Welcome to the video using and map scripts for automating network scanning in this video we will learn
about NFC also known as the map scripting engine will find were these NSC scripts are located on our
Kelly Linux machine and we'll run NSC scripts against targets in our environment.
So far we have focused heavily on using end map to do an initial discovery of our networks.
We've run both broad and very targeted scans depending on what we're looking for either to get a nice
overview of what's on a network.
If scanning it for the first time or doing more focused scans to find hosts that are just running a
specific service like Web services on port 80 or 4:43 And we've also practiced exporting these results
to several different formats such as X-amount and HTL now that we're getting good at the discovery phase
of scanning the next logical step is to find potential vulnerabilities and misconfiguration on our hosts.
And this is one area where the NSC or map scripting engine really shines if you head to the u r l shown
on my screen here you can take a real deep dive into what the end maps scripting engine is all about
and how to use it.
For the purposes of this video I'm going to give you a high level overview and then dive into some helpful
commands as well as some of my favorite scripts the maps scripting engine as the name implies is focused
on scripts specifically the engine contains over 500 scripts.
We can leverage and the first logical step is to find them let's use the locate command we've played
with in previous videos to locate the scripts the scripts have an extension of NSC.
So I'm just going to type locate space start in SC.
It looks like the slash us are slash share slash and map slash scripts directory is the headquarters
for these scripts.
So let's go there and then I'm going to do an ls space task L to list all the files in the directory
as we can see there's a ton of files here.
So let's run LS space tech l again and this time pipe it to the more command so we can see one screen
at a time.
It appears there are all sorts of interesting looking scripts here ones having to do with DNS.
F t p h TDP and more.
But the big question is what to each of these scripts actually do.
Well one thing we're going to pay close attention to is the naming convention of these scripts.
Let's do an ls command for all files with the word brute.
Now any script with the word bruit is for guessing authentication credentials of a remote server.
We can see there are several protocols mentioned here like FGP HTP and S-M T.P..
Another important category of scripts to check out are those containing the word Volm
as these focus on specific known vulnerabilities.
Now we're going to look at how to figure out what each of these scripts do in a moment.
But in the case of these scripts with the word Volm it is helpful to know that many of the file names
have CVP numbers attached to them.
So if I want to know what this SMB vuln M-S 17 0 1 0 script was all about I could just look up the mess
17 0 1 0 number and learn that it's associated with the patch that Microsoft put out for the eternal
blue exploit.
And just as a side note I see this particular patch missing quite frequently on penetration tests.
So it's a good one to check the network for early in your engagement.
Also you had to scan a whole network for a particular vulnerability in just a bit.
Now back to the question about figuring out what each specific script does.
Let's first pick a script we want to know more about like this SMB tech OS task discovery what we can
do is run and map with the tac tac script TAC help command followed by the name of the script.
This tells us that the script attempts to determine the operating system computer name domain workgroup
and current time over the SMB protocol.
And we can read a few more comments here about what gotcha's we might run into as well as an additional
help your el let's hit that site and will be taken to a page with much of the same content.
But one thing that's really handy is we can see some example usage syntax in a sample of what the output
will look like.
So let's give this a shot against a known Windows host in my environment.
I'm going to run and map space tac tac script space SMB TAC OS TAC discovery and NSC space TAC P for
4 or 5 to specify just port 4 4 5 and then my target IP address and there we go it looks like Ive got
a host called mini me in my environment with Windows 10 on it and its not joined to a domain its just
sitting out here in a work group.
Now if I wanted to run that same specific check against my whole environment I could just change the
individual IP to be a whole subnet or if I had a list of hosts and subnets remember that we can call
that with the space TAC I capital L and then our command space our text file with hosts in it.
Let's take a look at the help file for another script such as banner down in SC and lets pop open the
URL for the Associated help file.
I want to call your attention to a few things here.
One is that this script is categorized under discovery and safe remember how we were looking at scripts
with names that contain the words bruit or vuln before well by navigating around in the NSC help area
you can quickly bring up a category such as bruit and see all the scripts that fall into that category
and then dive directly into the script.
You want to know more about lets go back to our banner and see which we see categorized as Discovery
and also described as safe.
So what does that mean.
I'm going to click NSC documentation and then I'm going to click into script categories here we can
get a better high level understanding of what each script category means.
And in the case of scripts Mark safe it appears that they shouldn't cause services to crash overwhelm
the network or otherwise cause any serious disruption to the environment.
Let's back up one more time to the page about the banner NSC script and I want to call your attention
to an important section called script ARBs.
These are the arguments you can pass to the unmap script to tune your scan even further.
For example with bannered NSC it looks like we've got arguments called bannered Dom.
Time out and banner dot ports that we can play with banner timeout specifies how long to wait for a
banner response and banner ports specifies which ports to grab.
Let's test this out on a host on my network that I know has a bunch of ports open.
First let's look at a normal and map scan of the host and it looks like we've got ports 21 22 23 eighty
three 3 0 6 and 8 0 2 2 open all run and map space tech tech script space bannered NSC space tech tech
script tech args space banner dot Portes equals 21 and then the IP address that will enumerate just
the banner and we can see the banner says FTB server ready now.
Notice that while only the banner was pulled from Port 21 and maps still did a scan of the default ports
and returned to their state.
I found that sometimes you need to mix and match arguments with standard and map flags to get just the
result you want.
For example I'm going to get rid of the script ARBs here and just use tac.
P. 21.
That way I will only get the ban or grab from port 21 without any other scanning overhead.
Or as we've done in the past we can use a comma separated list of ports to just pull those port banners
like tack P 21 comma 22 come to 80 and of course we can open that scan up a little wider and do a sweep
for those FGP servers across an entire subnet because this input showed a lot of closed ports.
Let's narrow things down a bit more by adding the tac tac open flag which will only turn up results
that contain open ports.
Now I wanted to close this video on something we talked about a little earlier in this video.
I mentioned the SNB vuln M-S 17 0 1 0 script which checks if the host is patched for the popular eternal
blue exploit.
One of the first questions I had when first testing for a vulnerability using nmap is Can I just do
all the various SMB related vulnerability checks against all my hosts at one time.
The answer is yes but I want to warn you to proceed with extreme caution because while this type of
scan is possible I wouldn't recommend it.
The reason goes back to the map scripting engine help area remember how we were able to click a category
such as vuln and then read about each script in that category.
Well if you read through the scripts in this category you will see that several of them mentioned adverse
side effects such as crashing services if the host is vulnerable.
If you understand the risks and still want to check against an entire category of vulnerabilities you
can do so with wild cards in your end map command.
For example to check my Mini-Me host against all POSIX and still want to check this I can use the syntax
of and map space tech tech script space SMB tech Volm TAC star and we put that in quotes space P for
4 or 5 space my target or targets.
The bottom line is you're going to want to read up on an experiment with the various A.E. scripts and
how they can be leveraged with standard and map flags to get the exact result you're looking for.
Hopefully by now you're getting some creative ideas on how to string a bunch of commands and scripts
together to squeeze the most value possible out of each one of your scans.
In our next video we will start diving into Sparta and eyewitness.