공격툴&정보수집 - 25. OpenVAS를 이용한 취약점 스캐닝

공격툴&정보수집 - 25. OpenVAS를 이용한 취약점 스캐닝

 

 

본 내용은 교육 과정에서 필요한 실습 목적으로 구성된 것이며, 혹시라도 개인적인 용도 및 악의적인 목적으로 사용할 경우, 법적 책임은 본인에게 있다는 것을 알려드립니다.

 

 

 - OpenVAS : 취약점 분석 도구 (Kali Linux에 기본적으로 설치되어 있음/무료)

 

Ex1) OpenVAS 설치 유무 확인

 

@ Kali Linux

 

root@kali:~# dpkg -l openvas
희망상태=알수없음(U)/설치(I)/지우기(R)/깨끗이(P)/고정(H)
| 상태=아님(N)/설치(I)/설정(C)/풀림(U)/절반설정(F)/일부설치(H)/트리거대기(W)/
| /    트리거밀림(T)
|/ 오류?=(없음)/다시설치필요(R) (상태, 오류가 대문자=불량)
||/ 이름           버전         Architecture 설명
+++-==============-============-============-=================================
ii  openvas        8.0+kali1    all          dummy package for openvas

 

 

root@kali:~# dpkg -L openvas
/.
/usr
/usr/share
/usr/share/doc
/usr/share/doc/openvas
/usr/share/doc/openvas/changelog.gz
/usr/share/doc/openvas/copyright
/usr/bin
/usr/bin/openvas-feed-update
/usr/bin/openvas-setup
/usr/bin/openvas-start
/usr/bin/openvas-check-setup
/usr/bin/openvas-stop

 

 

 - 만약, 설치가 안되었다면, 'apt-get' 명령어를 이용하여 설치한다.

 

root@kali:~# apt-get install openvas

 

 

 

 

Ex2) OpenVAS 플러그인 및 다운로드 실시 (시간 오래 걸림)

 

 - 프로그램 -> Vulnerability Analysis -> openvas initial setup 클릭

/var/lib/openvas/private/CA created
/var/lib/openvas/CA created

[i] This script synchronizes an NVT collection with the 'OpenVAS NVT Feed'.
[i] The 'OpenVAS NVT Feed' is provided by 'The OpenVAS Project'.
[i] Online information about this feed: 'http://www.openvas.org/openvas-nvt-feed.html'.

~ 중간 생략 ~

 

Check that the request matches the signature
Signature ok
The Subject's Distinguished Name is as follows
countryName           :PRINTABLE:'DE'
localityName          :ASN.1 12:'Berlin'
commonName            :ASN.1 12:'om'
Certificate is to be certified until May 31 03:58:23 2017 GMT (365 days)

Write out database with 1 new entries

Data Base Updated
Rebuilding NVT cache... done.
User created with password 'c999f743-069d-4e23-900e-9c0ce675a139'. <- 웹-접속 패스워드

 

 

 - 파이어폭스를 실행하여 접속 실시 (https://127.0.0.1:9392)

 

root@kali:~# firefox &
[1] 3661

 

'admin/패스워드' 로그인 실시

 

 

 

Ex3) CentOS 취약점 스캐닝

 

OpenVAS 기본 페이지 -> '192.168.20.200' -> Start Scan 클릭

 

 

 

 

Reports -> (1) 클릭

 

 

 

 

취약점 스캐닝 결과 확인 -> 이전 페이지 이동

 

 

 

 

Status 상태바 클릭

 

 

 

 

취약점 스캐닝 세부 내용 확인 -> 이전 페이지 이동

 

 

 

 

로그아웃 실시

 

 

 

 

 

Ex4) Metasploit을 이용한 OpenVAS 사용 방법

 

root@kali:~# msfconsole

 

msf >
msf > load openvas
[*] Welcome to OpenVAS integration by kost and averagesecurityguy.
[*]
[*] OpenVAS integration requires a database connection. Once the
[*] database is ready, connect to the OpenVAS server using openvas_connect.
[*] For additional commands use openvas_help.
[*]
[*] Successfully loaded plugin: OpenVAS

 

msf > openvas_help
[*] openvas_help                  Display this help
[*] openvas_debug                 Enable/Disable debugging
[*] openvas_version               Display the version of the OpenVAS server
[*]
[*] CONNECTION
[*] ==========
[*] openvas_connect               Connects to OpenVAS
[*] openvas_disconnect            Disconnects from OpenVAS
[*]
[*] TARGETS
[*] =======
[*] openvas_target_create         Create target
[*] openvas_target_delete         Deletes target specified by ID
[*] openvas_target_list           Lists targets
[*]
[*] TASKS
[*] =====
[*] openvas_task_create           Create task
[*] openvas_task_delete           Delete a task and all associated reports
[*] openvas_task_list             Lists tasks
[*] openvas_task_start            Starts task specified by ID
[*] openvas_task_stop             Stops task specified by ID
[*] openvas_task_pause            Pauses task specified by ID
[*] openvas_task_resume           Resumes task specified by ID
[*] openvas_task_resume_or_start  Resumes or starts task specified by ID
[*]
[*] CONFIGS
[*] =======
[*] openvas_config_list           Lists scan configurations
[*]
[*] FORMATS
[*] =======
[*] openvas_format_list           Lists available report formats
[*]
[*] REPORTS
[*] =======
[*] openvas_report_list           Lists available reports
[*] openvas_report_delete         Delete a report specified by ID
[*] openvas_report_import         Imports an OpenVAS report specified by ID
[*] openvas_report_download       Downloads an OpenVAS report specified by ID

