NMAP TUTORIAL ++ BAB II

Other Scanning Techniques

In my opinion nmap is the most superior network scanner. But there are some newer technologies being developed that are worth mentioning.

Xprobe2 ICMP based fingerprinting

Xprobe is a ICMP based passive fingerprinting tool, this is a newer technique being used very successfully instead of the old TCP based fingerprinting. Xprobe uses a different ICMP response to determine what Operating system the host is running, very similar to TCP based fingerprinting it compares it's results to a database. Another advantage of ICMP based fingerprinting is it's very fast, in most cases all it needs is one packet, unlike nmaps TCP fingerprinting thats needs to build custom packets and is quite time consuming, ICMP does not need to craft any specific packets. Each operating system has small differences in implementations of there TCP stack and Xprobe has a database of those differences.

[root@REDHATBOX xprobe2-0.1]# xprobe2 -v 192.168.0.3

XProbe2 v.0.1 Copyright (c) 2002-2003 fygrave@tigerteam.net, ofir@sys-security.com

[+] Target is 192.168.0.3
[+] Loading modules.
[+] Following modules are loaded:
[x]ICMP echo (ping)
[x]TTL distance
[x]ICMP echo
[x]ICMP Timestamp
[x]ICMP Address
[x]ICMP Info Request
[x]ICMP port unreach
[+] 7 modules registered
[+] Initializing scan engine
[+] Running scan engine
[+] Host: 192.168.0.3 is up (Guess probability: 100%)
[+] Target: 192.168.0.3 is alive
[+] Primary guess:
[+] Host 192.168.0.3 Running OS: "Linux Kernel 2.4.5 and above" (Guess probability: 95%)
[+] Other guesses:
[+] Host 192.168.0.3 Running OS: "Linux Kernel 2.2.x" (Guess probability: 95%)
[+] Host 192.168.0.3 Running OS: "NetBSD 1.6" (Guess probability: 87%)
[+] Host 192.168.0.3 Running OS: "Linux Kernel 2.4.0 - 2.4.4" (Guess probability: 83%)
[+] Host 192.168.0.3 Running OS: "SCO OpenServer Release 5" (Guess probability: 83%)
[+] Host 192.168.0.3 Running OS: "OpenBSD 2.5" (Guess probability: 83%)
[+] Host 192.168.0.3 Running OS: "NetBSD 1.5.0" (Guess probability: 83%)
[+] Host 192.168.0.3 Running OS: "NetBSD 1.5.1" (Guess probability: 83%)
[+] Host 192.168.0.3 Running OS: "NetBSD 1.5.2" (Guess probability: 83%)
[+] Host 192.168.0.3 Running OS: "FreeBSD 4.5" (Guess probability: 79%)
[+] Host 192.168.0.3 Running OS: "FreeBSD 4.4" (Guess probability: 79%)
-------------------------------------SNIP---------------------------------------------------------

Xprobe has successfully identified the operating system as linux running kernel 2.45. Thats correct. This test took about 30-60seconds so its allot faster than Nmaps -O TCP fingerprinting. The next test was how it would go against a windows XP pro box.


[root@REDHATBOX xprobe2-0.1]# xprobe2 192.168.0.1

XProbe2 v.0.1 Copyright (c) 2002-2003 fygrave@tigerteam.net, ofir@sys-security.com

[+] Target is 192.168.0.1
[+] Loading modules.
[+] Following modules are loaded:
[x]ICMP echo (ping)
[x]TTL distance
[x]ICMP echo
[x]ICMP Timestamp
[x]ICMP Address
[x]ICMP Info Request
[x]ICMP port unreach
[+] 7 modules registered
[+] Initializing scan engine
[+] Running scan engine
[+] Host: 192.168.0.1 is up (Guess probability: 50%)
[+] Target: 192.168.0.1 is alive
[+] Primary guess:
[+] Host 192.168.0.1 Running OS: "Microsoft Windows 2000/2000SP1/2000SP2/2000SP3" (Guess probability: 58%)
[+] Other guesses:
[+] Host 192.168.0.1 Running OS: "Microsoft Windows XP Professional / XP Professional SP1" (Guess probability: 58%)
--------------------------------------SNIP-----------------------------------------------------

Unfortunately Xprobe failed to distinguish between xp and 2000. Nmap successfully guessed this was a xp pro box but Xprobe is giving us 6 possible versions. This is not accurate enough, if we where going to try the dcom exploit we would need to determine the exact operating system and service pack. So i suggest nmaps fingerprinting is still the most efficient, but as Xprobe grows and it's database gets updated it will be worth considering using is as a replacement, another good thing about Xprobe does not show up in snort logs and is allot faster than nmap.

Banner Grabbing

Before you can attempt any type of attack on a system you need to know what operating system is running and what services are running, we can determine them with nmap and if needed Xprobe. But you also need to know what version each service is to successfully exploit it. This is where banner grabbing comes into picture, if we can determine everything the target machine is running down to each version we greatly increase our chance of successful exploitation or finding a weakness in the system.

The First program we are going to look at for banner grabbing is Amap.

Just issue the command amap at the command prompt and you will get the following.

