Nmap 7.25BETA1 was initiated at Sun Aug 28 02:24:26 2016 with these arguments:
nmap -vv -sS -Pn -A -sV -T5 --script=default,auth,vuln,discovery -p- -oX 192-168-56-102.xml --script-args=unsafe=1 192.168.56.102
Verbosity: 2; Debug level 0
Nmap done at Sun Aug 28 02:32:52 2016; 1 IP address (1 host up) scanned in 506.54 seconds
| Script Name | Output |
| broadcast-igmp-discovery |
192.168.56.1
Interface: eth1
Version: 2
Group: 224.0.0.251
Description: mDNS (rfc6762)
Use the newtargets script-arg to add the results as targets
|
| broadcast-pim-discovery | ERROR: Script execution failed (use -d to debug) |
| ipv6-multicast-mld-list |
fe80::800:27ff:fe00:0:
device: eth1
mac: 0a:00:27:00:00:00
multicast_ips:
ff02::1:ff9b:1fa4 (Solicited-Node Address)
ff02::fb (mDNSv6)
ff02::fb (mDNSv6)
ff02::fb (mDNSv6)
ff02::fb (mDNSv6)
ff02::fb (mDNSv6)
ff02::1:ff00:0 (NDP Solicited-node)
ff02::fb (mDNSv6) |
| knx-gateway-discover | ERROR: Script execution failed (use -d to debug) |
| mrinfo | ERROR: Script execution failed (use -d to debug) |
| targets-asn | targets-asn.asn is a mandatory parameter |
| targets-ipv6-multicast-echo | IP: fe80::800:27ff:fe00:0 MAC: 0a:00:27:00:00:00 IFACE: eth1 Use --script-args=newtargets to add the results as targets |
| targets-ipv6-multicast-invalid-dst | IP: fe80::800:27ff:fe00:0 MAC: 0a:00:27:00:00:00 IFACE: eth1 Use --script-args=newtargets to add the results as targets |
| targets-ipv6-multicast-mld | IP: fe80::800:27ff:fe00:0 MAC: 0a:00:27:00:00:00 IFACE: eth1 Use --script-args=newtargets to add the results as targets |
| targets-ipv6-multicast-slaac | IP: fe80::800:27ff:fe00:0 MAC: 0a:00:27:00:00:00 IFACE: eth1 IP: fe80::953f:e6d2:469b:1fa4 MAC: 0a:00:27:00:00:00 IFACE: eth1 Use --script-args=newtargets to add the results as targets |
The 65523 ports scanned but not shown below are in state: filtered
65523 ports replied with: no-responses
| Script Name | Output |
| dns-brute | Can't guess domain of "192.168.56.102"; use dns-brute.domain script argument. |
| fcrdns | FAIL (No PTR record) |
| firewalk | HOP HOST PROTOCOL BLOCKED PORTS 0 192.168.56.5 tcp 1-10 |
| ipidseq | All zeros |
| msrpc-enum | NT_STATUS_OBJECT_NAME_NOT_FOUND |
| nbstat | NetBIOS name: RED, NetBIOS user: <unknown>, NetBIOS MAC: <unknown> (unknown) Names: RED<00> Flags: <unique><active> RED<03> Flags: <unique><active> RED<20> Flags: <unique><active> WORKGROUP<00> Flags: <group><active> WORKGROUP<1e> Flags: <group><active> Statistics: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |
| p2p-conficker | Checking for Conficker.C or higher... Check 1 (port 50063/tcp): CLEAN (Timeout) Check 2 (port 10167/tcp): CLEAN (Timeout) Check 3 (port 34474/udp): CLEAN (Failed to receive data) Check 4 (port 29075/udp): CLEAN (Failed to receive data) 0/4 checks are positive: Host is CLEAN or ports are blocked |
| path-mtu | PMTU == 1500 |
| qscan | PORT FAMILY MEAN (us) STDDEV LOSS (%) 20 0 230.30 47.67 0.0% 21 0 261.90 49.67 0.0% 22 0 263.50 75.89 0.0% 53 0 245.90 44.88 0.0% 80 0 250.89 56.03 10.0% 139 0 275.90 88.14 0.0% 666 0 257.80 71.84 0.0% 3306 0 230.90 43.02 0.0% 12380 0 238.30 54.61 0.0% |
| smb-enum-domains |
Builtin
Groups: n/a
Users: n/a
Creation time: unknown
Passwords: min length: 5; min age: n/a days; max age: n/a days; history: n/a passwords
Account lockout disabled
RED
Groups: n/a
Users: n/a
Creation time: unknown
Passwords: min length: 5; min age: n/a days; max age: n/a days; history: n/a passwords
Account lockout disabled
|
| smb-enum-sessions | <nobody> |
| smb-enum-shares |
account_used: guest
IPC$:
Type: STYPE_IPC_HIDDEN
Comment: IPC Service (red server (Samba, Ubuntu))
Users: 3
Max Users: <unlimited>
Path: C:\tmp
Anonymous access: READ/WRITE
Current user access: READ/WRITE
kathy:
Type: STYPE_DISKTREE
Comment: Fred, What are we doing here?
