2007
A HACKING ODYSSEY PART 2: NETWORK SCANNING & NMAP
If you have followed part one you will have most of the information
needed to allow you to progress on to the second phase of your
attack/Pen test.
You can find part one here:
http://tazforum.thetazzone.com/viewtopic.php?t=5445
The second phase can be generically summed up as ‘Scanning’. To even
start this phase we need of an absolute minimum one thing; an IP
address. If you have not been able to glean and IP address during your
reconnaissance phase, then you will need to go back and persevere with
it, because until you get one you will not be able to do anything
else….you can’t scan something if you don’t know where it is.
Scanning typically involves all or some of the following:
Covered in this paper:
War Driving
War Dialling
Network Mapping
Port Scanning
Covered in Part 3:
Vulnerability Scanning
IPS and IDS detection and evasion
Firewall ‘auditing’
PBX scanning
Scanning a network is a very unique activity as all networks are
different; they are configured in different ways, secured in different
ways, use different hardware, have different services running, respond
differently to various scans and use different software/OS’s – to name
but a few of the variations. For this reason it is impossible to write
a step by step paper along the line of ‘enter this command and you will
get this output, now enter this command and you have exploited the
service’. It just won’t work this way.
What I will do however is explain the theory of how it all works and
explain how to use the most common tools for doing this; the most
common of these common tools being Nmap, hence a large part of this
paper will be devoted to it.
I will briefly cover War Dialling and War Driving first though, as they
are not terribly hard to understand.
**Before I go on I need to point out that the scanning phase is the
complete opposite to the reconnaissance phase in terms of exposing
yourself to the target network. Reconnaissance when done properly is
nearly completely passive and is entirely legal. Scanning on the other
hand is not passive in any way shape or form and is for the most part
illegal. You WILL leave log entries on the remote system when scanning
it. Whether these look suspicious to an administrator or are suspicious
enough to set off an IDS alarm is entirely up to you and the methods
you chose to adopt**
War Dialling
Pretty much everyone has heard of War Dialling in today’s cyber world.
It was probably made famous by the film War Games – where a young
teenager connects to a government network via a Modem.
This film was released in the early 80’s and the technique used in it
is still valid today…
Before VPN’s and Remote Access software were readily available the only
feasible way for an employee to connect to the corporate LAN or indeed
for an administrator to connect to a remote system was via a Modem;
which they would ‘Dial in’ to.
Even though there are a lot more secure methods for remote access in
today’s world, it does not mean that remote access via a modem does not
still exist anywhere. A lot of people use the ‘if it is not broke, then
don’t fix it’ philosophy. Couple this with the price of a modem
(£5) and you have a very quick and extremely cheap remote access
solution, albeit not a very efficient one but a working one all the
same.
Think of your own dial up connection (everyone over the age of 10 must
have been unlucky enough to of had a dial up connection at some point).
You dial out onto the internet, usually to your ISP, enter a user name
and password and viola you are connected to the Internet.
Obviously data flows both ways through this connection. If used in the
conventional sense the data coming back is return traffic to one of
your legitimate requests, i.e. a web page you have requested to see.
However what if the return traffic is not legitimate…….how does your
modem know this……well, it doesn’t.
To use a dialup connection you must have a phone line, right? If you
have a phone line then you will have a phone number. If someone dials
this phone number and the line is connected to your modem…..what will
they dial in to? Yep you guessed it; your modem and in effect your
computer.
A very popular procedure amongst employees was to install some remote
control software such as VNC and set it to listen on the COM port that
the modem was using.
Then when they go home, they can dial in to the line attached to their
computer and be greeted with the VNC login prompt.
In modern times (modern from an IT point of view) there is a plethora
of remote control software available to any user for free or for very
cheap. And all they need is a phone line installed by their desk.
