Awesome Open Source
Awesome Open Source

ObsidianSailboat

Nmap and NSE command line wrapper

the vision

A tool that integrates a bunch of NSE scripts together to build a picture of a host that we can reason over and discover various properties. I got sick of either losing data about hosts (dropping it on the floor), wrapping glue code to bridge from one tool to another, and the tons of boilerplate calls I make to various NSE scripts.

This is designed to couple to tools like recon-ng, SET, metasploit, and w3af for discovery, mapping, and footprinting.

usage

The commands borrow models like set, setg, and the like from Metasploit.

Command Description Example
add Add a host by IP or hostname add 1.2.3.4
back Return to the top level command back
banner Prints a random OSail banner banner
detail Get detailed info about a host detail 1.2.3.4
exit Exits OSail exit
export Exports a workspace to an Nmap XML file export /path/file.xml
getf Get the module's Nmap flags getf
getg Get global option information getg
help List available commands with "help" or detailed help with "help cmd". help
hosts Show info about known hosts hosts
import Import an Nmap XML file and add information import nmap /path/to/nmap.xml
import Import hosts and ports from a Recon-NG workspace import recon-ng workspacename
ports Show known hosts, ports, and information ports, ports state open, ports 1.2.3.4, ports port 22
rescan Rescans NSE directory rescan
restore Replays a session from a savefile restore mycmds.txt
run Runs the selected module run
search Searches modules for the argument search tftp
set Set a module specific option set RHOST 1.2.3.0/24
setf Set a global flag setf -P0
setg Set a global option setg --scan-delay 99
show Show information about modules or results: 'vulns', 'info', 'description', 'results' show info
sleep Sleep for N seconds sleep 2
unset Unset the option unset RHOST
unsetf Unsets a flag unsetf -R
use Use the selected module use intrusive/tftp/tftp-enum
version Displays the Nmap version version
workspace Show, change, or create a workspace workspace add customer, workspace select customer

Hosts are defined in the RHOST option, much like Metasploit. Like Metasploit and Recon-ng, if you see (or set) the option "default" it will enumerate targets from the hosts it's identified.

Often I will use the host discovery modules - aka discovery/ping/host-discovery or discovery/tcp/masscan-discovery - and set RHOST to a CIDR network and let those modules run and find live hosts. Then future modules I choose - e.g. discovery/banner - will scan only those live hosts.

For flags, OSail tries to be smart about stuff, but it can always be smarter. It determines if the script calls external services (e.g. enrichment APIs) and sets the appropriate flags. It could be a lot smarter at helping scale Nmap, it often chumps out on large scans (a lot of dest IPs and port combined).

requirements

Because ObsidianSailboat wraps Nmap, you must have Nmap installed. You can see more about the large body of NSE scripts available at the NSEDoc site.

Optionally you can install Masscan for high throughput wide area host discovery. I use this when doing host enumeration, for instance.

preparing and installing

I run OSail on Kali Linux, which has Nmap and Masscan installed. Tested working on dotnet core versions 2.2 and 3.0.

You'll have to install the dotnet core, and while we're at it we'll install aptitude as well. You have to add a couple of dependencies, add the MS repo info, and then install the dotnet-sdk package:

$ wget -q https://packages.microsoft.com/config/ubuntu/19.04/packages-microsoft-prod.deb -O packages-microsoft-prod.deb
$ sudo dpkg -i packages-microsoft-prod.deb
$ sudo apt-get update
$ sudo apt-get install apt-transport-https
$ sudo apt-get update
$ sudo apt-get install dotnet-sdk-3.0

building

To install dependencies and build use dotnet core and run:

$ dotnet restore

To run use:

$ dotnet run

example session

[+] ObsidianSailboat starting up ...

    O))))     O))                     O))                        O)) O)                O))O))                            O))
  O))    O))  O))              O)     O)) O)                   O))    O))           O) O))O))                            O))
O))        O))O))       O))))         O))      O))    O)) O))   O))         O))        O))O))         O))       O))    O)O) O)
O))        O))O)) O))  O))    O)) O)) O))O)) O))  O))  O))  O))   O))     O))  O)) O)) O))O)) O))   O))  O))  O))  O))   O))
O))        O))O))   O))  O))) O))O)   O))O))O))   O))  O))  O))      O)) O))   O)) O)) O))O))   O))O))    O))O))   O))   O))
  O))     O)) O))   O))    O))O))O)   O))O))O))   O))  O))  O))O))    O))O))   O)) O)) O))O))   O)) O))  O)) O))   O))   O))
    O))))     O)) O))  O)) O))O)) O)) O))O))  O)) O)))O)))  O))  O)) O)    O)) O)))O))O)))O)) O))     O))      O)) O)))   O))



[+] Welcome to ObsidianSailboat
[+] Loaded 568 modules
osail > use discovery/tcp/
discovery/tcp/connect           discovery/tcp/service-discovery discovery/tcp/syn
osail > use discovery/tcp/service-discovery
osail default(tcp-service-discovery)> set RHOST 159.89.225.14
osail default(tcp-service-discovery)> unset RPORT
osail default(tcp-service-discovery)> show info
      Name: tcp-service-discovery
    Module: /usr/bin/nmap
 Author(s): Fyodor
   License: Nmap--See https://nmap.org/book/man-legal.html
Categories: default, safe, version, discovery

