Techpository

1. Usefull for when you don’t have nmap and need to find a missing host. Pings all addresses from 10.1.1.1 to 10.1.1.254, modify for your subnet. Timeout set to 1 sec for speed, if running over a slow connection you should raise that to avoid missing replies. This will clean up the junk, leaving just the IP address:

for i in {1..254}; do ping -c 1 -W 1 10.1.1.$i | grep ‘from’ | cut -d’ ‘ -f 4 | tr -d ‘:’; done Show Sample Output

2. Waits for all pings to complete and returns ip with mac address

(prefix=”10.59.21″ && for i in seq 254; do (sleep 0.5 && ping -c1 -w1 $prefix.$i &> /dev/null && arp -n | awk ‘ /’$prefix’.’$i’ / { print $1 ” ” $3 } ‘) & done; wait)

4. This version combines the best of the other suggestions and adds these features: 1. It scans a /16 subnet 2. It is very fast by running the ping commands in the background, running them in parallel. 3. Does not use the “-W” option as that’s not available in older ping versions (I needed this for OS X 10.5)

prefix=”169.254″ && for i in {0..254}; do echo $prefix.$i/8; for j in {1..254}; do sh -c “ping -m 1 -c 1 -t 1 $prefix.$i.$j | grep \”icmp\” &” ; done; done

5. Not really an easier solution. But an example using && for (if last command returned 0). You can use || for (if last command returned other than 0).

prefix=”10.0.0″ && for i in seq 25; do ping -c 1 $prefix.$i &> /dev/null && echo “Answer from: $prefix.$i” ; done

Basic Nmap scanning examples, often used at the first stage of enumeration.
Command Description

nmap -sP 10.0.0.0/24

Ping scans the network, listing machines that respond to ping.

nmap -p 1-65535 -sV -sS -T4 target

Full TCP port scan using with service version detection – usually my first scan, I find T4 more accurate than T5 and still “pretty quick”.

nmap -v -sS -A -T4 target

Prints verbose output, runs stealth syn scan, T4 timing, OS and version detection + traceroute and scripts against target services.

nmap -v -sS -A -T5 target

Prints verbose output, runs stealth syn scan, T5 timing, OS and version detection + traceroute and scripts against target services.

nmap -v -sV -O -sS -T5 target

Prints verbose output, runs stealth syn scan, T5 timing, OS and version detection.

nmap -v -p 1-65535 -sV -O -sS -T4 target

Prints verbose output, runs stealth syn scan, T4 timing, OS and version detection + full port range scan.

nmap -v -p 1-65535 -sV -O -sS -T5 target

Prints verbose output, runs stealth syn scan, T5 timing, OS and version detection + full port range scan.
Agressive scan timings are faster, but could yeild inaccurate results!

T5 uses very aggressive scan timings and could lead to missed ports, T4 is a better compromise if you need fast results.
Nmap scan from file
Command Description

nmap -iL ip-addresses.txt

Scans a list of IP addresses, you can add options before / after.
Nmap output formats
Command Description

nmap -sV -p 139,445 -oG grep-output.txt 10.0.1.0/24

Outputs “grepable” output to a file, in this example Netbios servers.

E.g, The output file could be grepped for “Open”.

nmap -sS -sV -T5 10.0.1.99 –webxml -oX –
| xsltproc –output file.html –

Export nmap output to HTML report.
Nmap Netbios Examples
Command Description

nmap -sV -v -p 139,445 10.0.0.1/24

Find all Netbios servers on subnet

nmap -sU –script nbstat.nse -p 137 target

Nmap display Netbios name

nmap –script-args=unsafe=1 –script
smb-check-vulns.nse -p 445 target

Nmap check if Netbios servers are vulnerable to MS08-067

rpm -qa | grep yum
yum reinstall yum-utils-1.1.31-45.el7 – change to appropriate version number
package-cleanup –cleandupes
Once this is complete we shouldn’t see any more duplicates on the system.
package-cleanup –duped

If Satellite is not seeing a report from the server use the following command from the host to try and force a sync
puppet agent -tv

---

If you run into a lock issue where “puppet agent -tv” will not work, try the following:

systemctl stop puppet

rm /var/lib/puppet/state/agent_catalog_run.lock

systemctl start puppet

ps aux | grep puppet
root 26701 42.0 0.3 248764 41080 ? Ssl 10:14 0:01 /usr/bin/ruby /usr/bin/puppet agent –no-daemonize
root 26711 51.0 0.4 351092 56660 ? Sl 10:14 0:01 puppet agent: applying configuration

A couple of minutes later the “puppet agent: applying configuration” job completed. I was able to rerun “puppet agent -tv”.

Host:
yum install puppet -y

RHEL 7
echo “server = satelliteserver.yourdomain.com” >> /etc/puppet/puppet.conf;systemctl enable puppet ; systemctl start puppet

RHEL 6
echo “server = satelliteserver.yourdomain.com” >> /etc/puppet/puppet.conf;chkconfig puppet on ; service puppet start

Server:
puppet cert list

puppet cert sign -all

---

After you assign the host you can run “puppet agent -tv” to force a sync