Chances are they will already have a phone next to their desk….so when
they leave at night they connect this up to their modem, go home and
dial their own number, connect to the free edition of VNC they have
installed and start working from home. As far as they are concerned
they are doing the company a favour as they can get more work done and
it hasn’t cost the company a penny……what do they care about network
security, that’s the job for they guy who keeps saying no to them
whenever they ask for something……..sod him, right?
Unfortunately it is not just clueless end users who do this; Routers,
switches and firewalls used to be remotely managed via a dialup link
into them, with basic authentication. How often does a network
infrastructure get upgraded? Not very often……..
Sadly in my experience of pen testing, 60% of the unsecured modems I
find are attached to routers and not to end user work stations. System
Admins come and go and they have a lot more to think about than one
poxy phone line coming into an old router…….
The most common application used for War Dialling is probably THC-Scan
(The Hackers Choice - http://www.thc.org/thc-scan/). It runs on pretty
much anything that has a kernel and an emulator (yes even a MAC) and is
extremely easy to use.
Obviously the final thing we need is a range of phone numbers right? If
you have read part one you may have noticed the first two things we
ever learnt about the target……its phone numbers and office hours. Why
are the office hours important? Well we don’t want to try and take over
a PC whilst the user is sitting in front of it do we….also if they do
plug their phone line into the computer it is going to be so they can
work from home….which won’t be in office hours will it?
I won’t cover instructions on how to use it as I don’t want to spend
too much time on War Dialling, but there is a very good video tutorial
showing how to use it on the above mentioned site and very extensive
documentation is included with the download.
So you dial away and look at the log detailing what it found. If you
use the Nudge feature of THC you may very well see some banners that
can be very informative to use – such as ‘Hi, I’m a PC, or Hi, I am a
MAC’. You will need to learn to recognise the return strings from the
various modems it finds to be able to know what is listening behind the
modem, i.e. VNC, PC Anywhere etc.
Some commercial War Diallers have a database that will tell you this
automatically; if you don’t mind paying for them then this is a good
choice to go for. PhoneSweep is probably the best commercial one
available (http://www.sandstorm.net/products/phonesweep/) you can see a
screen shot to better explain what I mean about identifying the system
type – THC will just show you the raw output and it will be up to you
to trawl through the logs and work out what system is what.
That’s pretty much it for War Dialling, find a modem, dial into it, see
what remote control software is listening on the COM port, try and
connect to it. The most common software listening will probably be VNC
as it is free…..there is also a well publicized exploit for
circumventing VNC authorisation……
War Driving
War Driving derives its name from War Dialling. If War Dialling is
phoning every number in a range to find a modem, then War Driving is
driving round an area looking for every Wireless Access Points.(WAP).
There are subsets of War Driving such as War Walking, War Mountain
Biking, War Flying, War sitting on the bench outside the building with
my laptop hoping I don’t look suspicious…generically they can all be
safely called War Driving.
The chances of finding a WAP in today’s world are much greater that the
chances of finding a modem. In the past most security/hacking type
books typically confined Wireless LAN (WLAN) hacking to a few pages at
the back of the book, however now-a-days it is becoming more and more
popular and more and more rewarding in terms of illegally accessing a
network. Due to this the newer security and hacking books tend to
devote a lot more page space to WLAN hacking.
When conducting a Pen Test, after the reconnaissance phase I usually
set up a laptop and leave someone with it to carry out the War Dialling
, whilst that is running I will drive around the targets building and
War Drive it. By the time I get back we are able to go through the
results of both assessments. If we find any ‘miss configurations’ it
usually gives us a general impression as to the state of the network
and its security.
WLAN’s obviously use radio transmissions to transmit data from one node
to another. Our aim as WLAN hackers is to put ourselves within range of
these transmissions so we can also receive them and look at the
contents being sent.
Before we do this we obviously need to find the Wireless networks.
WLAN’s all have a network name, which is what distinguishes them from
each other and helps employees know which one they are meant to connect
to. This network name is known as the Extended Service Set Identifier
or ESSID. If you open your wireless network properties and search for
networks, you will end up with a list of networks that your wireless
adaptor is within range of. Each of these will have a name, what you
are looking at is the ESSID of each WLAN.
