Re: [PATCH] TCP Idle Scan in IPv6

[david <david () bamsoftware com>]

On Tue, Sep 10, 2013 at 10:06:46PM +0200, Mathias Morbitzer wrote:
> The attached patch should fix all the issues pointed out. 

I'm having some trouble getting results with this patch. I set up a test
IPv6 network:
        abcd::1 GNU/Linux scanning host
        abcd::2 Windows 7 VM zombie
        abcd::3 GNU/Linux target
Is there any more information I can send you?

Here is what I tried first. Notice the warning about -Pn, the detected
"Class: Incrementing by 2", and the error "Even though your Zombie".

$ sudo ./nmap -6 --top-ports 10 -sI '[abcd::2]:22' abcd::3 --packet-trace
WARNING: Many people use -Pn w/Idlescan to prevent pings from their true IP.  On the other hand, timing info Nmap gains 
from pings can allow for faster, more reliable scans.
Starting Nmap 6.41SVN ( http://nmap.org ) at 2013-10-13 09:29 PDT
SENT (2.1294s) ICMPv6 (58) abcd::1 > ff02::1:ff00:3 (type=135/code=0) hopl=255 flow=0 payloadlen=32
RCVD (2.1297s) ICMPv6 (58) abcd::3 > abcd::1 (type=136/code=0) hopl=255 flow=0 payloadlen=32
SENT (2.3091s) ICMPv6 (58) abcd::1 > abcd::2 (type=128/code=0) hopl=255 flow=0 payloadlen=1226
RCVD (2.3091s) ICMPv6 (58) abcd::1 > ff02::1:ff00:2 (type=135/code=0) hopl=255 flow=0 payloadlen=32
RCVD (2.3098s) ICMPv6 (58) abcd::2 > ff02::1:ff00:1 (type=135/code=0) hopl=255 flow=0 payloadlen=32
RCVD (2.3099s) ICMPv6 (58) abcd::1 > abcd::2 (type=128/code=0) hopl=255 flow=0 payloadlen=1226
RCVD (2.3099s) ICMPv6 (58) abcd::1 > abcd::2 (type=136/code=0) hopl=255 flow=0 payloadlen=32
RCVD (2.3108s) ICMPv6 (58) abcd::2 > abcd::1 (type=129/code=0) hopl=128 flow=0 payloadlen=1226
SENT (2.3809s) ICMPv6 (58) abcd::1 > abcd::2 (type=2/code=0) hopl=255 flow=0 payloadlen=1222
SENT (2.3810s) ICMPv6 (58) abcd::3 > abcd::2 (type=128/code=0) hopl=255 flow=0 payloadlen=1226
SENT (2.3912s) ICMPv6 (58) abcd::3 > abcd::2 (type=2/code=0) hopl=255 flow=0 payloadlen=1222
SENT (2.4893s) TCP abcd::1:54287 > abcd::2:22 SA hopl=255 flow=0 payloadlen=24 seq=3022450249 win=1024 <mss 1460>
RCVD (2.4897s) TCP abcd::2:22 > abcd::1:54287 R hopl=128 flow=0 payloadlen=28 seq=2604933148 win=0
SENT (2.5201s) TCP abcd::1:54288 > abcd::2:22 SA hopl=255 flow=0 payloadlen=24 seq=3022450250 win=1024 <mss 1460>
RCVD (2.5204s) TCP abcd::2:22 > abcd::1:54288 R hopl=128 flow=0 payloadlen=28 seq=2604933148 win=0
SENT (2.5507s) TCP abcd::1:54289 > abcd::2:22 SA hopl=255 flow=0 payloadlen=24 seq=3022450251 win=1024 <mss 1460>
RCVD (2.5511s) TCP abcd::2:22 > abcd::1:54289 R hopl=128 flow=0 payloadlen=28 seq=2604933148 win=0
SENT (2.5814s) TCP abcd::1:54290 > abcd::2:22 SA hopl=255 flow=0 payloadlen=24 seq=3022450252 win=1024 <mss 1460>
RCVD (2.5818s) TCP abcd::2:22 > abcd::1:54290 R hopl=128 flow=0 payloadlen=28 seq=2604933148 win=0
SENT (2.6121s) TCP abcd::1:54291 > abcd::2:22 SA hopl=255 flow=0 payloadlen=24 seq=3022450253 win=1024 <mss 1460>
RCVD (2.6125s) TCP abcd::2:22 > abcd::1:54291 R hopl=128 flow=0 payloadlen=28 seq=2604933148 win=0
SENT (2.6428s) TCP abcd::1:54292 > abcd::2:22 SA hopl=255 flow=0 payloadlen=24 seq=3022450254 win=1024 <mss 1460>
RCVD (2.6432s) TCP abcd::2:22 > abcd::1:54292 R hopl=128 flow=0 payloadlen=28 seq=2604933148 win=0
Idle scan using zombie abcd::2 (abcd::2:22); Class: Incrementing by 2
SENT (2.6434s) TCP abcd::3:54286 > abcd::2:22 SA hopl=255 flow=0 payloadlen=24 seq=3022450249 win=1024 <mss 1460>
SENT (2.6937s) TCP abcd::3:54286 > abcd::2:22 SA hopl=255 flow=0 payloadlen=24 seq=3022450250 win=1024 <mss 1460>
SENT (2.7440s) TCP abcd::3:54286 > abcd::2:22 SA hopl=255 flow=0 payloadlen=24 seq=3022450251 win=1024 <mss 1460>
SENT (2.7943s) TCP abcd::3:54286 > abcd::2:22 SA hopl=255 flow=0 payloadlen=24 seq=3022450252 win=1024 <mss 1460>
SENT (3.0946s) TCP abcd::1:54321 > abcd::2:22 SA hopl=255 flow=0 payloadlen=24 seq=3918816763 win=1024 <mss 1460>
RCVD (3.0951s) TCP abcd::2:22 > abcd::1:54321 R hopl=128 flow=0 payloadlen=28 seq=950163425 win=0
Even though your Zombie (abcd::2; abcd::2) appears to be vulnerable to IP ID sequence prediction (class: Incrementing 
by 2), our attempts have failed.  This generally means that either the Zombie uses a separate IP ID base for each host 
(like Solaris), or because you cannot spoof IP packets (perhaps your ISP has enabled egress filtering to prevent IP 
spoofing), or maybe the target network recognizes the packet source as bogus and drops them
QUITTING!

