Nmap Scripting Engine (NSE) Part 3 - Usage and Cool Scripts

Some other interesting Nmap scripts here. We've got SMB dash O S dash discovery.

There are actually a number of SMB scripts that you can run, but let's start off with this one.

Just to give you a quick idea.

This is obviously just running a single script.

Just running the single script. So it's nice and quick.

And we can see here as query the SMB services and we've got the, we've got those running samba.

We know the computer name, the net bios name, the fully qualified domain name from the SMB query.

Now, if we wanted to find out what are the SMB scripts were there.

Obviously we can look online, we can also do a locate and you can see there's quite a few SMB scripts, including denial of service scripts, and also brute forcing as well as lots of enumeration and discovery and also vulnerability checking.

We click over here. We've got our usual -N -P.

And so no DNS resolution, no discovery, vebose OS detection versioning.

And then you see what we're doing here.

We're going to SMB dash enum.

So then we're adding the star.

So we're doing all of the enums.

Then we're adding these individual ones.

I'm writing it, all the ones with S and we're adding the vulnerability checking ones as well.

So essentially that's pretty much doing all of the SMB checks that aren't overly, time-consuming like brute force attacks.

So we should get most of their discovery information out of this host. There.

This will take a little bit of time, cause there's a number of scripts that that is being run.

So that's finished, let's pop up to the top and then we'll have a look at the results.

We can see quite a few of the results here as we go through.

So here we are.

We can see all of the ports.

We were doing a search for SMB here, so we can see SMB ports there.

And let's start looking at some of the scripts.

So the SMB enum domains you can see account lockout is disabled.

We can see a number of accounts, admin guest, Csilla, Nathan, Jean Bob.

We can see number of shares have been enumerated by the guest account so we can see things like you've got download.

We've got IPC, which anonymous access has read.

Write? There's multimedia public, all sorts of shares are open and available, or at least are potentially accessible with the right username and password users.

We can see again, we've got users more on the users, guests.

Jean Nathan SMB OS discovery has before and some potential vulnerabilities here.

We've got this service, regsvc and Microsoft windows systems vulnerable to denial of service, state vulnerable, and you can see SMB two is enabled, et cetera, et cetera.

So you can see there's quite a few scripts there to dig into and look into for SMB.

Let's pop them to the next tab here.

And here we have minus minus script as usual, and then broadcast minus V broadcast requests can reveal protocol and host details.

This Nmap scripting engine can gather broadcast information from a network with this broadcast script.

So let's run it. And let me show you what you get.

And we can see here, this is doing it pre pre scanning, and it doesn't need an IP address cause it is just purely looking at broadcast. Okay.

So let's go up here as we've got some scripts that ACK targets.

Note that for our next demonstration.

And as we go out here, we can see various broadcast based information.

You can see a printer there on the network.

Go a little bit further up.

We can see that somebody's on 192.168.1.8 is running Dropbox.

We can see DNS service discovery, and we can see we've got some team viewer as well.

So there you go. You can see sort of information you get on broadcast.

And as I said, now, we've got these targets here.

Cause I'm going to show you now more on how you can use the syntax for this.

So say for example, we wanted broadcasts, but we didn't want those targets what we can add in here and not targets.

And then our asterick. And that will do this and not include these target scripts.

So let me just show you an example of that.

Let me just try that again, because that is the wrong sort of quote.

Let's try that again. And there we go.

That's completed. So the same as last time, but it is removed the targets scripts based on and not targets star, so you can use and you can use not, and you can use or. 

The other option here we have is dash dash script dash trace.

Let's just run this.

If this option is specified all incoming and outgoing communication performed by a script is printed.

As you can see here as it's going through it, as it's doing the broadcasts.

So if we scroll up here,

We can see the communication there from this IP, this IP on this port, we can also see a breakdown of some of the communication we've got.

That's a HP, so we can see we've got a printer there doing some of its broadcasts.

And that is the dash dash script dash tray.

The bureaucrats scripts, perform tasks, such as detecting Dropbox listeners, as I've shown you sniffing to detect hosts and discovering things like MSC call and N C P servers among many other things.

And as I said, if the script trace option is specified all incoming and outgoing communication performed by a script is printed.

Let me show you another way of using the syntax for scripts.

You can have not intrusive, so this will run all scripts, but the intrusive scripts.

So it's kind of like an alternative way of running safest scripts.

If you want to look for vulnerabilities and exploits, then you can try the vuln, comma and exploit, which will show you the results of many of the vulnerabilities and exploits scripts, which I'll just run to give you a quick demonstration.

So this will check for specific known vulnerabilities and generally only report results.

If they are found. And here are the results and you go through and see what was interesting here.

We've got, it says that it's a IRC unrealircd backdoor Trojan.

This has actually been run against meth exploitable too.

So there'll be a number of exploits and vulnerabilities that can be found on here and here we can see what it says is an FTP version backdoor, etc.

So that's running vuln and export. You can do IP geo location.

You can get Nmap to tell you the physical location of where an IP addresses, where you will need to install an API key.

And we'll rather get an API key and you will need a database.

So this is the command to run it or do the IP geolocation.

So it's IP geolocation dash and then the asterix.

So you can run all of them. This example, just using Facebook.

I pop over here. Now I'm just doing a locate so we can see all the scripts that it will actually run. And it would be all of these here.

Now for this script here, the MaxMind script, you're going to need an external database.

So you want to download the MaxMind city database and you can download it from the URL on the screen.

We'll do a search for that and extract it into your local Nmap data folder.

So on kali, that happens to be.

On your system, that could be somewhere else.

And for this script here, IP info, DB and API key is needed.

So you need to register this URL here, which I'm just brought up on the screen for you.

This service does not impose a query limit, unlike geo bites as an alternative.

So I highly recommend grabbing your own API key to enable this script. here, this URL.

Then if we pop back here, that will be the command that you would use to enable geo location.

Then a final example for this lecture you can do, who is, this is an example of an external script.

We can run a who is against a target, so let's do it against Facebook and see what we get.

So this will essentially query the who is database against your target.

And you'll get your results back.

And here we can see our information about Facebook and it's owned by Facebook, Inc, which is no surprise.

If we go a little bit further up, we can find some more who is based information.

And of course, we've got our ports as well.