{"id":970,"date":"2021-02-22T07:18:22","date_gmt":"2021-02-21T23:18:22","guid":{"rendered":"https:\/\/byy3.com\/?p=970"},"modified":"2021-02-22T21:06:35","modified_gmt":"2021-02-22T13:06:35","slug":"nmap%e8%84%9a%e6%9c%accve%e7%9a%84%e6%a3%80%e6%b5%8b%e7%94%a8%e6%b3%95","status":"publish","type":"post","link":"https:\/\/byy3.com\/?p=970","title":{"rendered":"nmap\u811a\u672cnmap-vulenrs\u548cvulscan\u811a\u672cNSE\u641c\u7d22\u6f0f\u6d1ecve\u7684\u68c0\u6d4b\u7528\u6cd5"},"content":{"rendered":"

\u5b89\u88c5Nmap-vulenrs<\/h1>\n

\u9996\u5148\u6211\u4eec\u5148cd\u5230nmap\u7684\u811a\u672c\u76ee\u5f55
\ncd \/usr\/share\/nmap\/scripts\/<\/code>
\n\u7136\u540e\u514b\u9686nmap-vulners github\u5b58\u50a8\u5e93
\ngit clone https:\/\/github.com\/vulnersCom\/nmap-vulners.git<\/code><\/p>\n

\u5b89\u88c5Vulscan<\/h1>\n

\u5b89\u88c5vulsan\uff0c\u6211\u4eec\u8fd8\u9700\u5c06Vulscan\u7684\u5b58\u50a8\u5e93\u514b\u9686\u5230nmap\u7684\u811a\u672c\u76ee\u5f55\u4e2d
\ngit clone https:\/\/github.com\/scipag\/vulscan.git<\/code>
\nvulscan\u4f7f\u7528\u672c\u5730\u5b58\u50a8\u5728\u6211\u4eec\u8ba1\u7b97\u673a\u4e0a\u7684\u9884\u914d\u7f6e\u6570\u636e\u5e93\u3002\u6211\u4eec\u53ef\u4ee5\u5728vulscan\u76ee\u5f55\u7684\u6839\u76ee\u5f55\u4e2d\u67e5\u770b\u8fd9\u4e9b\u6570\u636e\u5e93\u3002\u8fd0\u884c\u4ee5\u4e0bls\u547d\u4ee4\u5217\u51fa\u53ef\u7528\u7684\u6570\u636e\u5e93\u3002<\/p>\n

\u4f7f\u7528nmap-Vulners\u8fdb\u884c\u626b\u63cf<\/h1>\n

\u4f7f\u7528NSE\u811a\u672c\u5f88\u7b80\u5355\u3002\u6211\u4eec\u6240\u8981\u505a\u7684\u5c31\u662f\u5c06\u2013script\u53c2\u6570\u6dfb\u52a0\u5230\u6211\u4eec\u7684Nmap\u547d\u4ee4\u4e2d\uff0c\u5e76\u544a\u8bc9Nmap\u4f7f\u7528\u54ea\u4e2aNSE\u811a\u672c\u3002\u8981\u4f7f\u7528nmap-vulners\u811a\u672c\uff0c\u6211\u4eec\u5c06\u4f7f\u7528\u4ee5\u4e0b\u547d\u4ee4\u3002<\/p>\n

