我尝试iptables -I INPUT -p tcp -m tcp --dport 4444 -j ACCEPT
打开端口但仍然关闭:
$ nmap hostname -p 4444
Starting Nmap 7.70 ( https://nmap.org ) at 2018-05-23 04:47 +0430
Nmap scan report for linux (127.0.1.1)
Host is up (0.000040s latency).
rDNS record for 127.0.1.1: Linux.domain.linux
PORT STATE SERVICE
4444/tcp closed krb524
Nmap done: 1 IP address (1 host up) scanned in 0.10 seconds
原因可能是什么?我该怎么办?
答案1
端口上一定有东西在监听,单独打开防火墙是打不开的。
这里httpd正在监听80,所以它显示打开
$ nmap localhost -p 80
Starting Nmap 6.40 ( http://nmap.org ) at 2018-05-22 19:22 MDT
Nmap scan report for localhost (127.0.0.1)
Host is up (0.00019s latency).
Other addresses for localhost (not scanned): 127.0.0.1
PORT STATE SERVICE
80/tcp open http
Nmap done: 1 IP address (1 host up) scanned in 0.18 seconds
这里 netstat 显示我正在监听 80,因为 httpd 正在监听它。
$ netstat --listening --numeric-ports | grep 80
tcp6 0 0 [::]:80 [::]:* LISTEN
$ systemctl status httpd
● httpd.service - The Apache HTTP Server
Loaded: loaded (/usr/lib/systemd/system/httpd.service; enabled; vendor preset: disabled)
Active: active (running) since Tue 2018-05-22 18:18:01 MDT; 1h 5min ago
Docs: man:httpd(8)
man:apachectl(8)
Main PID: 1279 (httpd)
Status: "Total requests: 0; Current requests/sec: 0; Current traffic: 0 B/sec"
Tasks: 7
CGroup: /system.slice/httpd.service
├─1279 /usr/sbin/httpd -DFOREGROUND
├─1928 /usr/sbin/httpd -DFOREGROUND
├─1929 /usr/sbin/httpd -DFOREGROUND
├─1930 /usr/sbin/httpd -DFOREGROUND
├─1931 /usr/sbin/httpd -DFOREGROUND
├─1932 /usr/sbin/httpd -DFOREGROUND
└─1933 /usr/sbin/httpd -DFOREGROUND
May 22 18:17:55 trogdor.mydomain.com systemd[1]: Starting The Apache HTT...
May 22 18:18:01 trogdor.mydomain.com systemd[1]: Started The Apache HTTP...
Hint: Some lines were ellipsized, use -l to show in full.
如果我关闭 httpd:
# systemctl stop httpd
$ nmap localhost -p 80
Starting Nmap 6.40 ( http://nmap.org ) at 2018-05-22 19:23 MDT
Nmap scan report for localhost (127.0.0.1)
Host is up (0.00017s latency).
Other addresses for localhost (not scanned): 127.0.0.1
PORT STATE SERVICE
80/tcp closed http
Nmap done: 1 IP address (1 host up) scanned in 0.13 seconds
Netstat 显示我没有在 80 上监听,即使它是开放的
$ netstat --listening --numeric-ports | grep 80
$
关键是,IPTables 部分是问题。如果我在 4444 上启动反向连接侦听器(这取自Rapid7 问答),然后端口 4444 显示为打开并正在侦听,我永远不必触摸 IP 表。
msf > use exploit/multi/handler
msf exploit(handler) > set PAYLOAD windows/meterpreter/reverse_tcp
msf exploit(handler) > set LHOST 127.0.0.1
msf exploit(handler) > set LPORT 4444
msf exploit(handler) > set ExitOnSession false
msf exploit(handler) > exploit -j
# netstat --numeric-ports --listening | grep 4444
tcp 0 0 localhost:4444 0.0.0.0:*