{"id":19817,"date":"2023-03-07T23:23:22","date_gmt":"2023-03-07T15:23:22","guid":{"rendered":"https:\/\/blog.pmail.idv.tw\/?p=19817"},"modified":"2023-03-07T23:24:34","modified_gmt":"2023-03-07T15:24:34","slug":"ceh-v12-module-4-enumeration-%e5%88%97%e8%88%89","status":"publish","type":"post","link":"https:\/\/blog.pmail.idv.tw\/?p=19817","title":{"rendered":"[CEH V12] Module 4 Enumeration \u5217\u8209"},"content":{"rendered":"<p><b>\u672c\u7ae0\u5927\u6982\u5c31\u662f\u8aaa\u660e\u4e00\u4e9bEnumeration(<\/b><b>\u5217\u8209)\u7684\u6280\u5de7<\/b> <\/p>\n<p><strong>\u7b46\u8a18\u4e00\u4e0b\uff0c\u6709\u932f\u8aa4\u7684\u5730\u65b9\u518d\u9ebb\u7169\u63d0\u9ede\u4e00\u4e0b<\/strong><\/p>\n<p><!--more--><\/p>\n<p><b>1. <\/b><b>Extract usernames using email IDs <\/b> <\/p>\n<ul>\n<li><b>&nbsp;<\/b><b>\u5f9e<\/b><b>email <\/b><b>\u63d0\u53d6\u51fa\u5e33\u865f\u540d<\/b><b><\/b><\/li>\n<li><b>\u6bcf\u500b\u96fb\u5b50\u90f5\u4ef6\u5730\u5740\u90fd\u5305\u542b\u7528\u6236\u540d\u548c\u57df\u540d\u5169\u90e8\u5206\uff0c\u683c\u5f0f\u70ba<a href=\"mailto:&ldquo;username@domainname\">\u201c<\/b><b>username@domainname<\/a><\/b><b>\u201d<\/b><b><\/b><\/li>\n<\/ul>\n<p><b>2. <\/b><b>Extract information using default passwords<\/b> <\/p>\n<p>\u5f88\u591a\u7dda\u4e0a\u8cc7\u6e90\u53ef\u4ee5\u627e\u5f97\u5230\u5ee0\u5546\u9810\u8a2d\u5bc6\u78bc\u5217\u8868\uff0c\u7528\u6236\u7aef\u5e38\u5e38\u63ee\u5ffd\u7565\u6539\u9810\u8a2d\u5e33\u5bc6\uff0c\u6240\u4ee5\u7c21\u5316\u653b\u64ca\u8005\u5217\u8209\u548c\u5229\u7528\u76ee\u6a19\u7cfb\u7d71\u7684\u4efb\u52d9<b><\/b> <\/p>\n<p><b>3. <\/b><b>Brute force Active Directory<\/b> <\/p>\n<ul>\n<li><b>\u66b4\u529b\u7834\u89e3<\/b><b>AD<\/b><\/li>\n<\/ul>\n<p><b>4. <\/b><b>Extract information using DNS Zone Transfer<\/b> <\/p>\n<ul>\n<li><b>DNS <\/b><b>\u7ba1\u7406\u54e1\u5982\u679c\u8a2d\u5b9a\u4e0d\u7576<\/b><b><\/b><\/li>\n<\/ul>\n<p><b>5.Extract user groups from Windows<\/b> <\/p>\n<p><b>6.Extract usernames using SNMP<\/b> <\/p>\n<p><b><\/b> <\/p>\n<p><b>service and port Enumeration<\/b> <\/p>\n<table cellspacing=\"0\" cellpadding=\"0\" border=\"1\">\n<tbody>\n<tr>\n<td valign=\"top\" width=\"208\">\n<p>DNS Zone Transfer<\/p>\n<\/td>\n<td valign=\"top\" width=\"151\">\n<p>TCP\/UDP 53<\/p>\n<\/td>\n<td valign=\"top\" width=\"179\">\n<p>SMTP<\/p>\n<\/td>\n<td valign=\"top\" width=\"179\">\n<p>TCP 25<\/p>\n<\/td>\n<\/tr>\n<tr>\n<td valign=\"top\" width=\"208\">\n<p>Microsoft RPC <\/p>\n<\/td>\n<td valign=\"top\" width=\"151\">\n<p>TCP\/UDP 135<\/p>\n<\/td>\n<td valign=\"top\" width=\"179\">\n<p>SNMP Trap<\/p>\n<\/td>\n<td valign=\"top\" width=\"179\">\n<p>TCPO\/UDP 162 <\/p>\n<\/td>\n<\/tr>\n<tr>\n<td valign=\"top\" width=\"208\">\n<p>NetBIOS Name Service (NBNS)<\/p>\n<\/td>\n<td valign=\"top\" width=\"151\">\n<p>UDP 137<\/p>\n<\/td>\n<td valign=\"top\" width=\"179\">\n<p>ISAKMP\/Internet Key Exchange (IKE)<\/p>\n<\/td>\n<td valign=\"top\" width=\"179\">\n<p>UDP 500<\/p>\n<\/td>\n<\/tr>\n<tr>\n<td valign=\"top\" width=\"208\">\n<p>NetBIOS Session Service(SMB over NetBIOS)<\/p>\n<\/td>\n<td valign=\"top\" width=\"151\">\n<p>TCP 139<\/p>\n<\/td>\n<td valign=\"top\" width=\"179\">\n<p>SSH<\/p>\n<\/td>\n<td valign=\"top\" width=\"179\">\n<p>TCP 22<\/p>\n<\/td>\n<\/tr>\n<tr>\n<td valign=\"top\" width=\"208\">\n<p>SMB over TCP (Direct Host)<\/p>\n<\/td>\n<td