使用DNS-SD和SSDP扫描内网主机

微信号

功能介绍

作者：0x7F@知道创宇404实验室

时间：2021年09月28日

0x00 前言

前段时间看到一款局域网扫描的 App「Fing」，相比于 Nmap 的端口服务扫描，他可以扫描获取目标主机的设备名称和用户名，在内网资产梳理时这些信息能够提供一定的帮助。

0x01 Fing

0x02 DNS-SD

#/usr/bin/python3
#!coding=utf-8

import socket
import sys
from scapy.all import raw, DNS, DNSQR

def get_service_info(sock, target, resp):
    service = (resp.an.rdata).decode()

    # query each service detail informations
    req = DNS(id=0x0001, rd=1, qd=DNSQR(qtype="PTR", qname=service))
    #req.show()
    sock.sendto(raw(req), target)
    data, _ = sock.recvfrom(1024)
    resp = DNS(data)
    #resp.show()

    # parse additional records
    repeat = {}
    for i in range(0, resp.arcount):
        rrname = (resp.ar[i].rrname).decode()
        rdata  = resp.ar[i].rdata

        if rrname in repeat:
            continue
        repeat[rrname] = rdata

        if hasattr(resp.ar[i], "port"):
            rrname += (" " + str(resp.ar[i].port))

        if rrname.find("._device-info._tcp.local.") > 0:
            print(" "*4, rrname, rdata)
        else:
            print(" "*4, rrname)
# end get_service_info()

def dnssd_scan(target):
    sock = socket.socket(socket.AF_INET, socket.SOCK_DGRAM)
    sock.settimeout(2)

    # query all service name
    req = DNS(id=0x0001, rd=1, qd=DNSQR(qtype="PTR", qname="_services._dns-sd._udp.local"))
    #req.show()
    try:
        sock.sendto(raw(req), target)
        data, _ = sock.recvfrom(1024)
    except KeyboardInterrupt:
        exit(0)
    except:
        print("[%s] OFFLINE" % target[0])
        return
    resp = DNS(data)
    #resp.show()

    print("[%s] ONLINE" % target[0])
    for i in range(0, resp.ancount):
        get_service_info(sock, target, resp)
# end dnssd_scan()

if __name__ == "__main__":
    if not (len([sys.argv]) > 0 and sys.argv[1].endswith(".0")):
        print("usage: python3 dnssd.py 192.168.1.0")
        exit(0)

    print("dnssd scan start")
    network = sys.argv[1].rstrip("0")

    # scan local network
    for i in range(1, 256):
        target = (network + str(i), 5353)
        dnssd_scan(target)

    print("dnssd scan end")
# end main()

后来发现 Nmap 也提供了 dns-service-discovery.nse 的扫描脚本(https://github.com/nmap/nmap/blob/master/scripts/dns-service-discovery.nse)

0x03 SSDP

M-SEARCH * HTTP/1.1
S: uuid:ijklmnop-7dec-11d0-a765-00a0c91e6bf6
Host: 239.255.255.250:reservedSSDPport
Man: "ssdp:discover"
ST: ge:fridge
MX: 3
USER-AGENT: Google Chrome/93.0.4577.82 Mac OS X

HTTP/1.1 200 OK
S: uuid:ijklmnop-7dec-11d0-a765-00a0c91e6bf6
Ext:
Cache-Control: no-cache="Ext", max-age = 5000
ST: ge:fridge
USN: uuid:abcdefgh-7dec-11d0-a765-00a0c91e6bf6
AL: <blender:ixl><http://foo/bar>
Server:Microsoft-Windows/6.3 UPnP/1.0 UPnP-Device-Host/1.0

#/usr/bin/python3
#!coding=utf-8

import socket
import struct

address = ("239.255.255.250", 1900)
result = {}

def get_serv_ua(resp):
    lines = resp.split("\r\n")
    for i in lines:
        array = i.split(":")
        if array[0].upper() == "SERVER" or array[0].upper() == "USER-AGENT":
            return array[1]
    # end-for
# end get_serv_ua()


def ssdp_scan():
    print("[scan mode]")
    req = b'M-SEARCH * HTTP/1.1\r\nHost: 239.255.255.250:1900\r\nST:ssdp:all\r\nMan: "ssdp:discover"\r\nMX:1\r\n\r\n'

    sock = socket.socket(socket.AF_INET, socket.SOCK_DGRAM)
    sock.settimeout(5)

    # send "ssdp:all" query request
    sock.sendto(req, address)

    # receive and print
    while True:
        try:
            resp, raddr = sock.recvfrom(1024)
        except:
            break
        if raddr[0] not in result:
            data = get_serv_ua(resp.decode())
            result[raddr[0]] = data
            print(raddr[0], data)
    # end-while
# ssdp_scan()

def ssdp_sniffer():
    print("[sniffer mode] (stop by Ctrl-C)")

    sock = socket.socket(socket.AF_INET, socket.SOCK_DGRAM)
    sock.bind(address)

    # join the multicast group
    maddr = struct.pack("4sl", socket.inet_aton("239.255.255.250"), socket.INADDR_ANY)
    sock.setsockopt(socket.IPPROTO_IP, socket.IP_ADD_MEMBERSHIP, maddr)

    # receive and print
    while True:
        try:
            resp, raddr = sock.recvfrom(1024)
        except:
            break
        if raddr[0] not in result:
            data = get_serv_ua(resp.decode())
            result[raddr[0]] = data
            print(raddr[0], data)
# ssdp_sniffer()

if __name__ == "__main__":
    print("ssdp scan start")

    ssdp_scan()
    ssdp_sniffer()

    print("ssdp scan end")
# end main()

0x04 总结

往 期 热 门

(点击图片跳转）

CVE-2021-40444 漏洞深入分析

dll 劫持和应用

震惊！安全圈某知名大佬竟被人制成表情包！

点击下方“阅读原文”了解更多