-: Welcome to the vulnerability analysis section.
So we covered scanning and we managed to discover a bunch
of information about our target,
and right now,
we are going to use that information to discover
whether a target has some vulnerabilities.
We are going to cover three different tools in this section
and the first one is going to be an already familiar tool,
which is called nmap.
We're going to tackle a subject on nmap scripting.
By now, we learned that nmap is used for scanning targets.
But nmap can also perform vulnerability analysis
and in some cases it can even perform exploitation
with the help of different scripts.
As this is advanced use of nmap,
we should first explain, what are these nmap scripts?
While nmap scripts are commonly used
in scanning to detect different service vulnerabilities,
it can also be used for brute forcing attacks.
It can be used to detect a malware on target machine.
It is also used to collect even more information
about databases and other network services.
So we can consider this lecture to be half scanning
and half vulnerability analysis.
The goal of this lecture, however,
will not be the vulnerability analysis
but to show you how we can run these scripts.
And before we even run them,
we need to know what are our available options.
So where are those scripts, how do we run them?
How do we know which scripts even exist?
Inside of the catalytics
we can find all the scripts that nmap has
inside of this directory.
So, open up your terminal and navigate to user,
share, slash nmap, and then slash scripts.
If I type Ls right here, we can see there are a lot of them.
Let us test some of them out and see
whether they give us any information about our target.
Now, running scripts comes with two different options.
We can either specify one script to use in a scan
or we can specify a group of scripts
that we will use inside of a scan.
And to fully understand all the possible things
that we can do with scripts using nmap,
you should take a look at the page right here.
This is the official nmap page from the nmap.org link
and in the slash book, slash NSE-usage.html,
it'll give us a good explanation about script groups
and the usage of nmap.
If we scroll all the way down here
is the usage and examples.
We get different script categories, which are script groups.
We can see right here that the currently defined categories
are auth, broadcast, brute default, discovery
and many, more right here.
And down here we can read about each and every one
of them to see what each script group does.
So for example, right here, the brute script group,
it says these scripts are used to brute force
attacks to guess authentication credentials
of a remote server.
Nmap contains scripts for brute forcing dozens
of protocols, including http-brute, oracle-brute,
snmp-brute, and so on and so on.
Let us test some of them out.
Let us start with this auth script group first.
We can read these scripts deal
with authentication credentials
or bypassing them on the target system.
Examples include x11-access, ftp-anonymous
and oracle-enum-users.
Now, these right here that you read are single script names
and these single scripts belong
to this larger script group.
Right here, it also says scripts which
use brute force attacks to determine credentials are placed
in the brute category instead.
So right here,
there are no scripts that are used for brute forcing.
And what the brute forcing simply means is running a bunch
of usernames and passwords
onto the target system to discover which one is
the correct username and which one is the correct password.
But more about brute forcing later on.
For now, let us go and test some of these scripts.
To run a scan with a script group,
we can use nmap dash, dash, script and after it
we specify the script group.
So in my case, I will use auth
and I will scan my method portable machine
with the SYN scan.
Remember, SYN scan requires sudo privileges,
so let's add sudo
and type in our password.
As soon as it finishes,
we're going to see whether this oath script group discovered
any useful information for us regarding vulnerabilities.
Okay, so it has finished.
Let us see
whether our script managed to detect anything unusual.
So we get the standard output of all the open ports
and we also get some other information
for some of the ports.
For example, right here we get ftp-anon
and this ftp-anon is just a single script name
from the nmap.
It tells us that anonymous ftp login is allowed.
Hmm, what does this mean?
Well, this is something that we will cover later.
For now, just keep in mind
that anonymous login is allowed for the port 21.
Under the ssh port,
we get which authentication matters are supported,
right here.
Down here we get information for the sql port.
It tells us that root account has empty password.
This can also be very useful for us.
And right here we can see tomcat, two dots, tomcat.
What does this mean?
Well, this looks like a default tomcat credentials
and if I go down here it tells us posts can script results.
It says that this is a valid credential for tomcat.
It is for the service running on this port.
Let us check this out.
This might be the first vulnerability that we find.
To check whether this is correct
we can go and open up Firefox.
And we are going to make a connection
to our metasploitable on this port right here.
So, just find out the IP address of your meta exploitable
and if you scanned it right now, you already know it.
So for me it is 192.168.1.6.
And to make a connection to a port
I will type two dots and then the port number.
In my case,
what seems to be a vulnerability is found on this port.
So let's copy the port and I will paste it right here.
Oops, it seems that it only pasted the port.
Let me just retype this and type the port like this.
So eight, one, eight, zero and then visit this
and here we get the official Apache Tomcat page.
Let's see
whether we can find something interesting right here.
And what we are looking for based on these credentials
is a login screen.
So, this tomcat administration seems interesting.
If I click on it, it leads us to this admin page
where we are required to specify username and password.
And down here from our scan we got tomcat and tomcat.
Let's try it out and see whether it fits.
If I type tomcat for the username
and tomcat for the password, click on log in.
There it is.
We manage to log to the admin page of the Tomcat server.
Great, this is our first vulnerability
that we manage to discover and exploit.
We are now in the administrator page of the Tomcat.
Now there are other things that we can do right here
as well, but for now we are just happy
that we managed to gain access to the administrator page.
Down here we have user databases, mail sessions,
data sources, and these are all empty
because this is a test machine,
but if it was a real machine,
this will probably all be filled
with some other useful information.
Great, let's leave this on side for now.
So we managed to gain access
to the Tomcat administrator page
with the help of nmap script.
Let's see what else we can do with scripts.
So let's go and try out the malware scan.
These scripts test whether the target platform
is infected by malware or back doors.