valign=\"top\" width=\"151\">\n<p>TCP\/UDP 445<\/p>\n<\/td>\n<td valign=\"top\" width=\"179\">\n<p>LDAP<\/p>\n<\/td>\n<td valign=\"top\" width=\"179\">\n<p>TCP\/UDP 389<\/p>\n<\/td>\n<\/tr>\n<tr>\n<td valign=\"top\" width=\"208\">\n<p>SNMP<\/p>\n<\/td>\n<td valign=\"top\" width=\"151\">\n<p>UDP 161<\/p>\n<\/td>\n<td valign=\"top\" width=\"179\">\n<p>Network File System(NFS)<\/p>\n<\/td>\n<td valign=\"top\" width=\"179\">\n<p>TCP 2049<\/p>\n<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<p>DNS\u7528\u6236\u67e5\u8a62 =&gt; UDP 53 <\/p>\n<p>DNS Zone Transfer =&gt; TCP 53 <\/p>\n<p>Global Catalog Service =&gt; TCP\/UDP 3268 <\/p>\n<p>FTP : TCP 20\/21 <\/p>\n<p>Tlent : TCP 23 <\/p>\n<p>TFTP : UDP 69 <\/p>\n<p>Border Gateway Protocol (BGP): TCP 179 <\/p>\n<p><b><\/b> <\/p>\n<p><b><\/b> <\/p>\n<p><b><\/b> <\/p>\n<p><b><\/b> <\/p>\n<p>NetBIOS Enumeration : <\/p>\n<p>\u653b\u64ca\u8005\u53ef\u4ee5\u4f7f\u7528NetBIOS\u5217\u8209\u53d6\u5f97\u8cc7\u8a0a\u6709 <\/p>\n<p>1.List of computers that belong to a domain <\/p>\n<p>2.List of shares on the individual hosts on the network \u00e8 <\/p>\n<p>3.Policies and passwords <\/p>\n<p>Windows \u540d\u7a31\u89e3\u6790\u9806\u5e8f <\/p>\n<p>1. Netbios name cache <\/p>\n<p>2. Wins <\/p>\n<p>3. Broadcast <\/p>\n<p>4. lmhosts <\/p>\n<p><b>NebBIOS name List<\/b> <\/p>\n<p><b><a href=\"https:\/\/blog.pmail.idv.tw\/wp-content\/uploads\/2023\/03\/clip_image002.jpg\"><img loading=\"lazy\" decoding=\"async\" title=\"clip_image002\" style=\"border-top: 0px; border-right: 0px; background-image: none; border-bottom: 0px; padding-top: 0px; padding-left: 0px; border-left: 0px; display: inline; padding-right: 0px\" border=\"0\" alt=\"clip_image002\" src=\"https:\/\/blog.pmail.idv.tw\/wp-content\/uploads\/2023\/03\/clip_image002_thumb.jpg\" width=\"644\" height=\"271\"><\/a><\/b><b><\/b> <\/p>\n<p><b>Nbtstat Utility :<\/b> <\/p>\n<p><b><\/b> <\/p>\n<p><b>NBTSTAT [ [-a RemoteName] [-A IP address] [-c] [-n] [-r] [-R] [-RR] [-s] [-S] [interval] ]<\/b> <\/p>\n<p><b>-a (<\/b><b>\u4ecb\u9762\u5361\u72c0\u614b<\/b><b>) <\/b><b>\u5217\u51fa\u6307\u5b9a\u5176\u540d\u7a31\u7684\u9060\u7aef\u96fb\u8166\u540d\u7a31\u8868\u683c<\/b><b><\/b> <\/p>\n<p><b>-A (<\/b><b>\u4ecb\u9762\u5361\u72c0\u614b<\/b><b>) <\/b><b>\u5217\u51fa\u6307\u5b9a\u5176<\/b><b> IP <\/b><b>\u4f4d\u5740\u7684\u9060\u7aef\u96fb\u8166\u540d\u7a31\u8868\u683c\u3002<\/b><b><\/b> <\/p>\n<p><b>-c (<\/b><b>\u5feb\u53d6<\/b><b>) <\/b><b>\u5217\u51fa<\/b><b> NBT <\/b><b>\u5feb\u53d6\u7684\u9060\u7aef\u96fb\u8166\u540d\u7a31\u548c\u5b83\u5011\u7684<\/b><b> IP <\/b><b>\u4f4d\u5740\u3002<\/b><b><\/b> <\/p>\n<p><b>-n (<\/b><b>\u540d\u7a31<\/b><b>) <\/b><b>\u5217\u51fa\u672c\u6a5f<\/b><b> NetBIOS <\/b><b>\u540d\u7a31\u3002<\/b><b><\/b> <\/p>\n<p><b>-r (<\/b><b>\u5df2\u89e3\u6790<\/b><b>) <\/b><b>\u5217\u51fa\u7531\u5ee3\u64ad\u548c\u900f\u904e<\/b><b> WINS <\/b><b>\u89e3\u6790\u7684\u540d\u7a31<\/b><b><\/b> <\/p>\n<p><b>-R (<\/b><b>\u91cd\u65b0\u8f09\u5165<\/b><b>) <\/b><b>\u6e05\u9664\u548c\u91cd\u65b0\u8f09\u5165\u9060\u7aef\u5feb\u53d6\u540d\u7a31\u8868\u683c<\/b><b><\/b> <\/p>\n<p><b>-S (<\/b><b>\u5de5\u4f5c\u968e\u6bb5<\/b><b>) <\/b><b>\u5217\u51fa\u6709\u76ee\u7684\u5730<\/b><b> IP <\/b><b>\u4f4d\u5740\u7684\u5de5\u4f5c\u968e\u6bb5\u8868\u683c<\/b><b><\/b> <\/p>\n<p><b>-s (<\/b><b>\u968e\u6bb5\u4f5c\u696d<\/b><b>) <\/b><b>\u5217\u51fa\u5c07\u76ee\u7684\u5730<\/b><b> IP <\/b><b>\u4f4d\u5740\u8f49\u63db\u6210<\/b><b><\/b> <\/p>\n<p><b><\/b><b>\u96fb\u8166<\/b><b> NETBIOS <\/b><b>\u540d\u7a31\u7684\u5de5\u4f5c\u968e\u6bb5\u8868\u683c\u3002<\/b><b><\/b> <\/p>\n<p><b>-RR (ReleaseRefresh) <\/b><b>\u50b3\u9001\u540d\u7a31\u91cb\u653e\u5c01\u5305\u5230<\/b><b> WINS<\/b><b>\uff0c\u7136\u5f8c\u958b\u59cb\u91cd\u65b0\u6574\u7406<\/b><b><\/b> <\/p>\n<p><b><\/b> <\/p>\n<p><b>RemoteName <\/b><b>\u9060\u7aef\u7684\u4e3b\u6a5f\u96fb\u8166\u540d\u7a31\u3002<\/b><b><\/b> <\/p>\n<p><b>IP address <\/b><b>\u4ee5\u9ede\u5206\u9694\u8868\u793a<\/b><b> IP <\/b><b>\u4f4d\u5740\u7684\u5341\u9032\u4f4d\u6578\u3002<\/b><b><\/b> <\/p>\n<p><b>interval <\/b><b>\u91cd\u65b0\u986f\u793a\u9078\u53d6\u7684\u7d71\u8a08\u8cc7\u6599\u6642\uff0c\u6bcf\u6b21\u986f\u793a\u4e4b\u9593\u7684\u66ab\u505c<\/b><b><\/b> <\/p>\n<p><b><\/b><b>\u9593\u9694\u79d2\u6578\u3002\u6309<\/b><b> Ctrl+C <\/b><b>\u9375\u53ef\u4ee5\u505c\u6b62\u91cd\u65b0\u986f\u793a<\/b><b><\/b> <\/p>\n<p><b>Nmap scan netbios <\/b> <\/p>\n<p><b>Nmap -sV -v &#8211;script nbstat.nse 10.10.1.22<\/b> <\/p>\n<ul>\n<li>-sV&nbsp; (serviceVersion)\u63a2\u6e2c\u7aef\u53e3\u670d\u52d9\u7248\u672c\n<li>-v&nbsp; (view) \u986f\u793a\u6383\u63cf\u904e\u7a0b\uff0c\u6703\u6709\u5f88\u8a73\u7d30\u7684\u8aaa\u660e\u57f7\u884c\u5230\u54ea\u500b\u6b65\u9a5f\n<li>&#8212; script nbstat.nse \u8173\u672c<\/li>\n<\/ul>\n<p>\u5217\u8209user account <\/p>\n<p>\u53ef\u4ee5\u4f7f\u7528pstools <\/p>\n<p>\u5217\u8209shared Resources  <\/p>\n<p>-\u4f7f\u7528 net view  <\/p>\n<p>net view \\\\10.10.1.22 \/ALL <\/p>\n<p><a href=\"https:\/\/blog.pmail.idv.tw\/wp-content\/uploads\/2023\/03\/clip_image003-1.jpg\"><img loading=\"lazy\" decoding=\"async\" title=\"clip_image003\" style=\"border-top: 0px; border-right: 0px; background-image: none; border-bottom: 0px; padding-top: 0px; padding-left: 0px; border-left: 0px; display: inline; padding-right: 0px\" border=\"0\" alt=\"clip_image003\" src=\"https:\/\/blog.pmail.idv.tw\/wp-content\/uploads\/2023\/03\/clip_image003_thumb-1.jpg\" width=\"644\" height=\"392\"><\/a> <\/p>\n<p><b><\/b> <\/p>\n<p><b><\/b> <\/p>\n<p><b><\/b> <\/p>\n<p><b><\/b> <\/p>\n<p><b><\/b> <\/p>\n<p><b><\/b> <\/p>\n<p><b><\/b> <\/p>\n<p><b>SNMP Enumeration<\/b> <\/p>\n<p><b><\/b> <\/p>\n<p><b>UDP 161<\/b> <\/p>\n<p><b><\/b> <\/p>\n<p><b>Snmp <\/b><b>\u5305\u542b\u5169\u500b\u5bc6\u78bc<\/b><b><\/b> <\/p>\n<p><b>1.Read Community String-These strings are public. <\/b><b>\u53ea\u5141\u8a31<\/b><b>viewr <\/b><b>\u8a2d\u5099\u7cfb\u7d71\u8a2d\u5b9a<\/b><b><\/b> <\/p>\n<p><b>2.Read\/Write Community String-These strings are private. <\/b><b>\u5141\u8a31\u9060\u7aef\u7de8\u8f2f\u8a2d\u5b9a<\/b><b><\/b> <\/p>\n<p><b><\/b> <\/p>\n<p><b>\u653b\u64ca\u8005\u6703\u4f7f\u7528<\/b><b> public <\/b><b>\u5b57\u4e32\u4f86\u64f7\u53d6\u8a2d\u5099\u76f8\u95dc\u8cc7\u8a0a<\/b><b><\/b> <\/p>\n<ul>\n<li><b> Network resource <\/b><\/li>\n<li><b>Hosts,routers,share,arp table,routing tables,traffic<\/b><\/li>\n<\/ul>\n<p><b><\/b> <\/p>\n<p><b>Working of&nbsp; SNMP<\/b> <\/p>\n<p><b>1. <\/b><b>GetRequest<\/b> <\/p>\n<p><b>2. <\/b><b>GetNextRequest<\/b> <\/p>\n<p><b>3. <\/b><b>GetResponse<\/b> <\/p>\n<p><b>4. <\/b><b>SetRequest<\/b> <\/p>\n<p><b>5. <\/b><b>Trap<\/b> <\/p>\n<p><b><\/b> <\/p>\n<p><b>MIB (Management Information Base)<\/b> <\/p>\n<p><b>DHCP.MIB :<\/b><b>\u5305\u542b\u7528\u4f86\u76e3\u8996\u9060\u7aef\u4e3b\u6a5f\u8207<\/b><b> DHCP <\/b><b>\u4f3a\u670d\u5668\u4e4b\u9593\u7684\u7db2\u8def\u6d41\u91cf\u7684\u7269\u4ef6\u985e\u578b<\/b><b><\/b> <\/p>\n<p><b>HOSTMIB.MIB:<\/b><b>\u76e3\u63a7\u548c\u7ba1\u7406\u4e3b\u6a5f\u8cc7\u6e90<\/b><b><\/b> <\/p>\n<p><b>LNMIB2.MIB<\/b><b>\uff1a\u5305\u542b\u5de5\u4f5c\u7ad9\u548c\u670d\u52d9\u5668\u670d\u52d9\u7684\u5c0d\u50cf\u985e\u578b<\/b><b><\/b> <\/p>\n<p><b>MIB_II.MIB<\/b><b>\uff1a\u4f7f\u7528\u7c21\u55ae\u7684\u67b6\u69cb\u548c\u7cfb\u7d71\u7ba1\u7406\u57fa\u65bc<\/b><b> TCP\/IP <\/b><b>\u7684<\/b><b> Internet<\/b> <\/p>\n<p><b>WINS.MIB<\/b><b>\uff1a\u7528\u65bc<\/b><b> Windows Internet <\/b><b>\u540d\u7a31\u670d\u52d9<\/b><b> (WINS)<\/b> <\/p>\n<p><b>Snmp enumeration tools<\/b> <\/p>\n<p><b><\/b> <\/p>\n<p><b>1. <\/b><b>Snmpwalk <\/b> <\/p>\n<ul>\n<li><b>snmpwalk -v1 -c public &lt;target ip address&gt;<\/b><\/li>\n<\/ul>\n<p><b>2. <\/b><b>Snmp-chek ( snmp_enum Module)<\/b> <\/p>\n<p><b>\u958b\u6e90\u7684<\/b><b>tools <\/b><b>\uff0c\u653b\u64ca\u8005\u53ef\u4ee5\u4f7f\u7528\u5b83\u4f86\u6536\u96c6\u8a31\u591a\u8cc7\u8a0a\uff0c\u5982<\/b><b> iis , ip , user account ..<\/b><b>\u7b49\u8cc7\u8a0a<\/b><b><\/b> <\/p>\n<p><b>\u00e8<\/b><b>snmp-check &lt;target ip address&gt;<\/b> <\/p>\n<p><b><a href=\"https:\/\/blog.pmail.idv.tw\/wp-content\/uploads\/2023\/03\/clip_image005-1.jpg\"><img loading=\"lazy\" decoding=\"async\" title=\"clip_image005\" style=\"border-top: 0px; border-right: 0px; background-image: none; border-bottom: 0px; padding-top: 0px; padding-left: 0px; border-left: 0px; display: inline; padding-right: 0px\" border=\"0\" alt=\"clip_image005\" src=\"https:\/\/blog.pmail.idv.tw\/wp-content\/uploads\/2023\/03\/clip_image005_thumb-1.jpg\" width=\"644\" height=\"271\"><\/a><\/b><b><\/b> <\/p>\n<p><b>3. <\/b><b>SpftPerfect Network Scnner (<\/b><b>\u4ed8\u8cbb\u8edf\u9ad4<\/b><b>)<\/b> <\/p>\n<p><a href=\"https:\/\/www.softperfect.com\/\"><b>https:\/\/www.softperfect.com\/<\/b><\/a><b><\/b> <\/p>\n<p><b>\u53ef\u4ee5<\/b><b>scan port , ping computer,<\/b><b>\u627e<\/b><b>share folder, <\/b><b>\u7d93\u7531<\/b><b>windows WMI , SNMP,Http,SSH ,PowerShell<\/b><b>\u4f86<\/b><b>Scan.<\/b> <\/p>\n<p><b>4. <\/b><b>\u5176\u4ed6\u5de5\u5177<\/b><b><\/b> <\/p>\n<p>l<b>Network Performance Monitor (https:\/\/www.solarwinds.com)<\/b> <\/p>\n<p>&nbsp;<b>OpUtils (https:\/\/www.managgengine.com)<\/b> <\/p>\n<p><b>PRTG Network Monitor (https:\/\/www.paessler.com)<\/b> <\/p>\n<p><b>Enginner\u2019s Toolset (<\/b><a href=\"https:\/\/solarwinds.com\"><b>https:\/\/solarwinds.com<\/b><\/a><b>)<\/b> <\/p>\n<p><b><\/b> <\/p>\n<p><b>LDAP Enumeration<\/b> <\/p>\n<p><b><\/b> <\/p>\n<p><b>LDAP is an Internet protocol for accessing distributed directory services.<\/b> <\/p>\n<p><b>Directory services may provide any organized set of records, often in a hierarchical and logical structure, such as a corporate email directory.<\/b> <\/p>\n<p>l <b>A client starts an LDAP session by connecting to a Directory System Agent (DSA), typically on TCP port 389, and sends an operation request to the DSA.<\/b> <\/p>\n<p><b>information is transmitted between the client and server using The Basic Encoding Rules (BER)<\/b> <\/p>\n<p>l <b>attacker query the LDAP service to gather information such as usernames, addresses, departmental details, and server names.