Vulnerability scanning with Nmap scripts--
in this video, we're going to be taking a look at how
to utilize the Nmap Scripting Engine to perform vulnerability
scans on a specific service that is running on a target
in order to identify or in order to verify whether or not
it is vulnerable to a particular exploit.
And of course, this will all be automated,
and it is really one of the great features of Nmap.
And again, as you'll see during the practical demonstration,
it is quite, quite powerful.
Now, before we get started with the practical demonstration,
I just want to take you to a quick, really, really awesome
resource on the Nmap Scripting Engine
that, again, you can take a look at if you want
to learn more about Nmap scripts,
not just pertinent to vulnerability scanning
but also, to automating a wide variety of networking tasks
and reconnaissance.
All right, so I'm just going to switch over to my browser
really quickly.
All right, so I'm currently on my browser,
and this is the page.
This is the official Nmap website.
And the Nmap project already has a free book available online
that you can read to learn more about how to use
Nmap that really is awesome.
And of course, I will be posting this link as a resource.
You can access it by going to nmap.org/book/nse.html
because we are talking about the Nmap Scripting Engine.
All right, so let's learn more about the Nmap Scripting
Engine.
So as it's stated here, the Nmap Scripting Engine,
also known as NSE, is one of Nmap's most
powerful and flexible features.
It allows users to write and share
simple scripts to automate a wide variety of networking
tasks.
Those scripts are then executed in parallel
with the speed and efficiency you expect from Nmap.
Users can rely on the growing and diverse set of scripts
distributed with Nmap or write their own to meet custom needs.
All right, now, the Nmap Scripting Engine
can be used to perform the following types
of functionality or can be used to automate the following types
of functionality.
So you can find various Nmap scripts
to automate network discovery.
Again, as you can see here, you can utilize Nmap scripts
for more sophisticated version detection or service version
detection.
What we are primarily interested in here
is vulnerability detection.
And of course, you also have the vulnerability exploitation
scripts.
However, these are considered intrusive.
And as a penetration tester, you should never run an exploit
on a target unless you verify that it is indeed
vulnerable to a particular exploit.
So under vulnerability detection,
let me just go through the description really quickly.
When a new vulnerability is discovered,
you often want to scan your networks
to quickly identify vulnerable systems before the bad guys do.
While Nmap isn't a comprehensive vulnerability scanner,
the Nmap Scripting Engine is powerful enough
to handle even demanding vulnerability checks.
When the Heartbleed bug affected hundreds of thousands
of systems worldwide, Nmap's developers
responded with the SSL Heartbleed detection script
within two days.
Many vulnerability detection scripts are already available,
and we plan to distribute more as they're written.
All right, so we are primarily going
to be focused on the vulnerability detection
scripts.
And these are already available once you
install Nmap on your system.
And of course, Nmap comes pre-packaged on most
penetration testing distributions.
Now that we have an idea of what the Nmap Scripting Engine is
and what Nmap scripts can be used to do, furthermore,
the various categories of Nmap scripts,
we can actually get started with the practical demonstration
side of this video that will highlight
how to utilize these vulnerability detection
scripts to identify whether or not
a target or a service that's running on a target
is indeed vulnerable to a particular exploit.
All right, so I'm just going to switch over back to my slides,
and we can get started with the lab environment.
All right, so this video already has a lab environment
attached to it that will allow you to essentially
perform or to actually follow along with the techniques
that I'll be demonstrating during the practical
demonstration.
So all you need to do is just fire up the lab environment,
and I'll see you within the lab environment.
All right, so I'm currently within the lab environment,
and the first step will involve identifying the target IP
address, which of course, you can
do by opening up your terminal.
And I'll just zoom in so you can see what's going on.
And I can type in ifconfig and take a look
at the interface ethernet one.
Your subnet is going to be different.
So the target IP is always going to be on the third IP address
within your specific subnet.
