Nmap Enumeration

Notes received from an anonymous contributor, with consent.

• The most important part of a pentest.
• Most ways in which we can gain access to a system can be narrowed down into 2 points:
  • Functions and/or resources that allow us to interact with the target and/or provide additional information.
  • Information that provides us with even more important information to access our target.
• Manual enumeration is VERY IMPORTANT
• Many scanning tools automate things, but they cannot always bypass security measures of services.
• The key here however, is to learn more about the service and how to interact with it, which will reveal more pathways.

Intro to Nmap

• Nmap = Network Mapper

• Features:

  • Host Discovery
  • Port scanning
  • Service Enumeration and detection
  • OS detection
  • Scriptable interaction with the target service (Nmap Scripting Engine)

• Basic Syntax: nmap <scan types> <options> <target>

• TCP Syn Scan: nmap -sS <ip>

Host Discovery

• To scan a network range for hosts, we can use nmap in this way:

sudo nmap 10.129.2.0/24 -sn -oA tnet | grep for | cut -d" " -f5

• 10.129.2.0/24 is the network range
• -sn disables portscanning
• -oA tnet Stores results in all formats starting with the name tnet.
• Works only if the firewalls of the host allow it, if not we need to use some evasion techniques.

Scanning IP lists

sudo nmap -sn -oA tnet -iL hosts.lst | grep for | cut -d" " -f5

• -iL specifies a list for scanning

Scanning Multiple IPs

sudo nmap -sn -oA tnet 10.129.2.18 10.129.2.19 10.129.2.20| grep for | cut -d" " -f5

If these are consecutive IPs we can specify a range also

sudo nmap -sn -oA tnet 10.129.2.18-20| grep for | cut -d" " -f5

Scanning Single IP

sudo nmap 10.129.2.18 -sn -oA host

If we disable port scan (-sn), Nmap automatically ping scan with ICMP Echo Requests (-PE). Once such a request is sent, we usually expect an ICMP reply if the pinging host is alive.

sudo nmap 10.129.2.18 -sn -oA host -PE --packet-trace

• -PE: Performs the ping scan by using 'ICMP Echo requests' against the target.
• --packet-trace: Shows all packets sent and received.
• --reason: Displays the reason for specific result.
• --disable-arp-ping: To disable ARP requests and scan our target with the desired ICMP echo requests, we can disable ARP pings.

Check out more host discovert strategies here.

Exercise Solution

• The OS in this scan here is windows.
• This is because of the TTL value, which it sends back as 128. This actually refers to windows.
• Check here for the default ttl values.

Host and Port Scanning

• Different states of ports:

Discovering Open TCP ports

• By default, nmap scans the top 1000 TCP ports with the Syn Scan flag.

sudo nmap 10.129.2.28 --top-ports=10

Nmap - Trace the packets

sudo nmap 10.129.2.28 -p 21 --packet-trace -Pn -n --disable-arp-ping

• -p Scans a specified port

• --packet-trace Shows all packets sent and received.

• -n Disable DNS resolution

• --disable-arp-ping Disables ARP ping

• Requests and Responses

Requests

Responses

Connect Scan on tcp 443

sudo nmap 10.129.2.28 -p 443 --packet-trace --disable-arp-ping -Pn -n --reason -sT

Filtered Ports

sudo nmap 10.129.2.28 -p 139 --packet-trace -n --disable-arp-ping -Pn

• When a port is shown as filtered, it can have several reasons. In most cases, firewalls have certain rules set to handle specific connections.

Discovering Open UDP Ports

sudo nmap 10.129.2.28 -F -sU

• -sU: Performs UDP scan

• -F: Scans top 100 ports

• A major disadvantage of UDP is that we often don't get a response back because Nmap sends empty datagrams to the scanned UDP ports, so no responses are sent.

• Other flags as shown in the previous scans also work with UDP scans.

Version Scan

sudo nmap 10.129.2.28 -Pn -n --disable-arp-ping --packet-trace -p 445 --reason  -sV

• -sV: Performs a service scan.

Exercises

• I found 12 open ports, but htb says 7. So whatever
• Again, the target is chopped so idk.

Saving the results

• Saving results is always important after any scan.

• Formats:

  • Normal output (-oN) with the .nmap file extension
  • Grepable output (-oG) with the .gnmap file extension
  • XML output (-oX) with the .xml file extension
  • -oA to save in all formats

• We can convert XML results to html results using xsltproc.

xsltproc result.xml -o result.html

Exercise

• I just used masscan to get all the open ports (see checklist.md)

Service Enumeration

• Perform a quick portscan to get the open ports and then perform service enum on those.
• This can be time-consuming which is why we use masscan (easier and faster).
• Consider this command:

sudo nmap 10.129.2.28 -p- -sV --stats-every=5s

• Here, the --stats-every=5s displays the progress and scan stats every 5 seconds.
• Use the -v and -vv flags to increase verbosity levels.
• Use the -sV flag to perform banner grabbing.

Banner grabbing using tcpdump and netcat

sudo tcpdump -i eth0 host 10.10.14.2 and 10.129.2.28
nc -nv 10.129.2.28 25 # Do this in another terminal

Exercise solution

• Get ports using masscan
• Use nmap service enumeration to get the banners.
• If that doesn't happen use the tcpdump netcat method (I didn't do this).
• After getting all the flags, I saw port 31337 open which was FTP. So I used ftp to connect to it and get the flag (it just sends it over).

Nmap Scripting Engine

• Create scripts with lua to do more stuff. Script categories are shown in the below table.

• Different nmap functions are here:

Exercise solution

• Use my flow (see cheatsheet or previous sections to get that) to get all open ports.
• Do some fuzzing on the webserver (port 80) and flag will be in robots.txt

Performance

Firewall and IDS/IPS Evasion

Easy lab solution

sudo nmap -sA -PE --disable-arp-ping -O <ip>

Medium Lab Solution

sudo nmap -PE 10.129.2.48 -sV -sU -p 53 --disable-arp-ping --stats-every=3s

NOTE: This thing returns a custom HTB{something_something} flag, which is the answer (kinda gay).

Hard Lab Solution

sudo nmap -g53 --max-retries=1 -Pn -p- --disable-arp-ping <ip>