DC: Domain Controller
|192.168.31.131
| | Client1: Win 10 Enterprise | 192.168.31.132 | | Client2: Windows 10 Pro | 192.168.31.133 | This lab is intended to practice certain vulnerabilities of various types, some of them detailed below: | | | | -------------------------------------------------------------------------------------------------------------------------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------- | |PORT STATE SERVICE
53/tcp open domain
88/tcp open kerberos-sec
135/tcp open msrpc
139/tcp open netbios-ssn
389/tcp open ldap
445/tcp open microsoft-ds
464/tcp open kpasswd5
593/tcp open http-rpc-epmap
636/tcp open ldapssl
3268/tcp open globalcatLDAP
3269/tcp open globalcatLDAPssl
| | Network distance to the host | 1 hop | | Possible Operating System Version (Example host) | Windows XP SP3 or Windows Server 2012 | ### Scanning specific ports. To scan certain ports we can use the switch `-p` which allows us to specify a series of specific ports to scan. The command looks like this: {% hint style="success" %} nmap -p 53,88,389,445 192.168.31.134 {% endhint %}  This way we can scan the desired ports. If we want to scan a particular range of ports we can do it as follows: {% hint style="success" %} nmap -p 54-445 192.168.31.131 {% endhint %}  ### Scanning all ports (65535). If instead we want to scan all ports we can do it as follows, using the switch `-p-`. The command looks like this: {% hint style="success" %} nmap -p- 192.168.31.131 {% endhint %} {% hint style="warning" %} For this particular host I used the switch `-Pn` which allows us to tell nmap not to perform pings. Necessary for targets that do not respond to ping (ICMP) echo requests. {% endhint %}  ### Version Scan. To perform a scan that helps us identify the versions of the services running on the target we can use the following switch `-sV`. The command looks like this: {% hint style="success" %} nmap -sV 192.168.31.131 {% endhint %}  ### TCP/IP Full Open Scan If we want to perform a fully open scan, we can use the switch `-sT`. In this type of scan it generally ensures a response since the session is initiated in full (SYN, SYN+ACK, ACK, RST). {% hint style="danger" %} Important: This scan is easily detected by firewalls and other security measures. {% endhint %} To perform this scan the command is as follows: {% hint style="success" %} nmap -sT 192.168.31.131 {% endhint %}  ### Stealth Scan (Half-open) In many cases we need to perform scans without alerting or triggering detections on the target side. For these cases nmap has the switch `-sS`. In this type of scan the session does not complete correctly, and only the packets **`SYC, SYNC+ACK and RST`** are used. When the target responds, the client instead of responding with **`ACK`** responds directly with **`RST`**. {% hint style="warning" %} **This command requires privileges to run (sudo).** {% endhint %} To run this type of scan the command looks like this: {% hint style="success" %} nmap -sS 192.168.31.131 {% endhint %}  {% hint style="warning" %} As I explained before the additional switch **`-Pn`** is necessary for hosts that do not respond to ping requests (ICMP Echo Requests) as is the case with this target I am using. {% endhint %} ### Scan machines on the network If we want to get an overview of the machines that are active on the network we are scanning we can use the switch `-sP`. It may take some time to finish depending on how extensive our network is. In this case the target lab is quite small. We can use the command like this: {% hint style="success" %} nmap -sP 192.168.31.\* {% endhint %} Note that in this case we are passing part of the IP, and indicate the last value as `*` so that nmap automatically scans all the machines that are part of the same subnet.  Alternatively we can use the switches **`-PS (SYN Ping) or -PR (ARP Scan)`** which return results like these:  For the moment we will not explain the use of the additional switches/flags that you can see in the previous image. We will cover those later in this exercise. ### Scan with Default scripts Nmap includes scripts (NSE) that allow us to indicate if during the scan we also want nmap to try to run the scripts it comes with. These scripts test common vulnerabilities that can provide good information about the target and about how to exploit them to gain access. This is done using the switch `-sC`. The command for this type of scan is the following: {% hint style="success" %} **nmap -sC 192.168.31.131** {% endhint %}  We see that the results we obtain include a lot of information about the domain controller (in this case) scanned. These results vary depending on which target we are scanning and which vulnerabilities nmap can detect for each particular case. ## Part 2: Multiple scans. In this part of the practical we will see some more advanced scans and begin to use several switches or flags at the same time in our commands. Let's say I want to quickly obtain all the information we saw in the individual scans, to have an overall view of the target as soon as possible. Normally when I run a scan with nmap for a lab I start keeping the following in mind: * Types of data I need to obtain * Types of data I would like to obtain * How quickly I want to obtain the results Usually in practice labs or Capture The Flag type challenges, I use the following set of nmap switches or flags: {% hint style="success" %} sudo nmap -sC -sV -Pn -p- -T5 -O -v -oN results 192.168.31.131 {% endhint %} As we can see in that previous line, there are several new switches or flags that we are passing to nmap that we have not seen in this exercise yet. Let's see one by one what function they perform. | Switch/Flag | Function | | :-------------------: | -------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | **-T5** | Indicates the scan speed. Possible values 1 to 5, with 5 being the highest. (Increases the likelihood of our scan being detected by the target's defense mechanisms) | | **-v** | Tells nmap to produce verbose output, providing the user with a lot of detail about each scan and its result. | | **-oN \53 (domain Simple DNS Plus)
135 (MS Windows RPC)
139 (MS Netbios SSN)
445 (MS DS)
49703 (MS Win RPC)
9389 (.NET Message Framing)
49667 ( MS Win RPC)
3268 (MS Active Directory LDAP)
3269 (MS Active Directory LDAP)
636 (SSL LDAP)
49674 (MS Win RPC)
49666 (MS Win RPC)
593 (MS Win RPC Over HTTP 1.0)
5985 (Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP))
49673 (Microsoft Win RPC over HTTP 1.0)
88 (MS Kerberos)
464 (kpasswd5)
49710 (MS Win RPC)
49686 (MS Win RPC)
389 (MS Active Directory LDAP).
| | **Domain Controller Domain Name** | Chukaro-DC.CHUKARO.local | | **Operating System** | MS Windows | | **Active machines in the DC's subnet** |192.168.31.1
192.168.31.2
192.168.31.131 (DC)
192.168.31.31.132 (Client1)
192.168.31.31.133 (Client2)
192.168.31.31.134
| | {% endtab %} | | | {% endtabs %} | | This is where we finish this nmap scanning exercise; we saw how to execute different types of scans to obtain various pieces of information and learned the basic use of nmap. {% hint style="info" %} These exercises are subject to modifications and corrections, the most up-to-date version available is online at [the following link](https://tzero86.gitbook.io/tzero86/). {% endhint %} --- # Agent Instructions: Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter: ``` GET https://tzero86.gitbook.io/tzero86/scanning/running-scans-with-nmap.md?ask=