操作系统识别

---

title: 操作系统识别
date: 2016-06-04 12:16
tags: kali渗透测试 主动信息收集

---

OS的识别技术多种多样，有简单的也有复杂的，最简单的就是用TTL值去识别。不同类型的OS默认的起始TTL值是不同的，比如，windows的默认是128，然后每经过一个路由，TTL值减一。Linux/Unix的值是64，但有些特殊的Unix会是255。

0x00 Python识别TTL值

#!/usr/bin/python 
from scapy.all import *
import logging
logging.getLogger("scapy.runtime").setLevel(logging.ERROR)
import sys

if len(sys.argv) != 2:
    print("Usage --/ttl_os.py [IP Address]")
    print("Example --/ttl_os.py 192.168.0.1")
    print("Example will preform ttl analysis to attempt to determine whether the system is windows or linux/unix")
    sys.exit()
    
ip = sys.argv[1]

ans = sr1(IP(dst=str(ip))/ICMP(), timeout=1, verbose=0)
if ans == None:
    print("NO response was returned")
elif int(ans[IP].ttl)<=64:
    print("Host is Linux/Unix")
else:
    print("Host is Windows")

---

0x01 NMAP识别OS

由于自身脚本的局限性，Python扫描的结果过于简单。
NMAP的-O参数同样可以进行OS的识别

➜  Python nmap -O 192.168.0.1  

Starting Nmap 7.12 ( https://nmap.org ) at 2016-06-04 16:06 CST
Nmap scan report for 192.168.0.1
Host is up (0.00077s latency).
Not shown: 999 closed ports
PORT   STATE SERVICE
80/tcp open  http
MAC Address: C8:3A:35:4E:4B:B0 (Tenda Technology)
Device type: general purpose
Running: Wind River VxWorks
OS CPE: cpe:/o:windriver:vxworks
OS details: VxWorks
Network Distance: 1 hop

OS detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 2.07 seconds

使用__namp -O __对所在的网关进行OS识别扫描。

---

0x02 被动识别OS

基于网络监听的工作原理，Windows和Linux发送出来的包是有很大区别的。被动式的扫描可以部署在网络进出口的地方，目的是让所经过的流量通过我的流量分析器。

同样在Kali中也存在这般的工具p0f，他会监听凡是通过本地网卡的流量。

➜  ~ p0f
--- p0f 3.07b by Michal Zalewski <lcamtuf@coredump.cx> ---

[+] Closed 1 file descriptor.
[+] Loaded 320 signatures from 'p0f.fp'.
[+] Intercepting traffic on default interface 'eth0'.
[+] Default packet filtering configured [+VLAN].
[+] Entered main event loop.

.-[ 192.168.0.109/52188 -> 106.2.189.18/80 (syn) ]-
|
| client   = 192.168.0.109/52188
| os       = Linux 3.11 and newer
| dist     = 0
| params   = none
| raw_sig  = 4:64+0:0:1460:mss*20,7:mss,sok,ts,nop,ws:df,id+:0
|
`----

p0f不但会探测OS类型，同时也会对目标上面所运行的应用程序进行探测。