1. HOW TO DOMINATE A COUNTRY.
Codebits 2012
T.H.,J.F.,T.M.,F.R.
@PTCoreSec

2. WHAT ARE YOU ?
We are:
• Security Researchers
• Security enthusiasts
• Students, corporate sheep (read: auditors),
programmers, pentesters
• Beer lovers 
We are not :
• Lulzsec
• Anonymous
• Hacking group
• And no we wont help you hack you girlfriends facebook!
• Ok… that depends on the amount of beer
involved! 

3. WHO ARE YOU ?
• Tiago Henriques • Tiago Martins
• Team founder and leader @ PTCoreSec • Team vice-founder @ PTCoreSec
• Pentester/Researcher @ 7Elements • Researcher
• @Balgan • @Gank_101
• Filipe Reis
• Jean Figueiredo
• Programmer @ PTCoreSec
• Network security researcher @ PTCoreSec
• Intern @ Layer8
• Netsec admin @ Tecnocom
• @fjdreis
• @klinzter

4. WHO ARE YOU ?

5. TOPICS

6. WE ARE NOT
RESPONSIBLE FOR ANY ILLEGAL
ACTS OR ACTIONS PRACTICED BY
YOU OR ANYONE THAT LEARNS
SOMETHING FROM TODAY’S
PRESENTATION.

7. CAUSING CHAOS.
Q:If you guys were an attacker that
was out to cause real damage or get
profit, how would you go on about it ?
A:This is what we would do, control as
many machines in that country,
penetrate critical systems and get as
much intel/info as possible.

8. CAUSING CHAOS.
And that’s what we are gonna talk about today!

9. HOW IT ALL GOT STARTED
We’re hackers! We love knowing how to break things and how
others would go on about breaking things!
The difference between us and others is simple:
• We want to break things legally and find a way to fix things.
• We want to learn about new things and help people.

10. PORT SCANNING….

11. HOW IT ALL GOT STARTED
We saw some talks that really inspired us given by two great people
HD Moore Fyodor

12. HOWEVER…
We also ran into a bit of a problem…
Portscanning might or might not be illegal in Portugal!
No one is actually sure, and we talked with multiple people:
• Police
• Sysadmins
• Researchers
• Security professionals

13. WHAT TO DO ?
• So, if you can’t port scan, how do u find out what ur enemies attack
surface is ?
• How do u know out if the entire infrastructure u rely on everyday is
vulnerable or safe?
• Security by obscurity? Right that works well….
But like I said before…we’re hackers, so we hacked the law and rules and bent
them to our favor!

14. WHAT TO DO ?
• Port scanning isn’t illegal in 2 nice places! Sweden and USA!
• So we got 2 friends of ours who knew nothing of portscanning and
wanted to learn, taught them how to portscan the big internets, and
then they sent the raw results to us…

15. PORT SCANNING
• Tools of the trade:
• Nmap
• Wkhtmltoimage
• Python
• Scapy
• Linux
• NodeJS
• MongoDB
• C
• Redbull + Lots of nights awake +
Frustration

16. PORT SCANNING - PROCESS
1. Get Portugal’s CIDRs
2. Decide on a set of services you consider important
3. Check which ip’s have those port’s open
Actual scanning.
4. Check versions running of those services

17. PORT SCANNING - PROCESS
1. Get Portugal’s CIDRs
There are two places where you can get these:
• http://software77.net/geo-ip/
• ftp://ftp.ripe.net/pub/stats/ripencc/delegated-ripencc-latest
2.80.0.0/14 62.48.192.0/18 81.90.48.0/20
5.43.0.0/18 62.169.64.0/18 81.92.192.0/20
5.44.192.0/20 62.249.0.0/19 81.92.208.0/20
5.158.0.0/18 77.54.0.0/16 81.193.0.0/16
5.159.216.0/21 77.91.200.0/21 82.102.0.0/18
5.172.144.0/21 78.29.128.0/18 82.154.0.0/15
31.22.128.0/17 78.130.0.0/17 83.132.0.0/16
37.28.192.0/18 78.137.192.0/18 83.144.128.0/18
37.189.0.0/16 79.168.0.0/15 83.174.0.0/18
46.50.0.0/17 80.172.0.0/16 83.223.160.0/19
46.182.32.0/21 80.243.80.0/20 83.240.128.0/17
46.189.128.0/17 81.20.240.0/20 84.18.224.0/19
62.28.0.0/16 81.84.0.0/16 84.23.192.0/19
62.48.128.0/18 81.90.48.0/20 84.90.0.0/15

