So let's go back into our environment,
and we'll check for running services and processes.
We'll check for running services first locally and remotely.
Then we'll use Nmap to identify services for common ports.
And so that's one thing to be aware of is that when we're
trying to identify services using Nmap,
it's actually trying to identify them based on open ports,
so this won't give you a full list of every service.
And then, we'll go and check for running processes as well.
So the last part of the equation is tying everything together.
So we already looked at‑‑‑ So if I type Get‑Service here,
this will look for the services that are running on this machine.
If I go back and change my command again and say Get‑Process.
It gives me the processes.
Now we know that ports and protocols are
intrinsically tied to services and processes.
So we often want to kind of tie those things together. If
we're monitoring specific machines,
we obviously want to monitor the ports that might be open.
Now, of course, we've already looked at using these two commands,
and we can also filter by the status of them by saying
if they're running or not running.
We also looked at using Nmap.
Now Nmap is really, really, really powerful.
So what we can do from here is we've done some scans before,
but we can say nmap ‑sv.
I'm going to say my IP address,
and then I'm going to use a different flag here called version‑all.
Now this is going to go ahead and try to do a pretty
significant scan against the IP address,
which is our Windows 2022 Server.
So we should get the port 16000 back and a whole host of other information.
Now, I'm not saying that we have to use Nmap all the time,
but Nmap is one tool that kind of bundles all the things
together that we would try to do with PowerShell.
However, we can use Get‑Service, we can use Get‑Process,
we can use the Get‑WmiObjects,
and we can also use the CIM instance commands that we'll talk
about next where we're able to retrieve information that is
targeted to the specific device.
Now,
the reason this one takes a while to execute is because
it has what's called version‑all,
and it's trying to interrogate everything on the machine and
trying to guess what those services might be based on ports
being available on the server as well.
So when it comes to monitoring servers and trying to identify things,
there's two trials of thought here while we wait for this to finish.
The first one would be that we remotely connect to a machine,
and then we'd go ahead and run the various connections locally on that machine.
So instead of scanning from the outside like we did with PowerSploit,
we would scan really on the server itself,
but over a PowerShell session.
Or we use something like Nmap or the PowerShell command
separately to run from the outside attaching to the box and then
trying to identify what's on that machine.
So we'll give it a second to finish, and then we'll look at some of the output,
and it will help us to understand the relationship between services,
processes, and ports.
So as you can see, it's gone through.
And based on the ports that have been identified,
it's been able to figure out what the services are.
So 3389 obviously has come up as Terminal Services.
We've got our port 16000 that shows up,
but doesn't quite know what to do with it and then a few other ports.
So Nmap really works well for doing a scan to be able to identify what some of
those ports might be and what the corresponding services are.
Now using Nmap is a great tool.
However, what we might want to do is to use native PowerShell.
So let's open up Visual Studio Code again,
we'll just expand this, and I'm going to create a new file here,
and we'll call this one PortScan.ps1.
And then I'm just going to paste in some existing code that we already have.
Now the code itself is fairly straightforward,
so let me just move this over here.
You can see we've set our subnet and our ending range as we've done previously,
as well as the port that we want to use,
which will be our 16000.
And then we've set an error preference,
which basically means if something errors,
then we want you to continue and just move on.
What we then do is construct the IP into the subnet and,
of course,
the number in the range to make our IP address Then we're going to
move down to writing some progress out where we have scanning network
and then the percent that was complete, which is basically a calculation.
Then we're going to use a standard PowerShell cmdlet called Test‑Connection,
which we've used previously.
And then with the response from that one,
we'll create a socket connection, which we also use previously.
And then we'll check if the socket is connected as a status.
If it is connected and the status is set that way,
then we'll write the value out and say, hey,
the port is open, and then we'll close the port.
If it's not successful,
obviously it's not connected, but maybe it's a filtered
value, then we'll write that it's not open. Anything else and
we'll say Connection Unsuccessful.
So let me just copy this here. Go back to our terminal. Let me clear
the screen here, and then I'll just paste all of that into here,
ready for us to action, and then I'll just press Enter. And this will
now go ahead and work very similar to the way Nmap did, but it's just
using PowerShell.
You can see we have a port open on the first server,
which will be our Windows 2022 server.
Then its connections is unsuccessful to 129 because that doesn't exist.
And then 130, it will tell me it's not open,
which means it's potentially filtered or closed.
So PowerShell can do exactly the same thing.
So you have great options to choose from when you want to
perform a port scan of some machine,
especially when you're trying to identify services and processes and ports.