从arl中学习到的nmap配置

灯塔(ARL)里面有一个namp扫描模块,里面有配置可以学习一下 首先上代码 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 class PortScan: def __init__(self, targets, ports=None, service_detect=False, os_detect=False, port_parallelism=None, port_min_rate=None, custom_host_timeout=None): self.targets = " ".join(targets) self.ports = ports self.max_hostgroup = 128 self.alive_port = "22,80,443,843,3389,8007-8011,8443,9090,8080-8091,8093,8099,5000-5004,2222,3306,1433,21,25" self.nmap_arguments = "-sT -n --open" self.max_retries = 3 self.host_timeout = 60*5 self.parallelism = port_parallelism # 默认 32 self.min_rate = port_min_rate # 默认64 if service_detect: self.host_timeout += 60 * 5 self.nmap_arguments += " -sV" if os_detect: self.host_timeout += 60 * 4 self.nmap_arguments += " -O" if len(self.ports.split(",")) > 60: self.nmap_arguments += " -PE -PS{}".format(self.alive_port) self.max_retries = 2 else: if self.ports != "0-65535": self.nmap_arguments += " -Pn" if self.ports == "0-65535": self.max_hostgroup = 8 self.min_rate = max(self.min_rate, 400) self.nmap_arguments += " -PE -PS{}".format(self.alive_port) self.host_timeout += 60 * 2 self.max_retries = 2 self.nmap_arguments += " --max-rtt-timeout 800ms" self.nmap_arguments += " --min-rate {}".format(self.min_rate) self.nmap_arguments += " --script-timeout 6s" self.nmap_arguments += " --max-hostgroup {}".format(self.max_hostgroup) # 依据传过来的超时为准 if custom_host_timeout is not None: if int(custom_host_timeout) > 0: self.host_timeout = custom_host_timeout self.nmap_arguments += " --host-timeout {}s".format(self.host_timeout) self.nmap_arguments += " --min-parallelism {}".format(self.parallelism) self.nmap_arguments += " --max-retries {}".format(self.max_retries) def run(self): logger.info("nmap target {} ports {} arguments {}".format( self.targets[:20], self.ports[:20], self.nmap_arguments)) nm = nmap.PortScanner() nm.scan(hosts=self.targets, ports=self.ports, arguments=self.nmap_arguments) ip_info_list = [] for host in nm.all_hosts(): port_info_list = [] for proto in nm[host].all_protocols(): port_len = len(nm[host][proto]) for port in nm[host][proto]: # 对于开了很多端口的直接丢弃 if port_len > 600 and (port not in [80, 443]): continue port_info = nm[host][proto][port] item = { "port_id": port, "service_name": port_info["name"], "version": port_info["version"], "product": port_info["product"], "protocol": proto } port_info_list.append(item) osmatch_list = nm[host].get("osmatch", []) os_info = self.os_match_by_accuracy(osmatch_list) ip_info = { "ip": host, "port_info": port_info_list, "os_info": os_info } ip_info_list.append(ip_info) return ip_info_list def os_match_by_accuracy(self, os_match_list): for os_match in os_match_list: accuracy = os_match.get('accuracy', '0') if int(accuracy) > 90: return os_match return {} 入口是run ...

四月 13, 2022 · 3 分钟 · 

识别SigFlip生成的恶意文件

最近在移植 med0x2e/SigFlip 的过程中发现了一个有意思的点,可以用来作为检测的手段 在 SigFlip 项目的 Detect/Prevent 一节中作者有提到一些检测防御手段 https://docs.microsoft.com/en-us/security-updates/SecurityAdvisories/2014/2915720?redirectedfrom=MSDN Once the patch is installed and proper registry keys are set, No system restarts are required, you only need to restart the Cryptographic Services. The Applocker service will be also restarted as it depends on the cryptographic services.(@p0w3rsh3ll) Yara rule by Adrien; https://twitter.com/Int2e_/status/1330975808941330432 从 SigFlip 源码中,其实也能发现一个点 SigFlip 依赖一串特定的字节来定位shellcode的位置,详见 Native/SigLoader/SigLoader/SigLoader.cpp#L102 和 Native/SigFlip/SigFlip/SigFlip.cpp#L232 1 2 3 4 5 6 7 for (_index = 0; _index < _CertTableSize; _index++) { if (*(_pePtr + _index) == 0xfe && *(_pePtr + _index + 1) == 0xed && *(_pePtr + _index + 2) == 0xfa && *(_pePtr + _index + 3) == 0xce) { printf("[*]: Tag Found 0x%x%x%x%x", *(_pePtr + _index), *(_pePtr + _index+1), *(_pePtr + _index+2), *(_pePtr + _index+3)); _dataOffset = _index + 8; break; } } 1 2 memcpy(_encryptedData, "\xFE\xED\xFA\xCE\xFE\xED\xFA\xCE", 8); crypt((unsigned char*)_data, _dataSize, _key, _keySize, (unsigned char*)_encryptedData + 8); 也就是说我们在证书表中定位到 \xFE\xED\xFA\xCE\xFE\xED\xFA\xCE 这段特征就可以断定它疑似 SigFlip 生成的 payload 了,想要更精准一些可以结合 https://twitter.com/Int2e_/status/1330975808941330432 中提到的长度特征。 ...

十二月 10, 2021 · 2 分钟 ·