IF Notes

Writeup Network Scanning

4 min read

Naufarrel Zhafif Abhista 13523149

Tugas

Melakukan network scanning di kos atau di kafe.

Detail:

  1. Lokasi: Ayam-ayaman Dago
  2. Tools: nmap

Script

What it does :

  1. Ambil IP device,
  2. Scanning untuk IP yang ada di suatu network
  3. Simpan ke file
  4. Feed file untuk iterasi fingerprint per IP
#!/bin/bash
set -euo pipefail
 
OUTDIR="scan_$(date +%Y%m%d_%H%M%S)"
mkdir -p "$OUTDIR"
HOSTS="$OUTDIR/hosts.txt"
 
INTERFACE=$(ip route get 1.1.1.1 | awk '{print $5; exit}')
CIDR=$(ip -o -f inet addr show "$INTERFACE" | awk '{print $4; exit}')
IP=${CIDR%/*}
 
echo "IP: $CIDR"
 
nmap -sn "$CIDR" -oG - | awk '/Up$/{print $2}' > "$HOSTS"
echo "Network scan result:"
cat "$HOSTS"
 
i=0
while read -r ip; do
	i=$((i+1))
	echo "[*] Fingerprinting $ip ..."
	sudo nmap -Pn -sS -sV -O --osscan-guess -T3 \
	"$ip" -oA "$OUTDIR/fp_$ip"
done < "$HOSTS"

Hasil:

Kesimpulan

Ringkasan

Scanning dilakukan di Ayam-ayaman Dago lewat Wi-Fi yang sama dengan pelanggan lain.

  1. Jaringannya flat 192.168.0.0/24 (satu broadcast domain, tanpa VLAN), gateway di 192.168.0.1, dan mesin scanner dapat IP 192.168.0.185/24.
  2. Host discovery (nmap -sn), dapat ~17 host. Tidak ada client isolation / AP isolation: dari posisi sebagai guest biasa, semua host di subnet bisa di-probe, di-port scan, dan dicoba di-fingerprint tanpa hambatan L2.

Tabel Host

IPMACVendor (OUI)Port terbukaOS guess (nmap)Dugaan device
.1A8:42:A1:9F:08:E4TP-Link Systems53/domain (REFUSED), 80/http BusyBox httpd 1.19.4, 443/ssl-http BusyBox 1.19.4, 1900/upnp MiniUPnP 1.8no exact match; guess Linux 3.x / MikroTik RouterOSRouter / gateway consumer TP-Link
.10590:31:4B:EB:78:22AltoBeam80/http, 554/rtsp H264DVR rtspd 1.0, 8899/ospf-lite?Linux 3.2 – 3.16DVR / NVR CCTV (title “Web Viewer”)
.111––––Sempat up saat discovery, hilang saat fingerprint (0 hosts up)
.11790:31:4B:EA:9C:C2AltoBeam80/http, 554/rtsp H264DVR rtspd 1.0, 8899/ospf-lite?Linux 3.2 – 3.16DVR / NVR CCTV
.138C0:87:EB:90:6B:71Samsung Electronicssemua 1000 port closedtoo many fingerprintsHP / perangkat Samsung
.14266:EA:03:0B:F2:C7Unknown (LAA / randomized)49152/tcpwrapped, 62078/tcpwrapped (iOS lockdownd)Apple iOS 15.0 – 15.6 (Darwin 21)iPhone, MAC di-random
.1490C:98:38:1E:39:2FXiaomi Communications5060/tcp filtered sipLinux 2.6.23 / 2.6.27 (OSScan unreliable)HP Xiaomi / Android
.1535C:D0:6E:25:B1:37Xiaomi Communicationssemua 1000 port closedtoo many fingerprintsHP Xiaomi / Android
.1675C:4E:EE:C3:0D:D3AltoBeam8089/tcp NDesk-RC (JSON {"chn":0,...,"result":{"code":1102}})no exact match; guess embedded (lwIP / OSRAM / iRobot — just guessing)IP camera
.179C4:6E:33:7F:E8:8DZhong Ge Smart Technologysemua 1000 port closedtoo many fingerprintsIoT / smart device
.180E0:1F:88:6C:88:28Xiaomi Communicationssemua 1000 port closedtoo many fingerprintsHP / IoT Xiaomi
.214––––Sempat up saat discovery, hilang saat fingerprint (0 hosts up)
.2150A:D2:E5:80:90:2CUnknown (LAA / randomized)7/tcp filtered echotoo many fingerprintsKemungkinan HP, MAC di-random
.2343A:5E:F4:BB:DC:C0Unknown (LAA / randomized)62078/tcpwrapped (iOS lockdownd)Apple iOS 15.0 – 15.6 (Darwin 21)iPhone, MAC di-random
.2394C:37:DE:DC:CA:11AltoBeam8089/tcp NDesk-RC (JSON code:1102)no exact match; guess embeddedIP camera (sekelas .167)
.243AC:15:A2:1E:52:BETP-Link Systems443/ssl/https?, 8800/sunwebadmin? (respons ada header CSeq: → RTSP)no exact match; guess OpenWrt / Linux 2.6, “Asus RT-N10 atau AXIS 211A Network Camera”IP camera TP-Link (Tapo/Kasa)
.185(self)–3306/tcp mysql MariaDB 12.3.3Linux 5.x – 6.xMesin scanner sendiri (Arch)

Kesimpulan

Note:

  • Gateway .1 = router consumer TP-Link jalan BusyBox httpd 1.19.4 (rilis ~2011). UPnP (MiniUPnP 1.8, port 1900) terbuka ke LAN. Port 53 kebuka tapi DNS query di-REFUSED. Tidak ada exact OS match, service info hanya mengatakan “Device: broadband router; Linux”.
  • Device class dominan = CCTV / surveillance. Minimal 5 device kamera:
    • .105, .117 → DVR/NVR pakai H264DVR rtspd 1.0 di port 554 + web UI “Web Viewer” di 80 (chipset AltoBeam).
    • .167, .239 → IP camera AltoBeam, protokol NDesk-RC di port 8089, balas JSON {"chn":..., "result":{"code":1102}}.
    • .243 → IP camera TP-Link, jawab handshake mirip RTSP (CSeq:) di 443/8800. Semua kamera ini satu subnet dengan device customer, tidak dipisah.
  • HP: iPhone iOS 15 (.142, .234), Xiaomi/Android (.149, .153, .180), Samsung (.138), most likely punya pelanggan. Sisanya IoT (.179 Zhong Ge Smart).
  • HP modern menutup/men-filter semua port. nmap OSScan butuh minimal 1 port open + 1 port closed untuk kalibrasi; kalau semua closed/filtered, hasilnya “Too many fingerprints match this host” atau “No exact OS matches”, dan sering muncul “Warning: OSScan results may be unreliable”.
  • .142, .215, .234 pakai locally-administered address (bit ke-2 oktet pertama = 1: 66:, 0A:, 3A:). Vendor lookup OUI jadi “Unknown”, jadi fingerprinting berbasis OUI mati total. Yang MAC-nya asli (Apple/Samsung/Xiaomi/TP-Link) masih ketahuan pabrikannya.
  • .111 dan .214 terbaca up pas host discovery (ARP), tetapi ketika di-fingerprint beberapa menit kemudian sudah 0 hosts up.
    • Penyebabnya bisa karena DHCP ganti, device disconnected
  • Beberapa scan lambat (.153 278 s, .167 ~910 s, .179 858 s, .243 181 s) karena kombinasi port filtered + rate limiting + retry --osscan-guess.

Catatan Keamanan

  • CCTV/DVR se-subnet dengan guest. Kalau salah satu kamera masih pakai default credential, siapa pun yang konek Wi-Fi bisa akses stream RTSP dan web UI-nya. Idealnya kamera ditaruh di VLAN/SSID terpisah dari pelanggan Di sini masih aman (belum coba bypass auth), default tidak ada yang tembus.
  • Router jalan BusyBox 1.19.4, versinya sangat outdated :)
  • UPnP aktif di gateway (routernya), padahal wi-fi-nya publik.
    • A UPnP protocol could permit devices with critical vulnerabilities to connect to your network and sensitive resources. (Bacaan)
    • Jika ada device yang terjangkit malware, penyebarannya lebih mudah (tetapi tidak serta menjadi mudah) dengan memanfaatkan protokol UPnP.
  • Tidak terlihat VLAN maupun client isolation Satu jaringan datar untuk router + CCTV + kasir(?) + semua HP pelanggan.

Graph View

Backlinks