performing-agentless-vulnerability-scanning

执行无代理漏洞扫描

概述

无代理漏洞扫描无需在终端安装 Agent，即可评估系统中的安全弱点。这种方法利用现有网络协议（Linux 使用 SSH，Windows 使用 WMI）、云服务提供商 API 进行基于快照的分析，以及经过身份验证的远程检查。Microsoft Defender for Cloud、Wiz、Datadog 和 Tenable 等现代云平台会通过创建磁盘快照并离线检查操作系统配置和已安装的软件包，执行带外分析。开源工具 Vuls 利用 NVD 和 OVAL 数据，为 Linux/FreeBSD 系统提供无代理扫描。本技能介绍如何为本地部署、云和容器化环境配置无代理扫描。

适用场景

• 开展涉及无代理漏洞扫描的安全评估时
• 遵循相关安全事件的事件响应流程时
• 执行定期安全测试或审计活动时
• 通过实践测试验证安全控制时

前提条件

• 为 Linux/Unix 目标配置基于 SSH 密钥的身份验证
• Windows 目标可通过 WMI/WinRM 访问，并具备适当凭据
• 云服务提供商 API 凭据（AWS IAM、Azure RBAC、GCP IAM）
• 扫描器可通过所需端口访问目标系统
• 对目标系统配置具有只读访问权限的服务账户
• 使用 Python 3.8+ 进行自定义扫描自动化

核心概念

无代理扫描与基于 Agent 的扫描

方面	无代理	基于 Agent
部署	无需安装软件	每个终端都要安装 Agent
网络依赖	需要网络连接	可离线运行，并与云端同步
对性能的影响	对目标系统影响极小	持续产生轻微开销
覆盖深度	取决于协议/凭据	可深入访问本地系统
云快照分析	原生支持	不适用
适用对象	云 VM、IoT、旧式系统、OT	托管终端、笔记本电脑

无代理扫描方法

方法	协议	目标操作系统	端口	用例
SSH 远程命令	SSH	Linux/Unix	22	软件包枚举、配置审计
WMI 远程查询	WMI/DCOM	Windows	135, 445	热修复枚举、注册表检查
WinRM PowerShell	WS-Man	Windows	5985/5986	远程命令执行
SNMP Community	SNMP v2c/v3	网络设备	161	设备指纹识别、固件检查
云快照	服务提供商 API	云 VM	N/A	磁盘映像分析
容器注册表	HTTPS	容器映像	443	映像漏洞扫描
基于 API	REST/HTTPS	SaaS/云	443	配置评估

云快照分析流程

1. Scanner requests disk snapshot via cloud API
2. Cloud provider creates snapshot of VM root + data disks
3. Scanner mounts snapshot in isolated analysis environment
4. Scanner examines OS packages, configurations, file system
5. Snapshot is deleted after analysis (no persistent copies)
6. Results sent to central management console

工作流

第 1 步：基于 SSH 的无代理扫描（Linux）

# Create dedicated scan SSH key pair
ssh-keygen -t ed25519 -f /opt/scanner/.ssh/scan_key -N "" \
  -C "[email protected]"

# Deploy public key to targets via Ansible
# ansible-playbook deploy_scan_key.yml

# Test connectivity to target
ssh -i /opt/scanner/.ssh/scan_key -o ConnectTimeout=10 \
  scanner@target-host "cat /etc/os-release && dpkg -l 2>/dev/null || rpm -qa"

import paramiko
import json

class AgentlessLinuxScanner:
    """SSH-based agentless vulnerability scanner for Linux systems."""

    def __init__(self, key_path):
        self.key_path = key_path

    def connect(self, hostname, username="scanner", port=22):
        """Establish SSH connection to target."""
        client = paramiko.SSHClient()
        client.set_missing_host_key_policy(paramiko.AutoAddPolicy())
        key = paramiko.Ed25519Key.from_private_key_file(self.key_path)
        client.connect(hostname, port=port, username=username, pkey=key,
                       timeout=30, banner_timeout=30)
        return client

    def get_os_info(self, client):
        """Detect OS type and version."""
        _, stdout, _ = client.exec_command("cat /etc/os-release", timeout=10)
        os_release = stdout.read().decode()
        info = {}
        for line in os_release.strip().split("\n"):
            if "=" in line:
                key, val = line.split("=", 1)
                info[key] = val.strip('"')
        return info

    def get_installed_packages(self, client):
        """Enumerate installed packages."""
        # Try dpkg (Debian/Ubuntu)
        _, stdout, _ = client.exec_command(
            "dpkg-query -W -f='${Package}|${Version}|${Architecture}\\n'",
            timeout=30
        )
        output = stdout.read().decode().strip()
        if output:
            packages = []
            for line in output.split("\n"):
                parts = line.split("|")
                if len(parts) >= 2:
                    packages.append({
                        "name": parts[0],
                        "version": parts[1],
                        "arch": parts[2] if len(parts) > 2 else "",
                        "manager": "dpkg"
                    })
            return packages