Users: 0
Max Users: <unlimited>
Path: C:\var\samba\
Anonymous access: READ
Current user access: READ
print$:
Type: STYPE_DISKTREE
Comment: Printer Drivers
Users: 0
Max Users: <unlimited>
Path: C:\var\lib\samba\printers
Anonymous access: <none>
Current user access: <none>
tmp:
Type: STYPE_DISKTREE
Comment: All temporary files should be stored here
Users: 0
Max Users: <unlimited>
Path: C:\var\tmp
Anonymous access: READ/WRITE
Current user access: READ/WRITE |
| smb-ls | Volume \\192.168.56.102\kathy SIZE TIME FILENAME <DIR> 2016-06-03 11:52:52 . <DIR> 2016-06-06 16:39:56 .. <DIR> 2016-06-05 10:02:27 kathy_stuff 64 2016-06-05 10:02:27 kathy_stuff\todo-list.txt <DIR> 2016-06-05 10:04:14 backup 5961 2016-06-05 10:03:45 backup\vsftpd.conf 6321767 2015-04-27 12:14:46 backup\wordpress-4.tar.gz Volume \\192.168.56.102\tmp SIZE TIME FILENAME <DIR> 2016-08-27 21:26:23 . <DIR> 2016-06-06 16:39:56 .. 274 2016-06-05 10:32:58 ls |
| smb-mbenum |
DFS Root
RED 0.0 red server (Samba, Ubuntu)
Potential Browser
RED 0.0 red server (Samba, Ubuntu)
Print server
RED 0.0 red server (Samba, Ubuntu)
Server
RED 0.0 red server (Samba, Ubuntu)
Server service
RED 0.0 red server (Samba, Ubuntu)
Unix server
RED 0.0 red server (Samba, Ubuntu)
Windows NT/2000/XP/2003 server
RED 0.0 red server (Samba, Ubuntu)
Workstation
RED 0.0 red server (Samba, Ubuntu)
|
| smb-os-discovery | OS: Windows 6.1 (Samba 4.3.9-Ubuntu) Computer name: red NetBIOS computer name: RED Domain name: FQDN: red System time: 2016-08-28T03:25:58+01:00 |
| smb-security-mode | account_used: guest authentication_level: user challenge_response: supported message_signing: disabled (dangerous, but default) |
| smb-system-info | ERROR: Script execution failed (use -d to debug) |
| smb-vuln-cve2009-3103 |
VULNERABLE:
SMBv2 exploit (CVE-2009-3103, Microsoft Security Advisory 975497)
State: VULNERABLE
IDs: CVE:CVE-2009-3103
Array index error in the SMBv2 protocol implementation in srv2.sys in Microsoft Windows Vista Gold, SP1, and SP2,
Windows Server 2008 Gold and SP2, and Windows 7 RC allows remote attackers to execute arbitrary code or cause a
denial of service (system crash) via an & (ampersand) character in a Process ID High header field in a NEGOTIATE
PROTOCOL REQUEST packet, which triggers an attempted dereference of an out-of-bounds memory location,
aka "SMBv2 Negotiation Vulnerability."
Disclosure date: 2009-09-08
References:
http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-3103
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-3103
|
| smb-vuln-ms10-054 | ERROR: Script execution failed (use -d to debug) |
| smb-vuln-ms10-061 | false |
| smb-vuln-regsvc-dos |
VULNERABLE:
Service regsvc in Microsoft Windows systems vulnerable to denial of service
State: VULNERABLE
The service regsvc in Microsoft Windows 2000 systems is vulnerable to denial of service caused by a null deference
pointer. This script will crash the service if it is vulnerable. This vulnerability was discovered by Ron Bowes
while working on smb-enum-sessions.
|
| smbv2-enabled | Server supports SMBv2 protocol |
| traceroute-geolocation | HOP RTT ADDRESS GEOLOCATION 1 0.49 192.168.56.102 - ,- |
| Metric | Value |
| Ping Results | arp-response |
| System Uptime | 681 seconds (last reboot: Sun Aug 28 02:21:31 2016) |
| Network Distance | 1 hops |
| TCP Sequence Prediction | Difficulty=252 (Good luck!) |
| IP ID Sequence Generation | All zeros |