Solution Consultoria e Treinamento www.solution-rj.com.br Rua Monan Pequeno 38/38, Pendotiba, Niterói, RJ. Email: [email protected]/Tel: 021 8732-9993 1 Laboratório do Curso de Segurança Ofensiva Netcat e Enumeração (Google Hacking, Whois e DNS) 1. NETCAT a) Ajuda root@bt:~/lab_bash-script# nc -h [v1.10-38] connect to somewhere: nc [-options] hostname port[s] [ports] ... listen for inbound: nc -l -p port [-options] [hostname] [port] options: -c shell commands as `-e'; use /bin/sh to exec [dangerous!!] -e filename program to exec after connect [dangerous!!] -b allow broadcasts -g gateway source-routing hop point[s], up to 8 -G num source-routing pointer: 4, 8, 12, ... -h this cruft -i secs delay interval for lines sent, ports scanned -k set keepalive option on socket -l listen mode, for inbound connects -n numeric-only IP addresses, no DNS -o file hex dump of traffic -p port local port number -r randomize local and remote ports -q secs quit after EOF on stdin and delay of secs -s addr local source address -T tos set Type Of Service -t answer TELNET negotiation -u UDP mode -v verbose [use twice to be more verbose] -w secs timeout for connects and final net reads -z zero-I/O mode [used for scanning] port numbers can be individual or ranges: lo-hi [inclusive]; hyphens in port names must be backslash escaped (e.g. 'ftp\-data'). root@bt:~/lab_bash-script#
This document is posted to help you gain knowledge. Please leave a comment to let me know what you think about it! Share it to your friends and learn new things together.
Transcript
S o l u t i o n C o n s u l t o r i a e T r e i n a m e n t o
root@bt:~/lab_bash-script# nc -h [v1.10-38] connect to somewhere: nc [-options] hostname port[s] [ports] ... listen for inbound: nc -l -p port [-options] [hostname] [port] options: -c shell commands as `-e'; use /bin/sh to exec [dangerous!!] -e filename program to exec after connect [dangerous!!] -b allow broadcasts -g gateway source-routing hop point[s], up to 8 -G num source-routing pointer: 4, 8, 12, ... -h this cruft -i secs delay interval for lines sent, ports scanned -k set keepalive option on socket -l listen mode, for inbound connects -n numeric-only IP addresses, no DNS -o file hex dump of traffic -p port local port number -r randomize local and remote ports -q secs quit after EOF on stdin and delay of secs -s addr local source address -T tos set Type Of Service -t answer TELNET negotiation -u UDP mode -v verbose [use twice to be more verbose] -w secs timeout for connects and final net reads -z zero-I/O mode [used for scanning] port numbers can be individual or ranges: lo-hi [inclusive]; hyphens in port names must be backslash escaped (e.g. 'ftp\-data'). root@bt:~/lab_bash-script#
S o l u t i o n C o n s u l t o r i a e T r e i n a m e n t o
Administrative Contact, Technical Contact: Admin, DNS [email protected] Check Point Software Technologies Ltd. 3A Jabotinsky St. Ramat-Gan, 52520 IL +972-3-7534555 fax: +972-3-5759256 Record expires on 30-Mar-2018. Record created on 29-Mar-1994. Database last updated on 20-Jun-2012 22:30:44 EDT. Domain servers in listed order: NS2.CHECKPOINT.COM 206.184.151.195 NS6.CHECKPOINT.COM 194.29.32.199 NS8.CHECKPOINT.COM 216.228.148.29 NS9.CHECKPOINT.COM 194.29.38.64
S o l u t i o n C o n s u l t o r i a e T r e i n a m e n t o
root@bt:~# whois 216.200.241.66 # # Query terms are ambiguous. The query is assumed to be: # "n 216.200.241.66" # # Use "?" to get help. # # # The following results may also be obtained via: # http://whois.arin.net/rest/nets;q=216.200.241.66?showDetails=true&showARIN=false&ext=netref2 # CHECKPOINT SOFTWARE MFN-B655-216-200-241-64-28 (NET-216-200-241-64-1) 216.200.241.64 - 216.200.241.79 Abovenet Communications, Inc ABOVENET-5 (NET-216-200-0-0-1) 216.200.0.0 - 216.200.255.255 # # ARIN WHOIS data and services are subject to the Terms of Use # available at: https://www.arin.net/whois_tou.html
S o l u t i o n C o n s u l t o r i a e T r e i n a m e n t o
- DNS Information Gathering 1- forward lookup BF - tentar acertar nomes validos
- usar script1.sh no BT para FB (sem manipulação)
- usar script2.sh no BT para FB ("has address")
root@bt:~/lab_DNS# host www.checkpoint.com www.checkpoint.com has address 216.200.241.66 www.checkpoint.com has IPv6 address 2620:0:2a01:2::1a10 root@bt:~/lab_DNS# host wwwwwwww.checkpoint.com Host wwwwwwww.checkpoint.com not found: 3(NXDOMAIN) root@bt:~/lab_DNS#
root@bt:~/lab_DNS# more script_dns1.sh #!/bin/bash for name in $(cat /pentest/enumeration/dns/dnsenum/dns.txt);do host $name.checkpoint.com done