Options:
  Name                      Current Setting    Description
  ----                      ---------------    -----------
  --version-intensity       2                  Set from 0 (light) to 9 (try all probes)
  RHOST                     159.89.225.14      The target address
  RPORT                                        The target port

Description:
 Probe open ports to determine service/version info

osail default(tcp-service-discovery)> run
[*] /usr/bin/nmap  -sV -A -oX - --version-intensity=2 --host-timeout=10 --dns-servers=8.8.8.8 --max-retries=10 --max-scan-delay=0 --min-parallelism=1 --scan-delay=0 --max-parallelism=100 159.89.225.14

[+] Nmap done at Sat Mar 17 01:08:13 2018; 1 IP address (1 host up) scanned in 7.85 seconds
[+] 159.89.225.14
[+] Anonymous FTP login allowed (FTP code 230)
-rw-r--r--    1 0        0           37412 Feb 17 16:49 1337
-rw-r--r--    1 0        0           37411 Feb 17 16:49 bazooka
-rw-r--r--    1 0        0           37422 Feb 17 21:09 bot.php
-rw-r--r--    1 0        0           38192 Feb 17 16:49 cyber
-rw-r--r--    1 0        0            2117 Feb 17 16:49 cyberinfo
-rw-r--r--    1 0        0           37421 Feb 17 16:49 cybernetikus
-rw-r--r--    1 0        0           37415 Feb 25 20:25 duck
-rw-r--r--    1 0        0           39045 Feb 25 20:16 duckperlbot
-rw-r--r--    1 0        0          668568 Feb 17 16:49 miner
-rw-r--r--    1 0        0           38164 Feb 20 17:19 pwlamea
-rw-r--r--    1 0        0           39082 Feb 28 10:59 salpa
-rw-r--r--    1 0        0           37406 Feb 17 16:49 xmlrpc
[+] bounce working!
[+]
  STAT:
FTP server status:
     Connected to ::ffff:x.x.x.x
     Logged in as ftp
     TYPE: ASCII
     No session bandwidth limit
     Session timeout in seconds is 300
     Control connection is plain text
     Data connections will be plain text
     At session startup, client count was 16
     vsFTPd 3.0.3 - secure, fast, stable
End of status
[+]
  2048 32:9c:3f:17:95:6c:3f:6e:3c:ee:c6:f7:9b:d8:00:56 (RSA)
  256 43:ff:5a:8c:3a:06:5c:8a:37:1a:7c:69:6b:d5:a2:40 (ECDSA)
  256 a9:c8:ca:d7:97:50:47:aa:fa:ed:51:46:2e:af:ba:f9 (ED25519)
osail default(tcp-service-discovery)>
osail default(tcp-service-discovery)> hosts 159.89.225.14
    Host                 Hostname
    ----                 --------
    159.89.225.14
    Port 25/tcp (smtp): 	State: filtered
        CPE
           None
        Analysis
    Port 21/tcp (ftp): 	State: open
        CPE
           cpe:/a:vsftpd:vsftpd:3.0.3
        Analysis
           ftp-syst
               STAT=
FTP server status:
     Connected to ::ffff:x.x.x.x
     Logged in as ftp
     TYPE: ASCII
     No session bandwidth limit
     Session timeout in seconds is 300
     Control connection is plain text
     Data connections will be plain text
     At session startup, client count was 16
     vsFTPd 3.0.3 - secure, fast, stable
End of status
    Port 22/tcp (unknown): 	State: open
        CPE
           cpe:/a:openbsd:openssh:7.2p2
        Analysis
           ssh-hostkey
               a9c8cad7975047aafaed51462eafbaf9
               ecdsa-sha2-nistp256
               329c3f17956c3f6e3ceec6f79bd80056
               ssh-ed25519
               43ff5a8c3a065c8a371a7c696bd5a240
               AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBCVPtJldY/DLYM/YF33JwtJxAexVvfngTPQ7AC/yhJe89sbilgT1QbjdMTiUiaZzdsOGcUIEmi0Er/Weqewhk7E=
               256
               AAAAB3NzaC1yc2EAAAADAQABAAABAQC8XmX6NUku0CcKR6F5tfOnKRkw1ndqmjLRMniykYj4vVjLnpUlxokTdUCi/KR09H1z8kNk3869xW7nu9fN0vhMuOhmCBjKBTWiWzMd7s6JWrzH0ArKQsT9+UpOrf74n3LoxtgmuXmjW8Am/FW7spsFb/b8e/s1s/Gtzs0aVQ+KuRr6Qr9dz3j6c/dLZLP3sKKBFjiIOHjPputPO/17x8Hhs92fhHc5LNtoGKd4Te7duCt+HlJ7mXgq4uPRuboguY3dtfDVdBUoOsOjkXLObyWjk8e534sKhpP8AWgw6txiTHr+DvBMyeU8BtzMjdsWAT7G6yyq84uQCb5TIAhY2/z3
               2048.0
               AAAAC3NzaC1lZDI1NTE5AAAAINCNGhPoag3xFg0X2gsxDkQy/xkye2fZ7yHVYYXpqQ3y
               ssh-rsa
               a9c8cad7975047aafaed51462eafbaf9
               ecdsa-sha2-nistp256
               329c3f17956c3f6e3ceec6f79bd80056
