All language subtitles for 1. Finding First Vulnerability With Nmap Scripts

Welcome to Deployability and Analysis Section.

So we covered scanning and we managed to discover a bunch of information about our target.

And right now we're going to use that information to discover whether our target has some vulnerabilities.

We're going to cover three different tools in this section.

And the first one is going to be an already familiar tool, which is called and MAP.

We're going to tackle a subject on EMAP scripting.

By now, we learned that map is used for scanning targets, but MAP can also perform vulnerability analysis

and in some cases it can even perform exploitation with the help of different scripts.

As this is advanced use of MAP, we should first explain what are these and map scripts.

Well, and my scripts are commonly used in scanning to detect different service vulnerabilities.

It can also be used for brute force forcing attacks.

It can be used to detect a malware on target machine.

It is also used to collect even more information about databases and other network services so we can

consider this factor to be half scanning and have vulnerability analysis.

The goal of this lecture, however, will not be the vulnerability analysis, but to show you how we

can run the scripts.

And before we even run them, we need to know what are our available options.

So where are those scripts?

How do we run them?

How do we know which scripts even exist?

Inside of the clinics, we can find all the scripts that any map has inside of this directory, so open

up your terminal and navigate to user share and map and then scripts if I type.

All right.

Here we can see there are a lot of them.

Let us test some of them out and see whether they give us any information about our target.

Now, running scripts comes with two different options.

We can either specify one script to use in a scan or we can specify a group of scripts that we will

use inside of a scan and to fully understand all the possible things that we can do with scripts using

a map.

You should take a look at this page right here.

This is the official end, my page from the Web dot org link, and in this book and usage dot org html,

it will give us a good explanation about script groups and the usage of unmap.

If we scroll all the way down, here is the usage and examples.

We get different script categories, which are script groups we can see right here that are currently

defined categories are not broadcast, brute default discovery and many more right here and down here.

We can read about each and every one of them to see what each script group does.

So, for example, right here, the broad script group, it says these scripts are used to brute force

attacks to guess authentication credentials of a remote server, and that contains scripts for brute,

forcing dozens of protocols, including HTP, Brute, Oracle, brute as an MP, bruta and so on and

so on.

Let us test some of them out.

Let us start with this off script group first.

We can read these scripts, deal with authentication credentials or by passing them on the target system.

Examples include X 11 Xs, FTP, Anonymous and Oracle and some users.

Now, these right here that you read are single script names.

And these single scripts belong to this larger script group right here.

It also says Scripts, which uses brute force attacks to determine credentials, are placed in the broad

category instead.

So right here, there are no scripts that are used for brute forcing and for the brute force thing simply

means is running a bunch of usernames and passwords onto the target system to discover which one is

the correct username and which one is the correct password.

But more about brute forcing later on.

For now, let us go and test some of these scripts to run a scan with a script group we can use and

map Bastet script, and after it we specify the script group.

So in my case, I will use of.

And I can Minmetals Botibol machine pretty, since I can remember since can require the privileges,

so let's add up and type in our password.

As soon as it finishes, we're going to see whether this off script group discovered any useful information

for us regarding vulnerabilities.

OK, so it is finished.

Let us see whether our script managed to detect anything unusual.

So we get the standard output of all the open ports and we also get some other information for some

of the ports.

For example, right here we get FTP enum and this FTP is just a single script name from the unmap.

It tells us that anonymous FTP login is allowed.

Hmm.

What does this mean.

Well this is something that we will cover later for now.

Just keep in mind that anonymous login is allowed for the port.

Twenty one.

Under the S.H. port, we get which authentication methods are supported right here.

Down here, we get information for the Ezekial Port, he tells us that route account has a. password.

This can also be very useful for us.

And right here, we can see Tomcat, two dots drumkit.

What does this mean?

Well, this looks like a default Tomcat credentials, and if I go down here, it tells us posts can

script results.

It says that this is a valid credential for Tomcat.

It is for the service running on this port.

Let us check this out.

This might be the first vulnerability that we find to check whether this is correct.

We can go and open up Firefox and we are going to make a connection to our anticipatable on this port

right here.

So just find out the IP address of your anticipatable and if you scanned it right now, you already

know it.

So for me, it is one 182, that 168 that found that six.

And to make a connection to a portable type two dots and then the port number, in my case, what seems

to be a vulnerability is found on this port.

So let's go to port and double Bass Strait here.

It seems that it only pays to deport.

Let me just free type this and type deport like this.

So eight one eight zero and then visit this.

And here we get the official Apache Tomcat page.

Let's see whether we can find something interesting right here.

And what we are looking for based on these credentials is a login screen.

So this Tomcat administration seems interesting.

If I click on it, it leads us to this admin page where we are required to specify username and password.

And down here from our scan, we got Tomcat and Tomcat.

Let's try it out and see whether it fits.

If I type it for the username and Tomcat for the password, click on login.

There it is.

We managed to log in to the admin page of the Tomcat server.

Great.

This is our first vulnerability that we managed to discover and exploit.

We are now in the administrator page of the Tomcat.

Now, there are other things that we can do right here as well, but for now we are just happy that

we managed to gain access to the administrator page down here.

We have user databases, mail sessions, data sources, and these are all empty because this is a test

machine.

But if it was a real machine, this would probably all be filled with some other useful information.

Great.

Let's leave this on side for now.

So we managed to gain access to the Tomcat administrator page with the help of map script.