<\/i><\/p>\n
<\/div>\n

<\/i><\/p>\n

shell<\/div>\n
\n\n\n\n
\n
nmap --script nmap-vulners -sV -p port ip<\/span><\/pre>\n<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<\/figure>\n<\/div>\n
\u8be5-sV\u662f\u7edd\u5bf9\u5fc5\u8981\u7684\u3002\u4f7f\u7528-sV\uff0c\u6211\u4eec\u544a\u8bc9Nmap\u63a2\u6d4b\u7248\u672c\u4fe1\u606f\u7684\u76ee\u6807\u5730\u5740\u3002\u5982\u679cNmap\u4e0d\u751f\u6210\u7248\u672c\u4fe1\u606f\uff0c\u5219nmap-vulners\u5c06\u6ca1\u6709\u4efb\u4f55\u6570\u636e\u6765\u67e5\u8be2Vulners\u6570\u636e\u5e93\u3002\u4f7f\u7528\u8fd9\u4e9bNSE\u811a\u672c\u65f6\u59cb\u7ec8\u4f7f\u7528-sV\u3002<\/p>\n
<\/i><\/p>\n
<\/div>\n
<\/i><\/p>\n
shell<\/div>\n
\n\n\n\n
\n
nmap --script nmap-vulners -sV -p80 ###.###.###.###<\/span><\/pre>\n<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<\/figure>\n<\/div>\n
\u4e0b\u9762\u662f\u4e00\u4e2a\u793a\u4f8b<\/p>\n
<\/i><\/p>\n
<\/div>\n
<\/i><\/p>\n
shell<\/div>\n
\n\n\n\n
\n
nmap --script vulscan --script-args vulscandb=exploitdb.csv -sV -p22 172.23.211.97<\/span><\/pre>\n<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<\/figure>\n<\/div>\n
\u5408\u5e76\u4f7f\u7528<\/h1>\n
\u4f5c\u4e3a\u5b89\u5168\u626b\u63cf\u7a0b\u5e8f\uff0cNSE\u811a\u672c\u663e\u7740\u63d0\u9ad8\u4e86Nmap\u7684\u591a\u529f\u80fd\u6027\uff0c\u4e3a\u4e86\u5145\u5206\u5229\u7528Nmap\u7684\u7248\u672c\u626b\u63cf\uff0c\u6211\u4eec\u53ef\u4ee5\u5728\u4e00\u4e2a\u547d\u4ee4\u4e2d\u540c\u65f6\u4f7f\u7528nmap-vulners\u548cvulscan\u3002<\/p>\n
\n
 <\/p>\n
<\/div>\n
 <\/p>\n
shell<\/div>\n
\n\n\n\n
\n
nmap --script nmap-vulners,vulscan --script-args vulscandb=scipvuldb.csv -sV -p# ###.###.###.###<\/span><\/pre>\n<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<\/figure>\n<\/div>\n
Nmap vulscan<\/h3>\n
Vulscan<\/a>\u00a0queries its own local CVE databases, hosted on the client performing the scan. These local databases include the following files: scipvuldb.csv, cve.csv, securityfocus.csv, xforce.csv, expliotdb.csv, openvas.csv, securitytracker.csv, osvdb.csv.<\/p>\n
In order to use this NSE script, we\u2019ll need to clone its github repo, in almost the same way we did before.<\/p>\n
Installation<\/strong><\/p>\n
The following commands will install the vulscan script along with all the databases mentioned:<\/p>\n
git clone https:\/\/github.com\/scipag\/vulscan scipag_vulscan<\/span>\r\n<\/code>\u7136\u540e\u8f6f\u8fde\u63a5ln -s pwd<\/code><\/span>\/scipag_vulscan \/usr\/share\/nmap\/scripts\/vulscan<\/code><\/pre>\n
Now let\u2019s perform an Nmap vulnerability scan with vulscan, by using the following syntax:<\/p>\n
nmap -sV --script=vulscan\/vulscan.nse www.example.com<\/span><\/code><\/pre>\n
The expected output will show you something like this:<\/p>\n
[research@securitytrails.com ~]# nmap -sV --script=vulscan\/vulscan.nse 192.168.1.105<\/span>\r\nStarting Nmap 7.70<\/span> ( https:\/\/<\/span>nmap.org ) at 2019<\/span>-10<\/span>-24<\/span> 11<\/span>:24<\/span> -03<\/span>\r\nNmap scan report for<\/span> 192.168<\/span>.1<\/span>.105<\/span> (192.168<\/span>.1<\/span>.105<\/span>)\r\nHost is<\/span> up (0.000061<\/span>s latency).\r\nNot shown: 999<\/span> closed ports\r\nPORT STATE SERVICE VERSION\r\n53<\/span>\/tcp open domain dnsmasq 2.80<\/span>\r\n| vulscan: VulDB - https:\/\/<\/span>vuldb.com:\r\n| [49778<\/span>] Thekelleys dnsmasq up to 2.32<\/span> tftp.c tftp_request memory corruption\r\n| [43410<\/span>] The Kelleys dnsmasq 2.43<\/span> Crash denial of<\/span> service\r\n| [43287<\/span>] Thekelleys dnsmasq 2.25<\/span> Crash denial of<\/span> service\r\n| MITRE CVE - https:\/\/<\/span>cve.mitre.org:\r\n| [CVE-2013<\/span>-0198<\/span>] Dnsmasq before 2.66<\/span>test2, when<\/span> used with certain libvirt configurations, replies to queries from<\/span> prohibited interfaces, which allows remote attackers to cause a denial of<\/span> service (traffic amplification) via spoofed TCP based DNS queries. NOTE: this<\/span> vulnerability exists because of<\/span> an incomplete fix for<\/span> CVE-2012<\/span>-3411.