               ssh-ed25519
               43ff5a8c3a065c8a371a7c696bd5a240
               AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBCVPtJldY/DLYM/YF33JwtJxAexVvfngTPQ7AC/yhJe89sbilgT1QbjdMTiUiaZzdsOGcUIEmi0Er/Weqewhk7E=
               256
               AAAAB3NzaC1yc2EAAAADAQABAAABAQC8XmX6NUku0CcKR6F5tfOnKRkw1ndqmjLRMniykYj4vVjLnpUlxokTdUCi/KR09H1z8kNk3869xW7nu9fN0vhMuOhmCBjKBTWiWzMd7s6JWrzH0ArKQsT9+UpOrf74n3LoxtgmuXmjW8Am/FW7spsFb/b8e/s1s/Gtzs0aVQ+KuRr6Qr9dz3j6c/dLZLP3sKKBFjiIOHjPputPO/17x8Hhs92fhHc5LNtoGKd4Te7duCt+HlJ7mXgq4uPRuboguY3dtfDVdBUoOsOjkXLObyWjk8e534sKhpP8AWgw6txiTHr+DvBMyeU8BtzMjdsWAT7G6yyq84uQCb5TIAhY2/z3
               2048.0
               AAAAC3NzaC1lZDI1NTE5AAAAINCNGhPoag3xFg0X2gsxDkQy/xkye2fZ7yHVYYXpqQ3y
               ssh-rsa
    Port 554/tcp (tcpwrapped): 	State: open
        CPE
           None
        Analysis
    Port 7070/tcp (tcpwrapped): 	State: open
        CPE
           None
        Analysis
    Port 445/tcp (microsoft-ds): 	State: filtered
        CPE
           None
        Analysis
    Port 135/tcp (msrpc): 	State: filtered
        CPE
           None
        Analysis
    Port 139/tcp (netbios-ssn): 	State: filtered
        CPE
           None
        Analysis
osail default(tcp-service-discovery)> ports 159.89.225.14
[-] Error, expected filter field
osail default(tcp-service-discovery)> ports
host  port  state
osail default(tcp-service-discovery)> ports hos
osail default(tcp-service-discovery)> ports host 159.89.225.14
    Host                 Hostname                                            Proto       Port State            Service    CPE
    ----                 --------                                            -----       ---- -----            -------    ---
    159.89.225.14                                                              tcp        135 filtered         msrpc
    159.89.225.14                                                              tcp        139 filtered         netbios-ssn
    159.89.225.14                                                              tcp         21 open             ftp        cpe:/a:vsftpd:vsftpd:3.0.3
    159.89.225.14                                                              tcp         22 open             ssh        cpe:/o:linux:linux_kernel
    159.89.225.14                                                              tcp         22 open             ssh        cpe:/a:openbsd:openssh:7.2p2
    159.89.225.14                                                              tcp         25 filtered         smtp
    159.89.225.14                                                              tcp        445 filtered         microsoft-ds
    159.89.225.14                                                              tcp        554 open             tcpwrapped
    159.89.225.14                                                              tcp       7070 open             tcpwrapped
osail default(tcp-service-discovery)> search vsftp
exploit/ftp/vsftpd-backdoor            Tests for the presence of the vsFTPd 2.3.4 backdoor reporte
intrusive/ftp/vsftpd-backdoor          Tests for the presence of the vsFTPd 2.3.4 backdoor reporte
malware/ftp/vsftpd-backdoor            Tests for the presence of the vsFTPd 2.3.4 backdoor reporte
vuln/ftp/vsftpd-backdoor               Tests for the presence of the vsFTPd 2.3.4 backdoor reporte
osail default(tcp-service-discovery)> use exploit/ftp/vsftpd-backdoor
osail vuln(ftp-vsftpd-backdoor)> show info
      Name: ftp-vsftpd-backdoor
    Module: /usr/share/nmap/scripts/ftp-vsftpd-backdoor.nse
 Author(s): Daniel Miller
   License: Same as Nmap--See https://nmap.org/book/man-legal.html
Categories: vuln, malware, intrusive, exploit

Options:
  Name                      Current Setting    Description
  ----                      ---------------    -----------
  RHOST                     default            The target address
  RPORT                     80                 The target port
  ftp-vsftpd-backdoor.cmd                      Command to execute in shell