Let's see whether our target is infected with malware.
If we can run the same command,
just this time instead of auth,
we're going to use malware.
Let's run the scan.
And let me control c this,
just so we can make this faster,
I'm going to use the dash capital F option
to scan only 100 ports and not thousand ports.
And it doesn't seem to find any malware right here.
But what you can do with this scan,
you can wait for us to first exploit the method exploitable
in the next section and then test this scan once again
to see whether you can notice any back doors
that we uploaded that are making connection
to our Cal Linux machine.
For now, it doesn't seem to give us any result
for the first 100 ports.
Let's try another scan.
We're going to use right now the banner script group.
And what banners are, are simply what the open port
will give us is the information once we connect to it.
Banners usually hold information disclosure.
And by information disclosure,
they can give us the exact version
of the software running on an open port.
And we can see the scan has finished,
and we get the banner, which holds diversion for the ftp.
We get the banner for the ssh, that also holds diversion.
And this is something similar for diversion scan
that we covered in nmap.
Now sometimes banner will look something like this
and this is something that we cannot read.
But I will show you in the exploitation section
that this telnet port is one of the easiest ports to exploit
and gain access to metasploitable.
And we are going to do this over banner.
For now, it seems that we cannot even read this banner
but later we are going to use the exact same banner
for telnet to gain access to the metasploitable.
Let's check out another scan.
Let's try this scan group.
And this scan group is called exploit.
And while it runs,
if I go right here and try to find it, scan group,
it tells us that the scripts that belong to this exploit
scan group aim to actively exploit some vulnerability.
Here are some of the examples of the script
names that belong to the group.
So this script group will actually try to exploit
if it finds our vulnerability.
Let's see whether it finished.
And it did finish.
Right here, we can see port 80,
spidering limited to this found
the following possible csrf vulnerabilities.
So, here are the possible vulnerabilities that it found
for this specific vulnerability.
And for now on, don't worry about this.
This type of vulnerabilities for the htp port.
We are going to cover in the website penetration
testing section.
For now, we are just taking a look
at how we can discover them using vulnerability analysis.
Let's go all the way up.
And for the ftp port, it tells us right here,
that the port is vulnerable.
It is running this version
and it seems that it managed to exploit it,
as it says right here, vulnerable and exploitable.
And right here we get the exploit results.
The nmap script ran this command and it actually
managed to get the root account on the target machine.
So we found another vulnerability.
Here is the ftp port that is exploitable.
Now we don't really know how to exploit it yet,
but for now,
with the help of scripts and vulnerability analysis
we know that this right here is exploitable.
And in the exploitation section we're going
to see exactly how we can gain access
and perform the same thing that the nmap
performed right here.
Now under these IDs, you will see this name right here.
Now get used to these type of names.
This is how different vulnerabilities are labeled.
These 2011 is a year when the vulnerability occurred.
Okay, great.
But these are just some
of the script groups that we can run.
Of course, we are not going to be running all
of them in this video since, as you see right here,
there is a lot of them.
You can test them out
and see what each and every one of them do.
But for now, let us just see how we can run one script.
We saw how we can run script groups
but sometimes you will only want to run a single script.
And we already know that scripts are located inside
of this directory, right here, and there is a lot of them.
Let's go all the way up and try to find some cool script.
Hmm, this one seems interesting.
Firewall bypass and this dot nse is just the extension
for the scripts.
And by the way, to not blindly run these scripts,
what you can do to check out what exactly
a certain script does,
is you can copy it's name and then run the command sudo
nmap dash dash script dash help.
And then the name of the script.
So, base the script name and type enter.
It'll tell us that this particular script
detects the vulnerability in net filter
and other firewalls that use helpers to dynamically
open ports for protocols such as ftp and sip.
Right here, it also tells us how the script works.
So the script works based proofing a packet
from the target server asking
for opening a related connection to a target port.
And to run it, in case you want to run it,
you can type sudo nmap dash script.
And it is similar to running the script groups.
All we need to do is just paste the name of the script
and add the IP address.
It'll start running this script onto the target.
And for now,
it seems that we got the exact same output
of a normal nmap scan.
Usually you will get this output.
That means the script didn't work.
So since this one didn't seem to give any output,
let's try another one.
Let's try the one that
we already know will give us an output,
and that one is ftp-anon dot nse.
And remember when we ran one of the script groups,
this script gave us the output for the ftp port,
telling us that anonymous ftp login is allowed.
Let's see whether we get the same result right now.
If I run it, go all the way up
and it tells us anonymous ftp login allowed.
And I already told you that ftp anonymous login means
that you can use anonymous username
and a random password to log to the ftp.
Let's see whether it'll work.
Let's just test it out.
We are curious.
We want to see what does this anonymous ftp login mean.
To do that, we're going to connect to a target using ftp.
So you just type ftp
and then the IP address of the target machine.
In our case, of the metasploitable.
Press enter.
And right here, it'll ask us for the name.
Let's type anonymous
and let's type the password.
Here, you can type anything you want.
In my case, I will just type password 1, 2, 3
and press enter.
And here it is, login successful.
Remote system type is Unix.
And now we can use the help command to see what
are our available options inside of this ftp server.
So we can run these commands right here.
Great, it seems that ftp anonymous login is indeed allowed.
But once again, more about ftp and the ftp vulnerabilities
that we discovered in the exploitation section.
For now, we managed to find
out about some potential vulnerabilities.
Such as the Tomcat administrator login,
the ftp port 21 showed to also be vulnerable.
Remember when we ran the exploit script group,
it told us that it is exploitable.
But let's also see what
else we can find using other vulnerability analysis tools.