root@bt:~/lab_DNS# more script_dns2.sh #!/bin/bash for name in $(cat /pentest/enumeration/dns/dnsenum/dns.txt);do host $name.checkpoint.com | grep "has address" done root@bt:~/lab_DNS# ./script_dns2.sh forums.checkpoint.com has address 194.29.38.13 ftp.checkpoint.com has address 194.29.38.25 ftps.checkpoint.com has address 194.29.38.27 mailhost.checkpoint.com has address 194.29.32.199 cale.checkpoint.com has address 194.29.32.199 mx1.checkpoint.com has address 194.29.38.66 ns.checkpoint.com has address 194.29.32.199 ns1.checkpoint.com has address 208.185.174.140 ns2.checkpoint.com has address 208.185.174.141 register.checkpoint.com has address 194.29.38.35 search.us.checkpoint.com has address 209.87.209.207 smtp.checkpoint.com has address 194.29.34.68 www.checkpoint.com has address 216.200.241.66 www.checkpoint.com has address 216.200.241.66 root@bt:~/lab_DNS#
S o l u t i o n C o n s u l t o r i a e T r e i n a m e n t o
root@bt:~/lab_DNS# more script_dns3.sh #!/bin/bash for name in $(cat /pentest/enumeration/dns/dnsenum/dns.txt);do host $name.checkpoint.com | grep "has address" | cut -d" " -f4 done root@bt:~/lab_DNS# ./script_dns3.sh 194.29.38.13 194.29.38.25 194.29.38.27 194.29.32.199 194.29.32.199 194.29.38.66 194.29.32.199 208.185.174.140 208.185.174.141 194.29.38.35 209.87.209.207 194.29.34.68 216.200.241.66 216.200.241.66
root@bt:~/lab_DNS# host 216.200.241.66 66.241.200.216.in-addr.arpa domain name pointer www.checkpoint.com. root@bt:~/lab_DNS# for ip in $(seq 64 79); do host 216.200.241.$ip | grep "domain name pointer" ;done 64.241.200.216.in-addr.arpa domain name pointer 216.200.241.64.available.above.net. 65.241.200.216.in-addr.arpa domain name pointer lata-gw.us.checkpoint.com. 66.241.200.216.in-addr.arpa domain name pointer www.checkpoint.com. 67.241.200.216.in-addr.arpa domain name pointer garmin.us.checkpoint.com. 68.241.200.216.in-addr.arpa domain name pointer flanger.us.checkpoint.com. 69.241.200.216.in-addr.arpa domain name pointer gould.us.checkpoint.com. 70.241.200.216.in-addr.arpa domain name pointer franklin.us.checkpoint.com. 71.241.200.216.in-addr.arpa domain name pointer darwin.us.checkpoint.com. 72.241.200.216.in-addr.arpa domain name pointer artemis.us.checkpoint.com. 73.241.200.216.in-addr.arpa domain name pointer amadeus.us.checkpoint.com. 74.241.200.216.in-addr.arpa domain name pointer streamer.us.checkpoint.com. 75.241.200.216.in-addr.arpa domain name pointer lata1.us.checkpoint.com. 76.241.200.216.in-addr.arpa domain name pointer lata2.us.checkpoint.com. 77.241.200.216.in-addr.arpa domain name pointer davis1.us.checkpoint.com. 78.241.200.216.in-addr.arpa domain name pointer davis2.us.checkpoint.com. 79.241.200.216.in-addr.arpa domain name pointer 216.200.241.79.available.above.net.
S o l u t i o n C o n s u l t o r i a e T r e i n a m e n t o
------tentar com todos servidores de nomes - (primário e secundários)
------fazer com aeoi.org.ir e estacio.br
root@bt:~# host -t ns offensive-security.com offensive-security.com name server ns4.no-ip.com. offensive-security.com name server ns2.no-ip.com. offensive-security.com name server ns1.no-ip.com. offensive-security.com name server ns3.no-ip.com. offensive-security.com name server ns5.no-ip.com. root@bt:~# host -l offensive-security.com ns1.no-ip.com ; Transfer failed. Using domain server: Name: ns1.no-ip.com Address: 204.16.255.55#53 Aliases: Host offensive-security.com.localdomain not found: 9(NOTAUTH) ; Transfer failed.
S o l u t i o n C o n s u l t o r i a e T r e i n a m e n t o
root@bt:/pentest/enumeration/dns/dnsenum# ls dns-big.txt dnsenum.pl dns.txt README.txt root@bt:/pentest/enumeration/dns/dnsenum# ./dnsenum.pl estacio.br estacio.br 5 IN A 200.216.152.71 Name Servers: ns1.estacio.br 5 IN A 200.216.152.249 ns2.estacio.br 5 IN A 200.216.152.250 Mail (MX) Servers: Mail.Global.FrontBridge.com 5 IN A 216.32.180.22 Mail.Global.FrontBridge.com 5 IN A 216.32.181.178 estacio.br 1800 IN TXT estacio.br 1800 IN A 200.216.152.71 1989163337.estacio.br 1800 IN CNAME mail._domainkey.estacio.br 14400 IN TXT agenda.estacio.br 1800 IN A 200.216.152.71 agendaconselho.estacio.br 1800 IN A 200.216.152.71 aluno.estacio.br 1800 IN MX biblioteca.estacio.br 1800 IN CNAME bibliotecasonora.estacio.br 1800 IN A 200.216.152.90 blogdopresidente.estacio.br 1800 IN A 200.216.152.149 bquestoes.estacio.br 1800 IN A 200.216.152.63 adm.bquestoes.estacio.br 1800 IN A 200.216.152.62 provas.bquestoes.estacio.br 1800 IN A 200.216.152.63