In this demo, we use PowerShell to find live hosts on the network.
And more specific,
we use PowerShell to perform ping scans across the
network and return which hosts are live.
Hey there. Welcome back to our live environment.
There are several ways of creating a host discovery scanner.
Some people like to use the modern PowerShell features
like the Test Connection feature.
However,
those modern features might not work in all PowerShell versions. As in a
red team engagement, you never know the version of the PowerShell you
get. I personally like to use some basic techniques that are supported by
virtually all PowerShell versions.
In this demo, we'll use the ping feature from the operational system, which
can be used by the class System.Net.NetworkInformation.Ping.
This class allows us to ping a piece to find out if they're live or not.
To make things easier, I will put this ping object into a variable called ping.
So let's start by the basics.
The most simple thing we can do is pinging a single IP. For that, I
can just use the feature, send, on the ping object.
And this action requires me to input an IP address
like this one you can see here.
So, let's run this and see what happens.
Perfect, take a look.
We've got a successful ping here. As I'm only interested to
know if the host is up or not, I will filter the output by
typing Select‑Object Address,Status.
Perfect! Now when I run this,
I get a simple table saying if the ping to the IP was successful or not.
Now let's start to increment this code here.
We can leverage some of the PowerShell tricks here to ping multiple IPs. For
example, I can put in the beginning of this line a list of IPs, and then pipe,
and then ForEach‑Object. In this way, PowerShell will integrate over this IP
list and then run the ping command for each IP. And, of course, we need to
replace this hard‑coded IP address here by the underscore variable, which is
the IP of the ForEach‑Object.
Perfect! Now, let's run this. Amazing! Take a look. We've got here a list of
the IPs that are live. Only the .11 IP is live. The other one timed out. One
thing you might have noted is that even though we have only two IPs, our scan
took a little while. And the reason for that is that by default the ping
command waits 3 seconds before giving a timeout. So, we can change the ping
timeouts to only 1 second. For that, I'll just add to the Send function a
timeout value. In my case, I'll put 1000 ms, which means 1 second, and this
should make the scan a little bit faster, so let's run this again and verify
that.
Cool, take a look. It looks way faster now. Now, if you want
to scan the whole network with this script, it would be too
annoying to type this manually.
We would have to write every single IP in this list of IPs. So,
we need to think about a better solution here.
What I could do here is put the beginning of my IP address and
then interact just the last digits of the IP. In this way, I can
just put a range of IPs like from 10 to 14, and the script would
scan all of those IPs for me.
So let's try this.
Perfect! It works.
Take a look. We scanned five IPs from this list. If I wanted, I could scan a
whole network by just putting here from 1 to 255. And once I run this, it would
scan the whole network and let me know which hosts are up. Pretty cool, right?
Now, if you're working on a red team engagement and you want to scan a network,
you can just copy and paste those two lines into the PowerShell of your victim
computer. In this way, you wouldn't need to transfer any files to your target
computer.
However, if you want to have a standalone script that is able to scan for live
hosts, we can modify this command here so we can have a proper tool. First,
let's remove the hard‑coded IPs from the code and migrate them to variables.
For example, I'll migrate the network address to a variable and IP range to
another variable. Then, and again, I didn't change any features. I just moved
the values to variables.
Now let's just test this to make sure this is still working. Perfect, it does.
Now let's say I want to save this script into a file and use it later on.
Instead of having the variables hard coded into the script,
I can pass them via parameters when calling the script. For that,
I'll just have to add this param line here, and then I can comment
the hard‑coded values. Done, so let me save this into a file. I'll
call this as network‑discovery.ps1. Perfect! Now let me go to the
PowerShell terminal, and in here I have the script that I just
created. If I want to run it,
I just have to put the name of the script and pass the
two parameters that I had in the code, the ‑ip_network,
which is the network that I want to scan, and the ‑ip_range,
which is the range of a IPs that I want to scan.
An important thing is to put the range in between round
brackets since PowerShell will translate this into an array
of numbers, so let's run this.
Perfect, take a look. We have 2 IPs on this network, the .10 and .11.
And again, if you want to scan the whole network, you can do that by
just changing the IP range to 1 to 255, and this would scan the whole
network looking for the live IPs. Interesting,
right? With just a few PowerShell lines, we're able to
identify which hosts are online in this network.
And although this might take a little bit longer than some of the
out‑of‑the‑box tools like Nmap, by using this PowerShell script,
it would reduce a lot of your chances of being detected by security solutions.
Amazing! With our discovery script,
we now have mapped the internal host of Globomantics. Now, we need to
figure out which parts are open on those servers, and that's exactly
what we'll be covering in the next demo.