jjlhlianfangzhizaoportmap

InternetScanningCurrentStateandLessonsLearnedMarkSchloesser-Rapid7Labs@BlackHatUSA-August6th2014MarkSchloesserTwitter@repmovsbSecurityResearcheratRapid7LabsCoredeveloperforCuckooSandboxResearchonbotnets,malwareLotsofsmallersideprojects,dexlabs.
org(Android),honeypots,protocols$idQuickRecapInternetScanningIntro/History/Motivation/Ethics/etcProjectSonarResearch/FindingsAssetdiscoveryexampleusecaseOutlineLargescalescanningInternetwidedata-gatheringInternet-widescanningInternetMappingProject,BellLabs/Lumeta,1998+IPv4Census2003-2006EFFSSLObservatory2014InternetCensus2012(thebotnet)ShodanRIPEAtlas(slightlydifferent)Critical.
IO,2012-2013UniversityofMichiganShadowserverErrataSec(R.
Graham/masscan)Rapid7,ProjectSonarResearch/FindinghistoryTop3UPnPsoftwarestackscontainvulnerabilities/areexploitableMostwidespreadserviceontheInternet,millionsofdevicesaffected,patchrateslowuntiltodayIPMIServerManagementProtocolvulnerabilitiesServerManagementControllersauth-bypassandothervulnsWidespreadmisconfigurationsNTPDDoSamplificationproblemsknownsince2010OpenRecursors,OpenSMTPrelays,ElasticSearchinstances,etcMiningPsandQs,UMich/UCSDWeakkeysusedforSSLcommunicationusername=sapassword=Masterkey2011LicenseCheck=DefneDSN=sms;UID=XXX;PWD=XXXsys;DSN=GeoXXX;UID=XXX;PWD=XXXsys;8383passwordh4ve@gr8d3y--daemon--port8020--socks5--s_userWindows--s_passwordSystemXXXX/ssh/auth=password/user=admin/passwd=admin_p@s$wordhttp://a.
b.
c/manage/retail_login.
php3ms_id=14320101&passwd=7325a.
b.
c.
d:3389--useradministrator--passpassw0rd123SNMP–listprocesses,getcredentialsTelnet:RouterShells10,000+Routersdon'tevenbotherwithpasswordsjiuyuan_bt_nm_ah>jiyougongsi>jjcaisanxiaoxue>jjda>jjdc>jjgd>jjlhlianfangzhizao>jjpzx>jjshhshengangzhizao>jjxjy>jjxy>jjxz>jjyljuda>jkx_sdl>jnszy_2692>joelsmith>jsyh>jt_net>jtic>jx123>jzglkyzz>kashiwa>kbbmetro>kd-ip>mp1700-kslp>mp1700E>mp1762>mp2600e>mp2692>mp2700>msk-cat3>mty-3500-1>multivoice01>mvy-rtr-01>mx-fdc-dmz1>mx-frtsw01>mx-frtsw02>nak2ama-east-ps>nak2ama-north-ps>nak2ama-ps>nak2ama-south-ps>nak2ama-west-ps>naldi>nanchang2621>nanquc3550-02>nanshigaosu_A5>narashino>nayana2>telnet@AYRS-CES2k-1>telnet@AdminVideoSW1>telnet@BBG>telnet@BEL-WIFI-1>telnet@BGLWANSW01>telnet@BGLWANSW02>telnet@BI-RX-1>telnet@BI-Solsi>telnet@BIGION-CORE-1>telnet@BR2-NET1-MLXe>telnet@BRCD-ADX-2>telnet@BSI01>telnet@Backbone_Backup>telnet@BigIronRX-4Router>telnet@BigIronRX-8Router>telnet@BigIronRouter>telnet@Bloco.
A1.
Core>telnet@Bloco.
B.
Core>telnet@Border40G-1>telnet@Brocade_ABA_1>telnet@CHD-BOU-CO-2>telnet@CON-LONFESX4801>telnet@CON-LONFESX4802>S1-DNS-3560-NSGK>3,000+WindowsCEdevicesdropCMDshellsTelnet:WindowsCEShellsWelcometotheWindowsCETelnetServiceonWindowsCEPocketCMDv5.
0\>WelcometotheWindowsCETelnetServiceonITPPocketCMDv5.
0\>WelcometotheWindowsCETelnetServiceonWindowsCEPocketCMDv6.
00\>WelcometotheWindowsCETelnetServiceonWindowsCEPocketCMDv4.
20\>WelcometotheWindowsCETelnetServiceonPicoCOM2-SielaffPocketCMDv6.
00\>WelcometotheWindowsCETelnetServiceonWindowsCEPocketCMDv4.
10\>WelcometotheWindowsCETelnetServiceonG4-XRCPocketCMDv5.
0\>WelcometotheWindowsCETelnetServiceonHMI_PanelPocketCMDv5.