<\/b> <\/p>\n<p><b><\/b> <\/p>\n<p><b>LDAP TCP Port : 389<\/b> <\/p>\n<p><b>LDAPS TCP Port: 636 (<\/b><b>\u5efa\u8b70\u4f7f\u7528<\/b><b>)<\/b> <\/p>\n<p><b>\u653b\u64ca\u8005\u4f7f\u7528<\/b><b>LDAP <\/b><b>\u670d\u52d9\u4f86\u53d6\u5f97<\/b><b> username,address ,departmental details,<\/b><b>\u53d6\u5f97\u9019\u4e9b\u8cc7\u8a0a\u5728\u9032\u884c\u4e0b\u4e00\u6b65\u7684\u653b\u64ca\u3002<\/b><b><\/b> <\/p>\n<p><b><\/b> <\/p>\n<p><b>1. <\/b><b>Manual LDAP Enumeration <\/b> <\/p>\n<p>l <b>Python tools =&gt; ldap3<\/b> <\/p>\n<p><b>2. <\/b><b>Automated LDAP Enumeration <\/b> <\/p>\n<p>l <b>Nmap <\/b> <\/p>\n<p><b>ldap-brute NSE script<\/b> <\/p>\n<p><b>nmap -p 389 &#8211;script ldap-brute \u2013script-args ldap.base=\u2019 \u201ccn=users,dc=ceh,dc=com\u201d\u2019 &lt;Tarage ip address&gt;<\/b> <\/p>\n<p><b><\/b> <\/p>\n<p><b><\/b> <\/p>\n<p><b><\/b> <\/p>\n<p><b><\/b> <\/p>\n<p><b><\/b> <\/p>\n<p><b><\/b> <\/p>\n<p><b><\/b> <\/p>\n<p><b><\/b> <\/p>\n<p><b><\/b> <\/p>\n<p><b><\/b> <\/p>\n<p><b><\/b> <\/p>\n<p><b>Ldap Enumeration Tools<\/b> <\/p>\n<p><b>Softerra Ldap Administrator (https:\/\/www.ldapadministrator.com\/)<\/b> <\/p>\n<p><b>LDAP Administrator <\/b><b>\u652f\u6301<\/b><b> LDAPv2 <\/b><b>\u548c<\/b><b> LDAPv3 <\/b><b>\u5354\u8b70\uff0c\u4e26\u5141\u8a31\u4f7f\u7528<\/b><b> OpenLDAP<\/b><b>\u3001<\/b><b>Netscape\/iPlanet<\/b><b>\u3001<\/b><b>Novell eDirectory<\/b><b>\u3001<\/b><b>Oracle Internet Directory<\/b><b>\u3001<\/b><b>Lotus Domino<\/b><b>\u3001<\/b><b>Microsoft Active Directory<\/b><b>\u3001<\/b><b>CA Directory<\/b><b>\u3001<\/b><b>Siemens DirX <\/b><b>\u548c\u4efb\u4f55\u5176\u4ed6<\/b><b> LDAP <\/b><b>\u670d\u52d9\u5668\u3002<\/b><b><\/b> <\/p>\n<p><b><\/b> <\/p>\n<p><b><a href=\"https:\/\/blog.pmail.idv.tw\/wp-content\/uploads\/2023\/03\/clip_image007-1.jpg\"><img loading=\"lazy\" decoding=\"async\" title=\"clip_image007\" style=\"border-top: 0px; border-right: 0px; background-image: none; border-bottom: 0px; padding-top: 0px; padding-left: 0px; border-left: 0px; display: inline; padding-right: 0px\" border=\"0\" alt=\"clip_image007\" src=\"https:\/\/blog.pmail.idv.tw\/wp-content\/uploads\/2023\/03\/clip_image007_thumb-1.jpg\" width=\"644\" height=\"366\"><\/a><\/b><b><\/b> <\/p>\n<p><b><\/b> <\/p>\n<p><b>Ldapseach (<\/b><a href=\"https:\/\/linux.die.net\/\"><b>https:\/\/linux.die.net\/<\/b><\/a><b>)<\/b> <\/p>\n<p><b>ldapsearch <\/b><b>\u6253\u958b\u8207<\/b><b> LDAP <\/b><b>\u670d\u52d9\u5668\u7684\u9023\u63a5\uff0c\u7d81\u5b9a\u5b83\uff0c\u4e26\u4f7f\u7528\u6307\u5b9a\u7684\u53c3\u6578\u57f7\u884c\u641c\u7d22\u3002<\/b><b> <\/b><b>\u904e\u6ffe\u5668\u61c9\u7b26\u5408\u641c\u7d22\u904e\u6ffe\u5668\u7684\u5b57\u7b26\u4e32\u8868\u793a\u5f62\u5f0f\uff0c\u5982<\/b><b> RFC 4515 <\/b><b>\u4e2d\u6240\u5b9a\u7fa9\u3002\u5982\u679c\u672a\u63d0\u4f9b\uff0c\u5247\u4f7f\u7528\u9ed8\u8a8d\u904e\u6ffe\u5668<\/b><b> (objectClass=*)<\/b><b>\u3002<\/b><b><\/b> <\/p>\n<p><b><\/b> <\/p>\n<p><b>ldapsearch -h 10.10.1.22 -x<\/b> <\/p>\n<p><b>-h LDAP<\/b><b>\u4e3b\u6a5f<\/b><b>IP<\/b><b>\u6216\u53ef\u4ee5\u89e3\u6790\u7684<\/b><b>hostname<\/b> <\/p>\n<p><b>-x <\/b><b>\u4f7f\u7528\u7c21\u55ae\u8a8d\u8b49\u65b9\u5f0f<\/b><b><\/b> <\/p>\n<p><b><\/b> <\/p>\n<p><b>ldapsearch -h 10.10.1.22 -x -s base