcp on 187.41.10.77
Discovered open port 110/tcp on 187.41.10.77
Discovered open port 587/tcp on 187.41.10.77
Discovered open port 995/tcp on 187.41.10.77
Discovered open port 143/tcp on 187.41.10.77
Discovered open port 135/tcp on 187.41.10.77
Discovered open port 25/tcp on 187.41.10.77
Discovered open port 912/tcp on 187.41.10.77
Increasing send delay for 187.41.10.77 from 0 to 5 due to 85 out of 283 dropped probes since last increase.
SYN Stealth Scan Timing: About 58.27% done; ETC: 23:07 (0:00:30 remaining)
SYN Stealth Scan Timing: About 61.17% done; ETC: 23:07 (0:00:46 remaining)
SYN Stealth Scan Timing: About 65.67% done; ETC: 23:08 (0:01:01 remaining)
SYN Stealth Scan Timing: About 71.97% done; ETC: 23:10 (0:01:10 remaining)
SYN Stealth Scan Timing: About 79.17% done; ETC: 23:11 (0:01:06 remaining)
Discovered open port 563/tcp on 187.41.10.77
Discovered open port 465/tcp on 187.41.10.77
SYN Stealth Scan Timing: About 85.97% done; ETC: 23:12 (0:00:52 remaining)
SYN Stealth Scan Timing: About 91.37% done; ETC: 23:12 (0:00:35 remaining)
Discovered open port 119/tcp on 187.41.10.77
Completed SYN Stealth Scan at 23:17, 729.26s elapsed (1000 total ports)
Initiating Service scan at 23:18
Scanning 11 services on 18741010077.user.veloxzone.com.br (187.41.10.77)
Completed Service scan at 23:18, 48.33s elapsed (11 services on 1 host)
Initiating OS detection (try #1) against 18741010077.user.veloxzone.com.br (187.41.10.77)
Retrying OS detection (try #2) against 18741010077.user.veloxzone.com.br (187.41.10.77)
Initiating Traceroute at 23:19
Completed Traceroute at 23:19, 1.96s elapsed
Initiating Parallel DNS resolution of 2 hosts. at 23:19
Completed Parallel DNS resolution of 2 hosts. at 23:19, 0.17s elapsed
NSE: Script scanning 187.41.10.77.
Initiating NSE at 23:19
Completed NSE at 23:19, 6.14s elapsed
Nmap scan report for 18741010077.user.veloxzone.com.br (187.41.10.77)
Host is up (0.35s latency).
Not shown: 988 closed ports
PORT STATE SERVICE VERSION
25/tcp open smtp?
|_smtp-commands: Couldn't establish connection on port 25
110/tcp open pop3?
119/tcp open nntp?
135/tcp open msrpc Microsoft Windows RPC
143/tcp open imap?
465/tcp open tcpwrapped
|_smtp-commands: Couldn't establish connection on port 465
514/tcp filtered shell
563/tcp open tcpwrapped
587/tcp open submission?
|_smtp-commands: Couldn't establish connection on port 587
912/tcp open vmware-auth VMware Authentication Daemon 1.0 (Uses VNC, SOAP)
993/tcp open tcpwrapped
995/tcp open tcpwrapped
5 services unrecognized despite returning data. If you know the service/version, please submit the following fingerprints at Apenas usuários registrados e ativados podem ver os links., Clique aqui para se cadastrar... :
==============NEXT SERVICE FINGERPRINT (SUBMIT INDIVIDUALLY)==============
SF-Port25-TCP:V=5.51%I=7%D=8/22%Time=4E530DDA%P=i686-pc-linux-gnu%r(NULL,5
SF:7,"421\x20Cannot\x20connect\x20to\x20SMTP\x20se rver\x20187\.41\.10\.77\
SF:x20\(187\.41\.10\.77:25\),\x20connect\x20error\ x2010061\r\n");
==============NEXT SERVICE FINGERPRINT (SUBMIT INDIVIDUALLY)==============
SF-Port110-TCP:V=5.51%I=7%D=8/22%Time=4E530DDA%P=i686-pc-linux-gnu%r(NULL,
SF:58,"-ERR\x20Cannot\x20connect\x20to\x20POP\x20server\x2 0187\.41\.10\.77
SF:\x20\(187\.41\.10\.77:110\),\x20connect\x20erro r\x2010061\r\n");
==============NEXT SERVICE FINGERPRINT (SUBMIT INDIVIDUALLY)==============
SF-Port119-TCP:V=5.51%I=7%D=8/22%Time=4E530DDA%P=i686-pc-linux-gnu%r(NULL,
SF:58,"400\x20Cannot\x20connect\x20to\x20NNTP\x20s erver\x20187\.41\.10\.77
SF:\x20\(187\.41\.10\.77:119\),\x20connect\x20erro r\x2010061\r\n");
==============NEXT SERVICE FINGERPRINT (SUBMIT INDIVIDUALLY)==============
SF-Port143-TCP:V=5.51%I=7%D=8/22%Time=4E530DDA%P=i686-pc-linux-gnu%r(NULL,
SF:5A,"\*\x20BYE\x20Cannot\x20connect\x20to\x20IMA P\x20server\x20187\.41\.
SF:10\.77\x20\(187\.41\.10\.77:143\),\x20connect\x 20error\x2010061\r\n");
==============NEXT SERVICE FINGERPRINT (SUBMIT INDIVIDUALLY)==============
SF-Port587-TCP:V=5.51%I=7%D=8/22%Time=4E530DDA%P=i686-pc-linux-gnu%r(NULL,
SF:58,"421\x20Cannot\x20connect\x20to\x20SMTP\x20s erver\x20187\.41\.10\.77
SF:\x20\(187\.41\.10\.77:587\),\x20connect\x20erro r\x2010061\r\n");
Device type: general purpose
Running (JUST GUESSING): Microsoft Windows 7|2008 (94%)
Aggressive OS guesses: Microsoft Windows 7 Enterprise (94%), Microsoft Windows Server 2008 SP1 (88%)
No exact OS matches for host (test conditions non-ideal).
Network Distance: 2 hops
TCP Sequence Prediction: Difficulty=258 (Good luck!)
IP ID Sequence Generation: Incremental
Service Info: OS: Windows