ESSID’s are transmitted in clear to every wireless client that may be
listening; this forms part of the ‘beacon’ that is transmitted
periodically by the AP and is included on most packets leaving the WAP.
Likewise when a client is associated with an AP, this also transmits
the ESSID in clear.
It is possible for a wireless client that is not associated with an AP
to send a ‘probe request’ to the AP asking for various bits of
information. Normally the ESSID is included with these requests and any
AP that does not have the same ESSID will drop the packet.
The rules of the various 802.11 protocols say that it must acknowledge
a probe request that is using the ESSID configured on the AP OR that
has the ESSID parameter set to ‘Any’.
If you re-read the above statement you will see a fairly large whole in
the 802.11 implementations that we can exploit: “OR that has the ESSID
parameter set to ‘Any’.”….
SO, if we send probe requests and set the ESSID bit to ‘any’…then all
WAP’s within range must respond to the requests….. and when the WAP’s
send traffic what is included in the packet, yep the ESSID.
Netstumbler (http://www.netstumbler.com/) which is arguably the most
popular War Driving tool around uses this ‘flaw’ in the 802.11
protocols. It sends out 100’s of probe requests with the ESSID bit set
to any and waits for return traffic. When this traffic comes it
extracts the ESSID, sending MAC address, wireless channel and
approximate signal strength of the WAP or the wireless client. If your
wireless adaptor is set to receive a DHCP IP address (one that is
automatically assigned to you) then Netstumbler will also record the IP
range in use on that WLAN.
Wireless Access Points can be configured to ignore probe requests with
the ESSID bit set to ‘any’, but as we will see later on this does not
really increase the WLAN security. They will however defeat Netstumbler
static of using the ‘any’ ESSID and will remain hidden to it.
Personally I don’t like Netstumbler due to it being very very
noisy…..100’s of probe requests with the ESSID set to ‘any’ will set
wireless IDS alarms of in an instant. Couple this with the fact it
won’t pick up WLAN’s with the ESSID set to ‘any’ and you are found
wanting when conducting an ‘Active Scan’. You set all the IDS’s off and
may still not find all the WLAN’s.
It must be mentioned that Netstumbler comes into its element when using
it with a GPS and a decent antenna though.
So how do we find the WLAN’s that are ignoring probe requests with the
‘any’ ESSID bit set and at the same time avoid setting off IDS’s?
To accomplish this we need to put of card into Monitor mode (sometimes
referred to as rfmon mode)
Most people confuse promiscuous mode with monitor mode. They are two
very different things.
Promiscuous mode will listen to all traffic that is sent on a WLAN that
it is currently associated with. If it is not associated with a certain
WLAN, then it will not accept traffic from it.
Monitor mode on the other hand listens to all WLAN traffic without
associating to any WLAN.
Obviously if we have not associated with a WLAN and are not sending any
packets to any, then no one will know we are there and no IDS alarms
will be raised.
Airodump
(http://www.wirelessdefence.org/Contents/Aircrack_airodump.htm) which
run on *nix platforms, Airodump-ng
(http://www.aircrack-ng.org/doku.php?id=airodump-ng) which runs on
Windows platforms and Wellenreitter (http://www.remote-exploit.org/)
which is now part of the BackTrack live CD are the most popular tools
for this and are all capable of capturing packets in monitor mode. For
the anoraks that use a MAC, Kismet will run on your *cough* MAC
(http://www.kismetwireless.net/index.shtml) as well as pretty much any
other OS too.
See here for a tutorial on using Airodump and indeed how to crack the
WEP encryption: http://www.tazforum.thetazzone.com/viewtopic.php?t=2069
There will be a counterpart explaining packet injection with Windows
and how to crack WPA-PSK at some point in the near future.
