Nmap-03：Nmap识别目标机器上服务的指纹

灰太狼 2022-12-07 11:38 327阅读 0赞

**目录**

1.服务指纹介绍

2.Nmap识别服务指纹

3.Nmap侵略性的探测

--------------------

# 1.服务指纹介绍 #

为了确保有一个成功的渗透测试或者网络设备监控，必须需要知道目标系统中服务的指纹信息。服务指纹信息包括服务端口、服务名和版本等。

通过分析目标往Nmap中发送的数据包中某些协议标记、选项和数据，我们可以推断发送这些数据包的操作系统等。

**Nmap通过向目标主机发送多个UDP与TCP数据包并分析其响应来进行操作系统指纹识别工作。**

# **2.Nmap识别服务指纹** #

我们通过使用命令 **nmap -sV IP地址 来识别目标机器的服务信息**。

![watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L1N1eWViaXViaXU_size_16_color_FFFFFF_t_70][]

# 3.Nmap侵略性的探测 #

可以直接使用命令：**nmap -A -v -T4 IP地址  ，来探测目标机器的操作系统、服务等信息**。-A表示侵略性探测，-v表示持续输出探测结果，-T4加快探测速度（T范围是1到5）。

suye@ubuntu:~$ nmap -A -v -T4 192.168.3.118
    
    Starting Nmap 7.60 ( https://nmap.org ) at 2020-09-15 11:07 CST
    NSE: Loaded 146 scripts for scanning.
    NSE: Script Pre-scanning.
    Initiating NSE at 11:07
    Completed NSE at 11:07, 0.00s elapsed
    Initiating NSE at 11:07
    Completed NSE at 11:07, 0.00s elapsed
    Initiating Ping Scan at 11:07
    Scanning 192.168.3.118 [2 ports]
    Completed Ping Scan at 11:07, 0.00s elapsed (1 total hosts)
    Initiating Parallel DNS resolution of 1 host. at 11:07
    Completed Parallel DNS resolution of 1 host. at 11:07, 0.00s elapsed
    Initiating Connect Scan at 11:07
    Scanning ubuntu.lan (192.168.3.118) [1000 ports]
    Discovered open port 139/tcp on 192.168.3.118
    Discovered open port 22/tcp on 192.168.3.118
    Discovered open port 445/tcp on 192.168.3.118
    Completed Connect Scan at 11:07, 0.02s elapsed (1000 total ports)
    Initiating Service scan at 11:07
    Scanning 3 services on ubuntu.lan (192.168.3.118)
    Completed Service scan at 11:07, 11.02s elapsed (3 services on 1 host)
    NSE: Script scanning 192.168.3.118.
    Initiating NSE at 11:07
    Completed NSE at 11:07, 5.16s elapsed
    Initiating NSE at 11:07
    Completed NSE at 11:07, 0.00s elapsed
    Nmap scan report for ubuntu.lan (192.168.3.118)
    Host is up (0.00013s latency).
    Not shown: 997 closed ports
    PORT    STATE SERVICE     VERSION
    22/tcp  open  ssh         OpenSSH 7.6p1 Ubuntu 4ubuntu0.3 (Ubuntu Linux; protocol 2.0)
    | ssh-hostkey: 
    |   2048 a8:80:ce:80:d0:bc:0b:8e:46:cf:4b:00:5f:2b:58:b7 (RSA)
    |   256 5c:01:f0:29:63:fc:ef:1e:85:4f:84:dd:7c:c1:e1:e1 (ECDSA)
    |_  256 e3:6d:d5:cb:30:c3:37:80:08:ee:6b:3b:44:3b:c0:85 (EdDSA)
    139/tcp open  netbios-ssn Samba smbd 3.X - 4.X (workgroup: WORKGROUP)
    445/tcp open  netbios-ssn Samba smbd 4.7.6-Ubuntu (workgroup: WORKGROUP)
    Service Info: Host: UBUNTU; OS: Linux; CPE: cpe:/o:linux:linux_kernel
    