TRACEROUTE (using port 8888/tcp)
HOP RTT ADDRESS
1 0.86 ms 192.168.95.2
2 994.71 ms 18741010077.user.veloxzone.com.br (187.41.10.77)

Read data files from: /usr/local/share/nmap
OS and Service detection performed. Please report any incorrect results at Apenas usuários registrados e ativados podem ver os links., Clique aqui para se cadastrar... .
Nmap done: 1 IP address (1 host up) scanned in 803.94 seconds
Raw packets sent: 1874 (84.068KB) | Rcvd: 1052 (43.008KB)



espero resposta vlw!!

[SirBagda]

Pronto Brother, agora você pode começar sua analise tranquilão...

Veja só, este comando trouxe informações preciosas para nós...

Vou começar explicando o que comando faz:

-v = tenta detalhar melhor o scan

-A = habilita tanto a detecção do sistema operacional como a detecção de versão dos serviços

(Obs: eu tenho no fórum um post que serve de guia do Nmap, aconselho você e a todos a darem uma lida, modéstia parte acho ele muito bom -> Apenas usuários registrados e ativados podem ver os links., Clique aqui para se cadastrar... )

Isto acima é muito importante saber mas chega de blábláblá...

Vamos analisar o log de baixo para cima!

1º

TRACEROUTE (using port 8888/tcp)
HOP RTT ADDRESS
1 0.86 ms 192.168.95.2
2 994.71 ms 18741010077.user.veloxzone.com.br (187.41.10.77)

Ele fez um traceroute e podemos observar que não passa por firewall até chegar ao destino.

2º

Service Info: OS: Windows

Ou seja.. esta máquina usa Windows.