So just copy this and make sure to change the 2 to a 3,
and that's the target IP.
All right, so we're approaching this as a penetration tester
so the first step will, of course,
involve performing an Nmap scan to identify what services are
running on the target system as well as identify the operating
system if we can.
All right, so to do this, I'm just going to say Nmap,
and we'll perform a service version detection scan.
We can also perform an operating system detection scan,
and we can paste in the target IP.
Make sure to change the 2 to a 3, and I'll hit Enter.
And we'll give this a couple of seconds.
All right, so the Nmap scan is complete.
And as you can see, the target is only running one port
or only has one port open.
That is port 80, which is used to host a web server.
And you can see that the actual service itself is Apache
so we know that the target is running an Apache web
server, version 2.4.6.
In terms of the operating system,
it tells us Unix, which pretty much means
we can guess that it is running Linux or a version of Unix,
maybe a variant like BSD.
But we'll need to investigate this further.
So what we can do is we can try and access the web server.
So I'll open up Firefox here, and we
can paste in the target IP--
there we are-- and hit Enter.
And you can see that it is hosting a web server.
It's actually hosting a website that's under construction.
And that pretty much tells us that, yes,
indeed, Apache is running on port 80,
and it's being used to host a particular website.
And this website is under construction.
Now, as a penetration tester, given the fact
that this is the only service that is currently
running on an open port on the target,
we can pretty much utilize the Nmap Scripting Engine or Nmap
scripts to perform vulnerability scans or vulnerability
detection scans on web servers, or rather, just port 80.
Now, how do we do this?
Well, firstly we need to have an understanding as to where
Nmap scripts are stored.
Now, as I said, the default directory
is under user share Nmap scripts.
And if we list all the contents of this directory,
you can see that Nmap has a plethora of Nmap scripts
that can be used to automate a wide variety of scans
or functionality from network scanning to service version
detection, vulnerability detection, vulnerability
exploitation, so on and so forth.
And you can go through them manually like this.
However, as penetration testers, we
need to be much more efficient.
So given the fact that we know what's running on the target,
we know it's a web server, we can limit the results
by piping the output and using grep to only display HTTP Nmap
scripts.
So we can say HTTP, hit Enter, and this will give us
a set of scripts that, again, essentially automate
a wide variety of tasks for performing,
for example, a web application firewall detection, web
application fingerprinting.
And then of course, there's these really interesting ones
here that I'll get to in a second.
So we can go through the list of them all.
You can see there are quite a lot.
And from this point onwards, an attacker
could typically utilize one of them
to identify more information regarding
the web server and consequently the web application.
So for example, they could utilize a script like HTTP enum
to enumerate more information.
And again, this can typically be done by running an Nmap scan,
and we can then specify the script as HTTP enum.
So we can say script.
The syntax for loading or using a script is fairly simple.
You just say script and then paste
the name of the script here.
You don't need to provide the path
to the script or the actual extension
unless you're trying to utilize a script that you've
developed yourself.
And I'll get to that in a second.
So we can say http enum, hit Enter,
and you can also probably specify
the port to be more specific.
So for example, I can limit this scan to only port 80
as that is what we're interested in.
So I can say port 80, hit Enter, and we'll
give this a couple of seconds.
And let's see what the script is able to bring up.
Now, this really isn't a vulnerability detection script
so it'll only provide us with information that we've already
been able to obtain like the actual header, which tells us
the exact version of Apache.
Now, as a penetration tester, you
can really start off from this point
and utilize searchsploit and say Apache 2.4.6
and try and identify vulnerabilities or exploits.
And of course, this really isn't comprehensive.
And of course, I'll take you through the process of using
searchsploit when we get there.
However, going back to the Nmap scripts
under the scripts directory here,
the Nmap scripts are developed or can
be created using the Lua programming language.
So I'll just use a simple example here using
the nano text editor.