<\/span>\r\n| [CVE-2012<\/span>-3411<\/span>] Dnsmasq before 2.63<\/span>test1, when<\/span> used with certain libvirt configurations, replies to requests from<\/span> prohibited interfaces, which allows remote attackers to cause a denial of<\/span> service (traffic amplification) via a spoofed DNS query.\r\n| [CVE-2009<\/span>-2958<\/span>] The tftp_request function in<\/span> tftp.c in<\/span> dnsmasq before 2.50<\/span>, when<\/span> --enable-tftp is<\/span> used, allows remote attackers to cause a denial of<\/span> service (NULL pointer dereference and<\/span> daemon crash) via a TFTP read (aka RRQ) request with a malformed blksize option.\r\n| SecurityFocus - https:\/\/<\/span>www.securityfocus.com\/bid\/<\/span>:\r\n| [31017<\/span>] Dnsmasq DCHP Lease Multiple Remote Denial Of Service Vulnerabilities\r\n| [17662<\/span>] DNSmasq Broadcast Reply Denial Of Service Vulnerability\r\n| [12897<\/span>] Dnsmasq Multiple Remote Vulnerabilities\r\nNmap done: 1<\/span> IP address (1<\/span> host up) scanned in<\/span> 11.25<\/span> seconds\r\n[research@securitytrails.com ~]#<\/span><\/code><\/pre>\n
Tip: you can also use your own CVE local database by using the vulscandb argument:<\/p>\n
--script-args vulscandb=your_own_database<\/span><\/code><\/pre>\n
Nmap-vulners<\/h3>\n
Nmap-vulners<\/a>\u00a0is one of the most famous vulnerability scanners in use. Let\u2019s explore how to install this tool, as well as how to perform a simple CVE scan.<\/p>\n
Installation<\/strong><\/p>\n
Copy and paste the following two lines to install the nmap-vulners:<\/p>\n
cd \/usr\/share\/nmap\/scripts\/ \u7136\u540e\u518d\u514b\u9686\r\ngit clone<\/span> https:\/\/github.com\/vulnersCom\/nmap-vulners.git<\/span><\/code><\/pre>\n
Testing<\/strong><\/p>\n
The syntax we\u2019ll be using is pretty simple, calling the script by using \u2013script and specifying the vulners engine, as shown here:<\/p>\n
nmap<\/span> --script<\/span> nmap-vulners<\/span> -sV<\/span> 11.22<\/span>.33<\/span>.44<\/span><\/code><\/pre>\n
If you want to target specific posts, you simply need to add -p80 at the end, and replace \u201c80\u201d with the port you want to scan. And of course, replace 11.22.33.44 with your desired IP.<\/p>\n
You can also target by host name. For example:<\/p>\n
nmap --script nmap-vulners -sV www.securitytrails.com<\/span>\r\nThe -sV parameters will allow Nmap to show<\/span> you version<\/span> information from<\/span> the vulnerable services on<\/span> the remote host.<\/code><\/pre>\n
[research@securitytrails.com ~<\/span>]# nmap --script nmap-vulners -sV 192.168.1.105 -p 21-80<\/span>\r\nStarting Nmap 7.70<\/span> ( https:\/\/nmap.org ) at 2019-10-25 10:41 -03<\/span>\r\nNmap scan report for<\/span> 192.168<\/span>.1<\/span>.105<\/span>\r\nHost is<\/span> up<\/span> (0.34<\/span>s latency<\/span>).