namingcontexts<\/b> <\/p>\n<p><b>-s <\/b><b>\u6307\u5b9a\u641c\u5c0b\u7bc4\u570d<\/b><b>, <\/b><b>\u53ef\u9078\u503c\uff1a<\/b><b>base|one|sub|children<\/b><b><\/b> <\/p>\n<p><b><\/b> <\/p>\n<p><b><a href=\"https:\/\/blog.pmail.idv.tw\/wp-content\/uploads\/2023\/03\/clip_image008-1.jpg\"><img loading=\"lazy\" decoding=\"async\" title=\"clip_image008\" style=\"border-top: 0px; border-right: 0px; background-image: none; border-bottom: 0px; padding-top: 0px; padding-left: 0px; border-left: 0px; display: inline; padding-right: 0px\" border=\"0\" alt=\"clip_image008\" src=\"https:\/\/blog.pmail.idv.tw\/wp-content\/uploads\/2023\/03\/clip_image008_thumb-1.jpg\" width=\"644\" height=\"413\"><\/a><\/b><b><\/b> <\/p>\n<p><b><\/b> <\/p>\n<p><b>ldapsearch -h 10.10.1.22 -x -b \u201cdc=ceh,dc=com\u201d<\/b> <\/p>\n<p><b>-b base dn <\/b><b>\u6307\u5b9a\u7528\u4f5c\u641c\u7d22\u8d77\u59cb\u9ede\u7684\u5c08\u6709\u540d\u7a31\u3002\u4f7f\u7528\u5f15\u865f\u4f86\u6307\u5b9a\u8a72\u503c\uff0c\u4f8b\u5982\uff1a<\/b><b>&#8220;ou=West,o=Acme,c=US&#8221;<\/b><b><\/b> <\/p>\n<p><b><\/b> <\/p>\n<p><b>\u5176\u4ed6<\/b><b> LDAP Enumeration tools<\/b> <\/p>\n<ul>\n<li><b>AD Explorer (https:\/\/docs.microsoft.com)<\/b><\/li>\n<li><b>LDAP Admin Tool (https:\/\/www.ldapsoft.com)<\/b><\/li>\n<li><b>LDAP Account Manager (https:\/\/www.ldap-account-manager.org)<\/b><\/li>\n<li><b>LDAP Search (<\/b><a href=\"http:\/\/securityxploded.com\"><b>http:\/\/securityxploded.com<\/b><\/a><b>)<\/b><\/li>\n<li><b>JXplorer<\/b><b><\/b><\/li>\n<\/ul>\n<p><b><\/b> <\/p>\n<p><b><\/b> <\/p>\n<p><b>NTP Enumeration <\/b> <\/p>\n<p><b>NTP :UDP 123<\/b> <\/p>\n<p><b><\/b> <\/p>\n<p><b>\u653b\u64ca\u8005\u5f9e<\/b><b>NTP <\/b><b>\u53ef\u4ee5\u6216\u7684\u8cc7\u8a0a<\/b><b><\/b> <\/p>\n<p>l <b><\/b><b>\u5217\u51fa\u9023\u7dda\u7684<\/b><b>hosts <\/b> <\/p>\n<p>l <b>Client IP <\/b><b>\u542b<\/b><b>system name , OS<\/b> <\/p>\n<p>l <b><\/b><b>\u5982\u679c<\/b><b>NTP server <\/b><b>\u4f4d\u65bc<\/b><b>DMZ<\/b><b>\uff0c\u9084\u53ef\u4ee5\u62ff\u5230\u5167\u90e8<\/b><b>IP<\/b> <\/p>\n<p><b><\/b> <\/p>\n<p><b>\u6307\u4ee4<\/b><b>: netdae,ntptrace,ntpdc,ntpq<\/b> <\/p>\n<p><b>Ntptrac : <\/b>\u7528\u4f86\u8ffd\u8e64\u67d0\u90e8\u6642\u9593\u4f3a\u670d\u5668\u7684\u6642\u9593\u5c0d\u61c9\u95dc\u4fc2 <\/p>\n<p>Ntptrac [-n ] [-m maxhosts] [servername\/ip address] <\/p>\n<p><b><\/b> <\/p>\n<p><b><\/b> <\/p>\n<p><b>NFS Enumeration <\/b> <\/p>\n<p><b>\u653b\u64ca\u8005\u53ef\u4ee5\u5217\u8209<\/b><b>NFS <\/b><b>\u53d6\u5f97<\/b><b>NFS <\/b><b>\u5206\u4eab\u76ee\u9304\uff0c\u518d\u5229\u7528\u5176\u4ed6\u65b9\u5f0f\u53d6\u5f97\u8a72\u76ee\u9304\u4e0a\u50b3\u6b0a\u9650\u5f8c\u6563\u6b65\u60e1\u610f\u7a0b\u5f0f\u4f86\u505a\u9032\u4e00\u6b65\u653b\u64ca\u3002<\/b><b><\/b> <\/p>\n<p><b>TCP Port 2049<\/b> <\/p>\n<p><b>Rpcinfo -p &lt;target ip address&gt; <\/b><b>\u6383\u63cf<\/b><b>NFS <\/b><b>\u670d\u52d9<\/b><b><\/b> <\/p>\n<p><b>Showmont -e &lt;target ip address&gt; <\/b><b>\u5217\u51fa<\/b><b>NFS <\/b><b>\u5206\u4eab\u7684\u76ee\u9304<\/b><b><\/b> <\/p>\n<p><b><\/b> <\/p>\n<p><b>Tools <\/b> <\/p>\n<p>l <b>RPCScan (<\/b><a href=\"https:\/\/github.com\"><b>https:\/\/github.com<\/b><\/a><b>)<\/b> <\/p>\n<p><b>Python3 rpc-scan.py &lt;Target ip address&gt; &#8211;rpc<\/b> <\/p>\n<p>l <b>SuperEnum (<\/b><a