Let's see what else we can do with scripts.

So let's go and try out the malware, scan these scripts test whether the target platform is infected

by malware or vectors.

Let's see whether our target is infected with malware.

We can run the same command just this time instead of what we're going to use malware.

Let's from the scan.

And let me control this just so we can make this faster.

I'm going to use the dash capital F option to scan only one hundred ports and not a thousand ports.

And it doesn't seem to find any malware right here.

But what you can do with this can you can wait for us to first exploit them at this point in the next

election and then test this can once again to see whether you can notice any back doors that we uploaded

that are making connection to our Linux machine.

For now, it doesn't seem to give us any result for the first one hundred, but let's try another scan.

We're going to use right now Debenham script group and what banners are are simply what the open port

will give us is the information once we connect to it.

Banders usually called information, disclosure and information disclosure.

They can give us the exact version of the software running on an open port and we can see the scan has

finished and we get depen, which calls the version for the FTP.

We get the banner for the sausage that also calls the version.

And this is something similar for the version that we covered in Anne-Mette.

Now, sometimes Bender will look something like this, and this is something that we cannot read, but

I'll show you in the exploitation section that this telnet port is one of the easiest ports to exploit

and gain access to anticipatable.

And we are going to do this over Baner for now.

It seems that we cannot even agree to this banner.

But later we are going to use the exact same banner for Telnet to gain access to them at this point.

Let's check out another skin.

Let's try this again group.

And this group is called Explained.

And while it runs, if I go right here and try to find that scan group, it tells us that the scripts

that belong to this exploit scan group aim to actively exploit some ability.

Here are some of the examples of the script names that belong to the group.

So this script group will actually try to exploit if it finds a similar ability.

Let's see whether it's finished.

And it did finish.

Right here we can see Port 80, spidering limited to this, found the following possible seats are fallibilities.

So here are the possible vulnerabilities that it found for this specific vulnerability.

And for note, don't worry about this, this type of vulnerabilities for the port.

We are going to cover deep website penetration testing, Section four Nauen.

We're just taking a look at how we can discover them using vulnerability analysis.

Let's go all the way up.

And 40 outport.

It tells us right here that the port is vulnerable.

It is running this version and it seems that it managed to exploit it, as it says right here, vulnerable

and exploitable.

And right here we get the exploit results.

The map script ran this comment and it actually managed to get the router count on the target machine.

So we found another vulnerability.

Here is the FTP report that is exploitable.

Now, we don't really know how to exploit it yet, but for now, with the help of scripts and vulnerability

analysis, we know that this right here is exploitable.

And in the exploitation section, we're going to see exactly how we can gain access and perform the

same thing that the EMAP performed right here.

Now, under these IDs, you will see this name right here.

Now get used to these type of names.

This is how different abilities are labeled.

These two thousand and eleven is a year when the vulnerability occurred.

OK, great.

But these are just some of the script groups that we can run.

Of course, we're not going to be running all of them in this video since, as you see right here,

there is a lot of them.

You can test them out and see what each and every one of them do.

But for now, let us just see how we can run one script.

We saw how we can run script groups, but sometimes you will only want to run a single script.

And we already know that scripts are located inside of this directory right here.

And there is a lot let's go all the way up and try to find some cool script.

Hmm.

This one seems interesting.

All bypass and this dot and as is just the extension for the scripts.

And by the way, do not blindly run these scripts, what you can do to check out what exactly a certain

script does.

These you can copy its name and then run the command studio and map that script to help.

And then the name of the script so based the script, name and type.

And it will tell us that this particular script detect some vulnerability in that filter and other firewalls

that use Halberstadt Anemically open ports for protocols such as FPP and Sipi right here.

It also tells us how the script works.

So the script works by spoofing a packet from the target server, asking for opening a related connection

to a target port and to run it.

In case you want to run it, you can type through the script and it is similar to running the script

groups.

All we need to do is just paste the name of the script and add the IP address.

It will start running the script onto the target and for now it seems that we got the exact same output

of a normal amp can.

Usually you will get this output.

That means the script didn't work.

So since this one didn't seem to give any output, let's try another one.

Let's try the one that we already know will give us an output and that one is FCP and on top.

And it's.

And remember when we ran one of the script groups, this script gave us the output for the output,

telling us that anonymous FTP login is allowed, let's see whether we get the same result right now.

If I run it, go all the way up and it tells us anonymous after logging a lot.

And I already told you that FTP anonymous login means that you can use anonymous username and a random

password to log in to the FTP.

Let's see whether it will work.

Let's just test it out.

We are curious.

We want to see what does this anonymous FTP log in me to do that we're going to connect to a target

using FTP.

So you just type FTP and then the IP address of the target machine.

In our case of the metal citable press enter and right here it will ask us for the name lets type anonymous

and let's type the password here.

You can type anything you want.

In my case I will just type password.

One, two, three and press enter and here it is.

Login successful remote system type is Unix and now we can use the help command to see what are our

available options inside of this FTP so we can run these commands right here.

Great.

It seems that FTP anonymous login is indeed allowed, but once again more about FTP and the FTP liabilities

that we discovered in the exploitation section.

For now, we managed to find out about some potential vulnerabilities such as the Tomcat administrator

login the FTP port.

Twenty one should to also be vulnerable.

Remember when we ran the Exploit script group, it told us that it is exploitable.

But let's also see what else we can find using other vulnerability analysis tools.