Utilizando nmap como escáner de vulnerabilidades

El hecho de que haya proyectos Open Source es uno de los motivos por o que ocurren el tipo de cosas que voy a explicar hoy, en seguridad es de bien conocida la herramienta Nmap, sobretodo en auditorías de red te permite descubrir servicios, equipos etc, hoy te comparto este interesante post Utilizando nmap como escáner de vulnerabilidades, una herramienta muy amada por todos los pentesters.

Utilizando nmap como escáner de vulnerabilidades un escaner de puertos

Nmap, además de ser un escáner de puertos, con base en scripts permite identificar versiones de software en remoto, vulnerabilidades, enumeración de usuarios, directorios etc..

Vulscan completa esta fantástica herramienta, Nmap, para ser un escaneador de vulnerabilidades completo.

En las herramientas que nos llevamos a una auditoría de red, tendríamos Nmap como herramienta de fingerprint, Nessus, como escaneador de vulnerabilidades, OpenVAS si queremos usar la alternativa de Open Source, también tendríamos Metasploit para la explotación de vulnerabilidades, W3af para la parte web etc..

Marc Ruef ha desarrollado un script para Nmap con el que podremos identificar vulnerabilidades usando las bases de datos:

Para usar Vulscan, primero de todo deberemos de ir a la web del autor.

http://www.computec.ch/projekte/vulscan/

De ahí descargamos la última versión.

Descomprimimos la herramienta y lo colocamos donde toca para que la herramienta funcione.

En el fichero tar.gz que nos bajaremos tenemos las distintas bases de datos en formato cvs y un nse, que es el script de nmap.

El NSE, deberemos de colocarlo en a carpeta scripts de nmap. Los CSV deberemos de colocarnos en un carpeta vulscan que crearemos dentro del directorio scrips de nmap.

Para usarlo en un scaneo que realicemos, solo deberemos de pasar como argumento a nmap.

nmap -vv sV --script=vulscan.nse

Por defecto comprobará en todas las listas de vulnerabilidades, si por el contrario, solo queremos hacer un check de 1 CSV en concreto

--script-args vulscandb=securitytracker.csv

Cuando Nmap, acabe el escaneo obtendremos un output parecido al siguiente:


server-home:Downloads marc$ nmap -vv -PN -p- --script=vulscan.nse testphp.vulnweb.com -A -oA test_php

