title: 操作系統(tǒng)識別
date: 2016-06-04 12:16
tags: kali滲透測試 主動信息收集
OS的識別技術(shù)多種多樣，有簡單的也有復(fù)雜的贪庙，最簡單的就是用TTL值去識別幢泼。不同類型的OS默認的起始TTL值是不同的被芳，比如烤送，windows的默認是128咖摹，然后每經(jīng)過一個路由爹土，TTL值減一甥雕。Linux/Unix的值是64，但有些特殊的Unix會是255胀茵。
0x00 Python識別TTL值
#!/usr/bin/python
from scapy.all import *
import logging
logging.getLogger("scapy.runtime").setLevel(logging.ERROR)
import sys
if len(sys.argv) != 2:
print("Usage --/ttl_os.py [IP Address]")
print("Example --/ttl_os.py 192.168.0.1")
print("Example will preform ttl analysis to attempt to determine whether the system is windows or linux/unix")
sys.exit()
ip = sys.argv[1]
ans = sr1(IP(dst=str(ip))/ICMP(), timeout=1, verbose=0)
if ans == None:
print("NO response was returned")
elif int(ans[IP].ttl)<=64:
print("Host is Linux/Unix")
else:
print("Host is Windows")
0x01 NMAP識別OS
由于自身腳本的局限性社露，Python掃描的結(jié)果過于簡單。
NMAP的-O參數(shù)同樣可以進行OS的識別
? Python nmap -O 192.168.0.1
Starting Nmap 7.12 ( https://nmap.org ) at 2016-06-04 16:06 CST
Nmap scan report for 192.168.0.1
Host is up (0.00077s latency).
Not shown: 999 closed ports
PORT STATE SERVICE
80/tcp open http
MAC Address: C8:3A:35:4E:4B:B0 (Tenda Technology)
Device type: general purpose
Running: Wind River VxWorks
OS CPE: cpe:/o:windriver:vxworks
OS details: VxWorks
Network Distance: 1 hop
OS detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 2.07 seconds
使用__namp -O __對所在的網(wǎng)關(guān)進行OS識別掃描琼娘。
0x02 被動識別OS
基于網(wǎng)絡(luò)監(jiān)聽的工作原理峭弟，Windows和Linux發(fā)送出來的包是有很大區(qū)別的。被動式的掃描可以部署在網(wǎng)絡(luò)進出口的地方脱拼，目的是讓所經(jīng)過的流量通過我的流量分析器瞒瘸。
同樣在Kali中也存在這般的工具p0f，他會監(jiān)聽凡是通過本地網(wǎng)卡的流量熄浓。
? ~ p0f
--- p0f 3.07b by Michal Zalewski <lcamtuf@coredump.cx> ---
[+] Closed 1 file descriptor.
[+] Loaded 320 signatures from 'p0f.fp'.
[+] Intercepting traffic on default interface 'eth0'.
[+] Default packet filtering configured [+VLAN].
[+] Entered main event loop.
.-[ 192.168.0.109/52188 -> 106.2.189.18/80 (syn) ]-
|
| client = 192.168.0.109/52188
| os = Linux 3.11 and newer
| dist = 0
| params = none
| raw_sig = 4:64+0:0:1460:mss*20,7:mss,sok,ts,nop,ws:df,id+:0
|
`----
p0f不但會探測OS類型情臭，同時也會對目標上面所運行的應(yīng)用程序進行探測。