Which ever one you chose to use you will more than likely need extra
drivers to put your wireless adaptor into monitor mode. Once in monitor
mode you can chose to capture all packets as either an ‘.ivs’ file (for
WEP cracking) or a ‘.cap’ file for viewing with applications such as
Ethereal or Wireshark as it is now known.
The only occurrence left that we may find is if the WAP has been
configured to not reply to probe requests set to ‘any’ and it is not
broadcasting the ESSID with its beacons and is not a whole lot of
traffic going over it. As long as there are clients associated with it
(Airodump will tell us this, as will Wellenreitter) we can force a
client off the WLAN and make it have to re-associate again. Commonly
referred to as a Deauthentication Attack or Deauth for short, this
forces traffic to be sent over the WLAN and will reveal the ESSID to
us. It also forms the basis for WPA-PSK hacking.
A deauth attack utilizes yet another weakness with the 802.11
protocols, whereby a client will accept and obey a deauthentication
packet that is sent by the AP without any authentication at all. In a
nutshell what this means is that if we can send a deauthentication
packet to a wireless client and make the packet look like it came from
the AP, then the client will disassociate from that WLAN.
To take it one step further if we send the deauthentication packet to
the broadcast address of the LAN then all of the wireless clients will
disassociate from it.
When the clients re-associate to the LAN they have to broadcast an
association packet which contains the ESSID in plain text to announce
to the AP that they want to associate with it, otherwise no AP will
answer, as if you remember from earlier they will only answer to their
own ESSID, (or the ESSID of ‘any’ if configured to do so).
This is a slightly more noisy way of finding the ESSID, but nowhere
near as noisy as Netstumbler. You may set IDS alarms off with this too,
so use it with caution.
The trick in all of the above is finding the right WLAN for your target
as you could be up 10’s of WLAN in the area, so you need to know which
one is the right one.
Most companies will name their WLAN something relevant to them or even
name it the same as the company name. If this is the case then they
have just made your job a lot easier.
If the ESSID does not give you any info and you still have no idea
which one belongs to your target you could try using the signal
strength to make a best guess as to which WLAN is coming from your
targets building, maybe visit the reception of your target and ask for
directions to somewhere and then have a look at your WLAN sniffer’s
logs to see what network had the strongest signal for the time you were
in the building. If this is not providing you with any results you
could even try phoning the IT dept up and asking them…..most will tell
you the name there and then.
The final things to say are that if you are having trouble picking up
the signal, try again at night time or better yet at night time after
it has been raining. Wireless signals travel further at night and
further still when the ground is damp. If you still can’t get a signal
try using a better antenna.
Mapping the Network
If we are going to try and gain entry to the network, it is a good idea
to know the layout of it. Any half decent attacker will draw out his
findings so that he has a diagram with as much information as he can
find, which might be a lot or a very little.
It is rather hard to map out networks that use NAT/PAT as our traces
won’t get past the border router or firewall – we can’t trace to an
internal IP address over the internet. However, if we have managed to
find a way in via our War Driving and/or Dialling attempts then we
already have access to the internal address space so can trace away to
our hearts content. Either way a trace route works the same and the
inner workings of it are very simple.
An IP packet has a Time To Live field set in it, commonly referred to
as a TTL. Every layer 3 device such as a router or a layer 3 switch
will decrement this TTL field by one as it routes the packet.
(See here if you are unsure what layer 3 refers to)
Once the frame has passed through enough layer 3 devices to reduce the
TTL field to zero, the layer 3 device who reduced it to zero will drop
it altogether. Without the TTL theoretically an IP packet would travel
around a network for ever….
(According to the RFC the TTL is decremented by one for every second
that the router has it. Due to the routing speed of most routers they
typically have it for a lot less then a second, so it is safe to say
that it will be reduced by one for every router it passes though)
When this last router drops the packet it needs to send something back
to the original sender to say that the packet has timed out, as per RFC
rules. To do this it will send an ICMP Time Exceeded message (ICMP type
11 as defined in RFC792).
