In this video, we will take a look at performing Network vulnerability
scanning using and map.
So let's dive on in.
This exercise, please ensure your Kali lyrics
virtual machine is booted and also power on
the metasploitable tree Windows Virtual
Machine.
For instance. You can see my Metroid
will treat currently pulled off. I'm gonna
click Start but I'm going to start it in
the Headless seat. So therefore this virtual machine
will run in the background. Let's give this a few
seconds super on.
CE this is powered on we'll perform in network
sweep to determine the IP address of this
virtual machine.
Great. So now it's actually powered on
now back to my colleague switch on machine.
I'm going to click on to two not like so could increase
the font size.
And no, let's type and map
like so Dash SN.
Followed by the network ID of the
pen test Network and we
can exclude our IP address from being scanned.
But before we actually perform the scan.
Let's type. I have config like Soo to get a IP address
of our Kali lungs virtual machine that is
connected to the pen test Network.
As you can see my Kali lungs
virtual machine has a few adapters. There's a
easy zero which is connected to my physical Network and
then there's eth one which is connected a
pen test Network simply copy this IP
address like so you can double click right click
and even copy
Next let's use and map-sn followed
by the network ID, which is 172.
tt1.0
/ 24 dash dash exclude
and then specify the IP address of your Kali lungs
machine.
This command or this entire syntax will
actually perform a pink sweep across
the entire network and tell us which virtual machines
or which machines actually on.
And great. We can see that our Target machine, which
is a metasploitable 3 Windows Virtual
Machine has the IP address of 172301 the
TTT but how do we
know for sure. This will show machine has that IB address?
Let's copy that Target.
let's do a map - capital o -
S capital V Dash o
will specify
to scan for operating system enumeration Dash SV
will allow us to retrieve the
silver Solutions on Banner of the operating system.
And then we can specify the IP address like so.
however
we can simply combine all of that by using
Dash e
and let's copy the IP address one more
time.
And this time let's face it in. The dash is in darks
will allow superform a couple of things. It will
allow us to perform serious version
enumeration such as biographing. It will also
allow us to D2 in operating system. It
will also perform basic SMB scanning
to get more familiar and map you could
type man and map like so
Currently we can see the entire name the
description but most importantly.
We can see examples on how to use and
map.
For instance. We have the different options so we can
specify Target specifications. We have
various host discovery.
And if you recall we did a dash S10, which
is a pink scan.
But let's screw on you on Twitter. They are different type
of scaling techniques that we can use we can specify different
ports as well.
There's a dash SV to proveful one
portion determine series version and version information.
There's - o for operating system.
However, we can use a dash capital
e
Let's see where the dash capital is
located great. It's right here. So it
will enable operating system detection version detection
script scanning entries throat.
So simply by using one.
Switch here or one syntax. We could
do multiple things going to
type Q to exit like so let's and I'll
come on one more time and map Dash e
and let's do sudo just to be
on a safe side.
Followed by the IP address of our Target. Let's hit
enter.
Enter your Carly password and this
can should take a few seconds to Pops
a minute to two to complete. I'm going to pause the video
once this is completed. We'll continue onwards.
The Scarlets finally completed now this
can't give us pretty much the same type of results that
we got in our previous videos.
However, let's pay attention to something a bit specific.
Let's look for any sort of indication of
an operating system.
Under the vision column.
And here we go, we can see Microsoft Windows
but specifically Port 445.
And marvelously will see enumerate. It is running Windows to Tolson
8 R2.
Standard we have the build number and
the series spark level. This is quite interesting.
Now back in around 2015 and
2016. There was a
security vulnerability. That was well
known.
within Microsoft operating system, and this
was called ms-17 -
0 1 0 like so
and we can see the security bulletin information.
Let's see the exact date. This was published.
So according to the URL here, it shows
that it was published in 2017.
And this security bulletin discussed that
is a vulnerable silver message block
version 1.1 silver is running
on Windows operating system. That is vulnerable.
However, with this security flow it allows various
types of malware such as ransomware like
Wanna Cry and Peter the compromise any Windows
operating system that was found vulnerable with
a security flow.
Let's perform a basic vulnerability
scan on the target system. Let's have
a back to Google.
The end map tool contains something called the
end map scripting engine that's simply allows us a service
Security Professionals to use additional
capabilities with nmap by running
custom scripts that are designed to run within and map itself.
We can simply search and map NSC script
list like so.
And just scroll down a little bit.
