Was leisten Port-Scanner?

Eingesetzte Techniken

[Ping-Scans] [Offene TCP-Scans][Verdeckte TCP-Scans] [UDP-Scans] [RPC-Scans][FTP bounce Scans] [TCP/IP-Fingerprinting][Reverse Ident Scans]

Ping-Scans

Erreichbarkeit von Hosts
verschiedene Techniken

ICMP echo requests

werden oft von Firewalls blockiert

TCP Segment mit ACK-Flag (Port 80)

Antwort: RST - Maschine läuft

TCP Segment mit SYN-Flag (Port 80)

Antwort: RST oder SYN/ACK - Maschine läuft

TCP connect()

Beispiel: ICMP echo request

root@merowech# nmap -sP -PI -oM - 134.109.200.1/24
Starting nmap V. 2.30BETA20 by fyodor@insecure.org ( www.insecure.org/nmap/ )
# Nmap (V. 2.30BETA20) scan initiated Thu Apr 13 09:29:35 2000 as: nmap -sP -PI -oM - 134.109.200.1/24
Host: 134.109.200.0 () Status: Smurf (74 responses)
Host: 134.109.200.1 (culix.hrz.tu-chemnitz.de) Status: Up
Host: 134.109.200.2 (duplo.hrz.tu-chemnitz.de) Status: Up
Host: 134.109.200.5 (toni.hrz.tu-chemnitz.de)   Status: Up
...
Host: 134.109.200.249 (s3000-1-060.hrz.tu-chemnitz.de) Status: Up
Host: 134.109.200.253 (bwin-gate.hrz.tu-chemnitz.de)    Status: Up
Host: 134.109.200.254 (msfc-1-060.hrz.tu-chemnitz.de)   Status: Up
Host: 134.109.200.255 ()        Status: Smurf (75 responses)
# Nmap run completed at Thu Apr 13 09:29:50 2000 -- 256 IP addresses (97 hosts up) scanned in 15 seconds
root@merowech#

Offene TCP-Scans

TCP connect()
korrekte Anwendung von TCP/IP
erfordern keine Privilegien
leicht zu entdecken:

Verbindungsaufbau findet statt
Anwendungsprotokoll wird nicht weitergeführt
entsprechende Fehlermitteilungen in den Logs

Beispiel: nmap: einbezogen werden alle TCP-Ports entsprechend /usr/lib/nmap/nmap-services

root@merowech# nmap -sT merowech

Starting nmap V. 2.30BETA20 by fyodor@insecure.org ( www.insecure.org/nmap/ )
Interesting ports on merowech.hrz.tu-chemnitz.de (134.109.200.26):
(The 1503 ports scanned but not shown below are in state: closed)
Port       State       Service
11/tcp     open        systat
15/tcp     open        netstat
21/tcp     open        ftp
22/tcp     open        ssh
23/tcp     open        telnet
25/tcp     open        smtp
79/tcp     open        finger
80/tcp     open        http
111/tcp    open        sunrpc
113/tcp    open        auth
443/tcp    open        https
513/tcp    open        login
514/tcp    open        shell
515/tcp    open        printer
6000/tcp   open        X11

Nmap run completed -- 1 IP address (1 host up) scanned in 1 second
root@merowech# tail /var/adm/messages
Apr 13 10:53:36 merowech sendmail[15855]: connect from root@merowech.hrz.tu-chemnitz.de
Apr 13 10:53:37 merowech netstat[15856]: connect from root@merowech.hrz.tu-chemnitz.de
Apr 13 10:53:37 merowech ps[15862]: connect from root@merowech.hrz.tu-chemnitz.de
Apr 13 10:53:37 merowech in.rlogind[15867]: twist root@merowech.hrz.tu-chemnitz.de to /usr/sbin/tcpd-rshd-echo Sorry, root@merowech.hrz.tu-chemnitz.de, rlogin is not supported, use slogin or ssh
Apr 13 10:53:37 merowech in.ftpd[15870]: connect from root@merowech.hrz.tu-chemnitz.de
Apr 13 10:53:37 merowech ftpd[15870]: lost connection to merowech.hrz.tu-chemnitz.de [134.109.200.26]
Apr 13 10:53:37 merowech ftpd[15870]: FTP session closed
Apr 13 10:53:37 merowech in.telnetd[15869]: twist root@merowech.hrz.tu-chemnitz.de to /bin/echo Nice to meet you, root@merowech.hrz.tu-chemnitz.de;exec /usr/sbin/in.telnetd
Apr 13 10:53:37 merowech in.rshd[15868]: twist root@merowech.hrz.tu-chemnitz.de
to /usr/sbin/tcpd-rshd-echo Sorry, root@merowech.hrz.tu-chemnitz.de, rsh is not
supported, use ssh or scp
Apr 13 10:53:38 merowech sshd[15854]: log: RSA key generation complete.
Apr 13 10:53:38 merowech sshd[15854]: log: Connection from 134.109.200.26 port 1925
Apr 13 10:53:38 merowech sshd[15854]: fatal: Did not receive ident string.
root@merowech#

