# 3260 - Pentesting ISCSI
Jifunze kuhusu kudukua AWS kutoka sifuri hadi shujaa na htARTE (HackTricks AWS Red Team Expert)! Njia nyingine za kusaidia HackTricks: * Ikiwa unataka kuona **kampuni yako inatangazwa kwenye HackTricks** au **kupakua HackTricks kwa PDF** Angalia [**MPANGO WA KUJIUNGA**](https://github.com/sponsors/carlospolop)! * Pata [**swag rasmi ya PEASS & HackTricks**](https://peass.creator-spring.com) * Gundua [**The PEASS Family**](https://opensea.io/collection/the-peass-family), mkusanyiko wetu wa kipekee wa [**NFTs**](https://opensea.io/collection/the-peass-family) * **Jiunge na** 💬 [**Kikundi cha Discord**](https://discord.gg/hRep4RUj7f) au [**kikundi cha telegram**](https://t.me/peass) au **tufuate** kwenye **Twitter** 🐦 [**@carlospolopm**](https://twitter.com/hacktricks_live)**.** * **Shiriki mbinu zako za kudukua kwa kuwasilisha PR kwa** [**HackTricks**](https://github.com/carlospolop/hacktricks) na [**HackTricks Cloud**](https://github.com/carlospolop/hacktricks-cloud) repos za github.
## Taarifa Msingi Kutoka [Wikipedia](https://en.wikipedia.org/wiki/ISCSI): > Katika kompyuta, **iSCSI** ni kifupi cha **Internet Small Computer Systems Interface**, kiwango cha mtandao wa uhifadhi wa data kwa msingi wa Itifaki ya Mtandao wa Itifaki (IP) kwa ajili ya kuunganisha vituo vya uhifadhi wa data. Inatoa ufikiaji wa ngazi ya block kwa vifaa vya uhifadhi kwa kubeba amri za SCSI juu ya mtandao wa TCP/IP. iSCSI hutumiwa kurahisisha uhamisho wa data juu ya mitandao ya ndani na kusimamia uhifadhi kwa umbali mrefu. Inaweza kutumika kuhamisha data juu ya mitandao ya eneo la ndani (LANs), mitandao ya eneo kubwa (WANs), au Mtandao na inaweza kuwezesha uhifadhi na upatikanaji wa data usio na kikomo kwa eneo. > > Itifaki hii inaruhusu wateja (inayoitwa initiators) kutuma amri za SCSI (CDBs) kwa vifaa vya uhifadhi (malengo) kwenye seva za mbali. Ni itifaki ya mtandao wa eneo la uhifadhi (SAN), kuruhusu shirika kuunganisha uhifadhi katika safu za uhifadhi wakati inatoa wateja (kama vile seva za database na wavuti) na hisia ya diski za SCSI zilizounganishwa kwa eneo. Inashindana sana na Fibre Channel, lakini tofauti na Fibre Channel ya jadi ambayo kawaida inahitaji nyaya maalum, iSCSI inaweza kukimbia kwa umbali mrefu kwa kutumia miundombinu ya mtandao iliyopo. **Bandari ya chaguo-msingi:** 3260 ``` PORT STATE SERVICE VERSION 3260/tcp open iscsi? ``` ## Uchambuzi ### iSCSI iSCSI ni itifaki ya mtandao inayotumiwa kuhamisha data kati ya seva na vifaa vya kuhifadhi. Katika hatua ya uchambuzi, tunaweza kutumia njia kadhaa za kuchunguza na kuchunguza mazingira ya iSCSI. #### Kugundua Huduma ya iSCSI Kwa kugundua huduma ya iSCSI, tunaweza kutumia zana kama Nmap au iSCSI Discovery Utility. Zana hizi zinaweza kutusaidia kupata seva za iSCSI zinazopatikana kwenye mtandao. Kwa mfano, tunaweza kutumia amri ifuatayo kwenye Nmap: ```plaintext nmap -p 3260 --script iscsi-info ``` #### Kuchunguza Huduma ya iSCSI Baada ya kugundua seva ya iSCSI, tunaweza kuchunguza huduma hiyo kwa kutumia zana kama iSCSI Discovery Utility au iSCSI Initiator. Zana hizi zinaweza kutusaidia kuchunguza na kuingiliana na seva