ctf：kali2：端口扫描:nmap和portscan

最新推荐文章于 2024-09-08 19:53:01 发布

回到未来望过去

最新推荐文章于 2024-09-08 19:53:01 发布

阅读量1.3k

点赞数

分类专栏： ctf 文章标签： linux 服务器运维

本文链接：https://blog.csdn.net/viviliving/article/details/128257384

版权

ctf 专栏收录该内容

18 篇文章

订阅专栏

本文展示了如何使用Nmap进行端口和服务版本扫描，并通过Metasploit框架的TCP端口扫描模块验证开放端口。扫描结果揭示了目标主机上开放的服务，包括SSH、HTTP、IMAP等。

摘要生成于 C知道，由 DeepSeek-R1 满血版支持，前往体验 >

直接使用nmap无需use

msf6 auxiliary(scanner/mysql/mysql_login) > nmap -O -sV 192.168.3.54
[*] exec: nmap -O -sV 192.168.3.54

Starting Nmap 7.93 ( https://nmap.org ) at 2022-12-09 05:11 EST
Nmap scan report for 192.168.3.54
Host is up (0.00037s latency).
Not shown: 991 closed tcp ports (reset)
PORT STATE SERVICE VERSION
22/tcp open ssh OpenSSH 5.3p1 Debian 3ubuntu4 (Ubuntu Linux; protocol 2.0)
80/tcp open http Apache httpd 2.2.14 ((Ubuntu) mod_mono/2.4.3 PHP/5.3.2-1ubuntu4.30 with Suhosin-Patch proxy_html/3.0.1 mod_python/3.3.1 Python/2.6.5 mod_ssl/2.2.14 OpenSSL...)
139/tcp open netbios-ssn Samba smbd 3.X - 4.X (workgroup: WORKGROUP)
143/tcp open imap Courier Imapd (released 2008)
443/tcp open ssl/https?
445/tcp open netbios-ssn Samba smbd 3.X - 4.X (workgroup: WORKGROUP)
5001/tcp open java-object Java Object Serialization
8080/tcp open http Apache Tomcat/Coyote JSP engine 1.1
8081/tcp open http Jetty 6.1.25
1 service unrecognized despite returning data. If you know the service/version, please submit the following fingerprint at https://nmap.org/cgi-bin/submit.cgi?new-service :
SF-Port5001-TCP:V=7.93%I=7%D=12/9%Time=639309C6%P=x86_64-pc-linux-gnu%r(NU
SF:LL,4,"\xac\xed\0\x05");
MAC Address: 08:00:27:51:C0:85 (Oracle VirtualBox virtual NIC)
Device type: general purpose
Running: Linux 2.6.X
OS CPE: cpe:/o:linux:linux_kernel:2.6
OS details: Linux 2.6.17 - 2.6.36
Network Distance: 1 hop
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel

OS and Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 13.70 seconds
msf6 auxiliary(scanner/mysql/mysql_login) > search portscan

Matching Modules
================

# Name Disclosure Date Rank Check Description
- ---- --------------- ---- ----- -----------
0 auxiliary/scanner/portscan/ftpbounce normal No FTP Bounce Port Scanner
1 auxiliary/scanner/natpmp/natpmp_portscan normal No NAT-PMP External Port Scanner
2 auxiliary/scanner/sap/sap_router_portscanner normal No SAPRouter Port Scanner
3 auxiliary/scanner/portscan/xmas normal No TCP "XMas" Port Scanner
4 auxiliary/scanner/portscan/ack normal No TCP ACK Firewall Scanner
5 auxiliary/scanner/portscan/tcp normal No TCP Port Scanner
6 auxiliary/scanner/portscan/syn normal No TCP SYN Port Scanner
7 auxiliary/scanner/http/wordpress_pingback_access normal No Wordpress Pingback Locator

Interact with a module by name or index. For example info 7, use 7 or use auxiliary/scanner/http/wordpress_pingback_access

msf6 auxiliary(scanner/mysql/mysql_login) > use auxiliary/scanner/portscan/tcp
msf6 auxiliary(scanner/portscan/tcp) > show options

Module options (auxiliary/scanner/portscan/tcp):

Name Current Setting Required Description
---- --------------- -------- -----------
CONCURRENCY 10 yes The number of concurrent ports to check per host
DELAY 0 yes The delay between connections, per thread, in milliseconds
JITTER 0 yes The delay jitter factor (maximum value by which to +/- DELAY) in milliseconds.
PORTS 1-10000 yes Ports to scan (e.g. 22-25,80,110-900)
RHOSTS yes The target host(s), see https://github.com/rapid7/metasploit-framework/wiki/Using-Metasploit
THREADS 1 yes The number of concurrent threads (max one per host)
TIMEOUT 1000 yes The socket connect timeout in milliseconds

View the full module info with the info, or info -d command.

msf6 auxiliary(scanner/portscan/tcp) > set RHOSTS 192.168.3.54
RHOSTS => 192.168.3.54
msf6 auxiliary(scanner/portscan/tcp) > exploit

[+] 192.168.3.54: - 192.168.3.54:22 - TCP OPEN
[+] 192.168.3.54: - 192.168.3.54:80 - TCP OPEN
[+] 192.168.3.54: - 192.168.3.54:139 - TCP OPEN
[+] 192.168.3.54: - 192.168.3.54:143 - TCP OPEN
[+] 192.168.3.54: - 192.168.3.54:445 - TCP OPEN
[+] 192.168.3.54: - 192.168.3.54:443 - TCP OPEN
[+] 192.168.3.54: - 192.168.3.54:5001 - TCP OPEN
[+] 192.168.3.54: - 192.168.3.54:8080 - TCP OPEN
[+] 192.168.3.54: - 192.168.3.54:8081 - TCP OPEN
[*] 192.168.3.54: - Scanned 1 of 1 hosts (100% complete)
[*] Auxiliary module execution completed
msf6 auxiliary(scanner/portscan/tcp) > back
msf6 >