Beispiel: stobe für TCP-Ports 21-25

root@merowech# strobe -b 21 -e 25 merowech
strobe 1.04 (c) 1995-1997 Julian Assange (proff@suburbia.net).
merowech    21 ftp          File Transfer [Control] [96,JBP]
               -> 220 merowech.hrz.tu-chemnitz.de FTP server (Version wu-2.6.0(1) Thu Oct 21 12:2
               -> 7:00 EDT 1999) ready.\r\n
merowech    23 telnet       Telnet [112,JBP]
               -> Nice to meet you, root@merowech.hrz.tu-chemnitz.de\n
merowech    25 smtp         Simple Mail Transfer [102,JBP]
               -> 220 merowech.hrz.tu-chemnitz.de ESMTP Sendmail 8.9.3/8.9.3; Thu, 13 Apr 2000 13
               -> :22:04 +0200\r\n
merowech    22 ssh          Secure Shell - RSA encrypted rsh
               -> SSH-1.5-1.2.27-afs_pl1\n
root@merowech#

Verdeckte TCP-Scans

Senden von TCP-Segmenten mit Verletzung des korrekten Protokollablaufs
verschiedene Varianten
erfordern root-Rechte
schwierig zu entdecken

kein Verbindungsaufbau
Entdeckung erfordert Einsatz spezieller Logging-Tools

TCP `SYN` Scan

klassischer "half-open" Scan
Vortäuschen eines Verbindungsaufbaus
nur erster Teil des Three-Way-Handshake: TCP-Segment mit SYN-Flag
Antwort: SYN|ACK - Port ist im LISTEN-Zustand, RST wird gesendet
Antwort: RST - Port wird nicht benutzt
Packet Filter protokollieren SYN Scans für restricted Ports

Stealth `FIN`, Xmas Tree, Null Scan

RFC 973: "If the state is CLOSED ... An incoming segment not containing a RST causes a RST to be sent in response."
in anderen Zuständen wird das empfangene Segment ignoriert
Varianten

Scantyp	`FIN`	Xmas Tree	Null
gesetzte Control Bits	`FIN`	`FIN, URG, PSH`	-

Microsoft ignoriert den RFC und sendet kein RST als Antwort
andere Systeme (z.B. Cisco IOS) senden RST für offene Ports

TCP `ACK` Scan

Firewall-Check: Packet-Filter (blockiert TCP SYN) oder mehr?
Senden eines TCP-Segments mit ACK-Flag und zufälliger ack/seq-Nummer
Antwort: RST -kein Firewall
Antwort: ICMP unreachable oder keine: Firewall vorhanden

UDP-Scans

Senden von UDP-Segmenten mit 0 Byte
Antwort: ICMP Port unreachable?
erfordert root-Rechte
schwierig zu entdecken, erfordert spezielle Logging-Tools
Beispiel: Auf welchen Hosts läuft der AFS-Client?

root@merowech# nmap -sU -p7001 -oM - 134.109.200.0/24
# Nmap (V. 2.30BETA20) scan initiated Fri Apr 14 15:02:18 2000 as: nmap -sU -p7001 -oM - 134.109.200.0/24
Host: 134.109.200.0 (hrz-lan.tu-chemnitz.de)    Status: Smurf (74 responses)
Host: 134.109.200.0 (hrz-lan.tu-chemnitz.de)    Ports: 7001/open/udp//afs3-callback/// Ignored State: closed
Host: 134.109.200.1 (culix.hrz.tu-chemnitz.de) Ports: 7001/open/udp//afs3-callback/// Ignored State: closed
Host: 134.109.200.2 (duplo.hrz.tu-chemnitz.de) Ports: 7001/open/udp//afs3-callback/// Ignored State: closed
Host: 134.109.200.5 (toni.hrz.tu-chemnitz.de)   Ports: 7001/open/udp//afs3-callback/// Ignored State: closed
Host: 134.109.200.7 (aetius.hrz.tu-chemnitz.de) Ports: 7001/open/udp//afs3-callback/// Ignored State: closed
...
Host: 134.109.200.253 (bwin-gate.hrz.tu-chemnitz.de)    Status: Up
Host: 134.109.200.254 (msfc-1-060.hrz.tu-chemnitz.de)   Status: Up
Host: 134.109.200.255 ()        Status: Smurf (71 responses)
Host: 134.109.200.255 ()        Ports: 7001/open/udp//afs3-callback/// Ignored State: closed
# Nmap run completed at Fri Apr 14 15:04:11 2000 -- 256 IP addresses (94 hosts up) scanned in 113 seconds
root@merowech#