ya iSCSI. Kwa mfano, tunaweza kutumia amri ifuatayo kwenye iSCSI Discovery Utility: ```plaintext iscsiadm -m discovery -t sendtargets -p ``` #### Kuchunguza Huduma ya iSCSI kwa Kutumia Wireshark Wireshark ni zana yenye nguvu ya uchambuzi wa trafiki ya mtandao. Tunaweza kutumia Wireshark kuchunguza mawasiliano ya iSCSI na kuchambua data inayopitishwa kati ya seva na vifaa vya kuhifadhi. Kwa mfano, tunaweza kufuatilia trafiki ya iSCSI kwa kuchagua kichujio cha "iscsi" kwenye Wireshark. #### Kuchunguza Huduma ya iSCSI kwa Kutumia iSCSI Authentication Bypass Katika hali fulani, tunaweza kujaribu kuchunguza huduma ya iSCSI kwa kutumia mbinu za kuvuka uthibitishaji wa iSCSI. Hii inaweza kuhusisha kutumia zana kama iSCSI Target Tester au iSCSI Security Scanner. Kwa mfano, tunaweza kutumia amri ifuatayo kwenye iSCSI Target Tester: ```plaintext iscsi-target-tester -t -p 3260 -a ``` #### Kuchunguza Huduma ya iSCSI kwa Kutumia iSCSI Exploitation Framework Ikiwa tunataka kuchunguza zaidi huduma ya iSCSI, tunaweza kutumia iSCSI Exploitation Framework. Hii ni zana yenye nguvu ambayo inaruhusu kuchunguza na kuchunguza udhaifu katika huduma ya iSCSI. Kwa mfano, tunaweza kutumia amri ifuatayo kwenye iSCSI Exploitation Framework: ```plaintext iscsi-exploit-framework -t -p 3260 ``` Kwa kufuata njia hizi za uchambuzi, tunaweza kupata habari muhimu na kuchunguza mazingira ya iSCSI kwa ufanisi. ``` nmap -sV --script=iscsi-info -p 3260 192.168.xx.xx ``` Hati hii itaonyesha ikiwa uwakiki unahitajika. ### [Nguvu ya nguvu](../generic-methodologies-and-resources/brute-force.md#iscsi) ### [Funga ISCSI kwenye Linux](https://www.synology.com/en-us/knowledgebase/DSM/tutorial/Virtualization/How\_to\_set\_up\_and\_use\_iSCSI\_target\_on\_Linux) **Note:** Unaweza kugundua kuwa malengo yako yanapatikana chini ya anwani tofauti ya IP. Hii mara nyingi hutokea ikiwa huduma ya iSCSI inafunuliwa kupitia NAT au anwani ya IP ya kubadilishwa. Katika kesi kama hizi, `iscsiadmin` itashindwa kuunganisha. Hii inahitaji marekebisho mawili: moja kwa jina la saraka ya nodi iliyoanzishwa moja kwa moja na shughuli zako za ugunduzi, na moja kwa faili ya `default` iliyomo ndani ya saraka hii. Kwa mfano, unajaribu kuunganisha kwenye lengo la iSCSI kwenye 123.123.123.123 kwenye bandari 3260. Seva inayofunua lengo la iSCSI iko kwa kweli kwenye 192.168.1.2 lakini inafunuliwa kupitia NAT. isciadm itasajili anwani ya _ndani_ badala ya anwani ya _umma_: ``` iscsiadm -m discovery -t sendtargets -p 123.123.123.123:3260 192.168.1.2:3260,1 iqn.1992-05.com.emc:fl1001433000190000-3-vnxe [...] ``` Amri hii itaunda saraka katika mfumo wako wa faili kama ifuatavyo: ``` /etc/iscsi/nodes/iqn.1992-05.com.emc:fl1001433000190000-3-vnxe/192.168.1.2\,3260\,1/ ``` Ndani ya saraka, kuna faili ya chaguo-msingi na mipangilio yote inayohitajika kuunganisha kwenye lengo. 