18. PORT SCANNING - PROCESS
2. Decide on a set of services you consider important
ID Port Number TCP/UDP Service 11 1900UDP UPNP
1 80TCP http 12 2869TCP UPNP
2 443TCP https 13 5353UDP MDNS
3 8080TCP http alternative 14 137TCP Netbios
4 21TCP FTP 15 25TCP SMTP
5 22TCP SSH 16 110TCP POP3
6 23TCP Telnet 17 143TCP IMAP
7 53UDP DNS 18 3306TCP Mysql
8 445TCP Samba 19 5900TCP VNC Server
9 139TCP Samba 20 17185UDP VoIP
10 161UDP SNMP 21 3389TCP Rdesktop
22 8082TCP TR 069

19. PORT SCANNING - PROCESS
3. Check which ip’s have those port’s open
4. Check versions running of those services
This is where it get’s tricky!

20. PORT SCANNING - PROCESS
• Portugal on the internet….
5,822,240 allocated ip’s
Dynamic ips
GPRS

21. PORT SCANNING - PROCESS
• So as we mentioned, we devided the actual scanning into two parts!
And you might be wondering why…
Common nmap scan for TCP
nmap -iL ipswithftp -oA port21-FTP-with-Services -sS -sV -p21 -T5 -PN
The problem of this, is that DNS resolution and –sV (Service detection) are very slow.
So how do we solve this problem? We obviously want the domains the ips are associated with,
and the versions of the services running.

22. PORT SCANNING - PROCESS
• Do the fast things on the 6 mil ips and then do the slow stuff merely
on the ips that are running the service we want to analyse.
• nmap -iL CIDRSPT.txt -oA port21-FTP -sS -p21
-T5 -PN --host-timeout 1501 –min-hostgroup
400 --min-parallelism 10 -n
• Then we will have the list of ips that have FTP running on port 21 on
3 files:
• Port21-FTP.xml
• Port21-FTP.gnmap
• Port21-FTP.nmap
• Extract ips from gnmap:
cat port21-FTP.gnmap | grep -w "21/open" | awk '{print $2}' > IPSWITHFTP.TXT

23. PORT SCANNING - PROCESS
• Do the show things only the ips that have our service running.
• nmap -iL IPSWITHFTP.txt -oA port21-FTP-FINAL -sV -p21 -T5
-PN --host-timeout 1501 –min-hostgroup 400 --min-parallelism 10
• Then we will have the list of ips that have FTP running on port 21
AND the version of those services on 3 files:
• Port21-FTP-FINAL.xml
• Port21-FTP-FINAL.gnmap
• Port21-FTP-FINAL.nmap

24. PORT SCANNING - PROCESS
• However…we still have UDP… and let me tell u….

25. PORT SCANNING - PROCESS
Nmap also has a UDP mode… -sU however it doesn’t work very well
without -sV (read: its shit!), when testing it on our lab we noticed that
most of the times nmap wasn’t able to detect if there was a service
running or not.
The reason for this is: “UDP scanning is slow as open/filtered ports
typically don't respond so nmap has to time out and then retransmit
whilst closed ports will send a ICMP port unreachable error, which
systems typically rate limit.”
When we started, it took us around 4 Weeks to scan UDP on the
entire country on 1 port….

26. PORT SCANNING - PROCESS
Solution ?
SCAPY!
Server
Client
Service running on port:11111

27. PORT SCANNING - PROCESS
Result of that script ?
On lab testing….

28. PORT SCANNING - PROCESS
Result of that script ?
On internet testing….

29. PORT SCANNING - PROCESS
When we started, it took us around +4 Weeks to scan UDP on the entire country on 1 port
using NMap…. -We took this as a baseline first run to improve…
Our second run, we used python+scapy and it went down!!
1 week – well not bad for a second run, but 1 week for a port ?
Our third run, we used python+multithreading fu + scapy + blackmamba – 3 days – and this
was the best we brought it down to without bringing in the big guns (read: “asking HD Moore
for help”)
Forth run – C
Yup entire .pt (1 port ) scanned in 4 minutes and 45 seconds.

30. PORT SCANNING - END
So we had our kick ass
friends, send us our kick ass
raw results… now what do we
do with them ?

31. PORT SCANNING - END
Terminals are fun, BUT we want an easier way
to look at our data…
So…. We wrote a tool:
Presenting for the first time:
Nmap Query Center!