0\>WelcometotheWindowsCETelnetServiceonG4-XFCPocketCMDv5.
0\>WelcometotheWindowsCETelnetServiceonPELOADPocketCMDv6.
00\>WelcometotheWindowsCETelnetServiceonMCGSPocketCMDv5.
0\>WelcometotheWindowsCETelnetServiceonDb1200PocketCMDv5.
0\>WelcometotheWindowsCETelnetServiceonVEUIICEPocketCMDv6.
00\>WelcometotheWindowsCETelnetServiceonBorneCebus/HorusPocketCMDv6.
00\>3,000+LinuxsystemsdroptorootTelnet:LinuxShellsMontaVista(R)Linux(R)ProfessionalEdition4.
0.
1(0502020)Linux/armv5tejlWelcometelnetroot@~#Localsystemtime:SunMay2004:12:49UTC2012root:#root@(unknown):/#root@routon-h1:/#root@umts_spyder:/#root@vanquish_u:/#root@smi:/#root@dinara_cg:/#root@BCS5200:/#root@edison:/#root@umts_yangtze:/#root@cdma_spyder:/#root@vanquish:/#root@scorpion_mini:/#root@qinara:/#sh-3.
00#Licenseplatereaders,ontheinternet,viaTelnetATZP372applicationAug29200816:07:45P372RAM:128M@128MEPROM:512kFlexcapabilities003fCamerafirmware:4.
34362ANPRenabledfor:USALouisiana.
Installedoptions:00220018*.
.
.
CompactFlash*.
.
.
BasicVESwithnosecurity*.
.
.
USALicenceplaterecognition*PIPSTechnologyAUTOPLATE(tm)licenseplaterecognition*VES-(violationenforcementsystem)Telnet:otherstuffSerialPortServersDevicesthatmakenetwork-disableddevicesintonetwork-enabledones.
Doesn'tsoundlikeagoodidea…Mostcommonaccessconfig(authenticated/encryptedmethodsavailable):Unauthenticatedclear-textTCPmultiplexportsUnauthenticatedTCPpass-throughportsExampleRemoteSerialPortsIPTVHeadendsystem,sometimesleftlogged-inElasticSearch,codeexecutionisafeatureBydefaultallows"dynamicscripting",executingcodeontheserverNotavulnerability,justmisconfigurationwhenservedonapublicIPwithoutfiltering/protectionOfcoursenottheonlyexample,seeMongoDB,andallotherSQLDBswithoutauthordefaultcredentialsFindingissuesandraisingawarenessaboutthemisimmenselyvaluable.
Rapid7LabsstartsProjectSonar(announcedbyHDatDerbycon2013)443/TCP-SSLCertificates80/TCP–HTTPGET/(IPvhost)ReverseDNS(PTRrecords)ForwardDNS(A/AAAA/ANYlookups)OtherSSLcertificatesources,STARTTLS,etcSeveralUDPprobesUPnP,IPMI,NTP,NetBios,MDNS,MSSQL,Portmap,SIP,etcSonar–Dataoverview443/TCP-SSLCertificates–weekly~40Mopenports,~25MSSLcerts,~55GBin100kdevicesexposedSomefalloutfrompreviousSupermicro/IPMI/BMCpublications(stillgivingawayroot…)Otherrecentfindings–indisclosureprocessUsescanningdatatobuildlookupdatabasesforIPsandnamesStartwithanarrayofdomainnamesandCIDRsandgenerateareportofassociatedassets/relevantdataQuickLivedemoforRapid7ExampleUse-CaseAssetDiscoveryMakedataavailabletotheSecuritycommunityCollaborationwithUniversityofMichiganRawScandatapublishedathttp://scans.
io/Historicalupload(critical.
io,Michigandata)Almost-real-timeuploadofrawscanoutputCollaborationishighlyimportanthttp://scans.
io/TheInternetisbroken.
Widespreadbugs,vulnerabilities,misconfigurationsWeakcredentialsLostandforgottendevices,embeddedhardwarepilingupwithoutupdatepossibilitiesWe'renotimprovingtheoverall"stateofsecurity"Can'tstressenoughtheimportanceofawarenessandvisibilityInternetscanningisapowerfultoolthatcandoalotofgoodforthecommunityIdentify/quantifyvulnerabilities,buildawarenessbeforetheyaremisusedMeasureimprovementscontinuouslyCollaborationisessentialfordatacollectionandanalysisMovingforwardZMapathttp://zmap.
io/ZMapBestPracticeshttps://zmap.
io/documentation.
html#bestpracticesJ.
AlexHaldermanon"FastInternet-wideScanninganditsSecurityApplications"at30C3(Germany)HDMoore'skeynote"ScanningDarkly"atDerbycon2013http://sonar.
labs.
rapid7.
com/MakesuretoalsocheckoutThanks!
Rapid7LabsMarkSchloessermark_schloesser@rapid7.
com@repmovsb