1. Badilisha jina la `/etc/iscsi/nodes/iqn.1992-05.com.emc:fl1001433000190000-3-vnxe/192.168.1.2\,3260\,1/` kuwa `/etc/iscsi/nodes/iqn.1992-05.com.emc:fl1001433000190000-3-vnxe/123.123.123.123\,3260\,1/` 2. Ndani ya `/etc/iscsi/nodes/iqn.1992-05.com.emc:fl1001433000190000-3-vnxe/123.123.123.123\,3260\,1/default`, badilisha mipangilio ya `node.conn[0].address` ili ielekeze kwa 123.123.123.123 badala ya 192.168.1.2. Hii inaweza kufanywa kwa amri kama `sed -i 's/192.168.1.2/123.123.123.123/g' /etc/iscsi/nodes/iqn.1992-05.com.emc:fl1001433000190000-3-vnxe/123.123.123.123\,3260\,1/default` Sasa unaweza kufunga lengo kulingana na maagizo kwenye kiungo. ### [Funga ISCSI kwenye Windows](https://docs.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2008-R2-and-2008/ee338476\(v=ws.10\)?redirectedfrom=MSDN) ## **Uchunguzi wa mwongozo** ```bash sudo apt-get install open-iscsi ``` Mfano kutoka [hati za iscsiadm](https://ptestmethod.readthedocs.io/en/latest/LFF-IPS-P2-VulnerabilityAnalysis.html#iscsiadm): Kwanza kabisa unahitaji **kugundua majina ya malengo** nyuma ya anwani ya IP: ```bash iscsiadm -m discovery -t sendtargets -p 123.123.123.123:3260 123.123.123.123:3260,1 iqn.1992-05.com.emc:fl1001433000190000-3-vnxe [2a01:211:7b7:1223:211:32ff:fea9:fab9]:3260,1 iqn.2000-01.com.synology:asd3.Target-1.d0280fd382 [fe80::211:3232:fab9:1223]:3260,1 iqn.2000-01.com.synology:Oassdx.Target-1.d0280fd382 ``` _Note kwamba itaonyesha I**P na bandari ya interfaces** ambapo unaweza **kufikia** malengo hayo. Inaweza hata **kuonyesha IPs za ndani au IPs tofauti** na ile uliyotumia._ Kisha **unakamata sehemu ya pili ya herufi iliyochapishwa ya kila mstari** (_iqn.1992-05.com.emc:fl1001433000190000-3-vnxe_ kutoka kwa mstari wa kwanza) na **jaribu kuingia**: ```bash iscsiadm -m node --targetname="iqn.1992-05.com.emc:fl1001433000190000-3-vnxe" -p 123.123.123.123:3260 --login Logging in to [iface: default, target: iqn.1992-05.com.emc:fl1001433000190000-3-vnxe, portal: 123.123.123.123,3260] (multiple) Login to [iface: default, target: iqn.1992-05.com.emc:fl1001433000190000-3-vnxe, portal: 123.123.123.123,3260] successful. ``` Kisha, unaweza **kutoka** kwa kutumia `–logout` ```bash iscsiadm -m node --targetname="iqn.1992-05.com.emc:fl1001433000190000-3-vnxe" -p 123.123.123.123:3260 --logout Logging out of session [sid: 6, target: iqn.1992-05.com.emc:fl1001433000190000-3-vnxe, portal: 123.123.123.123,3260] Logout of [sid: 6, target: iqn.1992-05.com.emc:fl1001433000190000-3-vnxe, portal: 123.123.123.123,3260] successful. ``` Tunaweza kupata **mashauri zaidi** kuhusu hilo kwa kutumia **bila** kutumia `--login`/`--logout` parameter. ```bash iscsiadm -m node --targetname="iqn.1992-05.com.emc:fl1001433000190000-3-vnxe" -p 123.123.123.123:3260 # BEGIN RECORD 2.0-873 node.name = iqn.1992-05.com.emc:fl1001433000190000-3-vnxe node.tpgt = 1 node.startup = manual node.leading_login = No iface.hwaddress = iface.ipaddress = iface.iscsi_ifacename = default iface.net_ifacename = iface.transport_name = tcp iface.initiatorname = iface.bootproto = iface.subnet_mask = iface.gateway = iface.ipv6_autocfg = iface.linklocal_autocfg = iface.router_autocfg = iface.ipv6_linklocal = iface.ipv6_router = iface.state = iface.vlan_id = 0 iface.vlan_priority = 0 iface.vlan_state = iface.iface_num = 0 iface.mtu = 0 iface.port = 0 node.discovery_address = 192.168.xx.xx node.discovery_port = 3260 node.discovery_type = send_targets node.session.initial_cmdsn = 0 node.session.initial_login_retry_max = 8 node.session.xmit_thread_priority = -20 node.session.cmds_max = 128 node.session.queue_depth = 32 node.session.nr_sessions = 1 node.session.auth.authmethod = None node.session.auth.username = node.session.auth.password = node.session.auth.username_in = node.session.auth.password_in = node.session.timeo.replacement_timeout = 120 node.session.err_timeo.abort_timeout = 15 node.session.err_timeo.lu_reset_timeout = 30 node.session.err_timeo.tgt_reset_timeout = 30 node.session.err_timeo.host_reset_timeout = 60 node.session.iscsi.FastAbort = Yes node.session.iscsi.InitialR2T = No node.session.iscsi.ImmediateData = Yes node.session.iscsi.FirstBurstLength = 262144 node.session.iscsi.MaxBurstLength = 16776192 node.session.iscsi.DefaultTime2Retain = 0 node.session.iscsi.DefaultTime2Wait = 2 node.session.iscsi.MaxConnections = 1 node.session.iscsi.MaxOutstandingR2T = 1 node.session.iscsi.ERL = 0 node.conn[0].address = 192.168.xx.xx node.conn[0].port = 3260 node.conn[0].startup = manual node.conn[0].tcp.window_size = 524288 node.conn[0].tcp.type_of_service = 0 node.conn[0].timeo.logout_timeout = 15 node.conn[0].timeo.login_timeout = 15 node.conn[0].timeo.auth_timeout = 45 node.conn[0].timeo.noop_out_interval = 5 node.conn[0].timeo.noop_out_timeout = 5 node.conn[0].iscsi.MaxXmitDataSegmentLength = 0 node.conn[0].iscsi.MaxRecvDataSegmentLength = 262144 node.conn[0].iscsi.HeaderDigest = None node.conn[0].iscsi.DataDigest = None node.conn[0].iscsi.IFMarker = No node.conn[0].iscsi.OFMarker = No # END RECORD ``` **Kuna script ya kiotomatiki ya kuchunguza mitandao ya subnet inapatikana kwenye** [**iscsiadm**](https://github.com/bitvijays/Pentest-Scripts/tree/master/Vulnerability\_Analysis/isciadm) ## **Shodan** * `port:3260 AuthMethod` ## **Marejeo** * [https://bitvijays.github.io/LFF-IPS-P2-VulnerabilityAnalysis.html](https://bitvijays.github.io/LFF-IPS-P2-VulnerabilityAnalysis.html) * [https://ptestmethod.readthedocs.io/en/latest/LFF-IPS-P2-VulnerabilityAnalysis.html#iscsiadm](https://ptestmethod.readthedocs.io/en/latest/LFF-IPS-P2-VulnerabilityAnalysis.html#iscsiadm)
Jifunze kuhusu kudukua AWS kutoka sifuri hadi shujaa na htARTE (HackTricks AWS Red Team Expert)! Njia nyingine za kusaidia HackTricks: * Ikiwa unataka kuona **kampuni yako inatangazwa kwenye HackTricks** au **kupakua HackTricks kwa PDF** Angalia [**MPANGO WA KUJIUNGA**](https://github.com/sponsors/carlospolop)! * Pata [**swag rasmi ya PEASS & HackTricks**](https://peass.creator-spring.com) * Gundua [**The PEASS Family**](https://opensea.io/collection/the-peass-family), mkusanyiko wetu wa [**NFTs**](https://opensea.io/collection/the-peass-family) za kipekee * **Jiunge na** 💬 [**Kikundi cha Discord**](https://discord.gg/hRep4RUj7f) au [**kikundi cha telegram**](https://t.me/peass) au **tufuate** kwenye **Twitter** 🐦 [**@carlospolopm**](https://twitter.com/hacktricks_live)**.** * **Shiriki mbinu zako za kudukua kwa kuwasilisha PRs kwenye** [**HackTricks**](https://github.com/carlospolop/hacktricks) na [**HackTricks Cloud**](https://github.com/carlospolop/hacktricks-cloud) github repos.