Scanning and Enumeration

Press this button to ready your machine for running the virtual machine targets. If your machine is reset or you reboot then you may have to press this button again.

Note that this target can take (quite) a few minutes to boot, as it has many processes running many services.

The machine can take 5 minutes to warm up. Press the test button to see if it is running fully. So long as the network of the target is running, you can continue for a few questions until OpenVas is ready to scan.

Target 1 lies somewhere in 192.168.1.1 - 192.168.1.254. This time use "ip route show" and find out the device name on your machine which would be used to handle packets going to target 1. You can identify it by looking at the output, finding the line involved with the target subnet, and looking for the "dev".

Target network device:

What is your machine's IP number on the target network?

Your IP:

Use nmap to sweep the target network, and identify the IP address of target 1. Use the appropriate flag so that no port scanning is done and no name resolution is performed.

What flag specifies no port scan is performed (include the "-" character)

What flag specifies no name resolution (include the "-" character)

Target IP:

We would like you to try a scan on the target using OpenVAS. However note that this can take about 15 minutes, so we will interleave this with the target booting process. Do not start the scan until told...

Start openvas in applications>Kali Linux>OpenVAS>openvas start.

Dont worry if the manager appears to fail to start. It has probably started and it is openvas which is mistaken...

Before logging into openVAS, you need to reset the openVAS certificates. Normally this is not needed, but in LinuxZoo the current certificates have expired. To reset the certificates simply run the following command:

openvasmd --rebuild
openvas-mkcert -f -q
openvas-mkcert-client -n om –i

In OpenVAS, create the following:

• A port called "port ssh" which scans only port 22
• A target called "target1" which targets the IP identified above and scanns only the port "port ssh".
• A task "ssh scan" which scans "target1". Make the Maximum concurrently executed NVTs per host 20.
• ONCE ALL CHECKS PASSED you can start the task "ssh scan". PASS THE CHECKS FIRST
• The scan takes about 15 minutes. While waiting for the answers go onto the next question in the meantime.

The username is "admin" and the password is "kali".

How many tcp ports are open on the target?

Open Ports:

Switch to using netcat and get the banner announcment for the target vnc server. You might want to use "-t 1", which will close the connection after 1 second (more than enough time to see the banner). This test is space and case sensitive.

vnc banner:

Use the same technique to isentify the OpenSSH version of the target. Get this from its banner, where the version lies in the characters immediately after "OpenSSH_" but before the next space character.

ssh version:

Use that version number for ssh and locate an CVE exploit which affects that version which was published in November 2008. Specify it in its full name, e.g. CVE-1999-1234. Case sensitive.

CVE 2008:

Use netcat as a client to connect to the target on a range of services, to fingerprint the ports which are open:

echo "" | nc -v -n -w1 target_IP 20-100

What version of FTP Server is reported?
FTP Server name:
FTP Server version:

Use xprobe2 to identify what sort of machine target 1 is. Save that information to /root/info1. Ignoring the final version number, what version of Linux is this (so if the version is "2.1.16", just enter "2.1").

Linux major version:

Use nmap with "-O" to identify what sort of machine target 1 is. Save that information to /root/info2. Ignoring the final version number, what version of Linux is this (so if the version is "2.1.16", just enter "2.1").

Linux major version:

Compare the major version information and evaluate the results.

What is the reason for the result? They are the same as both programs work well They are the same but the guess probabilities were low. Same versions but confidence factors were low. The versions differ: a firewall blocked all ports. The versions differ: the target was in stealth mode The versions differ: OS fingerprinting is just hard The versions differ: The target is too new for both programs The versions differ: The target is too old for both programs The versions could not be identified

From Kali, in a terminal window perform two tcpdumps to capture the nmap OS fingerprint packets sent, filtering on the target host address (e.g using the HOST filter), and not doing name resolution. Remember the interface is br0.

First capture with tcpdump the packets generated when using xprobe to fingerprint the target using the same procedure as earlier. Save the output of tcpdump to a file /root/dump1 using standard redirection.

Secondly capture with tcpdump the packets generated when using nmap to fingerprint the target using the same procedure as earlier. Save the output of tcpdump to a file /root/dump2 using standard redirection.

Look at the number of packets generated by each tool:
The packet count was around the same nmap used significantly more packets xprobe2 used significantly more packets Nether command generated any packets

At this point hopefully your ssh scan has completed. It tends to sit at 1% for a while, then again pause at 98%. You should never rush openvas...

From the report from this task, read the report and look at the "High" security risks. One problem identified is that there is a "default Credentials" problem. Look at that NVT and enter below the username and password that it is worried about.

Username: Password:

One of the most powerful features of nmap is its scripting engine which permits nmap to execute scripts against a target to gather more interesting information. Some of these scripts can also be used to launch simple exploits such as a Telnet brute force attack. This section will demonstrate how to use the scripts and will also point to some issues that you may encounter when using scripts. The complete list of scripts is available on the nmap web site.

A complete list of Nmap Scripts is available on the nmap web site:
http://nmap.org/nsedoc/scripts/

Locate the nmap script directory using:

	locate ".nse" 

What directory are the NSE script stored in:

Look at the script.db file in this scripts directory. Open it with less and look for the categories that the dns-zone-transfer script is in.

Categories (no spaces, list seperated by commas):

Use the script "smb-os-discovery" in nmap, targeting the target 1 machine, and limiting the scan to ports 137-139 (netbios).

What is the workgroup name discovered for target 1? Remember this is case sensitive.

worgroup name:

You can run all non invasive nmap script on all ports on the target. See what you can discover. This uses the "-sC" flag.

What version of dns bind did you identify during this.

bind version: