Leveraging Wake-On-LAN Support to Audit Powered-Off Hosts with Nessus
Have you ever been charged to perform a security audit for a set of hosts that has been turned off? If those hosts have been configured to be “woken up” with a “Wake-on-LAN” packet, you can now leverage this capability with your enterprise Nessus scans. This blog entry describes how organizations that leverage Nessus or SecurityCenter to scan their infrastructure can audit systems that have been powered off.
The most important item that you need to configure your scans is the list of Ethernet addresses of the hosts you want to wake up. A host that is configured for Wake-on-LAN isn’t fully powered off. The Ethernet card remains powered on and if it receives a specific packet, it will boot up the system. You also need to have your Nessus scanner installed on the same physical network as the target hosts.
If you have many different subnets, you may want to leverage SecurityCenter to control all your scanners from one central location. Nessus scanners managed by SecurityCenter do not need to be subscribed to the ProfessionalFeed. Tenable has many customers that leverage dozens and a few that manage hundreds of Nessus scanners this way.
To boot systems that have been configured for Wake-on-LAN, Nessus sends a broadcast packet to each Ethernet address that it should wake. Ethernet addresses can be obtained from many types of resources including:
- Uncredentialed Nessus scans of the local collision domain
- Uncredentialed Nessus scans of any Windows or OS X host running NetBIOS
- Credentialed Windows or Unix audits
- A list of all Ethernet addresses seen by the Log Correlation Engine’s new_mac.tasl correlation script
- An Ethernet address table provided by your network administrator
- A list of “live” addresses obtained from your DHCP server
There are several Nessus plugins that track Ethernet addresses such as:
- 10180 – Ping the Remote host (if the host responds to an arp request)
- 10150 – Windows NetBIOS / SMB Remote Host Information Disclosure
- 12218 – mDNS Detection
- 24272 - Network Interface Enumeration (WMI)
- 33276 – Enumerate MAC Addresses via SSH
- 35716 – Ethernet Card manufacturer Detection
SecurityCenter users can leverage aggregate Nessus scans and quickly export spreadsheets with lists of IP addresses and Ethernet addresses as shown below:
In addition to the list of Ethernet addresses, you need two other things:
- You need to be running Nessus 4.4 or higher to use the wol.nasl plugin
- You need network access to the scanned targets for UDP broadcast packets. The Wake-on-LAN packets sent by Nessus leverage broadcast addresses. If your routers or firewalls block this type of packet between your Nessus scanners and the targets, the special packets won’t be sent.
You will need to set two preferences to configure a scan to make use the Wake-on-LAN feature. Following is a sample screen shot of the preference screen in Nessus 4.4.1:
The first preference is simply a list of Ethernet addresses in a file such as:
[root@megalon db]# cat list.txt
00:26:82:3c:71:c0
00:24:2c:85:ed:5a
00:22:b0:b5:8f:66
00:0c:29:6a:08:3a
00:1d:72:bd:8b:4e
00:21:6a:4a:b8:4a
00:22:5f:6d:e8:e4
d8:a2:5e:0a:36:cb
d8:a2:5e:0d:fc:89
The second parameter allows you to tune your scan to specify how long to wait for systems to boot prior to running the scan. During this time, Nessus will reissue the Wake-on-LAN packet to keep systems that boot quickly from going back to standby every minute. After the time to wait has passed, Nessus will proceed with the audit.
If you have questions or feedback about this new feature of Nessus, please let us know at @TenableSecurity on Twitter, on the Tenable Discussion Forums or with Tenable’s Support team.
Related Articles
Study: Tenable Offers Fastest, Broadest Coverage of CISA's KEV Catalog
October 23, 2023Tenable ranked first in multiple vulnerability management categories, including the most comprehensive coverage and quickest detection of CISA's Known Exploited Vulnerabilities, according to a Miercom report commissioned by Tenable.
Tuning Network Assessments for Performance and Resource Usage
September 13, 2022Using the correct tool for the job and optimizing scanner placement will have a large impact on scan efficiency with Nessus, Tenable.io and Tenable.sc.
Terrascan Joins the Nessus Community, Enabling Nessus To Validate Modern Cloud Infrastructures
May 17, 2022The addition of Terrascan to the Nessus family of products helps users better secure cloud native infrastructure by identifying misconfigurations, security weaknesses, and policy violations by scanning Infrastructure as Code repositories.
Cybersecurity Snapshot: NIST Program Probes AI Cyber and Privacy Risks, as U.S. Gov’t Tackles Automotive IoT Threat from Russia, China
September 27, 2024A new NIST program will revise security frameworks like NIST’s CSF as AI risks intensify. Plus, the U.S. may ban cars with Russian and Chinese IoT components. Meanwhile, the CSA adds AI insights to its zero trust guide. And get the latest on cybersecurity budgets, SBOMs and the Ghost cybercrime platform!
CVE-2024-47076, CVE-2024-47175, CVE-2024-47176, CVE-2024-47177: Frequently Asked Questions About Common UNIX Printing System (CUPS) Vulnerabilities
September 26, 2024Frequently asked questions about multiple vulnerabilities in the Common UNIX Printing System (CUPS) that were disclosed as zero-days on September 26.
Establishing a Cloud Security Program: Best Practices and Lessons Learned
September 26, 2024As we’ve developed Tenable’s cloud security program, we in the Infosec team have asked many questions and faced interesting challenges. Along the way, we’ve learned valuable lessons and incorporated key best practices. In this blog, we’ll discuss how we’ve approached implementing our cloud security program using Tenable Cloud Security, and share recommendations that you may find helpful.
- Nessus