And we go to this link which is and map.org that
says NSC Docker reference
portal and a c script and map.
simply click on the URL
and this link is official website that
has all the scripts that can work
within a map. However, these scripts are already preloaded within
Kali Linux. Now this is a
lot of scripts to go through which is a lot, right?
The cool thing about using the end map scripting engine
or better notice NSC is that they are categories
and depending on what you're trying to do. We can
use ews categories of filter or scripts. For
instance. We can simply click on view Ln
like so and this will show us a
list of vulnerable scripts that can be used
to test for various security flows within a
Target system by using the end map tool.
Now, let's press Ctrl + F1 or keyboard. Let's
switch your ms-17 -
0 1 0 like so I'm
great here. We have found an SMB
script that will attempt to detect if a Microsoft
SMB version 1 server is
vulnerable to remove code execution.
And this is better known as Eternal blue.
The vulnerable tea is actively exploited
by Wanna Cry and Peter on somewhere
on other malware.
So let's perform this vulnerable vulnerable
descan.
To do so. Let's copy the name of
the script like so
that let's head over back to our terminal.
I'm going to clear the screen.
And we'll type sudo.
and map
Dash p to specify the port and the
port is is 445 like so
and type dash dash script
equals
the name of the script followed by the IEP address
of our Target
I'm going to hit enter and this scan should not take too
long. The purpose of the syntax is
it tells nmap?
Perform a port scan and determine of
Port 445 is open.
Once it is open then execute a chord
within the script on our Target.
Currently we can see it perform the port scan determine
the portrazoupon and now we can see it uses
script.
It specified a type of security flow but
most importantly it tells us a steep what it
is vulnerable or not, and currently it is vulnerable.
Now, let's have a back to our
web browser.
All of these scripts are really amazing and there's
so many different descriptions and there's so
many security flaws that we could test against a Target.
However, executing all of these scripts one by
one takes a lot of time.
So what we can do to actually speed up
this process is we can execute all
the scripts within the Vu Ln
category.
One by one, but we can automate the process.
So within the vuln category there's a
lot of scripts
So let's head over back to our terminal.
Let's clear the screen.
And this time we're going to type sudo.
and map
we're gonna type - task script.
like so
and we could specify.
The categories name we could
do this with the equal sign with all the equal sign. It's pretty much
the same.
And next we can specify our Target IP
address, which is 172 tt1
the tte.
However, keep in mind that your targets IP address
might be a little different from mines. This is why we need
to actually perform the pink scan before performing any
sort of attacks against this target.
I'm gonna hit enter and this car will take some time to
complete. So in the meantime, I'm gonna pause the video
and we'll return when everything is completed.
Great. So after a few minutes to scan completed and
at this point it actually run all
the vulnerability scripts that was found within the
vulnerability category.
Currently we can see the full scripted use was to discover
some type of broadcasts that me would of course
18 out of service, but it says hey it's not
vulnerable and it could not detect any
sort of cross-site scripting security weaknesses.
That's cool down a little more.
Another script that was used. This one
seems to determine.
Whether it was evil to find
any sort of security weaknesses within a
deafy Hellman key exchange.
a group shrink and currently
it is vulnerable and you
can see the state and the description. So that's one
security flow. We are phone so far by executing
a group of scripts. Let's scroll down again.
It was able to perform some enumeration some
each TDP are enumeration
and it seems a phone
a possible path traversal directory,
which is quite interesting.
So while we are fine security weaknesses, we
also finding things that seems to
be peeking or interest that might be exploitable. So
we need to take note of all of these additional things.
It did perform a scan using the
each TDP slow or
Shrek and we can see it is most likely
vulnerable.
To a type of the nanosus attack. So that's
another security flow. We are found.
There's another one that we found which is using SSL DH
parameters. And this
one is vulnerable. I think this one's
related to this only I found earlier which is
a difficulty exchange insufficient group
shrink because the description seems
to be the same. However, just found on a
different port. So perhaps you could
exploit the same system on two different
ports and set up multiple back to access.
I look there's a two port with the same
security flow as well.
That is exploitable.
And last but not least. It's still discovered the
security flow on ms-17010, which
is eternal blue.
So as you can see, we have found a few
security weaknesses.
each of these and map tools that the most likely
or actually vulnerable the cool
thing is
The security flows were fallen on multiple ports. That means
we could set up multiple back to access
so that we could have persistent access whenever
this vulnerable system is online.
In this video we take a look at using and map to discover
security weaknesses on a Target system.
In the next video, we will take a look at using nasus to
discover security weaknesses on
systems or any network. I hope this video
has one informative for you and I will see you in the next one.