Description:
  Tests for the presence of the vsFTPd 2.3.4 backdoor reported on
  2011-07-04 (CVE-2011-2523). This script attempts to exploit the
  backdoor using the innocuous <code>id</code> command by default, but
  that can be changed with the <code>exploit.cmd</code> or <code>ftp-
  vsftpd-backdoor.cmd</code> script arguments.  References:  *
  http://scarybeastsecurity.blogspot.com/2011/07/alert-vsftpd-
  download-backdoored.html * https://github.com/rapid7/metasploit-fram
  ework/blob/master/modules/exploits/unix/ftp/vsftpd_234_backdoor.rb *
  http://cve.mitre.org/cgi-bin/cvekey.cgi?keyword=CVE-2011-2523

osail vuln(ftp-vsftpd-backdoor)> set RHOST  159.89.225.14
osail vuln(ftp-vsftpd-backdoor)> set RPORT 21
osail vuln(ftp-vsftpd-backdoor)> set ftp-vsftpd-backdoor.cmd ls
osail vuln(ftp-vsftpd-backdoor)> run
[*] /usr/bin/nmap -p 21 -A -oX - --script ftp-vsftpd-backdoor --script-args "ftp-vsftpd-backdoor.cmd=ls" --host-timeout=10 --dns-servers=8.8.8.8 --max-retries=10 --max-scan-delay=0 --min-parallelism=1 --scan-delay=0 --max-parallelism=100 159.89.225.14
[+] Nmap done at Sat Mar 17 01:09:47 2018; 1 IP address (1 host up) scanned in 0.90 seconds
[+] 159.89.225.14
osail vuln(ftp-vsftpd-backdoor)> hosts 159.89.225.14
    Host                 Hostname
    ----                 --------
    159.89.225.14
    Port 25/tcp (smtp): 	State: filtered
        CPE
           None
        Analysis
    Port 21/tcp (unknown): 	State: open
        CPE
           cpe:/a:vsftpd:vsftpd:3.0.3
        Analysis
           ftp-syst
               STAT=
FTP server status:
     Connected to ::ffff:x.x.x.x
     Logged in as ftp
     TYPE: ASCII
     No session bandwidth limit
     Session timeout in seconds is 300
     Control connection is plain text
     Data connections will be plain text
     At session startup, client count was 16
     vsFTPd 3.0.3 - secure, fast, stable
End of status
    Port 22/tcp (unknown): 	State: open
        CPE
           cpe:/a:openbsd:openssh:7.2p2
        Analysis
           ssh-hostkey
               a9c8cad7975047aafaed51462eafbaf9
               ecdsa-sha2-nistp256
               329c3f17956c3f6e3ceec6f79bd80056
               ssh-ed25519
               43ff5a8c3a065c8a371a7c696bd5a240
               AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBCVPtJldY/DLYM/YF33JwtJxAexVvfngTPQ7AC/yhJe89sbilgT1QbjdMTiUiaZzdsOGcUIEmi0Er/Weqewhk7E=
               256
               AAAAB3NzaC1yc2EAAAADAQABAAABAQC8XmX6NUku0CcKR6F5tfOnKRkw1ndqmjLRMniykYj4vVjLnpUlxokTdUCi/KR09H1z8kNk3869xW7nu9fN0vhMuOhmCBjKBTWiWzMd7s6JWrzH0ArKQsT9+UpOrf74n3LoxtgmuXmjW8Am/FW7spsFb/b8e/s1s/Gtzs0aVQ+KuRr6Qr9dz3j6c/dLZLP3sKKBFjiIOHjPputPO/17x8Hhs92fhHc5LNtoGKd4Te7duCt+HlJ7mXgq4uPRuboguY3dtfDVdBUoOsOjkXLObyWjk8e534sKhpP8AWgw6txiTHr+DvBMyeU8BtzMjdsWAT7G6yyq84uQCb5TIAhY2/z3
               2048.0
               AAAAC3NzaC1lZDI1NTE5AAAAINCNGhPoag3xFg0X2gsxDkQy/xkye2fZ7yHVYYXpqQ3y
               ssh-rsa
               a9c8cad7975047aafaed51462eafbaf9
               ecdsa-sha2-nistp256
               329c3f17956c3f6e3ceec6f79bd80056
               ssh-ed25519
               43ff5a8c3a065c8a371a7c696bd5a240
               AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBCVPtJldY/DLYM/YF33JwtJxAexVvfngTPQ7AC/yhJe89sbilgT1QbjdMTiUiaZzdsOGcUIEmi0Er/Weqewhk7E=
               256
               AAAAB3NzaC1yc2EAAAADAQABAAABAQC8XmX6NUku0CcKR6F5tfOnKRkw1ndqmjLRMniykYj4vVjLnpUlxokTdUCi/KR09H1z8kNk3869xW7nu9fN0vhMuOhmCBjKBTWiWzMd7s6JWrzH0ArKQsT9+UpOrf74n3LoxtgmuXmjW8Am/FW7spsFb/b8e/s1s/Gtzs0aVQ+KuRr6Qr9dz3j6c/dLZLP3sKKBFjiIOHjPputPO/17x8Hhs92fhHc5LNtoGKd4Te7duCt+HlJ7mXgq4uPRuboguY3dtfDVdBUoOsOjkXLObyWjk8e534sKhpP8AWgw6txiTHr+DvBMyeU8BtzMjdsWAT7G6yyq84uQCb5TIAhY2/z3
               2048.0
               AAAAC3NzaC1lZDI1NTE5AAAAINCNGhPoag3xFg0X2gsxDkQy/xkye2fZ7yHVYYXpqQ3y
               ssh-rsa
    Port 554/tcp (tcpwrapped): 	State: open
        CPE
           None
        Analysis
    Port 7070/tcp (tcpwrapped): 	State: open
        CPE
           None
        Analysis
    Port 445/tcp (microsoft-ds): 	State: filtered
        CPE
           None
        Analysis
    Port 135/tcp (msrpc): 	State: filtered
        CPE
           None