So for example, if I wanted to take a look at the actual HTTP
enum script that we just used, so I
can say user share Nmap scripts http enum.nse,
we can hit Enter.
It'll actually show you what is being
done at a very advanced level.
And as I said, you really don't need
to understand what's going on here.
But if you ever wanted to learn how or what
an Nmap script is doing, this is a great place to start.
And of course, once you move along
or you progress in your pen testing journey,
you learn how to create your own Nmap scripts,
the Lua programming language in the context of Nmap and Nmap
scripts is fairly simple to understand.
So that is really how to utilize an Nmap
script in terms of syntax.
Now let's try and get an understanding
of how to utilize an Nmap script for a particular service.
Now, as a penetration tester, we know
that the target is running a web server on port 80.
We could run various HTTP scripts.
And what we could also do is try and search for particular Nmap
scripts by listing out the contents of the Nmap scripts
directory.
And then we can pipe out the actual output and use grep,
and we can utilize the keyword vuln.
So this will only display scripts with the keyword vuln
or vulnerability within it.
And this will give you a list of vulnerability detection
scripts.
Now, you can see there's quite a few,
and you probably need to research more
about what these scripts do in regards to the vulnerabilities
that they're scanning for.
And in the context of Windows, you
will typically see that it has the Microsoft security
identifier code, so ms06-025.
And then in some cases, you'll also have the cve code.
So in this case, we can see this is an SMB vulnerability
detection scanning script for the vulnerability cve2009-3103.
Now, given the fact that the target is running a web server,
we can look for a very interesting vulnerability
detection script, and that is by the name of shellshock.
Now, I've already explored the shellshock vulnerability
and explained how to exploit it in the system
and host-based attacks course, but just
for the purpose of demonstration,
I can search for that particular vulnerability
here by grepping out and saying only
to limit the results to shellshock.
And you can see that, indeed, Nmap
has an Nmap script for the shellshock vulnerability.
And this particular script can be
used to identify or to check whether or not
the target web server or the web server that's
running on the target is vulnerable to the shellshock
vulnerability.
All right, so we can do this, and I'm just
going to load up my previous Nmap script here.
And instead of using the HTTP enum script,
we'll say http shellshock.
And we'll give this--
yeah, that's all we need to specify, and I'll hit Enter.
And let's see what the results are.
All right, so we can see that the script really
doesn't give us any more information than we
were able to obtain previously.
And the reason for that is because the http shellshock
script requires additional arguments
pertinent to the actual vulnerability
or to the service that's running on the target.
So the shellshock vulnerability without getting
too deep into it essentially affects the ability for Apache
to essentially execute CGI scripts.
Now, if we go back to the website,
you can see that we have a little timer here.
And this tells us that the website
will be online in 0 days, 23 hours, et cetera, et cetera.
But this is really not being rendered in HTML,
and it is a dynamic counter, which
means that there is some dynamic code execution going on
probably on the server side.
So if we view the actual source of this page,
so I click on View Selection Source here,
and let's take a look at the code here,
and let's understand what's going on.
You can see that indeed, I was correct.
There is a script being executed here.
And this is just your typical JavaScript.
And if we take a look at the xhttp.open function here,
we can see that it actually is executing a CGI script called
gettime.cgi.
CGI scripts are essentially used to execute system commands
or commands on the actual server or the operating system that
is running or hosting this web server and the website
and then redirect or display the output onto the actual website
itself.
So again, the shellshock vulnerability essentially
affects your CGI scripts.
So if we try and see if we can access gettime.cgi
and hit Enter, this is our CGI script,
and we can now check as to whether or not
this particular CGI script is indeed
vulnerable to the shellshock vulnerability.
All right, so we can head back over into our terminal,
and what we can do now is we can use the previous Nmap scan.
However, the only difference now is
we will need to specify additional Nmap script
arguments, and this can be done by simply
saying script arguments.
So that is script args, and let me just get rid of the spaces
there.
And then for the arguments, we are specifying arguments
for the HTTP shellshock script.