Starting Nmap 6.40 ( http://nmap.org ) at 2013-08-18 18:36 CEST
NSE: Loaded 24 scripts for scanning.
NSE: Script Pre-scanning.
NSE: Starting runlevel 1 (of 1) scan.
Initiating Parallel DNS resolution of 1 host. at 18:36
Completed Parallel DNS resolution of 1 host. at 18:36, 2.66s elapsed
Initiating Connect Scan at 18:36
Scanning testphp.vulnweb.com (176.28.50.165) [65535 ports]
Discovered open port 993/tcp on 176.28.50.165
Discovered open port 110/tcp on 176.28.50.165
Discovered open port 25/tcp on 176.28.50.165
Discovered open port 80/tcp on 176.28.50.165
Discovered open port 21/tcp on 176.28.50.165
Discovered open port 22/tcp on 176.28.50.165
Discovered open port 53/tcp on 176.28.50.165
Discovered open port 143/tcp on 176.28.50.165
Discovered open port 995/tcp on 176.28.50.165
Connect Scan Timing: About 11.36% done; ETC: 18:41 (0:04:02 remaining)
Connect Scan Timing: About 22.68% done; ETC: 18:41 (0:03:28 remaining)
Connect Scan Timing: About 35.99% done; ETC: 18:40 (0:02:42 remaining)
Connect Scan Timing: About 48.54% done; ETC: 18:40 (0:02:08 remaining)
Discovered open port 465/tcp on 176.28.50.165
Increasing send delay for 176.28.50.165 from 0 to 5 due to max_successful_tryno increase to 4
Connect Scan Timing: About 58.17% done; ETC: 18:41 (0:01:53 remaining)
Connect Scan Timing: About 66.89% done; ETC: 18:41 (0:01:33 remaining)
Connect Scan Timing: About 75.63% done; ETC: 18:41 (0:01:10 remaining)
Discovered open port 106/tcp on 176.28.50.165
Discovered open port 8443/tcp on 176.28.50.165
Connect Scan Timing: About 84.28% done; ETC: 18:41 (0:00:46 remaining)
Increasing send delay for 176.28.50.165 from 5 to 10 due to max_successful_tryno increase to 5
Increasing send delay for 176.28.50.165 from 10 to 20 due to max_successful_tryno increase to 6
Increasing send delay for 176.28.50.165 from 20 to 40 due to max_successful_tryno increase to 7
Discovered open port 8880/tcp on 176.28.50.165
Completed Connect Scan at 18:43, 382.77s elapsed (65535 total ports)
Initiating Service scan at 18:43
Scanning 13 services on testphp.vulnweb.com (176.28.50.165)
Completed Service scan at 18:45, 138.45s elapsed (13 services on 1 host)
NSE: Script scanning 176.28.50.165.
NSE: Starting runlevel 1 (of 1) scan.
Initiating NSE at 18:45
NSE Timing: About 84.62% done; ETC: 18:46 (0:00:07 remaining)
NSE Timing: About 92.31% done; ETC: 18:46 (0:00:06 remaining)
Completed NSE at 18:46, 66.65s elapsed
Nmap scan report for testphp.vulnweb.com (176.28.50.165)
Host is up (0.11s latency).
rDNS record for 176.28.50.165: rs202995.rs.hosteurope.de
Scanned at 2013-08-18 18:36:37 CEST for 588s
Not shown: 65522 closed ports
PORT STATE SERVICE VERSION
21/tcp open ftp ProFTPD 1.3.3e
| vulscan: scip VulDB - http://www.scip.ch/en/?vuldb:
| [7244] ProFTPD up to 1.3.3 MKD/XMKD Command Handler race condition
| [4290] ProFTPD up to 1.3.3 mod_sftpd Big Payload denial of service
| [7456] ProFTPD up to 1.3.5rc1 MKD/XMKD race condition
| [2747] ProFTPD up to 1.3.1rc1 mod_ctrls pr_ctrls_recv_request() buffer overflow
| [2711] ProFTPD up to 1.3.0a mod_tls tls_x509_name_oneline() buffer overflow
| [2705] ProFTPD up to 1.3.x main.c CommandBufferSize denial of service
| [2673] ProFTPD up to 1.3.0 unknown vulnerability
| [1650] ProFTPD up to 1.3.0rc2 mod_sql Format String
| [1649] ProFTPD up to 1.3.0rc2 Shutdown Message Handler Format String
|
| MITRE CVE - http://cve.mitre.org:
| [CVE-2011-4130] Use-after-free vulnerability in the Response API in ProFTPD before 1.3.3g allows remote authenticated users to execute arbitrary code via vectors involving an error that occurs after an FTP data transfer.
| [CVE-2011-1137] Integer overflow in the mod_sftp (aka SFTP) module in ProFTPD 1.3.3d and earlier allows remote attackers to cause a denial of service (memory consumption leading to OOM kill) via a malformed SSH message.
| [CVE-2010-4652] Heap-based buffer overflow in the sql_prepare_where function (contrib/mod_sql.c) in ProFTPD before 1.3.3d, when mod_sql is enabled, allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a crafted username containing substitution tags, which are not properly handled during construction of an SQL query.
| [CVE-2010-4221] Multiple stack-based buffer overflows in the pr_netio_telnet_gets function in netio.c in ProFTPD before 1.3.3c allow remote attackers to execute arbitrary code via vectors involving a TELNET IAC escape character to a (1) FTP or (2) FTPS server.
| [CVE-2010-3867] Multiple directory traversal vulnerabilities in the mod_site_misc module in ProFTPD before 1.3.3c allow remote authenticated users to create directories, delete directories, create symlinks, and modify file timestamps via directory traversal sequences in a (1) SITE MKDIR, (2) SITE RMDIR, (3) SITE SYMLINK, or (4) SITE UTIME command.
| [CVE-2009-3639] The mod_tls module in ProFTPD before 1.3.2b, and 1.3.3 before 1.3.3rc2, when the dNSNameRequired TLS option is enabled, does not properly handle a '\0' character in a domain name in the Subject Alternative Name field of an X.509 client certificate, which allows remote attackers to bypass intended client-hostname restrictions via a crafted certificate issued by a legitimate Certification Authority, a related issue to CVE-2009-2408.
| [CVE-2004-0529] The modified suexec program in cPanel, when configured for mod_php and compiled for Apache 1.3.31 and earlier without mod_phpsuexec, allows local users to execute untrusted shared scripts and gain privileges, as demonstrated using untainted scripts such as (1) proftpdvhosts or (2) addalink.cgi, a different vulnerability than CVE-2004-0490.
| [CVE-2012-6095] ProFTPD before 1.3.5rc1, when using the UserOwner directive, allows local users to modify the ownership of arbitrary files via a race condition and a symlink attack on the (1) MKD or (2) XMKD commands.
| [CVE-2009-0543] ProFTPD Server 1.3.1, with NLS support enabled, allows remote attackers to bypass SQL injection protection mechanisms via invalid, encoded multibyte characters, which are not properly handled in (1) mod_sql_mysql and (2) mod_sql_postgres.
| [CVE-2009-0542] SQL injection vulnerability in ProFTPD Server 1.3.1 through 1.3.2rc2 allows remote attackers to execute arbitrary SQL commands via a "%" (percent) character in the username, which introduces a "'" (single quote) character during variable substitution by mod_sql.
| [CVE-2008-7265] The pr_data_xfer function in ProFTPD before 1.3.2rc3 allows remote authenticated users to cause a denial of service (CPU consumption) via an ABOR command during a data transfer.

Interesante verdad? 😀

Utilizando nmap como escáner de vulnerabilidades, tened en cuenta que al actualizar nmap, deberemos de actualizar vulscan.

También puede ser de tu interés - http://dragonjar.org/zmap-internet-scanner.xhtml

ZMap Internet scanner