Scanning for Misconfigured Network Services with Nmap

1. Introduction to the Nmap Scripting Engine (NSE)

Think of the NSE as a way to supercharge your Nmap scans. After Nmap discovers open ports and services, the NSE can run small, targeted programs—called scripts—to perform more advanced tasks. These tasks range from deeper discovery and information gathering to vulnerability detection and even basic exploitation.

This allows you to automate a huge part of the enumeration process directly within Nmap.

To get a better sense of what NSE is and how it works, let's start with a couple of resources.

To summarize the key points:

• NSE automates tasks: It runs scripts written in the Lua language to perform actions on the target.
• Scripts are categorized: This helps you choose the right script for the job (e.g., discovery for information gathering, vuln for checking known vulnerabilities).
• Key Commands:
  • nmap --script-updatedb: It's good practice to run this occasionally to get the latest scripts. You'll likely need sudo for it.
  • nmap -sC <target>: Runs all scripts in the default category. This is a good starting point, but can be "noisy."
  • nmap --script "<script-name>" <target>: Runs a single, specific script. This is great for targeted enumeration.
  • nmap --script-help "<script-name>": Shows you what a script does, its author, and what arguments it accepts.

2. Practical Enumeration with NSE

Now for the hands-on part. We'll use your lab environment (Kali and Metasploitable2) to see NSE in action against two common services.

Case Study 1: Enumerating NFS Misconfigurations

NFS (Network File System) is the standard way for Linux/Unix systems to share directories and files over a network. A common and severe misconfiguration is when a server "exports" (shares) its entire root filesystem (/) to anyone on the network (*). This is equivalent to leaving the front door of the server wide open.

Let's see if we can find this on Metasploitable2 using an NSE script.

Your Turn: Lab Instructions

1. Get Help: First, learn about the nfs-ls script.

   nmap --script-help nfs-ls
   

2. Run the Script: As the article explains, NFS relies on the rpcbind service on port 111 to manage connections. Let's run our script against that port on your Metasploitable2 VM.

   nmap -p 111 --script=nfs-ls <metasploitable_ip>
   

   You should see a very revealing output: a directory listing of the target's root (/) folder!

3. Confirm the Finding: The tool showmount is designed to query NFS servers about their exports.

   showmount -e <metasploitable_ip>
   

   This should confirm that / is exported to * (everyone). This is a critical finding in a real penetration test. It means you can mount the target's entire filesystem and have read/write access to its files.

Case Study 2: Enumerating SMTP

SMTP (Simple Mail Transfer Protocol) is the engine of email, running on port 25. Enumerating SMTP can reveal valid user accounts (useful for password attacks) or dangerous configurations like "open relay," where the server will happily send emails on behalf of anyone to anyone else (a spammer's dream).

Let's use NSE to probe the SMTP service on Metasploitable2.

Now let's see this in action. The HackerSploit video below provides a good visual demonstration.

Your Turn: Lab Instructions

1. Check Supported Commands: Run the smtp-commands script against your Metasploitable2 VM.

   nmap -p 25 --script smtp-commands <metasploitable_ip>
   

   The output will show you the capabilities of the SMTP server. Look for commands like VRFY (Verify) or EXPN (Expand), which are classic ways to enumerate users.

2. Enumerate Users: Now, let's try to get a list of valid users.

   nmap -p 25 --script smtp-enum-users <metasploitable_ip>
   

   Metasploitable2 is configured to allow this. The script will run and should return a list of usernames found on the system, such as root, admin, user, etc. This is another critical finding, providing you with a list of targets for brute-force or password-spraying attacks.

3. The Ultimate Enumeration Script: vulners

So far, we've used scripts to find service-specific information. But what if a script could take the service version you found and automatically check it against a massive database of known vulnerabilities?

That's exactly what the vulners script does. It is one of the most powerful scripts in the NSE library. It takes the results from a version scan (-sV), cross-references them with the Vulners.com vulnerability database, and reports back any known CVEs (Common Vulnerabilities and Exposures).

This is an advanced technique that combines several command-line skills. Don't worry if it seems complex; the video breaks it down step-by-step. Replicating this workflow is an excellent exercise. The ability to script and process tool output is a key skill for any penetration tester.

Try this on your Metasploitable2 VM. The sheer number of vulnerabilities it finds should highlight why that machine is such a great learning tool.

Conclusion

You have now moved from single-purpose enumeration tools to a flexible, powerful framework for service enumeration with the Nmap Scripting Engine. This skill allows you to quickly and efficiently gather deep intelligence on a wide variety of services.

Key Takeaways:

• The Nmap Scripting Engine (NSE) automates reconnaissance and vulnerability discovery for nearly any service.
• You can run default scripts with -sC, or target specific services with --script <script-name>.
• NFS enumeration (nfs-ls) can uncover dangerously exposed file shares.
• SMTP enumeration (smtp-commands, smtp-enum-users) can reveal server capabilities and valid user accounts.
• The vulners script is a powerful tool that connects service versions directly to known vulnerabilities, giving you a clear list of potential exploits to investigate.

Next Lesson Preview:

The vulners script gave you a list of potential exploits and their CVE identifiers. But how do you find the actual code to perform an attack? In our next lesson, we will focus on searchsploit, a command-line tool that allows you to search a massive offline database of exploits, bridging the gap between identifying a vulnerability and finding a way to exploit it.