|
|
| Línia 1: |
Línia 1: |
| | {{titol|UF2. Hacking ètic}} | | {{titol|UF2. Hacking ètic}} |
| | ==Exercici d'escaneig de xarxes== | | ==Exercici d'escaneig de xarxes== |
| − | ===Previa===
| |
| − | Tindrem una màquina virtual amb Ubuntu Server amb uns quants serveis instal·lats:
| |
| − | *Apache
| |
| − | *MariaDB (MySQL)
| |
| − | *SSH
| |
| − | *Postfix
| |
| − | *Dovecot
| |
| − |
| |
| − | '''Els objectius són:'''
| |
| − |
| |
| − | '''1. Descobrir els serveis de la xarxa'''
| |
| − | <source>
| |
| − | root@attack-nmap:~# nmap victim-nmap
| |
| − |
| |
| − | Starting Nmap 7.60 ( https://nmap.org ) at 2019-01-30 17:42 UTC
| |
| − | Nmap scan report for victim-nmap (10.16.2.6)
| |
| − | Host is up (0.0063s latency).
| |
| − | Not shown: 995 closed ports
| |
| − | PORT STATE SERVICE
| |
| − | 22/tcp open ssh
| |
| − | 25/tcp open smtp
| |
| − | 80/tcp open http
| |
| − | 143/tcp open imap
| |
| − | 993/tcp open imaps
| |
| − | MAC Address: 08:00:27:85:F6:76 (Oracle VirtualBox virtual NIC)
| |
| − |
| |
| − | Nmap done: 1 IP address (1 host up) scanned in 1.62 seconds
| |
| − | </source>
| |
| − |
| |
| − | '''2. Descobrir quin software executa cada servei mitjançant ''nmap'''''
| |
| − | <source>
| |
| − | root@attack-nmap:~# nmap -sV victim-nmap
| |
| − |
| |
| − | Starting Nmap 7.60 ( https://nmap.org ) at 2019-01-30 17:43 UTC
| |
| − | Nmap scan report for victim-nmap (10.16.2.6)
| |
| − | Host is up (0.00089s latency).
| |
| − | Not shown: 995 closed ports
| |
| − | PORT STATE SERVICE VERSION
| |
| − | 22/tcp open ssh OpenSSH 7.6p1 Ubuntu 4ubuntu0.1 (Ubuntu Linux; protocol 2.0)
| |
| − | 25/tcp open smtp Postfix smtpd
| |
| − | 80/tcp open http Apache httpd 2.4.29 ((Ubuntu))
| |
| − | 143/tcp open imap Dovecot imapd (Ubuntu)
| |
| − | 993/tcp open ssl/imap Dovecot imapd (Ubuntu)
| |
| − | MAC Address: 08:00:27:85:F6:76 (Oracle VirtualBox virtual NIC)
| |
| − | Service Info: Host: localhost.localdomain; OS: Linux; CPE: cpe:/o:linux:linux_kernel
| |
| − |
| |
| − | Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
| |
| − | Nmap done: 1 IP address (1 host up) scanned in 8.13 seconds
| |
| − | </source>
| |
| − | '''3. Esbrina si s'està executant un Firewall al servidor'''
| |
| − | '''4. Configura el Firewall per tal que filtri ICMP i fes una prova de funcionament'''
| |
| − | :''1. Prova de fer ping''
| |
| − | <source>
| |
| − | root@attack-nmap:~# ping victim-nmap -c3
| |
| − | PING victim-nmap (10.16.2.6) 56(84) bytes of data.
