|
| 1 | +## Description |
| 2 | + |
| 3 | +The “udp_sweep” module scans across a given range of hosts to detect commonly available UDP services. |
| 4 | + |
| 5 | +## Verification Steps |
| 6 | + |
| 7 | +1. Do: ```use auxiliary/scanner/discovery/udp_sweep``` |
| 8 | +2. Do: ```set RHOSTS [IP]``` |
| 9 | +3. Do: ```set THREADS [number of threads]``` |
| 10 | +4. Do: ```run``` |
| 11 | + |
| 12 | +To configure this module, just set the RHOSTS and THREADS values and run it. |
| 13 | + |
| 14 | +## Scenarios |
| 15 | + |
| 16 | +**Running the scanner** |
| 17 | +``` |
| 18 | +msf > use auxiliary/scanner/discovery/udp_sweep |
| 19 | +msf auxiliary(udp_sweep) > show options |
| 20 | +
|
| 21 | +Module options (auxiliary/scanner/discovery/udp_sweep): |
| 22 | +
|
| 23 | + Name Current Setting Required Description |
| 24 | + ---- --------------- -------- ----------- |
| 25 | + BATCHSIZE 256 yes The number of hosts to probe in each set |
| 26 | + RHOSTS yes The target address range or CIDR identifier |
| 27 | + THREADS 10 yes The number of concurrent threads |
| 28 | +
|
| 29 | +msf auxiliary(udp_sweep) > set RHOSTS 192.168.1.2-254 |
| 30 | +RHOSTS => 192.168.1.2-254 |
| 31 | +msf auxiliary(udp_sweep) > set THREADS 253 |
| 32 | +THREADS => 253 |
| 33 | +msf auxiliary(udp_sweep) > run |
| 34 | +
|
| 35 | +[*] Sending 10 probes to 192.168.1.2->192.168.1.254 (253 hosts) |
| 36 | +[*] Discovered NetBIOS on 192.168.1.109:137 (SAMSUNG::U :SAMSUNG::U :00:15:99:3f:40:bd) |
| 37 | +[*] Discovered NetBIOS on 192.168.1.150:137 (XEN-WIN7-PROD::U :WORKGROUP::G :XEN-WIN7-PROD::U :WORKGROUP::G :aa:e3:27:6e:3b:a5) |
| 38 | +[*] Discovered NetBIOS on 192.168.1.203:137 (XEN-XP-SPLOIT::U :WORKGROUP::G :XEN-XP-SPLOIT::U :WORKGROUP::G :3e:ff:3c:4c:89:67) |
| 39 | +[*] Discovered NetBIOS on 192.168.1.201:137 (XEN-XP-SP2-BARE::U :HOTZONE::G :XEN-XP-SP2-BARE::U :HOTZONE::G :HOTZONE::U :__MSBROWSE__::G :c6:ce:4e:d9:c9:6e) |
| 40 | +[*] Discovered NetBIOS on 192.168.1.206:137 (XEN-XP-PATCHED::U :XEN-XP-PATCHED::U :HOTZONE::G :HOTZONE::G :12:fa:1a:75:b8:a5) |
| 41 | +[*] Discovered NetBIOS on 192.168.1.250:137 (FREENAS::U :FREENAS::U :FREENAS::U :__MSBROWSE__::G :WORKGROUP::U :WORKGROUP::G :WORKGROUP::G :00:00:00:00:00:00) |
| 42 | +[*] Discovered SNMP on 192.168.1.2:161 (GSM7224 L2 Managed Gigabit Switch) |
| 43 | +[*] Discovered SNMP on 192.168.1.109:161 (Samsung CLX-3160 Series; OS V1.01.01.16 02-25-2008;Engine 6.01.00;NIC V4.03.08(CLX-3160) 02-25-2008;S/N 8Y61B1GP400065Y.) |
| 44 | +[*] Discovered NTP on 192.168.1.69:123 (NTP v4) |
| 45 | +[*] Discovered NTP on 192.168.1.99:123 (NTP v4) |
| 46 | +[*] Discovered NTP on 192.168.1.201:123 (Microsoft NTP) |
| 47 | +[*] Discovered NTP on 192.168.1.203:123 (Microsoft NTP) |
| 48 | +[*] Discovered NTP on 192.168.1.206:123 (Microsoft NTP) |
| 49 | +[*] Discovered MSSQL on 192.168.1.206:1434 (ServerName=XEN-XP-PATCHED InstanceName=SQLEXPRESS IsClustered=No Version=9.00.4035.00 tcp=1050 np=\\XEN-XP-PATCHED\pipe\MSSQL$SQLEXPRESS\sql\query ) |
| 50 | +[*] Discovered SNMP on 192.168.1.2:161 (GSM7224 L2 Managed Gigabit Switch) |
| 51 | +[*] Discovered SNMP on 192.168.1.109:161 (Samsung CLX-3160 Series; OS V1.01.01.16 02-25-2008;Engine 6.01.00;NIC V4.03.08(CLX-3160) 02-25-2008;S/N 8Y61B1GP400065Y.) |
| 52 | +[*] Scanned 253 of 253 hosts (100% complete) |
| 53 | +[*] Auxiliary module execution completed |
| 54 | +msf auxiliary(udp_sweep) > |
| 55 | +``` |
| 56 | + |
| 57 | +With minimal effort, we have once again identified a wide range of services running on many different platforms within our network. |
0 commit comments