RPC-Scans

in Verbindung mit anderen Scan-Methoden
Senden von SunRPC NULL command an alle offenen TCP/UDP-Ports
Antwort: RPC-Programm und Versionsnummer

FTP bounce Scans

RFC 959: "... a user might wish to transfer files between two hosts, neither of which is a local host ..."
ftp-Kommando DATA PORT (PORT) weist ftp-Server an, die Daten an spezifizierten IP-Adresse:Port zu senden
Port-Scan:

Verbindungsaufbau zu ftp-Server
PORT Kommando stellt das zu scannende Ziel ein (passive User-DTP is listening)
LIST Kommando (Server sendet Fileliste an passive DTP)
Reaktion: "425: Can´t build data connection: Connection refused" - Port wird nicht benutzt

TCP/IP Fingerprinting

erkennen von Betriebssystem und -version aus Implementierungsdetails des TCP/IP-Stacks
korrekte Implementierung (z.B. FIN probe: TCP-Segment ohne ACK/SYN an offenen Port sollen nicht beantwortet werden)
ISN - Analyse: wie werden die Sequenz-Nummern inkrementiert?
ACK-Nummer-Analyse
....
Resistenz gegen SYN-Flood-Attacken
Beispiel:

root@merowech# nmap -O -p 23 134.109.200.1,2,5,7,249,254

Starting nmap V. 2.30BETA20 by fyodor@insecure.org ( www.insecure.org/nmap/ )
Interesting ports on culix.hrz.tu-chemnitz.de (134.109.200.1):
Port State Service
23/tcp open telnet

TCP Sequence Prediction: Class=truly random
Difficulty=9999999 (Good luck!)
Remote operating system guess: Linux 2.0.35-38

Interesting ports on duplo.hrz.tu-chemnitz.de (134.109.200.2):
Port State Service
23/tcp open telnet

TCP Sequence Prediction: Class=random positive increments
Difficulty=4907662 (Good luck!)
Remote operating system guess: Linux 2.1.122 - 2.2.14

Interesting ports on toni.hrz.tu-chemnitz.de (134.109.200.5):
Port State Service
23/tcp open telnet

TCP Sequence Prediction: Class=random positive increments
Difficulty=42847 (Worthy challenge)
Remote operating system guess: Solaris 2.6 - 2.7

Interesting ports on aetius.hrz.tu-chemnitz.de (134.109.200.7):
Port State Service
23/tcp open telnet

TCP Sequence Prediction: Class=random positive increments
Difficulty=39200 (Worthy challenge)
Remote operating system guess: Solaris 2.5, 2.5.1

Interesting ports on s3000-1-060.hrz.tu-chemnitz.de (134.109.200.249):
Port State Service
23/tcp open telnet

TCP Sequence Prediction: Class=constant sequence number (!)
Difficulty=0 (Trivial joke)
Remote OS guesses: 3Com SuperStack II (OS v 2.0), AsanteHub 2072 Ethernet Hub

Interesting ports on msfc-1-060.hrz.tu-chemnitz.de (134.109.200.254):
Port State Service
23/tcp open telnet

TCP Sequence Prediction: Class=random positive increments
Difficulty=13436 (Worthy challenge)
Remote OS guesses: AS5200, Cisco 2501/5260/5300 terminal server IOS 11.3.6(T1), Cisco IOS 11.3 - 12.0(9)

Nmap run completed -- 6 IP addresses (6 hosts up) scanned in 10 seconds
root@merowech#

Reverse Ident Scans

ident Protokoll (RFC1413): Ermitteln des Eigentümers einer TCP-Verbindung
RFC1413: "Given a TCP port number pair, it returns a character string which identifies the owner of that connection on the server's system."
erfordert identd am Zielhost
Beispiel:

root@merowech# nmap -I janus

Starting nmap V. 2.30BETA20 by fyodor@insecure.org ( www.insecure.org/nmap/ )
Interesting ports on janus.hrz.tu-chemnitz.de (134.109.132.79):
(The 1503 ports scanned but not shown below are in state: closed)
Port       State       Service         Owner
11/tcp     open        systat                  root
15/tcp     open        netstat                 root
21/tcp     open        ftp                     root
22/tcp     open        ssh                     root
23/tcp     open        telnet                  root
25/tcp     open        smtp                    root
79/tcp     open        finger                  root
111/tcp    open        sunrpc                  bin
113/tcp    open        auth                    nobody
513/tcp    open        login                   root
514/tcp    open        shell                   root
515/tcp    open        printer                 root
3333/tcp   open        dec-notes               til
6666/tcp   open        irc-serv                alg
6667/tcp   open        irc                     alg

Nmap run completed -- 1 IP address (1 host up) scanned in 2 seconds
root@merowech#

Zur Homepage des URZ

Thomas Müller, 17. April 2000