| |
| − | 64 bytes from victim-nmap (10.16.2.6): icmp_seq=1 ttl=64 time=0.801 ms
| |
| − | 64 bytes from victim-nmap (10.16.2.6): icmp_seq=2 ttl=64 time=0.915 ms
| |
| − | 64 bytes from victim-nmap (10.16.2.6): icmp_seq=3 ttl=64 time=0.963 ms
| |
| − |
| |
| − | --- victim-nmap ping statistics ---
| |
| − | 3 packets transmitted, 3 received, 0% packet loss, time 2002ms
| |
| − | rtt min/avg/max/mdev = 0.801/0.893/0.963/0.067 ms
| |
| − | </source>
| |
| − |
| |
| − | :''2. Bloqueja amb ''IPTables'' el protocol ICMP''
| |
| − | <source>iptables -A INPUT -p icmp -j REJECT</source>
| |
| − | :''3. Prova el ping''
| |
| − | <source>
| |
| − | root@attack-nmap:~# ping victim-nmap -c3
| |
| − | PING victim-nmap (10.16.2.6) 56(84) bytes of data.
| |
| − | From victim-nmap (10.16.2.6) icmp_seq=1 Destination Port Unreachable
| |
| − | From victim-nmap (10.16.2.6) icmp_seq=2 Destination Port Unreachable
| |
| − | From victim-nmap (10.16.2.6) icmp_seq=3 Destination Port Unreachable
| |
| − |
| |
| − | --- victim-nmap ping statistics ---
| |
| − | 3 packets transmitted, 0 received, +3 errors, 100% packet loss, time 2002ms
| |
| − | </source>
| |
| − |
| |
| − | :''4. Prova el nmap. Funciona? Per què?''
| |
| − | <source>
| |
| − | root@attack-nmap:~# nmap victim-nmap
| |
| − |
| |
| − | Starting Nmap 7.60 ( https://nmap.org ) at 2019-01-30 17:50 UTC
| |
| − | Nmap scan report for victim-nmap (10.16.2.6)
| |
| − | Host is up (0.00071s latency).
| |
| − | Not shown: 995 closed ports
| |
| − | PORT STATE SERVICE
| |
| − | 22/tcp open ssh
| |
| − | 25/tcp open smtp
| |
| − | 80/tcp open http
| |
| − | 143/tcp open imap
| |
| − | 993/tcp open imaps
| |
| − | MAC Address: 08:00:27:85:F6:76 (Oracle VirtualBox virtual NIC)
| |
| − |
| |
| − | Nmap done: 1 IP address (1 host up) scanned in 1.60 seconds
| |
| − | </source>
| |
| − |
| |
| − |
| |
| − | ====Posada a punt====
| |
| − | Crearem una màquina virtual amb Ubuntu Server 18 que actuarà com a víctima <code>victim-nmap</code>. Una altra màquina virtual serà l'atacant <code>attack-nmap</code>. Compartiran la mateixa xarxa de VirtualBox amb una Xarxa NAT que permeti la connexió entre elles: mode ''NAT Network'' a les targetes virtuals.
| |
| − | =====Víctima=====
| |
| − | Instal·larem alguns serveis de prova que no requereixin gaire configuració per a poder fer les proves i explotar vulnerabilitats:
| |
| − | sudo apt install apache2 mariadb-server-10 dovecot-imapd postfix -y
| |
| − |
| |
| − | Farem una neteja de les regles del IPTables per a començar des d'un estat "net"
| |
| − | iptables -F
| |
| − | iptables -X
| |
| − | Això ho farem després de cada repte per tal de no arrossegar brutícia o regles incoherents entre elles.
| |
| − |
| |
| − | =====Atacant=====
| |
| − | Haurem d'instal·lar ''nmap'' per a poder fer els escanejos:
| |
| − | sudo apt install nmap -y
| |
| − |
| |
| − | Segons configuració per DHCP, la màquina atacant té l'adreça 10.16.2.6 i la víctima està a 10.16.2.7. Podem editar l'arxiu <code>/etc/hosts</code> per a poder fer els atacs amb nom de host en comptes d'adreces IP.
| |
| − |
| |
| | ===Reptes=== | | ===Reptes=== |
| | ====Repte 1. ''nmap'' VS ''IPTables''==== | | ====Repte 1. ''nmap'' VS ''IPTables''==== |