So we'll put that in quotation marks, "http-shellshock."
However, the actual argument that we want to provide
is the shellshock.uri.
So what we can do now is just say http-shellshock.uri,
and the uri is going to be the actual CGI script.
So we will specify the CGI script.
So we'll say that is equal to gettime.cgi,
really just providing its relative location on the web
server.
And we can then hit Enter, and let's see
what Nmap tells us this time.
All right, so the Nmap script scan is done,
and as you can see, we actually get really useful output
from the context of exploitation or from the context
of the penetration tester.
So you can see it performs its default service version
detection scan, and we get the output from the HTTP shellshock
script now.
So you can see that it tells us that the target is indeed
vulnerable.
And then under the HTTP shellshock vulnerability,
it provides you with the state, the IDs, the disclosure date,
and references.
So as a penetration tester, this is the most important.
So it tells you that, indeed, the target is vulnerable,
or the particular Apache HTTP web
server is indeed vulnerable.
And again, that is in relation to the CGI script.
And then it provides you with the relative cve identifier.
And the cve codes, or rather the CV identifier
is something that's very important to actually know
as a penetration tester.
And we'll get into that in the next section of this course.
But it gives you a description of this vulnerability.
So it says, "this web application
might be affected by the vulnerability known
as shellshock.
It seems the server is executing commands injected
via malicious HTTP headers."
All right, so again, I've already
explained how to exploit this vulnerability so I will not
be going into that.
I'm simply covering the process of utilizing
Nmap scripts to identify or to essentially perform
vulnerability scanning or detection
on a particular service that is running on a target.
So again, just at a very high level,
this vulnerability essentially allows
attackers to pass in malicious HTTP headers
when making a get request to a particular CGI script.
Those malicious HTTP headers will essentially
include system or command or rather just operating system
code, arbitrary code, that will then
be processed by the actual CGI script or the execution
of the CGI script.
And if that code is malicious, then, of course,
it'll be executed on the target, and it could potentially
provide an attacker with remote access.
Or it could potentially execute malicious code
that could be damaging to the actual system.
All right, so it provides you with the disclosure date
as well and references.
So you can learn more about this vulnerability
and how to exploit it by taking a look at the references.
And this is something that's very important.
All right, so this is really all that I wanted
to identify or to highlight.
And again, if you ever want to learn more
about a particular Nmap script that is, again, officially
developed and cataloged by the Nmap team, all you need to do
is just search for the actual Nmap script on Google,
and it'll actually provide you with documentation
as to how you need to specify the script arguments
and what information is needed in order to successfully
perform the vulnerability detection scan.
In this case, when we ran the script
without providing any script arguments, as you saw,
it did not provide us with any important output,
and that's because it didn't perform
the scan because it saw that no script arguments were
specified.
And of course, in some cases, you may be,
and of course, this is something that you'll run across,
some Nmap vulnerability detection scripts
do not require script arguments.
They can simply be ran without providing arguments.
All you need to do is learn how to look
for the particular script based on the service
that you're targeting.
And that can easily be done by, again, just
listing out the contents of the Nmap scripts directory
and then grepping for a particular service.
So for example, if I was targeting FTP,
I can simply say grep FTP, and you
can look for various FTP vulnerability detection scripts
like this one here to essentially identify or verify
whether that particular service that's running on a target
is indeed vulnerable.
All right, so that is going to conclude
the practical demonstration side of this video.
All right, in the next video, we will be taking a look
at how to perform vulnerability scanning and detection
with the Metasploit framework.
And of course, this is something that I've already
explored in its own course, but we'll just
be touching upon some of the important auxiliary modules
and how you can utilize the Metasploit framework to,
again, perform what we were able to do with the Nmap Scripting
Engine.
And that of course, is just to identify or detect
vulnerabilities that are running or that
affect a specific service that's running on a target system.
So I'll see you in the next video.