Here is where the trace part comes in:
We now that only a router will send the ICMP time exceeded message.
The source IP address of this times exceeded message will be the
routers IP address.
If we know what the original TTL setting was we can determine how many
hops away the router that sent the time exceeded message is.
(A hop is considered to be a routing device that the packer passes
through, so two hops means it has gone through two routers)
So we set the TTL to one – then send it to the first router, this will
decrement the TTL to zero and be forced to drop the packet and send the
ICMP message to us – when we receive this message we learn the IP
address of the first router.
Then we set the TTL to a value of two – the first router decrements the
TTL to one, but then as it is not zero it sends it on to the next
router in its path – this router receives it, decrements the TTL to
zero and is forced to send the ICMP type 11 message to us – thereby
giving us the IP address of the second router.
Then we set the TTL to three and the same process occurs until it gets
to the final router.
Setting all thses TTL fields manually can be quite a time consuming
task, so MS and *nix have an application that will do it for us. The
Microsoft version is called tracert and the *nix version is called
traceroute.
Simply open up a command prompt and type ‘tracert’ followed by the
destination IP address or Fully Qualified Domain Name (FQDN):
Code:
C:\Documents and Settings\Nokia>tracert google.com
Tracing route to google.com [72.14.207.99]
over a maximum of 30 hops:
1 95 ms 99
ms 99 ms speedtouch.lan [192.168.1.254]
2 241 ms 256 ms 257 ms
brnt-bam-2.inet.ntl.com [194.145.148.7]
3 239 ms 248 ms 251 ms
brnt-t3core-1a-ge-110-0.inet.ntl.com [213.105.19
9.85]
4 223 ms 227 ms 245 ms
bre-bb-a-so-130-0.inet.ntl.com [213.105.174.245]
5 240 ms 255 ms 247 ms
gfd-bb-b-so-120-0.inet.ntl.com [213.105.172.150]
6 * 217
ms 226 ms nth-bb-a-so-000-0.inet.ntl.com
[62.253.185.97]
7 256 ms 247 ms 245 ms
nth-bb-b-so-200-0.inet.ntl.com [213.105.172.194]
8 279 ms 265 ms 248 ms
tele-ic-1-as0-0.inet.ntl.com [62.253.184.2]
9 250 ms 278 ms 268 ms
212.250.14.66
10 245 ms 268 ms 277 ms
72.14.238.244
11 319 ms 316 ms 317 ms
216.239.46.112
12 359 ms 352 ms 356 ms
72.14.233.113
13 344 ms 349 ms 337 ms
66.249.94.96
14 343 ms 341 ms 337 ms
66.249.94.118
15 353 ms 349 ms 343 ms
eh-in-f99.google.com [72.14.207.99]
The numbers on the side indicate what the TTL was for that hop. The
next three columns tell us the round trip time and the last part of it
tells us the FQDN of the router if there is a DNS entry in existence
for that IP address, or it will just tell us the IP address of it.
You can usually tell by the trace route output which routers belong to
the same organisation; the first seven hops in my trace all belonged to
NTL.
Some times however the routers won’t play by the rules and will be
configured to not send ICMP Time Exceeded messages out. If this is the
case you will get some '*******'s' instead of an IP address.
You could also be unlucky enough to come across a router that not allow
ICMP type 11 packets to pass through it. If this is the case you will
get all ****’s from this router onwards as the return packets can not
get to you hence you can’t trace the routers IP address.
Original Tutorial
by nokia for TheTAZZone-TAZForum
Originally posted on March 2nd, 2007 here
Do not use, republish, in whole or in part, without the consent of
the Author. TheTAZZone policy is that Authors retain the rights to the
work they submit and/or post...we do not sell, publish, transmit, or
have the right to give permission for such...TheTAZZone merely retains
the right to use, retain, and publish submitted work within it's
Network.