        # Try rpm (RHEL/CentOS/Fedora)
        _, stdout, _ = client.exec_command(
            "rpm -qa --queryformat '%{NAME}|%{VERSION}-%{RELEASE}|%{ARCH}\\n'",
            timeout=30
        )
        output = stdout.read().decode().strip()
        packages = []
        for line in output.split("\n"):
            parts = line.split("|")
            if len(parts) >= 2:
                packages.append({
                    "name": parts[0],
                    "version": parts[1],
                    "arch": parts[2] if len(parts) > 2 else "",
                    "manager": "rpm"
                })
        return packages

    def check_kernel_version(self, client):
        """Get running kernel version."""
        _, stdout, _ = client.exec_command("uname -r", timeout=10)
        return stdout.read().decode().strip()

    def check_listening_ports(self, client):
        """Enumerate listening network services."""
        _, stdout, _ = client.exec_command(
            "ss -tlnp 2>/dev/null || netstat -tlnp 2>/dev/null",
            timeout=10
        )
        return stdout.read().decode().strip()

    def scan_host(self, hostname, username="scanner"):
        """Perform full agentless scan of a host."""
        print(f"[*] Scanning {hostname}...")
        client = self.connect(hostname, username)

        result = {
            "hostname": hostname,
            "os_info": self.get_os_info(client),
            "kernel": self.check_kernel_version(client),
            "packages": self.get_installed_packages(client),
            "listening_ports": self.check_listening_ports(client),
        }

        client.close()
        print(f"  [+] Found {len(result['packages'])} packages on {hostname}")
        return result

第 2 步：基于 WinRM 的无代理扫描（Windows）

import winrm

class AgentlessWindowsScanner:
    """WinRM-based agentless vulnerability scanner for Windows."""

    def __init__(self, username, password, domain=None):
        self.username = username
        self.password = password
        self.domain = domain

    def connect(self, hostname, use_ssl=True):
        """Create WinRM session."""
        port = 5986 if use_ssl else 5985
        transport = "ntlm"
        user = f"{self.domain}\\{self.username}" if self.domain else self.username
        session = winrm.Session(
            f"{'https' if use_ssl else 'http'}://{hostname}:{port}/wsman",
            auth=(user, self.password),
            transport=transport,
            server_cert_validation="ignore"
        )
        return session

    def get_installed_hotfixes(self, session):
        """Get installed Windows updates/hotfixes."""
        cmd = "Get-HotFix | Select-Object HotFixID,InstalledOn,Description | ConvertTo-Json"
        result = session.run_ps(cmd)
        if result.status_code == 0:
            return json.loads(result.std_out.decode())
        return []

    def get_installed_software(self, session):
        """Enumerate installed software from registry."""
        cmd = """
        $paths = @(
            'HKLM:\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\*',
            'HKLM:\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\*'
        )
        Get-ItemProperty $paths -ErrorAction SilentlyContinue |
            Where-Object {$_.DisplayName} |
            Select-Object DisplayName, DisplayVersion, Publisher |
            ConvertTo-Json
        """
        result = session.run_ps(cmd)
        if result.status_code == 0:
            return json.loads(result.std_out.decode())
        return []

    def get_os_info(self, session):
        """Get Windows OS details."""
        cmd = "Get-CimInstance Win32_OperatingSystem | Select-Object Caption,Version,BuildNumber,OSArchitecture | ConvertTo-Json"
        result = session.run_ps(cmd)
        if result.status_code == 0:
            return json.loads(result.std_out.decode())
        return {}

    def scan_host(self, hostname):
        """Perform full agentless scan of Windows host."""
        print(f"[*] Scanning {hostname} via WinRM...")
        session = self.connect(hostname)

        result = {
            "hostname": hostname,
            "os_info": self.get_os_info(session),
            "hotfixes": self.get_installed_hotfixes(session),
            "software": self.get_installed_software(session),
        }

        print(f"  [+] Found {len(result['hotfixes'])} hotfixes, "
              f"{len(result['software'])} software entries")
        return result

