Bypass Security Measures
SYN-Scan
eldeim@htb[/htb]$ sudo nmap 10.129.2.28 -p 21,22,25 -sS -Pn -n --disable-arp-ping --packet-trace
Starting Nmap 7.80 ( https://nmap.org ) at 2020-06-21 14:56 CEST
SENT (0.0278s) TCP 10.10.14.2:57347 > 10.129.2.28:22 S ttl=53 id=22412 iplen=44 seq=4092255222 win=1024 <mss 1460>
SENT (0.0278s) TCP 10.10.14.2:57347 > 10.129.2.28:25 S ttl=50 id=62291 iplen=44 seq=4092255222 win=1024 <mss 1460>
SENT (0.0278s) TCP 10.10.14.2:57347 > 10.129.2.28:21 S ttl=58 id=38696 iplen=44 seq=4092255222 win=1024 <mss 1460>
RCVD (0.0329s) ICMP [10.129.2.28 > 10.10.14.2 Port 21 unreachable (type=3/code=3) ] IP [ttl=64 id=40884 iplen=72 ]
RCVD (0.0341s) TCP 10.129.2.28:22 > 10.10.14.2:57347 SA ttl=64 id=0 iplen=44 seq=1153454414 win=64240 <mss 1460>
RCVD (1.0386s) TCP 10.129.2.28:22 > 10.10.14.2:57347 SA ttl=64 id=0 iplen=44 seq=1153454414 win=64240 <mss 1460>
SENT (1.1366s) TCP 10.10.14.2:57348 > 10.129.2.28:25 S ttl=44 id=6796 iplen=44 seq=4092320759 win=1024 <mss 1460>
Nmap scan report for 10.129.2.28
Host is up (0.0053s latency).
PORT STATE SERVICE
21/tcp filtered ftp
22/tcp open ssh
25/tcp filtered smtp
MAC Address: DE:AD:00:00:BE:EF (Intel Corporate)
Nmap done: 1 IP address (1 host up) scanned in 0.07 secondsACK-Scan
Scanning Options
Description
10.129.2.28
Scans the specified target.
-p 21,22,25
Scans only the specified ports.
-sS
Performs SYN scan on specified ports.
-sA
Performs ACK scan on specified ports.
-Pn
Disables ICMP Echo requests.
-n
Disables DNS resolution.
--disable-arp-ping
Disables ARP ping.
--packet-trace
Shows all packets sent and received.
Please pay attention to the RCVD packets and its set flag we receive from our target. With the SYN scan (-sS) our target tries to establish the TCP connection by sending a packet back with the SYN-ACK (SA) flags set and with the ACK scan (-sA) we get the RST flag because TCP port 22 is open. For the TCP port 25, we do not receive any packets back, which indicates that the packets will be dropped.
Scan by Using Decoys
Scanning Options
Description
10.129.2.28
Scans the specified target.
-p 80
Scans only the specified ports.
-sS
Performs SYN scan on specified ports.
-Pn
Disables ICMP Echo requests.
-n
Disables DNS resolution.
--disable-arp-ping
Disables ARP ping.
--packet-trace
Shows all packets sent and received.
-D RND:5
Generates five random IP addresses that indicates the source IP the connection comes from.
The spoofed packets are often filtered out by ISPs and routers, even though they come from the same network range. Therefore, we can also specify our VPS servers' IP addresses and use them in combination with "IP ID" manipulation in the IP headers to scan the target.
Another scenario would be that only individual subnets would not have access to the server's specific services. So we can also manually specify the source IP address (-S) to test if we get better results with this one. Decoys can be used for SYN, ACK, ICMP scans, and OS detection scans. So let us look at such an example and determine which operating system it is most likely to be.
Testing Firewall Rule
Scan by Using Different Source IP
Scanning Options
Description
10.129.2.28
Scans the specified target.
-n
Disables DNS resolution.
-Pn
Disables ICMP Echo requests.
-p 445
Scans only the specified ports.
-O
Performs operation system detection scan.
-S
Scans the target by using different source IP address.
10.129.2.200
Specifies the source IP address.
-e tun0
Sends all requests through the specified interface.
DNS Proxying
By default, Nmap performs a reverse DNS resolution unless otherwise specified to find more important information about our target. These DNS queries are also passed in most cases because the given web server is supposed to be found and visited. The DNS queries are made over the UDP port 53. The TCP port 53 was previously only used for the so-called "Zone transfers" between the DNS servers or data transfer larger than 512 bytes. More and more, this is changing due to IPv6 and DNSSEC expansions. These changes cause many DNS requests to be made via TCP port 53.
However, Nmap still gives us a way to specify DNS servers ourselves (--dns-server <ns>,<ns>). This method could be fundamental to us if we are in a demilitarized zone (DMZ). The company's DNS servers are usually more trusted than those from the Internet. So, for example, we could use them to interact with the hosts of the internal network. As another example, we can use TCP port 53 as a source port (--source-port) for our scans. If the administrator uses the firewall to control this port and does not filter IDS/IPS properly, our TCP packets will be trusted and passed through.
SYN-Scan of a Filtered Port
SYN-Scan From DNS Port
Scanning Options
Description
10.129.2.28
Scans the specified target.
-p 50000
Scans only the specified ports.
-sS
Performs SYN scan on specified ports.
-Pn
Disables ICMP Echo requests.
-n
Disables DNS resolution.
--disable-arp-ping
Disables ARP ping.
--packet-trace
Shows all packets sent and received.
--source-port 53
Performs the scans from specified source port.
Now that we have found out that the firewall accepts TCP port 53, it is very likely that IDS/IPS filters might also be configured much weaker than others. We can test this by trying to connect to this port by using Netcat.
Connect To The Filtered Port
Firewall and IDS/IPS Evasion - Easy Lab
Our client wants to know if we can identify which operating system their provided machine is running on. Submit the OS name as the answer.
Firewall and IDS/IPS Evasion - Medium Lab
Note: To successfully solve the exercise, we must use the UDP protocol on the VPN.
After the configurations are transferred to the system, our client wants to know if it is possible to find out our target's DNS server version. Submit the DNS server version of the target as the answer.
Firewall and IDS/IPS Evasion - Hard Lab
Now our client wants to know if it is possible to find out the version of the running services. Identify the version of service our client was talking about and submit the flag as the answer.
Last updated