\r\nNot shown: 55 closed ports\r\nPORT STATE\r\n21\/tcp open ftp ProFTPD 1.3.3e\r\n22\/tcp open ssh OpenSSH 5.3p1 Debian 3 ubuntu7.1 (Ubuntu Linux; protocol 2.0<\/span><\/span>)\r\n| vulners:\r\n| cpe:\/a:openbsd:openssh:5.3p1:\r\n| CVE-2016-10708 5.0 https:\/\/vulners.com\/cve\/CVE-2016-10708 8<\/span>\r\n| CVE-2017-15906 5.0 https:\/\/vulners.com\/cve\/CVE-2017-15906<\/span>\r\n| CVE-2018-15473 5.0 https:\/\/vulners.com\/cve\/CVE-2018-15473<\/span>\r\n|_ CVE-2016-0777 4.0 https:\/\/vulners.com\/cve\/CVE-2016-0777<\/span>\r\n25\/tcp open smtp Postfix smtpd\r\n53\/tcp open domain ISC BIND DNS\r\n| vulners:\r\n| ISC BIND DNS:\r\n| CVE-2012-1667 8.5 https:\/\/vulners.com\/cve\/CVE-2012-1667<\/span>\r\n| CVE-2002-0651 7.5 https:\/\/vulners.com\/cve\/CVE-2002-0651<\/span>\r\n| CVE-2002-0029 7.5 https:\/\/vulners.com\/cve\/CVE-2002-0029<\/span>\r\n80\/tcp open http nginx 1.4.1\r\n|_http-server-header: nginx\/1.4.1<\/span><\/code><\/pre>\n
As you can see, we were able to discover several CVEs easily, including SSH and BIND vulnerabilities.<\/p>\n
Tip: Another way to run these scripts is by combining both of them into one single command, as shown below:<\/p>\n
nmap --script nmap-vulners,vulscan -sV yourwebsite.com<\/span><\/code><\/pre>\n
Nmap vuln<\/h3>\n
The way\u00a0NSE<\/strong>\u00a0scripts are defined is based on a list of predefined categories where each script belongs. These categories include: auth, broadcast, brute, default, discovery, dos, exploit, external, fuzzer, intrusive, malware, safe, version, and vuln.<\/p>\n
Vuln<\/a>\u00a0is the one we\u2019ll be using to launch our next scan against vulnerable subdomains. The syntax is the same as that of the previous NSE scripts, with \u2018vuln\u2019 added after \u2018\u2013script\u2019, as you can see here:<\/p>\n
nmap<\/span> -Pn<\/span> --script<\/span> vuln<\/span> 192.168<\/span>.1<\/span>.105<\/span><\/code><\/pre>\n
Expected output:<\/p>\n
\"nmap\u811a\u672cnmap-vulenrs\u548cvulscan\u811a\u672cNSE\u641c\u7d22\u6f0f\u6d1ecve\u7684\u68c0\u6d4b\u7528\u6cd5\u63d2\u56fe\"<\/p>\n
Here, we launched a CVE scan against port 8443, but you can query other ports, or the entire site as well.<\/p>\n
Summary<\/h2>\n
Nmap\u2019s powerful scripts allow you to not only perform port scanning tasks, but also to discover CVEs in a matter of seconds. Thanks to Nmap, this becomes an easy task, even if you don\u2019t have advanced technical skills.<\/p>\n","protected":false},"excerpt":{"rendered":"
\u5b89\u88c5Nmap-vulenrs \u9996\u5148\u6211\u4eec\u5148cd\u5230nmap\u7684\u811a\u672c\u76ee\u5f55 cd \/usr\/share\/nmap\/scr […]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[1],"tags":[496,27,501,502],"class_list":["post-970","post","type-post","status-publish","format-standard","hentry","category-net-security","tag-namp","tag-nmap","tag-nmap-vulenrs","tag-vulscan"],"_links":{"self":[{"href":"https:\/\/byy3.com\/index.php?rest_route=\/wp\/v2\/posts\/970","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/byy3.com\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/byy3.com\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/byy3.com\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/byy3.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=970"}],"version-history":[{"count":0,"href":"https:\/\/byy3.com\/index.php?rest_route=\/wp\/v2\/posts\/970\/revisions"}],"wp:attachment":[{"href":"https:\/\/byy3.com\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=970"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/byy3.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=970"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/byy3.com\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=970"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}
Nmap-vulners queries the\u00a0Vulners<\/a>\u00a0exploit database every time we use the NSE script. And here\u2019s the expected output:<\/p>\n