3º

Running (JUST GUESSING): Microsoft Windows 7|2008 (94%)
Aggressive OS guesses: Microsoft Windows 7 Enterprise (94%), Microsoft Windows Server 2008 SP1 (88%)

Provável que o alvo use Windows 7 ou Windows server 2008. Pode já procurar vulnerabilidades que existam nestas versões do windows e tentar atacar.

4º

==============NEXT SERVICE FINGERPRINT (SUBMIT INDIVIDUALLY)==============
SF-Port25-TCP:V=5.51%I=7%D=8/22%Time=4E530DDA%P=i686-pc-linux-gnu%r(NULL,5
SF:7,"421\x20Cannot\x20connect\x20to\x20SMTP\x20se rver\x20187\.41\.10\.77\
SF:x20\(187\.41\.10\.77:25\),\x20connect\x20error\ x2010061\r\n");
==============NEXT SERVICE FINGERPRINT (SUBMIT INDIVIDUALLY)==============
SF-Port110-TCP:V=5.51%I=7%D=8/22%Time=4E530DDA%P=i686-pc-linux-gnu%r(NULL,
SF:58,"-ERR\x20Cannot\x20connect\x20to\x20POP\x20server\x2 0187\.41\.10\.77
SF:\x20\(187\.41\.10\.77:110\),\x20connect\x20erro r\x2010061\r\n");
==============NEXT SERVICE FINGERPRINT (SUBMIT INDIVIDUALLY)==============
SF-Port119-TCP:V=5.51%I=7%D=8/22%Time=4E530DDA%P=i686-pc-linux-gnu%r(NULL,
SF:58,"400\x20Cannot\x20connect\x20to\x20NNTP\x20s erver\x20187\.41\.10\.77
SF:\x20\(187\.41\.10\.77:119\),\x20connect\x20erro r\x2010061\r\n");
==============NEXT SERVICE FINGERPRINT (SUBMIT INDIVIDUALLY)==============
SF-Port143-TCP:V=5.51%I=7%D=8/22%Time=4E530DDA%P=i686-pc-linux-gnu%r(NULL,
SF:5A,"\*\x20BYE\x20Cannot\x20connect\x20to\x20IMA P\x20server\x20187\.41\.
SF:10\.77\x20\(187\.41\.10\.77:143\),\x20connect\x 20error\x2010061\r\n");
==============NEXT SERVICE FINGERPRINT (SUBMIT INDIVIDUALLY)==============
SF-Port587-TCP:V=5.51%I=7%D=8/22%Time=4E530DDA%P=i686-pc-linux-gnu%r(NULL,
SF:58,"421\x20Cannot\x20connect\x20to\x20SMTP\x20s erver\x20187\.41\.10\.77
SF:\x20\(187\.41\.10\.77:587\),\x20connect\x20erro r\x2010061\r\n");

Pulamos...

5º e mais importante!

PORT STATE SERVICE VERSION
25/tcp open smtp?
|_smtp-commands: Couldn't establish connection on port 25
110/tcp open pop3?
119/tcp open nntp?
135/tcp open msrpc Microsoft Windows RPC
143/tcp open imap?
465/tcp open tcpwrapped
|_smtp-commands: Couldn't establish connection on port 465
514/tcp filtered shell
563/tcp open tcpwrapped
587/tcp open submission?
|_smtp-commands: Couldn't establish connection on port 587
912/tcp open vmware-auth VMware Authentication Daemon 1.0 (Uses VNC, SOAP)
993/tcp open tcpwrapped
995/tcp open tcpwrapped
5 services unrecognized desp

Bom.. aqui ele se divide em 3 colunas....

1ª coluna: Porta e protocolo(tcp/udp).
2ª coluna: Status da porta (Aberto (open), Filtrado (filtered), Fechado (closed), Não-filtrado (unfilterd)).
3ª coluna: O serviço e a versão do serviço.

Agora o segredo é seguinte:
Prepare-se... o google é ouro agora, agora que você já sabe os serviços que estão rodando nesta máquina, você já pode fazer suas buscas atras de vulnerabilidades para estes determinados serviços e então dar o checkmate.

É isso ai!....

Vou utilizar este texto em algum matéria.. Abraço!