Firewalls and IDS

This post is a walkthrough of the lab. I won't display the flags but I'll show how we go to obtain them. I recommend downloading this FREE Nmap Cheat Sheet which is based on the previous posts; this cheat sheet helped me get through these labs

Breaking down Firewall and IDS/IPS Evasion: Easy Lab

For this lab, we need to get the operating system running on the server. I'll attempt the following command:

nmap 10.129.63.36 -A -F -Pn -n -disable-arp-ping --packet-trace --source-port=53 -f -D RND:5

Let's break down my reasoning:

  • -A makes an aggressive scan

  • -F to check only the top 100 ports

  • -Pn -n -disable-arp-ping --packet-trace. These flags have been present during the module. They disable ARP ping, ICMP echo requests, and DNS resolution. This also provides packet tracing. From the modules, we can see the TCP response, see if there is RA, and check for rejected packets.

  • --source-port=53 disguises our Nmap scan as DNS queries

  • -f makes the packets tiny. If the packet is 24 bytes long, -f sends three packets, each of eight bytes

  • -D RND:5 applies decoy and uses 5 generated IP addresses

I'll run both scans, one with the flags --source-port=53 -f -D RND:5 and a second one without them. We can see the number of alerts at <ip>/status.php and start with 50/100.

Running the command returns a big output that may or may not be hard to read. And a rather interesting result.

Nmap quitting

But if we scroll through it, we can see the trace of NSOCK and know the system it is using:

We got the flag and the IDS/IPS system got 5 alerts:

Alerts raised

But do the --source-port=53 -f -D RND:5 really help? How many alerts do we set if we send the command without them?

We got detected (doing this a second time, this raises approximately 50 alerts):

Nmap detected

Interestingly enough, we got the ports that were open, and the -A flag worked.

Which makes me wonder, which flag stops -A from working?

Command
Alerts
Received or no response

nmap 10.129.63.36 -F -Pn -n -disable-arp-ping --packet-trace --source-port=53

67

received response

nmap 10.129.63.36 -F -Pn -n -disable-arp-ping --packet-trace --source-port=53 -f

62

received response

nmap 10.129.63.36 -F -Pn -n -disable-arp-ping --packet-trace --source-port=53 -D RND:5

5

no response

So there is an error with -D RND:5. Even though the command returned this lab's flag, it did not return a response.

We also technically don't receive the Lab's flag from the response but rather from the banner message. I'll fix that by making the following changes:

  • Changing -A to -sV -O

  • Removing -D RND:5

And we get a nice response with only 17 alerts.

Breaking down Firewall and IDS/IPS Evasion: Medium Lab

For this lab, we want the DNS server version. If we google "DNS server version nmap" we learn that there is a script that can help us achieve our goal. Keeping in mind there is an IDS/IPS, the command we'll use will be the following:

Let's break down the new flags:

  • -sS -sU means TCP SYN and UDP scan

  • -p53 we're interested in the DNS server, and we know the DNS server is in port 53

  • --script dns-nsid we'll run the nse script to identify the DNS version

Once we run this command, we get a nice response with only 2 alerts.

There is another flag that we could try. Instead of -sS we can use -sA, and it would return the same response with 2 alerts.

If you're curious like me and do -sS and -sA, Nmap will send an error that you specified more than one TCP scan and then quit.

Breaking down Firewall and IDS/IPS Evasion: Hard Lab

Finally, we are told that the admin took precautions and now there is more security. By now I've realized the --source-port=53 -f raises few alerts, so I won't be focusing as much on the alerts.

Since we're looking for a version of a service, I'll run the following command:

Which returns the following

Port 50000 caught my eye, especially the drda-info: TIMEOUT. What is drda? From the nmap.org website, the drda protocol is related to databases.

Once a port catches your eye, see if it is vulnerable. Once locate the drda scripts, (with locate *.nse | grep drda) we run the following

-sS is open and shows ibm-db2 -sA is unfiltered and shows ibm-db2 -sU is closed

Both TCP scans show that there are too many fingerprints. But if the port is open/unfiltered, we might be able to connect with ncat.

So we run ncat -nv --source-port=53 10.129.22.234 50000 and we successfully connect to the server:

If you run the command and receive something like libnsock mksock_bind_addr(): Bind to 0.0.0.0:53 failed (IOD #1): Permission denied (13), you might wanna add sudo at the beginning of the ncat command. I know this got me stuck for a while.

Now, we have successfully completed the Network Enumeration with Nmap Module!

Thank you for reading! Next post I'll start with the Login Bruteforcing Module! There will be some C and some Python involved, so, stay tuned for that. Thank you for reading, if you have any comments or would like to connect, I am always eager to chat on my linkedin

PreviousCont'd NmapNextLogin Bruteforcing

Last updated