During this exercise, we will demonstrate how the Metasploit framework can be utilized for port-scanning, OS-fingerprinting, and service-identification using an integrated Nmap facility. On your MSFConsole, execute the following commands:
msf> load db_tracker
[*] Successfully loaded plugin: db_tracker
Systemclt start postgresql
Msfdb inint
The database tracker will save the data obtained for the sessions for further use. To start the Nmap scan, input the following:
msf>db_nmap -T Aggressive -sV -n -O -v 192.168.0.7 Starting Nmap 5.00 ( http://nmap.org ) at 2010-11-11 22:34 UTC NSE: Loaded 3 scripts for scanning. Initiating ARP Ping Scan at 22:34 Scanning 192.168.0.7 [1 port] Completed ARP Ping Scan at 22:34, 0.00s elapsed (1 total hosts) Initiating SYN Stealth Scan at 22:34 Scanning 192.168.0.7 [1000 ports] Discovered open port 445/tcp on 192.168.0.7 Discovered open port 135/tcp on 192.168.0.7 Discovered open port 25/tcp on 192.168.0.7 Discovered open port 139/tcp on 192.168.0.7 Discovered open port 3389/tcp on 192.168.0.7 Discovered open port 80/tcp on 192.168.0.7 Discovered open port 443/tcp on 192.168.0.7 Discovered open port 21/tcp on 192.168.0.7 Discovered open port 1025/tcp on 192.168.0.7 Discovered open port 1433/tcp on 192.168.0.7 Completed SYN Stealth Scan at 22:34, 3.04s elapsed (1000 total ports) Initiating Service scan at 22:34
Scanning 10 services on 192.168.0.7
Completed Service scan at 22:35, 15.15s elapsed (10 services on 1 host)
Initiating OS detection (try #1) against 192.168.0.7
...
PORT STATE SERVICE VERSION
21/tcpopen ftp Microsoft ftpd
25/tcpopen smtp Microsoft ESMTP 6.0.2600.2180
80/tcpopen http Microsoft IIS httpd 5.1
135/tcp openmsrpc Microsoft Windows RPC
139/tcp opennetbios-ssn
443/tcp open https?
445/tcp openmicrosoft-ds Microsoft Windows XP microsoft-ds
1025/tcpopen msrpc Microsoft Windows RPC
1433/tcpopen ms-sql-s Microsoft SQL Server 2005 9.00.1399; RTM
3389/tcpopen microsoft-rdp Microsoft Terminal Service
MAC Address: 00:0B:6B:68:19:91 (WistronNeweb)
Device type: general purpose
Running: Microsoft Windows 2000|XP|2003
OS details: Microsoft Windows 2000 SP2 - SP4, Windows XP SP2 - SP3, or Windows Server 2003 SP0 - SP2
Network Distance: 1 hop
TCP Sequence Prediction: Difficulty=263 (Good luck!)
IP ID Sequence Generation: Incremental
Service Info: Host: custdesk; OS: Windows
...
Nmap done: 1 IP address (1 host up) scanned in 20.55 seconds
Raw packets sent: 1026 (45.856KB) | Rcvd: 1024 (42.688KB)
At this point, we have successfully scanned our target and saved the results in our current database session. To list the target and services discovered, you can issue the db_hosts and db_services commands independently. Additionally, if you have already scanned your target using the Nmap program separately and saved the result in the XML format, you can import these results into Metasploit using the db_import_nmap_xml command.