如何检查默认情况下启用了哪些密码PAN-OS版本
25011
Created On 11/02/22 18:40 PM - Last Modified 02/02/24 18:42 PM
Objective
- 确定哪些密码默认启用PAN-OS在禁用弱密码或启用字符串密码之前。
- 信息可用于缓解漏洞。 例子：TLS /SSL对 64 位块密码的生日攻击 (SWEET32)
Environment
- 帕洛阿尔托 Firewall
- 支持的 PAN-OS
- 密码支持
Procedure
登录Linux机器，需要运行nmap命令
user1@ubuntu-182-32:~$ nmap --script ssh2-enum-algos -sV -p 22 10.193.92.68
更换IP地址上使用的Firewall.输出提供所有密码
user1@ubuntu-182-32:~$ nmap --script ssh2-enum-algos -sV -p 22 10.193.92.68
Starting Nmap 7.01 ( https://nmap.org ) at 2022-10-20 05:09 PDT
Nmap scan report for 10.193.92.68
Host is up (0.00056s latency).
PORT STATE SERVICE VERSION
22/tcp open ssh OpenSSH 12.1 (protocol 2.0)
| ssh2-enum-algos:
| kex_algorithms: (7)
| ecdh-sha2-nistp256
| ecdh-sha2-nistp384
| ecdh-sha2-nistp521
| diffie-hellman-group-exchange-sha256
| diffie-hellman-group14-sha1
| diffie-hellman-group-exchange-sha1
| diffie-hellman-group1-sha1
| server_host_key_algorithms: (1)
| ssh-rsa
| encryption_algorithms: (15)
| aes128-ctr
| aes192-ctr
| aes256-ctr
| arcfour256
| arcfour128
| aes128-gcm@openssh.com
| aes256-gcm@openssh.com
| aes128-cbc
| 3des-cbc
| blowfish-cbc
| cast128-cbc
| aes192-cbc
| aes256-cbc
| arcfour
| rijndael-cbc@lysator.liu.se
| mac_algorithms: (19)
| hmac-md5-etm@openssh.com
| hmac-sha1-etm@openssh.com
| umac-64-etm@openssh.com
| umac-128-etm@openssh.com
| hmac-sha2-256-etm@openssh.com
| hmac-sha2-512-etm@openssh.com
| hmac-ripemd160-etm@openssh.com
| hmac-sha1-96-etm@openssh.com
| hmac-md5-96-etm@openssh.com
| hmac-md5
| hmac-sha1
| umac-64@openssh.com
| umac-128@openssh.com
| hmac-sha2-256
| hmac-sha2-512
| hmac-ripemd160
| hmac-ripemd160@openssh.com
| hmac-sha1-96
| hmac-md5-96
| compression_algorithms: (2)
| none
|_ zlib@openssh.com
Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 6.39 seconds