32. PORT SCANNING - END
DEMO TIME!

33. Store processed
Nmap scans scan data
run here
Socket.io Express
NodeJS
Nmap Minion Scan Mongo DB NodeJS
Importer
Process raw nmap data to json
so we can better process the Show all the pretty
information data to the client

34. PORT SCANNING - END
Well that’s it folks…
Thank you for coming

35. PORT SCANNING – END
Just kidding! We did promise a
few more things didn’t we ?

36. PORT SCANNING – THE PROJECT
While we were preparing for
codebits…
We received something in the
mail….

37. PORT SCANNING – THE PROJECT
Raspi

38. PORT SCANNING – THE PROJECT
And it got us thinking…
Port scanning, doesn’t
require a great CPU, nor a
huge amount of ram…

39. PORT SCANNING – THE PROJECT
So we decided to create a
distributed port scanning
project…

40. PORT SCANNING – THE PROJECT
We grabbed the
And added a custom set of
scripts to it…

41. PORT SCANNING – THE PROJECT

42. PORT SCANNING – HOW DOES IT WORK?
Step 1 – PTCoreSec admins request a job
(scan) on the backend.
Step 2 – Server side checks current number
of live raspi minions.
Step 3 – Server divides de CIDRS by the
different clients and sends them over.
Step 4 – Clients (minions) do the scans and
XMLRPC send them back to the server.
Step 5 – Server imports these scans into the
MongoDB backend.

43. Part 2

44. BUSINESS
When a client asks for a pentest
We present them with these

45. BUSINESS

46. BUSINESS

47. BUSINESS

48. BUSINESS
And that’s all really neat and pretty,
however there are 2 problems with that!
These guys don’t give a f***.
Management Blackhats

49. MANAGEMENT
Cares about:
• Money
• Money
• Money
Does:
• Will lie for PCI DSS/ISO27001/{Compliance}
This shit gives us,
• Approves every single thing even if it doesn’t
security peeps,
match security department goals but gets them headaches!
moneys.

50. BLACKHATS
I managed to acquire video footage
that shows these guys in action and
their vision of the world, lets have a
sneek peek!

51. VIDEO - BLACKHATS

52. I ASK ONLY ONE THING OF U
Leave your whitehats at home, and

53. SHODAN
SHODAN is a search engine that lets you find specific computers (routers,
servers, etc.) using a variety of filters. Some have also described it as a public
port scan directory or a search engine of banners.
Another way of putting it would be:

54. Is the
Of these

55. Now combine this:
With these:

56. And you get a lot of these

57. Also if you do anything ilegal and get
caught, you’ll get one of these:

58. SHODAN
Now its when u ask

59. SHODAN
http://www.shodanhq.com/

60. SHODAN
Accessing that website will give u a bar, where you can type queries and
obtain results.
Your queries, can ask for PORTS, Countries, strings contained in the
banners, and all sorts of other things
Following is a sample set of queries that can lead to some interesting
results:

61. SHODAN QUERIES
• http://www.shodanhq.com/?q=cisco-IOS
• http://www.shodanhq.com/?q=IIS+4.0
• http://www.shodanhq.com/?q=Xerver
• http://www.shodanhq.com/?q=Fuji+xerox
• http://www.shodanhq.com/?q=JetDirect
• http://www.shodanhq.com/?q=Netgear
• http://www.shodanhq.com/?q=%22Anonymous+access+allowed%22
• http://www.shodanhq.com/?q=Golden+FTP+Server

62. SHODAN QUERIES + COMBINED COUNTRY?
AWESOME!
Saturday, 9th of
June 2012

63. SHODAN QUERIES + COMBINED COUNTRY
Port: 3306 country:PT

64. SHODAN QUERIES + COMBINED COUNTRY?
AWESOME!
Wednesday,
6th of June
2012

65. SHODAN QUERIES + COMBINED COUNTRY
BigIP country:PT

66. SHODAN QUERIES + COMBINED COUNTRY?
AWESOME!
Tuesday, March
13, 2012

67. SHODAN QUERIES + COMBINED COUNTRY
port:3389 -allowed country:PT

68. SHODAN QUERIES + COMBINED COUNTRY?
AWESOME!

69. SHODAN QUERIES OF AWESOMENESS
SAP Web Application Server (ICM)
Worldwide
Portugal

70. SHODAN QUERIES OF AWESOMENESS
SAP NetWeaver Application Server
Worldwide
Portugal

71. SHODAN QUERIES OF AWESOMENESS
SAP Web Application Server
Worldwide
Portugal

72. SHODAN QUERIES OF AWESOMENESS
SAP J2EE Engine
Worldwide
Portugal

73. SHODAN QUERIES OF AWESOMENESS

74. SHODAN QUERIES OF AWESOMENESS
port:23 country:PT
Worldwide
Portugal

75. SHODAN QUERIES OF AWESOMENESS
port:23 country:PT
Username:admin
Password:smcadmin

76. SHODAN QUERIES OF AWESOMENESS
port:23 list of built-in commands
Worldwide
Not a big number, however just telnet in and you get shell…