第 3 步：云快照扫描（AWS）

import boto3
import time

class AWSSnapshotScanner:
    """AWS EC2 agentless snapshot-based vulnerability scanner."""

    def __init__(self, region="us-east-1"):
        self.ec2 = boto3.client("ec2", region_name=region)

    def create_snapshot(self, volume_id, description="Security scan snapshot"):
        """Create EBS snapshot for analysis."""
        snapshot = self.ec2.create_snapshot(
            VolumeId=volume_id,
            Description=description,
            TagSpecifications=[{
                "ResourceType": "snapshot",
                "Tags": [
                    {"Key": "Purpose", "Value": "VulnScan"},
                    {"Key": "AutoDelete", "Value": "true"},
                ]
            }]
        )
        snapshot_id = snapshot["SnapshotId"]
        print(f"  [*] Creating snapshot {snapshot_id} from {volume_id}...")

        waiter = self.ec2.get_waiter("snapshot_completed")
        waiter.wait(SnapshotIds=[snapshot_id])
        print(f"  [+] Snapshot {snapshot_id} ready")
        return snapshot_id

    def delete_snapshot(self, snapshot_id):
        """Clean up snapshot after analysis."""
        self.ec2.delete_snapshot(SnapshotId=snapshot_id)
        print(f"  [+] Deleted snapshot {snapshot_id}")

    def scan_instance(self, instance_id):
        """Scan an EC2 instance via snapshot analysis."""
        print(f"[*] Agentless scan of instance {instance_id}")

        instance = self.ec2.describe_instances(
            InstanceIds=[instance_id]
        )["Reservations"][0]["Instances"][0]

        root_volume = None
        for bdm in instance.get("BlockDeviceMappings", []):
            if bdm["DeviceName"] == instance.get("RootDeviceName"):
                root_volume = bdm["Ebs"]["VolumeId"]
                break

        if not root_volume:
            print("  [!] No root volume found")
            return None

        snapshot_id = self.create_snapshot(root_volume)
        try:
            # Analysis would be performed here
            # Mount snapshot, examine packages, check configs
            result = {
                "instance_id": instance_id,
                "snapshot_id": snapshot_id,
                "root_volume": root_volume,
                "platform": instance.get("Platform", "linux"),
                "state": instance["State"]["Name"],
            }
            return result
        finally:
            self.delete_snapshot(snapshot_id)

第 4 步：Vuls 开源无代理扫描器

# /etc/vuls/config.toml - Vuls configuration for agentless scanning

[servers]

[servers.web-server-01]
host = "192.168.1.10"
port = "22"
user = "vuls"
keyPath = "/opt/vuls/.ssh/scan_key"
scanMode = ["fast"]

[servers.db-server-01]
host = "192.168.1.20"
port = "22"
user = "vuls"
keyPath = "/opt/vuls/.ssh/scan_key"
scanMode = ["fast-root"]
[servers.db-server-01.optional]
  [servers.db-server-01.optional.sudo]
    password = ""

[servers.container-host-01]
host = "192.168.1.30"
port = "22"
user = "vuls"
keyPath = "/opt/vuls/.ssh/scan_key"
scanMode = ["fast"]
containersIncluded = ["${running}"]

# Run Vuls agentless scan
vuls scan

# Generate report
vuls report -format-json -to-localfile

# View results
vuls tui

最佳实践

1. Linux 扫描使用基于 SSH 密钥的身份验证，而非密码
2. 为扫描创建专用服务账户，并仅授予最低限度的只读权限
3. 分析完成后务必清理云快照，以避免存储费用和数据泄露
4. 将无代理扫描与基于 Agent 的扫描结合使用，以实现全面覆盖
5. 在活动较少的时段安排扫描，将性能影响降至最低
6. 定期轮换扫描凭据，并将其存储在密钥库中
7. 安排生产扫描前，先测试扫描器的连接情况
8. 扫描网络设备时使用经过身份验证和加密的 SNMPv3

常见陷阱

• 在多个环境中使用共享凭据，但未进行适当隔离
• 未清理云环境中的临时快照
• 误以为无代理扫描不会造成任何性能影响（会占用网络和 CPU 资源）
• 缺少 WinRM/SSH 防火墙规则，导致新部署的扫描失败
• 未考虑 SSH 主机密钥变更会导致身份验证失败
• 使用 OT/ICS 设备无法安全处理的协议扫描这些设备

相关技能

• implementing-rapid7-insightvm-for-scanning
• implementing-wazuh-for-vulnerability-detection
• deploying-osquery-for-endpoint-monitoring
• performing-remediation-validation-scanning