[root@REDHATBOX amap-4.0]# amap
amap v4.0 (c) 2003 by van Hauser and DJ RevMoon www.thc.org
Syntax: amap [-A|-B|-P] [-1buSRHUdqv] [[-m] -o ] [-D ] [-t/-T sec] [-c cons] [-C retries] [-p proto] [-i ] [target port [port] ...]
Modes:
-A Map applications: send triggers and analyse responses (default)
-B Just grab banners, do not send triggers
-P No banner or application stuff - be a (full connect) port scanner!
Options:
-1 Only send triggers to a port until 1st identification. Speeeeed!
-b Print ascii banner of responses
-i FILE Nmap machine readable outputfile to read ports from
-u Ports specified on commandline are UDP (default is TCP)
-S Do NOT look behind an SSL port
-R Do NOT identify RPC service
-H Do NOT send application triggers marked as potentially harmful
-U Do NOT dump unrecognised responses (better for scripting)
-d Dump all responses
-v Verbose mode, use twice (or more!) for debug (not recommended :-)
-q Do not report closed ports, and do not print them as unidentified
-o FILE Write output to file FILE
-m Make output to file (-o) machine-readable (colon-separated list)
-c CONS Amount of parallel connections to make (default 32, max 256)
-C RETRIES Number of reconnects on connect timeouts (see -T) (default 3)
-T SEC Connect timeout on connection attempts in seconds (default 5)
-t SEC Response wait timeout in seconds (default 5)
-p PROTO Only send triggers for this protocol (e.g. ftp)
-D FILE Read from Definitions FILE[.trig|.resp|.rpc] instead of default
-h Print this shit
TARGET PORT The target address and port(s) to scan (additional to -i)
amap is a tool to identify application protocols on target ports.


As you can see amap is used to identify services or daemons and also has a banner grabbing function. Amap and Nmap go hand in hand and i find them very useful when used in conjunction with each other.

[root@REDHATBOX amap-4.0]# nmap -oG amap.nmap -sT 192.168.0.4; amap -i amap.nmap.gnmap

Starting nmap 3.30 ( http://www.insecure.org/nmap/ ) at 2003-08-01 01:15 EST
Interesting ports on 192.168.0.4:
(The 1637 ports scanned but not shown below are in state: closed)
Port State Service
21/tcp open ftp
22/tcp open ssh
23/tcp open telnet
111/tcp open sunrpc
139/tcp open netbios-ssn
1024/tcp open kdm
6000/tcp open X11

Nmap run completed -- 1 IP address (1 host up) scanned in 4.728 seconds
amap v4.0 (www.thc.org) started at 2003-08-01 01:16:04 - APPLICATION MAP mode

Protocol on 192.168.0.4:22/tcp matches ssh
Protocol on 192.168.0.4:22/tcp matches ssh-openssh
Protocol on 192.168.0.4:139/tcp matches netbios-session
Protocol on 192.168.0.4:21/tcp matches ftp
Protocol on 192.168.0.4:111/tcp matches rpc
Protocol on 192.168.0.4:6000/tcp matches x-windows
Protocol on 192.168.0.4:23/tcp matches telnet
Protocol on 192.168.0.4:1024/tcp matches rpc
Protocol on 192.168.0.4:111/tcp matches rpc-rpcbind-v2
Protocol on 192.168.0.4:1024/tcp matches rpc-status-v1

Unidentified ports: none.

amap v4.0 finnished at 2003-08-01 01:16:24

In the above command i used amaps abbility to greap nmaps -oG log format, so nmap scanned the target machine and identifed each open port, amap then gave us a protocol listing of what each service uses and what is actually running behind each port. But we can take this a step further and read some of the banners the above services display.

[root@REDHATBOX amap-4.0]# nmap -oG amap.nmap -sT 192.168.0.4; amap -B -i amap.nmap.gnmap

Starting nmap 3.30 ( http://www.insecure.org/nmap/ ) at 2003-08-01 01:43 EST
Interesting ports on 192.168.0.4:
(The 1637 ports scanned but not shown below are in state: closed)
Port State Service
21/tcp open ftp
22/tcp open ssh
23/tcp open telnet
111/tcp open sunrpc
139/tcp open netbios-ssn
1024/tcp open kdm
6000/tcp open X11

Nmap run completed -- 1 IP address (1 host up) scanned in 6.358 seconds
amap v4.0 (www.thc.org) started at 2003-08-01 01:43:30 - BANNER GRAB mode

Banner on 192.168.0.4:21/tcp : 220 ready, dude (vsFTPd 1.1.0 beat me, break me)\r\n
Banner on 192.168.0.4:22/tcp : SSH-1.99-OpenSSH_3.4p1\n

amap v4.0 finnished at 2003-08-01 01:43:42

We only got 2 banners, and we need more banners to get a better understanding about the target machine and if it is possible to break.Amap is usfull but you can use other techniques. Another thing to note is if you know youre banners you can determine what services come default with each operating system, vsFTP 1.1.0 bundles with redhat linux 8.0.

For example if there is port 80 and 443 open this usually indicates there is a web server running. I use telnet but you can use netcat also to get the webservers version.