        Analysis
    Port 139/tcp (netbios-ssn): 	State: filtered
        CPE
           None
        Analysis
osail vuln(ftp-vsftpd-backdoor)> search ssh
auth/ssh/auth-methods                  Returns authentication methods that a SSH server supports.
auth/ssh/publickey-acceptance          This script takes a table of paths to private keys, passphr
default/ssh/hostkey                    Shows SSH hostkeys.  Shows the target SSH server's key fing
default/sshv1                          Checks if an SSH server supports the obsolete and less secu
discovery/ssh/hostkey                  Shows SSH hostkeys.  Shows the target SSH server's key fing
discovery/ssh2-enum-algos              Reports the number of algorithms (for encryption, compressi
intrusive/ssh/auth-methods             Returns authentication methods that a SSH server supports.
intrusive/ssh/publickey-acceptance     This script takes a table of paths to private keys, passphr
safe/duplicates                        Attempts to discover multihomed systems by analysing and co
safe/rsa-vuln-roca                     Detects RSA keys vulnerable to Return Of Coppersmith Attack
safe/ssh/brute                         Performs brute-force password guessing against ssh servers.
safe/ssh/hostkey                       Shows SSH hostkeys.  Shows the target SSH server's key fing
safe/ssh/run                           Runs remote command on ssh server and returns command outpu
safe/ssh2-enum-algos                   Reports the number of algorithms (for encryption, compressi
safe/sshv1                             Checks if an SSH server supports the obsolete and less secu
safe/unusual-port                      Compares the detected service on a port against the expecte
vuln/rsa-vuln-roca                     Detects RSA keys vulnerable to Return Of Coppersmith Attack
osail vuln(ftp-vsftpd-backdoor)> use auth/ssh/auth-methods
osail intrusive(ssh-auth-methods)> set RHOST  159.89.225.14
osail intrusive(ssh-auth-methods)> run
[*] /usr/bin/nmap -p 22 -A -oX - --script ssh-auth-methods --script-args "" --host-timeout=10 --dns-servers=8.8.8.8 --max-retries=10 --max-scan-delay=0 --min-parallelism=1 --scan-delay=0 --max-parallelism=100 159.89.225.14
[+] Nmap done at Sat Mar 17 01:10:51 2018; 1 IP address (1 host up) scanned in 1.26 seconds
[+] 159.89.225.14
[+]
  Supported authentication methods:
    publickey
    password
osail intrusive(ssh-auth-methods)> use safe/ssh2-enum-algos
osail safe(ssh2-enum-algos)> use safe/set RHOST  159.89.225.14
osail safe(ssh2-enum-algos)> run
[*] /usr/bin/nmap -p 22 -A -oX - --script ssh2-enum-algos --script-args "" --host-timeout=10 --dns-servers=8.8.8.8 --max-retries=10 --max-scan-delay=0 --min-parallelism=1 --scan-delay=0 --max-parallelism=100 159.89.225.14
[+] Nmap done at Sat Mar 17 01:11:06 2018; 1 IP address (1 host up) scanned in 1.08 seconds
[+] 159.89.225.14
[+]
  kex_algorithms: (6)
      [email protected]
      ecdh-sha2-nistp256
      ecdh-sha2-nistp384
      ecdh-sha2-nistp521
      diffie-hellman-group-exchange-sha256
      diffie-hellman-group14-sha1
  server_host_key_algorithms: (5)
      ssh-rsa
      rsa-sha2-512
      rsa-sha2-256
      ecdsa-sha2-nistp256
      ssh-ed25519
  encryption_algorithms: (6)
      [email protected]
      aes128-ctr
      aes192-ctr
      aes256-ctr
      [email protected]
      [email protected]
  mac_algorithms: (10)
      [email protected]
      [email protected]
      [email protected]
      [email protected]
      [email protected]
      [email protected]
      [email protected]
      hmac-sha2-256
      hmac-sha2-512
      hmac-sha1
  compression_algorithms: (2)
      none
      [email protected]
osail safe(ssh2-enum-algos)> hosts 159.89.225.14
    Host                 Hostname
    ----                 --------
    159.89.225.14
    Port 25/tcp (smtp): 	State: filtered
        CPE
           None
        Analysis
    Port 21/tcp (unknown): 	State: open
        CPE
           cpe:/a:vsftpd:vsftpd:3.0.3
        Analysis
           ftp-syst
               STAT=
FTP server status:
     Connected to ::ffff:x.x.x.x
     Logged in as ftp
     TYPE: ASCII
     No session bandwidth limit