href=\"https:\/\/github.com\"><b>https:\/\/github.com<\/b><\/a><b>)<\/b> <\/p>\n<ul>\n<li><b>SupmerEnum <\/b><\/li>\n<\/ul>\n<p><b><a href=\"https:\/\/blog.pmail.idv.tw\/wp-content\/uploads\/2023\/03\/clip_image009.jpg\"><img loading=\"lazy\" decoding=\"async\" title=\"clip_image009\" style=\"border-top: 0px; border-right: 0px; background-image: none; border-bottom: 0px; padding-top: 0px; padding-left: 0px; border-left: 0px; display: inline; padding-right: 0px\" border=\"0\" alt=\"clip_image009\" src=\"https:\/\/blog.pmail.idv.tw\/wp-content\/uploads\/2023\/03\/clip_image009_thumb.jpg\" width=\"644\" height=\"271\"><\/a><\/b><\/p>\n<p><b><\/b> <\/p>\n<p><b><\/b> <\/p>\n<p><b>SMTP Enumeartion<\/b> <\/p>\n<p><b>SMTP TCP 25<\/b><b>\u3001<\/b><b>2525<\/b><b>\u3001<\/b><b>587<\/b> <\/p>\n<p><b>\u63d0\u4f9b\u4e09\u500b\u6307\u4ee4<\/b><b><\/b> <\/p>\n<p><b>VRFY : Validates users<\/b><b>\u9a57\u8b49\u4f7f\u7528\u8005<\/b><b><\/b> <\/p>\n<p><b>EXPN : <\/b><b>\u5225\u540d\u5c0d\u61c9\u7684<\/b><b>email<\/b> <\/p>\n<p><b>RCPT TO:-<\/b><b>\u5b9a\u7fa9\u6d88\u606f\u7684\u63a5\u6536\u8005<\/b><b><\/b> <\/p>\n<p><b>\u653b\u64ca\u8005\u53ef\u4ee5\u900f\u904e<\/b><b> telnet <\/b><b>\u4f86\u5217\u8209<\/b><b>SMTP <\/b><b>\u6709\u6548\u7684<\/b><b>users<\/b> <\/p>\n<p><b><\/b> <\/p>\n<p><b>Tools<\/b> <\/p>\n<ul>\n<li><b>Nmap :<\/b><\/li>\n<\/ul>\n<p><b>Nmap -p 25 -script=smtp-commands &lt;target ip address&gt;<\/b> <\/p>\n<p><b>Nmap -p 25 -script=smtp-open-relay &lt;target ip address&gt;<\/b> <\/p>\n<p><b>Nmap -p 25 -script=smtp-enum-users &lt;target ip address&gt;<\/b> <\/p>\n<p><b><\/b> <\/p>\n<ul>\n<li><b>Metasploit<\/b><\/li>\n<\/ul>\n<p><b>=&gt;msf &gt; use auxiliary\/scanner\/smtp\/smtp_enum<\/b> <\/p>\n<p>l <b>NetScanTools Pro<\/b> <\/p>\n<p>l <b>Smtp-user-enum<\/b> <\/p>\n<p><b><\/b> <\/p>\n<p><b><\/b> <\/p>\n<p><b><\/b> <\/p>\n<p><b><\/b> <\/p>\n<p><b>FTP Enumeration<\/b> <\/p>\n<p><b><\/b> <\/p>\n<p><b>TCP Port : 21 <\/b><b>\u50b3\u905e\u63a7\u5236\u8a0a\u606f<\/b><b><\/b> <\/p>\n<p><b>TCP Port : 20 <\/b><b>\u50b3\u905e\u8cc7\u6599<\/b><b><\/b> <\/p>\n<p><b>Tools<\/b> <\/p>\n<p><b><\/b> <\/p>\n<p><b>1. <\/b><b>nmap -p 21 &lt;target domain&gt;<\/b> <\/p>\n<p><b>2. <\/b><b>metaspolit<\/b> <\/p>\n<p><b><\/b> <\/p>\n<p><b>FTP Bounce Attack <\/b><b>\u53c3\u8003\u9023\u7d50<\/b><b><\/b> <\/p>\n<p><b>\u5229\u7528<\/b><b> FTP <\/b><b>\u5728\u50b3\u8f38\u6a94\u6848\u904e\u7a0b\u7684\u6f0f\u6d1e\u4f86\u9032\u884c\u653b\u64ca<\/b><b><\/b> <\/p>\n<p><b>FTP <\/b><b>\u4e2d\u4e3b\u52d5\u6a21\u5f0f\u7684<\/b><b> port command <\/b><b>\u53ef\u4ee5\u5c0d\u4f3a\u670d\u5668\u53bb\u8a2d\u5b9a\u8981\u9023\u7dda\u6a5f\u5668\u7684<\/b><b> IP <\/b><b>\u548c<\/b><b> port<\/b> <\/p>\n<p><a href=\"https:\/\/ithelp.ithome.com.tw\/articles\/10188705\"><b>https:\/\/ithelp.ithome.com.tw\/articles\/10188705<\/b><\/a><b><\/b> <\/p>\n<p><b><\/b> <\/p>\n<p><b><\/b> <\/p>\n<p><b>TFTP Enumeration<\/b> <\/p>\n<p><b><\/b> <\/p>\n<p><b>UDP Port :69<\/b> <\/p>\n<p><b><\/b> <\/p>\n<p><b>Tools : <\/b> <\/p>\n<p><b><\/b> <\/p>\n<p><b>-&gt;PortQry <\/b> <\/p>\n<p><b>Portqry.exe -n &lt;target domain\/ip&gt; -e 69 -p udp<\/b> <\/p>\n<p><b><\/b> <\/p>\n<p><b>-&gt;nmap<\/b> <\/p>\n<p><b>Nmap -p 69 &lt;target domain\/ip&gt;<\/b> <\/p>\n<p><b><\/b> <\/p>\n<p><b><\/b> <\/p>\n<p><b><\/b> <\/p>\n<p><b><\/b> <\/p>\n<p><b><\/b> <\/p>\n<p><b>DNS Enumeration<\/b> <\/p>\n<p><b><\/b> <\/p>\n<p><b>Tools:<\/b> <\/p>\n<ul>\n<li><b>Disg <\/b><b>\u6307\u4ee4<\/b><b><\/b><\/li>\n<\/ul>\n<p><b>Dig ns &lt;taget domain&gt;<\/b> <\/p>\n<p><b>Dig @&lt;domain of name server&gt; &lt;target domain&gt; axfr<\/b> <\/p>\n<p><b><\/b> <\/p>\n<ul>\n<li><b>DNSRecon<\/b><\/li>\n<\/ul>\n<p><b>Dnsrecon -t axfr -d &lt;target domain&gt;<\/b> <\/p>\n<p><b>ipsec Enumeration <\/b> <\/p>\n<p><strong>UDP Port 500<\/strong> <\/p>\n<p><strong>tools:<\/strong> <\/p>\n<p><strong>nmap&nbsp; -sU -p 500 &lt;target ip address&gt;<\/strong> <\/p>\n<p><strong>ike-scan&nbsp; -M &lt;target gateway ip address&gt;<\/strong> <\/p>\n<p><strong>Voip Enumeration<\/strong> <\/p>\n<p><strong>UDP\/TCP Port 2000,2001,5060,5061<\/strong> <\/p>\n<p><strong>tools <\/strong> <\/p>\n<p><strong>Svmap (<a href=\"https:\/\/github.com\">https:\/\/github.com<\/a>)<\/strong> <\/p>\n<p><strong>svmap &lt;tarage network rang\/ip address&gt;<\/strong> <\/p>\n<p><strong>RPC Enumeration <\/strong> <\/p>\n<p><strong>TCP and UDP port 111 (Linux)<\/strong> <\/p>\n<p><strong>tools:<\/strong> <\/p>\n<p><strong>nmap&nbsp; -sR &lt;target ip\/network&gt;<\/strong> <\/p>\n<p><strong>nmap&nbsp; -T4&nbsp; &lt;target ip\/network&gt;<\/strong><\/p>\n<div class=\"21cd169d3c0f71e95b84db320302cb4a\" data-index=\"1\" style=\"float: right; margin:10px 0 10px 10px;\">\n<script async src=\"https:\/\/pagead2.googlesyndication.com\/pagead\/js\/adsbygoogle.js?client=ca-pub-8711325745898650\"\r\n     crossorigin=\"anonymous\"><\/script>\n<\/div>\n\n<div style=\"font-size: 0px; height: 0px; line-height: 0px; margin: 0; padding: 0; clear: both;\"><\/div>","protected":false},"excerpt":{"rendered":"<p>\u672c\u7ae0\u5927\u6982\u5c31\u662f\u8aaa\u660e\u4e00\u4e9bEnumeration(\u5217\u8209)\u7684\u6280\u5de7 \u7b46\u8a18\u4e00\u4e0b\uff0c\u6709\u932f\u8aa4\u7684\u5730\u65b9 &hellip; <a href=\"https:\/\/blog.pmail.idv.tw\/?p=19817\">\u95b1\u8b80\u5168\u6587 <span class=\"meta-nav\">&rarr;<\/span><\/a><\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"ngg_post_thumbnail":0,"footnotes":""},"categories":[193,183],"tags":[],"class_list":["post-19817","post","type-post","status-publish","format-standard","hentry","category-ceh","category-183"],"_links":{"self":[{"href":"https:\/\/blog.pmail.idv.tw\/index.php?rest_route=\/wp\/v2\/posts\/19817","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/blog.pmail.idv.tw\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/blog.pmail.idv.tw\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/blog.pmail.idv.tw\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/blog.pmail.idv.tw\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=19817"}],"version-history":[{"count":2,"href":"https:\/\/blog.pmail.idv.tw\/index.php?rest_route=\/wp\/v2\/posts\/19817\/revisions"}],"predecessor-version":[{"id":19827,"href":"https:\/\/blog.pmail.idv.tw\/index.php?rest_route=\/wp\/v2\/posts\/19817\/revisions\/19827"}],"wp:attachment":[{"href":"https:\/\/blog.pmail.idv.tw\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=19817"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/blog.pmail.idv.tw\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=19817"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/blog.pmail.idv.tw\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=19817"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}