77. SHODAN QUERIES OF AWESOMENESS
port:161 country:PT
Worldwide
Portugal

78. SHODAN QUERIES OF AWESOMENESS
What sort of info do I get with SNMP ?
• Windows RUNNING PROCESSES 1.3.6.1.2.1.25.4.2.1.2
• Windows INSTALLED SOFTWARE 1.3.6.1.2.1.25.6.3.1.2
• Windows SYSTEM INFO 1.3.6.1.2.1.1.1
• Windows HOSTNAME 1.3.6.1.2.1.1.5
• Windows DOMAIN 1.3.6.1.4.1.77.1.4.1
• Windows UPTIME 1.3.6.1.2.1.1.3
• Windows USERS 1.3.6.1.4.1.77.1.2.25
• Windows SHARES 1.3.6.1.4.1.77.1.2.27
• Windows DISKS 1.3.6.1.2.1.25.2.3.1.3
• Windows SERVICES 1.3.6.1.4.1.77.1.2.3.1.1
• Windows LISTENING TCP PORTS 1.3.6.1.2.1.6.13.1.3.0.0.0.0
• Windows LISTENING UDP PORTS 1.3.6.1.2.1.7.5.1.2.0.0.0.0

79. SHODAN QUERIES OF AWESOMENESS
What sort of info do I get with SNMP ?
• Linux RUNNING PROCESSES 1.3.6.1.2.1.25.4.2.1.2
• Linux SYSTEM INFO 1.3.6.1.2.1.1.1
• Linux HOSTNAME 1.3.6.1.2.1.1.5
• Linux UPTIME 1.3.6.1.2.1.1.3
• Linux MOUNTPOINTS 1.3.6.1.2.1.25.2.3.1.3
• Linux RUNNING SOFTWARE PATHS 1.3.6.1.2.1.25.4.2.1.4
• Linux LISTENING UDP PORTS 1.3.6.1.2.1.7.5.1.2.0.0.0.0
• Linux LISTENING TCP PORTS 1.3.6.1.2.1.6.13.1.3.0.0.0.0

80. SHODAN QUERIES OF AWESOMENESS
What sort of info do I get with SNMP ?
• Cisco LAST TERMINAL USERS 1.3.6.1.4.1.9.9.43.1.1.6.1.8
• Cisco INTERFACES 1.3.6.1.2.1.2.2.1.2
• Cisco SYSTEM INFO 1.3.6.1.2.1.1.1
• Cisco HOSTNAME 1.3.6.1.2.1.1.5
• Cisco SNMPcommunities 1.3.6.1.6.3.12.1.3.1.4
• Cisco UPTIME 1.3.6.1.2.1.1.3
• Cisco IP ADDRESSES 1.3.6.1.2.1.4.20.1.1
• Cisco INTERFACE DESCRIPTIONS 1.3.6.1.2.1.31.1.1.1.18
• Cisco HARDWARE 1.3.6.1.2.1.47.1.1.1.1.2
• Cisco TACACS SERVER 1.3.6.1.4.1.9.2.1.5
• Cisco LOGMESSAGES 1.3.6.1.4.1.9.9.41.1.2.3.1.5
• Cisco PROCESSES 1.3.6.1.4.1.9.9.109.1.2.1.1.2
• Cisco SNMP TRAP SERVER 1.3.6.1.6.3.12.1.2.1.7

81. SHODAN QUERIES OF AWESOMENESS

82. SHODAN QUERIES OF AWESOMENESS
cisco country:PT
Worldwide
Portugal

83. SHODAN QUERIES OF country:PT
cisco
AWESOMENESS

84. CISCO

85. CISCO – GRE TUNNELING

86. SHODAN QUERIES OF AWESOMENESS
port:1900 country:PT
Worldwide
Portugal

87. SHODAN QUERIES OF AWESOMENESS
So, What is UPNP?

88. SHODAN QUERIES OF AWESOMENESS
So, What uses UPNP?

89. SHODAN QUERIES OF AWESOMENESS
Hackz

90. SHODAN QUERIES OF AWESOMENESS
Hackz

91. SHODAN QUERIES OF AWESOMENESS
UPNP zomg time

92. SHODAN QUERIES OF AWESOMENESS
UPNP Remote command execution

93. SHODAN QUERIES OF AWESOMENESS
Oh and by the way…

94. SHODAN QUERIES OF AWESOMENESS
Another funny thing about UPNP, is
that you can get the MAC ADDR and
SSID its using
And then….

