Service Identification
From Metasploit Unleashed
Again, other than using Nmap to perform scanning for services on our target network, Metasploit also includes a large variety of scanners for various services, often helping you determine potentially vulnerable running services on target machines. Our port scanning turned up some machines with TCP port 22 open. SSH is very secure but vulnerabilities are not unheard of and it always pays to gather as much information as possible from your targets. We'll put our grepable output file to use for this example, parsing out the hosts that have port 22 open and passing it to 'RHOSTS'.
msf > use auxiliary/scanner/ssh/ssh_version msf auxiliary(ssh_version) > show options Module options (auxiliary/scanner/ssh/ssh_version): Name Current Setting Required Description ---- --------------- -------- ----------- RHOSTS yes The target address range or CIDR identifier RPORT 22 yes The target port THREADS 1 yes The number of concurrent threads TIMEOUT 30 yes Timeout for the SSH probe msf auxiliary(ssh_version) > cat subnet_1.gnmap | grep 22/open | awk '{print $2}' > /tmp/22_open.txt [*] exec: cat subnet_1.gnmap | grep 22/open | awk '{print $2}' > /tmp/22_open.txt msf auxiliary(ssh_version) > set RHOSTS file:/tmp/22_open.txt RHOSTS => file:/tmp/22_open.txt msf auxiliary(ssh_version) > set THREADS 50 THREADS => 50 msf auxiliary(ssh_version) > run [*] 192.168.1.1:22, SSH server version: SSH-2.0-dropbear_0.52 [*] 192.168.1.137:22, SSH server version: SSH-1.99-OpenSSH_4.4 [*] Auxiliary module execution completed
Poorly configured FTP servers can frequently be the foothold you need in order to gain access to an entire network so it always pays off to check to see if anonymous access is allowed whenever you encounter an open FTP port which is usually on TCP port 21. We'll set the THREADS to 10 here as we're only going to scan a range of 10 hosts.
msf > use auxiliary/scanner/ftp/anonymous msf auxiliary(anonymous) > set RHOSTS 192.168.1.20-192.168.1.30 RHOSTS => 192.168.1.20-192.168.1.30 msf auxiliary(anonymous) > set THREADS 10 THREADS => 10 msf auxiliary(anonymous) > show options Module options (auxiliary/scanner/ftp/anonymous): Name Current Setting Required Description ---- --------------- -------- ----------- FTPPASS mozilla@example.com no The password for the specified username FTPUSER anonymous no The username to authenticate as RHOSTS 192.168.1.20-192.168.1.30 yes The target address range or CIDR identifier RPORT 21 yes The target port THREADS 10 yes The number of concurrent threads msf auxiliary(anonymous) > run [*] 192.168.1.23:21 Anonymous READ (220 (vsFTPd 1.1.3)) [*] Recording successful FTP credentials for 192.168.1.23 [*] Auxiliary module execution completed
In a short amount of time and with very little work, we are able to acquire a great deal of information about the hosts residing on our network thus providing us with a much better picture of what we are facing when conducting our penetration test.
Information Gathering > Service Identification
The Dradis Framework | Configuring Databases | Port Scanning | Auxiliary Plugins | Hunting For MSSQL | Service Identification | Password Sniffing | SNMP Sweeping | Writing Your Own Scanner