     Session timeout in seconds is 300
     Control connection is plain text
     Data connections will be plain text
     At session startup, client count was 16
     vsFTPd 3.0.3 - secure, fast, stable
End of status
    Port 22/tcp (unknown): 	State: open
        CPE
           cpe:/a:openbsd:openssh:7.2p2
        Analysis
           ssh-auth-methods
               publickey
               password
               publickey
               password
           ssh-hostkey
               a9c8cad7975047aafaed51462eafbaf9
               ecdsa-sha2-nistp256
               329c3f17956c3f6e3ceec6f79bd80056
               ssh-ed25519
               43ff5a8c3a065c8a371a7c696bd5a240
               AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBCVPtJldY/DLYM/YF33JwtJxAexVvfngTPQ7AC/yhJe89sbilgT1QbjdMTiUiaZzdsOGcUIEmi0Er/Weqewhk7E=
               256
               AAAAB3NzaC1yc2EAAAADAQABAAABAQC8XmX6NUku0CcKR6F5tfOnKRkw1ndqmjLRMniykYj4vVjLnpUlxokTdUCi/KR09H1z8kNk3869xW7nu9fN0vhMuOhmCBjKBTWiWzMd7s6JWrzH0ArKQsT9+UpOrf74n3LoxtgmuXmjW8Am/FW7spsFb/b8e/s1s/Gtzs0aVQ+KuRr6Qr9dz3j6c/dLZLP3sKKBFjiIOHjPputPO/17x8Hhs92fhHc5LNtoGKd4Te7duCt+HlJ7mXgq4uPRuboguY3dtfDVdBUoOsOjkXLObyWjk8e534sKhpP8AWgw6txiTHr+DvBMyeU8BtzMjdsWAT7G6yyq84uQCb5TIAhY2/z3
               2048.0
               AAAAC3NzaC1lZDI1NTE5AAAAINCNGhPoag3xFg0X2gsxDkQy/xkye2fZ7yHVYYXpqQ3y
               ssh-rsa
               a9c8cad7975047aafaed51462eafbaf9
               ecdsa-sha2-nistp256
               329c3f17956c3f6e3ceec6f79bd80056
               ssh-ed25519
               43ff5a8c3a065c8a371a7c696bd5a240
               AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBCVPtJldY/DLYM/YF33JwtJxAexVvfngTPQ7AC/yhJe89sbilgT1QbjdMTiUiaZzdsOGcUIEmi0Er/Weqewhk7E=
               256
               AAAAB3NzaC1yc2EAAAADAQABAAABAQC8XmX6NUku0CcKR6F5tfOnKRkw1ndqmjLRMniykYj4vVjLnpUlxokTdUCi/KR09H1z8kNk3869xW7nu9fN0vhMuOhmCBjKBTWiWzMd7s6JWrzH0ArKQsT9+UpOrf74n3LoxtgmuXmjW8Am/FW7spsFb/b8e/s1s/Gtzs0aVQ+KuRr6Qr9dz3j6c/dLZLP3sKKBFjiIOHjPputPO/17x8Hhs92fhHc5LNtoGKd4Te7duCt+HlJ7mXgq4uPRuboguY3dtfDVdBUoOsOjkXLObyWjk8e534sKhpP8AWgw6txiTHr+DvBMyeU8BtzMjdsWAT7G6yyq84uQCb5TIAhY2/z3
               2048.0
               AAAAC3NzaC1lZDI1NTE5AAAAINCNGhPoag3xFg0X2gsxDkQy/xkye2fZ7yHVYYXpqQ3y
               ssh-rsa
           ssh2-enum-algos
               ssh-rsa
               [email protected]
               [email protected]
               [email protected]
               [email protected]
               aes256-ctr
               hmac-sha1
               [email protected]
               hmac-sha2-256
               [email protected]
               diffie-hellman-group14-sha1
               rsa-sha2-256
               aes128-ctr
               ecdh-sha2-nistp521
               ecdh-sha2-nistp256
               aes192-ctr
               diffie-hellman-group-exchange-sha256
               hmac-sha2-512
               [email protected]
               [email protected]
               [email protected]
               ssh-ed25519
               [email protected]
               none
               rsa-sha2-512
               [email protected]
               ecdsa-sha2-nistp256
               [email protected]
               ecdh-sha2-nistp384
               ssh-rsa
               [email protected]
               [email protected]
               [email protected]
               [email protected]
               aes256-ctr
               hmac-sha1
               [email protected]
               hmac-sha2-256
               [email protected]
               diffie-hellman-group14-sha1
               rsa-sha2-256
               aes128-ctr
               ecdh-sha2-nistp521
               ecdh-sha2-nistp256
               aes192-ctr
               diffie-hellman-group-exchange-sha256
               hmac-sha2-512
               [email protected]
               [email protected]
               [email protected]
               ssh-ed25519
               [email protected]
               none
               rsa-sha2-512
               [email protected]
               ecdsa-sha2-nistp256
               [email protected]
               ecdh-sha2-nistp384
    Port 554/tcp (tcpwrapped): 	State: open
        CPE