 

 

 

 - OpenVAS 서버 IP 주소 및 포트 번호 지정 및 SSL 사용 여부 체크

 

msf > openvas_connect admin c999f743-069d-4e23-900e-9c0ce675a139 127.0.0.1 9390 ok
[*] Connecting to OpenVAS instance at 127.0.0.1:9390 with username admin...
[+] OpenVAS connection successful

 

 

 

 - 타겟 정보 생성

 

msf > openvas_target_create "Window2008" 192.168.20.201 "Windown2008 Scan"
[*] OK, resource created: 2b8568cf-ec5a-4a95-a539-4ee673a0e61f
[+] OpenVAS list of targets

 

ID  Name                                            Hosts           Max Hosts  In Use  Comment
--  ----                                            -----           ---------  ------  -------
0   Localhost                                       localhost       1          0      

1   Target for immediate scan of IP 192.168.20.200  192.168.20.200  1          1      

2   Window2008                                      192.168.20.201  1          0       Windown2008 Scan

 

 

 - 타겟 정보 재확인

 

msf > openvas_target_list
[+] OpenVAS list of targets

 

ID  Name                                            Hosts           Max Hosts  In Use  Comment
--  ----                                            -----           ---------  ------  -------
0   Localhost                                       localhost       1          0      

1   Target for immediate scan of IP 192.168.20.200  192.168.20.200  1          1      

2   Window2008                                      192.168.20.201  1          0       Windown2008 Scan

 

 

 - Scan 방식 파악

 

msf > openvas_config_list
[+] OpenVAS list of configs

 

ID  Name
--  ----
0   Discovery
1   empty
2   Full and fast
3   Full and fast ultimate
4   Full and very deep
5   Full and very deep ultimate
6   Host Discovery
7   System Discovery

 

 

 

 - Scan 방식 및 Scan 타겟 선택

 

msf > openvas_task_create TEST "Window2008 Scan" 4 2
[*] OK, resource created: b64074f8-3a40-4f66-bbf8-949dae1e17b1
[+] OpenVAS list of tasks

 

ID  Name                                 Comment          Status   Progress
--  ----                                 -------          ------   --------
0   Immediate scan of IP 192.168.20.200                   Stopped  98
1   TEST                                 Window2008 Scan  New      -1

 

 

 - Scan 시작

 

msf > openvas_task_start 1
[*] OK, request submitted

 

 

 

 - Scan 시작 여부 확인 (Scan이 완료가 되면, Status에 Done으로 출력됨)

 

msf > openvas_task_list
[+] OpenVAS list of tasks

 

ID  Name                                 Comment          Status   Progress
--  ----                                 -------          ------   --------
0   Immediate scan of IP 192.168.20.200                   Stopped  98
1   TEST                                 Window2008 Scan  Running  1

 

 

 

- Scan 중지 (오래 걸리기 때문에, Scan 중지 실시)

 

msf > openvas_task_stop 1
[*] OK, request submitted

 

 

 

 - Scan 결과 저장할 파일 형식 확인

 

msf > openvas_format_list
[+] OpenVAS list of report formats

 

ID  Name           Extension  Summary
--  ----           ---------  -------
0   Anonymous XML  xml        Anonymous version of the raw XML report
1   ARF            xml        Asset Reporting Format v1.0.0.
2   CPE            csv        Common Product Enumeration CSV table.
3   CSV Hosts      csv        CSV host summary.
4   CSV Results    csv        CSV result list.
5   HTML           html       Single page HTML report.
6   ITG            csv        German "IT-Grundschutz-Kataloge" report.
7   LaTeX          tex        LaTeX source file.
8   NBE            nbe        Legacy OpenVAS report.
9   PDF            pdf        Portable Document Format report.
10  Topology SVG   svg        Network topology SVG image.
11  TXT            txt        Plain text report.
12  Verinice ISM   vna        Greenbone Verinice ISM Report, v1.1.10.
13  XML            xml        Raw XML report.

 

 

 

 - Scan 리포트 정보 확인

 

msf > openvas_report_list
[+] OpenVAS list of reports

 

ID  Task Name                            Start Time            Stop Time
--  ---------                            ----------            ---------
0   Immediate scan of IP 192.168.20.200  2016-05-31T04:44:42Z 
1   TEST                                 2016-05-31T05:21:51Z  2016-05-31T05:32:35Z

 

 

 - Scan 리포트 결과 파일로 저장

 

msf > openvas_report_download 1 13 /root Window2008_Scan.xml

[*] Saving report to /root/Window2008_Scan.xml

 

msf > exit
root@kali:~#

 

root@kali:~# ls -l | grep Window
-rw-r--r-- 1 root root   125808  5월 31 14:43 Window2008_Scan.xml

 

 

 - OpenVAS 웹-접속 확인

 

root@kali:~# firefox &
[1] 24915

 

 

Test -> Status 상태바 클릭

 

 

 

 

 

취약점 스캐닝 결과 확인

 

 

 

 

취약점 스캐닝 세부 내용 확인 -> 로그아웃 실시

 

 

 

 

 

 - OpenVAS 서비스 종료 실시

 

root@kali:~# openvas-stop
Stopping OpenVas Services

 

[유튜브] 동영상 강의 링크 (구독! 좋아요!!!)

공격툴&정보수집 - 제25장 OpenVAS를 이용한 취약점 스캐닝   https://youtu.be/3FlAhZPA5So