    Host script results:
    | nbstat: NetBIOS name: UBUNTU, NetBIOS user: <unknown>, NetBIOS MAC: <unknown> (unknown)
    | Names:
    |   UBUNTU<00>           Flags: <unique><active>
    |   UBUNTU<03>           Flags: <unique><active>
    |   UBUNTU<20>           Flags: <unique><active>
    |   \x01\x02__MSBROWSE__\x02<01>  Flags: <group><active>
    |   WORKGROUP<00>        Flags: <group><active>
    |   WORKGROUP<1d>        Flags: <unique><active>
    |_  WORKGROUP<1e>        Flags: <group><active>
    | smb-os-discovery: 
    |   OS: Windows 6.1 (Samba 4.7.6-Ubuntu)
    |   Computer name: ubuntu
    |   NetBIOS computer name: UBUNTU\x00
    |   Domain name: lan
    |   FQDN: ubuntu.lan
    |_  System time: 2020-09-15T11:07:33+08:00
    | smb-security-mode: 
    |   account_used: guest
    |   authentication_level: user
    |   challenge_response: supported
    |_  message_signing: disabled (dangerous, but default)
    | smb2-security-mode: 
    |   2.02: 
    |_    Message signing enabled but not required
    | smb2-time: 
    |   date: 2020-09-15 11:07:33
    |_  start_date: 1601-01-01 08:05:43
    
    NSE: Script Post-scanning.
    Initiating NSE at 11:07
    Completed NSE at 11:07, 0.00s elapsed
    Initiating NSE at 11:07
    Completed NSE at 11:07, 0.00s elapsed
    Read data files from: /usr/bin/../share/nmap
    Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
    Nmap done: 1 IP address (1 host up) scanned in 17.07 seconds
    suye@ubuntu:~$

也可以使用 **nmap -sC -sV -O IP地址 ，来探测目标机器上操作系统、服务等信息(需要用到root权限)**。其中sC参数表示使用Nmap脚本来进行探测，sV表示探测机器上的服务信息，O表示探测目标机器的操作系统信息。 -sC：equivalent to --script=default.

suye@ubuntu:~$ nmap -sC -sV -O 192.168.3.109
    TCP/IP fingerprinting (for OS scan) requires root privileges.
    QUITTING!
    suye@ubuntu:~$ sudo nmap -sC -sV -O 192.168.3.118
    [sudo] suye 的密码： 
    
    Starting Nmap 7.60 ( https://nmap.org ) at 2020-09-15 11:19 CST
    Nmap scan report for ubuntu.lan (192.168.3.118)
    Host is up (0.000017s latency).
    Not shown: 997 closed ports
    PORT    STATE SERVICE     VERSION
    22/tcp  open  ssh         OpenSSH 7.6p1 Ubuntu 4ubuntu0.3 (Ubuntu Linux; protocol 2.0)
    | ssh-hostkey: 
    |   2048 a8:80:ce:80:d0:bc:0b:8e:46:cf:4b:00:5f:2b:58:b7 (RSA)
    |   256 5c:01:f0:29:63:fc:ef:1e:85:4f:84:dd:7c:c1:e1:e1 (ECDSA)
    |_  256 e3:6d:d5:cb:30:c3:37:80:08:ee:6b:3b:44:3b:c0:85 (EdDSA)
    139/tcp open  netbios-ssn Samba smbd 3.X - 4.X (workgroup: WORKGROUP)
    445/tcp open  netbios-ssn Samba smbd 4.7.6-Ubuntu (workgroup: WORKGROUP)
    Device type: general purpose
    Running: Linux 2.6.X
    OS CPE: cpe:/o:linux:linux_kernel:2.6.32
    OS details: Linux 2.6.32
    Network Distance: 0 hops
    Service Info: Host: UBUNTU; OS: Linux; CPE: cpe:/o:linux:linux_kernel
    
    Host script results:
    |_nbstat: NetBIOS name: UBUNTU, NetBIOS user: <unknown>, NetBIOS MAC: <unknown> (unknown)
    | smb-os-discovery: 
    |   OS: Windows 6.1 (Samba 4.7.6-Ubuntu)
    |   Computer name: ubuntu
    |   NetBIOS computer name: UBUNTU\x00
    |   Domain name: lan
    |   FQDN: ubuntu.lan
    |_  System time: 2020-09-15T11:20:07+08:00
    | smb-security-mode: 
    |   account_used: guest
    |   authentication_level: user
    |   challenge_response: supported
    |_  message_signing: disabled (dangerous, but default)
    | smb2-security-mode: 
    |   2.02: 
    |_    Message signing enabled but not required
    | smb2-time: 
    |   date: 2020-09-15 11:20:07
    |_  start_date: 1601-01-01 08:05:43
    
    OS and Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
    Nmap done: 1 IP address (1 host up) scanned in 15.65 seconds

[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L1N1eWViaXViaXU_size_16_color_FFFFFF_t_70]: /images/20221123/c4b0990ef3f648e99d995c648e40c76b.png