           None
        Analysis
    Port 7070/tcp (tcpwrapped): 	State: open
        CPE
           None
        Analysis
    Port 445/tcp (microsoft-ds): 	State: filtered
        CPE
           None
        Analysis
    Port 135/tcp (msrpc): 	State: filtered
        CPE
           None
        Analysis
    Port 139/tcp (netbios-ssn): 	State: filtered
        CPE
           None
        Analysis
osail safe(ssh2-enum-algos)> search resol
broadcast/broadcast-wpad-discover      Retrieves a list of proxy servers on a LAN using the Web Pr
broadcast/llmnr-resolve                Resolves a hostname by using the LLMNR (Link-Local Multicas
discovery/dns/cache-snoop              Performs DNS cache snooping against a DNS server.  There ar
discovery/dns/ip6-arpa-scan            Performs a quick reverse DNS lookup of an IPv6 network usin
discovery/hostmap/bfk                  Discovers hostnames that resolve to the target's IP address
discovery/hostmap/ip2hosts             Finds hostnames that resolve to the target's IP address by
discovery/llmnr-resolve                Resolves a hostname by using the LLMNR (Link-Local Multicas
discovery/resolveall                   Resolves hostnames and adds every address (IPv4 or IPv6, de
external/hostmap/bfk                   Discovers hostnames that resolve to the target's IP address
external/hostmap/ip2hosts              Finds hostnames that resolve to the target's IP address by
intrusive/dns/cache-snoop              Performs DNS cache snooping against a DNS server.  There ar
intrusive/dns/ip6-arpa-scan            Performs a quick reverse DNS lookup of an IPv6 network usin
safe/broadcast-wpad-discover           Retrieves a list of proxy servers on a LAN using the Web Pr
safe/hostmap/robtex                    Discovers hostnames that resolve to the target's IP address
safe/llmnr-resolve                     Resolves a hostname by using the LLMNR (Link-Local Multicas
safe/resolveall                        Resolves hostnames and adds every address (IPv4 or IPv6, de
osail safe(ssh2-enum-algos)> use safe/hostmap/robtex
osail safe(hostmap-robtex)> set RHOST  159.89.225.14
osail safe(hostmap-robtex)> run
[*] /usr/bin/nmap -p 80 -A -oX - --script hostmap-robtex --script-args "" --host-timeout=10 --dns-servers=8.8.8.8 --max-retries=10 --max-scan-delay=0 --min-parallelism=1 --scan-delay=0 --max-parallelism=100 159.89.225.14
[+] Nmap done at Sat Mar 17 01:12:03 2018; 1 IP address (1 host up) scanned in 1.45 seconds
[+] 159.89.225.14
[+] ERROR: Script execution failed (use -d to debug)
osail safe(hostmap-robtex)> use discovery/resolveall
osail safe(resolveall)> set RHOST  159.89.225.14
osail safe(resolveall)> run
[*] /usr/bin/nmap -p 80 -A -oX - --script resolveall --script-args "" --host-timeout=10 --dns-servers=8.8.8.8 --max-retries=10 --max-scan-delay=0 --min-parallelism=1 --scan-delay=0 --max-parallelism=100 159.89.225.14
[+] Nmap done at Sat Mar 17 01:12:18 2018; 1 IP address (1 host up) scanned in 0.86 seconds
[+] 159.89.225.14
osail safe(resolveall)> hosts 159.89.225.14
    Host                 Hostname
    ----                 --------
    159.89.225.14
    Port 25/tcp (smtp): 	State: filtered
        CPE
           None
        Analysis
    Port 21/tcp (unknown): 	State: open
        CPE
           cpe:/a:vsftpd:vsftpd:3.0.3
        Analysis
           ftp-syst
               STAT=
FTP server status:
     Connected to ::ffff:x.x.x.x
     Logged in as ftp
     TYPE: ASCII
     No session bandwidth limit
     Session timeout in seconds is 300
     Control connection is plain text
     Data connections will be plain text
     At session startup, client count was 16
     vsFTPd 3.0.3 - secure, fast, stable
End of status
    Port 22/tcp (unknown): 	State: open
        CPE
           cpe:/a:openbsd:openssh:7.2p2
        Analysis
           ssh-auth-methods
               publickey
               password
               publickey
               password
           ssh-hostkey
               a9c8cad7975047aafaed51462eafbaf9
               ecdsa-sha2-nistp256
               329c3f17956c3f6e3ceec6f79bd80056
               ssh-ed25519
               43ff5a8c3a065c8a371a7c696bd5a240
               AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBCVPtJldY/DLYM/YF33JwtJxAexVvfngTPQ7AC/yhJe89sbilgT1QbjdMTiUiaZzdsOGcUIEmi0Er/Weqewhk7E=
               256
               AAAAB3NzaC1yc2EAAAADAQABAAABAQC8XmX6NUku0CcKR6F5tfOnKRkw1ndqmjLRMniykYj4vVjLnpUlxokTdUCi/KR09H1z8kNk3869xW7nu9fN0vhMuOhmCBjKBTWiWzMd7s6JWrzH0ArKQsT9+UpOrf74n3LoxtgmuXmjW8Am/FW7spsFb/b8e/s1s/Gtzs0aVQ+KuRr6Qr9dz3j6c/dLZLP3sKKBFjiIOHjPputPO/17x8Hhs92fhHc5LNtoGKd4Te7duCt+HlJ7mXgq4uPRuboguY3dtfDVdBUoOsOjkXLObyWjk8e534sKhpP8AWgw6txiTHr+DvBMyeU8BtzMjdsWAT7G6yyq84uQCb5TIAhY2/z3
               2048.0
               AAAAC3NzaC1lZDI1NTE5AAAAINCNGhPoag3xFg0X2gsxDkQy/xkye2fZ7yHVYYXpqQ3y
               ssh-rsa
               a9c8cad7975047aafaed51462eafbaf9
               ecdsa-sha2-nistp256
               329c3f17956c3f6e3ceec6f79bd80056
               ssh-ed25519
               43ff5a8c3a065c8a371a7c696bd5a240
               AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBCVPtJldY/DLYM/YF33JwtJxAexVvfngTPQ7AC/yhJe89sbilgT1QbjdMTiUiaZzdsOGcUIEmi0Er/Weqewhk7E=
               256
               AAAAB3NzaC1yc2EAAAADAQABAAABAQC8XmX6NUku0CcKR6F5tfOnKRkw1ndqmjLRMniykYj4vVjLnpUlxokTdUCi/KR09H1z8kNk3869xW7nu9fN0vhMuOhmCBjKBTWiWzMd7s6JWrzH0ArKQsT9+UpOrf74n3LoxtgmuXmjW8Am/FW7spsFb/b8e/s1s/Gtzs0aVQ+KuRr6Qr9dz3j6c/dLZLP3sKKBFjiIOHjPputPO/17x8Hhs92fhHc5LNtoGKd4Te7duCt+HlJ7mXgq4uPRuboguY3dtfDVdBUoOsOjkXLObyWjk8e534sKhpP8AWgw6txiTHr+DvBMyeU8BtzMjdsWAT7G6yyq84uQCb5TIAhY2/z3
               2048.0
               AAAAC3NzaC1lZDI1NTE5AAAAINCNGhPoag3xFg0X2gsxDkQy/xkye2fZ7yHVYYXpqQ3y
               ssh-rsa
           ssh2-enum-algos
               ssh-rsa
               [email protected]
               [email protected]
               [email protected]
               [email protected]
               aes256-ctr
               hmac-sha1
               [email protected]
               hmac-sha2-256
               [email protected]
               diffie-hellman-group14-sha1
               rsa-sha2-256
               aes128-ctr
               ecdh-sha2-nistp521
               ecdh-sha2-nistp256
               aes192-ctr
               diffie-hellman-group-exchange-sha256
               hmac-sha2-512
               [email protected]
               [email protected]
               [email protected]
               ssh-ed25519
               [email protected]
               none
               rsa-sha2-512
               [email protected]
               ecdsa-sha2-nistp256
               [email protected]
               ecdh-sha2-nistp384
               ssh-rsa
               [email protected]
               [email protected]
               [email protected]
               [email protected]
               aes256-ctr
               hmac-sha1
               [email protected]
               hmac-sha2-256
               [email protected]
               diffie-hellman-group14-sha1
               rsa-sha2-256
               aes128-ctr
               ecdh-sha2-nistp521
               ecdh-sha2-nistp256
               aes192-ctr
               diffie-hellman-group-exchange-sha256
               hmac-sha2-512
               [email protected]
               [email protected]
               [email protected]
               ssh-ed25519
               [email protected]
               none
               rsa-sha2-512
               [email protected]
               ecdsa-sha2-nistp256
               [email protected]
               ecdh-sha2-nistp384
    Port 554/tcp (tcpwrapped): 	State: open
        CPE
           None
        Analysis
    Port 7070/tcp (tcpwrapped): 	State: open
        CPE
           None
        Analysis
    Port 445/tcp (microsoft-ds): 	State: filtered
        CPE
           None
        Analysis
    Port 135/tcp (msrpc): 	State: filtered
        CPE
           None
        Analysis
    Port 139/tcp (netbios-ssn): 	State: filtered
        CPE
           None
        Analysis
    Port 80/tcp (http): 	State: closed
        CPE
           None
        Analysis
osail safe(resolveall)>

Get A Weekly Email With Trending Projects For These Topics
No Spam. Unsubscribe easily at any time.
C Sharp (278,209
Pentesting (1,347
Pentest Tool (429
Nmap (380
Related Projects