95. SHODAN (MORE INTERESTING) QUERIES
SCADA
• http://www.shodanhq.com/?q=PLC
• http://www.shodanhq.com/?q=allen+bradley
• http://www.shodanhq.com/?q=fanuc
• http://www.shodanhq.com/?q=Rockwell
• http://www.shodanhq.com/?q=Cimplicity
• http://www.shodanhq.com/?q=Omron
• http://www.shodanhq.com/?q=Novatech
• http://www.shodanhq.com/?q=Citect
• http://www.shodanhq.com/?q=RTU
• http://www.shodanhq.com/?q=Modbus+Bridge
• http://www.shodanhq.com/?q=modicon
• http://www.shodanhq.com/?q=bacnet
• http://www.shodanhq.com/?q=telemetry+gateway
• http://www.shodanhq.com/?q=SIMATIC
• http://www.shodanhq.com/?q=hmi
• http://www.shodanhq.com/?q=siemens+-...er+-Subscriber
• http://www.shodanhq.com/?q=scada+RTS
• http://www.shodanhq.com/?q=SCHNEIDER

96. SHODAN (MORE INTERESTING) QUERIES
PORTUGAL?
SCADA

97. SHODAN (MORE INTERESTING) QUERIES
SCADA Portugal

98. SHODAN (MORE INTERESTING) QUERIES
SCADA Portugal

99. SHODAN (MORE INTERESTING) QUERIES
SCADA Portugal

100. SHODAN (MORE INTERESTING) QUERIES
SCADA Portugal

101. SHODAN (MORE INTERESTING) QUERIES
Cameras…. Simply connected online and without authentication…

102. A LITTLE TIP…
If you want to quickly check for stuff
(web related) that has no
authentication, use NMAP!

103. A LITTLE TIP…
First, let’s get wkhtmltoimage:
wget http://wkhtmltopdf.googlecode.com/files/wkhtmltoimage-0.11.0_rc1-static-i386.tar.bz2
tar -jxvf wkhtmltoimage-0.11.0_rc1-static-i386.tar.bz2
cp wkhtmltoimage-i386 /usr/local/bin/
Next, let’s get and install the Nmap module:
git clone git://github.com/SpiderLabs/Nmap-Tools.git
cd Nmap-Tools/NSE/
cp http-screenshot.nse /usr/local/share/nmap/scripts/
nmap --script-updatedb

104. A LITTLE TIP…
Then, do your shodan search and use:
This automatically exports a list of ips u
can import into nmap

105. A LITTLE TIP…
Then…

106. A LITTLE TIP…
And nmap, will automatically take screen
shots of the first pages that appear and
store them, then u just need to look at
those!

107. To end…

108. OPEN PORTS!

109. SCARY SHIT!
DEFACE 1 SCARY?
NO!

110. SCARY SHIT!
DEFACE 2 SCARY?
Well… disturbing, scary? Not so much!

111. SCARY SHIT!

112. SCARY SHIT!

113. SCARY SHIT!

114. SHODAN – THE BAD PART
• Imports nmap scans from their servers
on a rotational basis, so its not always
100% updated! Confirmed this by
correlating some of the shodan results
with our personal results!
• For example on mysql servers, Shodan
would find 785, where our results
showed 3000+

115. SHODAN – THE GOOD PART
• Good querying system
• If port scanning is illegal in your
country, you’re out of trouble if u use
shodan, because ur just querying
data acquired by them.

116. Kudos
Girlfriends / Wives
Aaron @f1nux
HD Moore
Codebits organization

117. Resources
http://secanalysis.com/interesting-shodan-searches/
blog.spiderlabs.com/2012/06/using-nmap-to-screenshot-web-services.html
http://www.youtube.com/watch?v=LPgZU7ZNIjQ - Defcon 18 2010 SHODAN
for Penetration Testers Michael Schearer
http://www.youtube.com/watch?v=Tg9ZAvynjdk – HD Moore – Empirical
Exploitation
http://www.youtube.com/watch?v=b-uPh99whw4 – HD Moore – Wild West

118. Requests
https://www.facebook.com/ptcoresec
Rate our talk @
codebits.eu

119. Test our tool
www.infosec.pt
ptcoresec0 jguw8r6msf
ptcoresec4 k48fg1wj7t
ptcoresec3 35q4lr2wxq
ptcoresec2 uhrptvkm28
ptcoresec1 pwqc9azmwl
ptcoresec6 dt9onrpnb8
ptcoresec9 l744jjy6g2
ptcoresec7 9on68zqfm5
ptcoresec8 xfw9wqqf6f