Sometimes I get different errors at the end:

Your IP ID Zombie (abcd::2; abcd::2) is behaving strangely -- suddenly cannot obtain IP ID
QUITTING!
Idle scan zombie abcd::2 (abcd::2) port 22 cannot be used because it has not returned any of our ICMPv6 Echo Requests 
-- perhaps it is down or firewalled.
QUITTING!

If I comment out the "Even though your Zombie" error, I get scan output,
but every port is closed|filtered, even though 22 is open on abcd::3.
Idle scan using IPv4 of the same hosts find port 22 open.

Nmap scan report for abcd::3
Host is up (0.00035s latency).
PORT     STATE           SERVICE
21/tcp   closed|filtered ftp
22/tcp   closed|filtered ssh
23/tcp   closed|filtered telnet
25/tcp   closed|filtered smtp
80/tcp   closed|filtered http
110/tcp  closed|filtered pop3
139/tcp  closed|filtered netbios-ssn
443/tcp  closed|filtered https
445/tcp  closed|filtered microsoft-ds
3389/tcp closed|filtered ms-wbt-server

This last one was an error on my part, because I was using my own
address ([abcd::1]:22) as the zombie address. But the "Malformed packet
received" error kills the whole Nmap process, and it probably shouldn't
do that.

$ sudo ./nmap -6 -Pn --top-ports 10 -sI '[abcd::1]:22' abcd::3 --packet-trace
Starting Nmap 6.41SVN ( http://nmap.org ) at 2013-10-13 09:24 PDT
SENT (0.1280s) ICMPv6 (58) abcd::1 > ff02::1:ff00:3 (type=135/code=0) hopl=255 flow=0 payloadlen=32
RCVD (0.1283s) ICMPv6 (58) abcd::3 > abcd::1 (type=136/code=0) hopl=255 flow=0 payloadlen=32
SENT (0.7730s) ICMPv6 (58) abcd::1 > abcd::1 (type=128/code=0) hopl=255 flow=0 payloadlen=1226
RCVD (0.7729s) ICMPv6 (58) abcd::1 > abcd::1 (type=128/code=0) hopl=255 flow=0 payloadlen=1234
RCVD (0.7730s) ICMPv6 (58) abcd::1 > abcd::1 (type=129/code=0) hopl=64 flow=0 payloadlen=1234
SENT (0.8797s) ICMPv6 (58) abcd::1 > abcd::1 (type=2/code=0) hopl=255 flow=0 payloadlen=1222
SENT (0.8799s) ICMPv6 (58) abcd::3 > abcd::1 (type=128/code=0) hopl=255 flow=0 payloadlen=1226
SENT (0.8902s) ICMPv6 (58) abcd::3 > abcd::1 (type=2/code=0) hopl=255 flow=0 payloadlen=1222
SENT (0.9519s) TCP abcd::1:57726 > abcd::1:22 SA hopl=255 flow=0 payloadlen=24 seq=3917294392 win=1024 <mss 1460>
RCVD (0.9519s) TCP abcd::1:57726 > abcd::1:22 SA hopl=255 flow=0 payloadlen=32 seq=3917294392 win=1024 <mss 1460>
SENT (1.0879s) ICMPv6 (58) abcd::1 > abcd::1 (type=128/code=0) hopl=255 flow=0 payloadlen=1226
RCVD (1.0878s) ICMPv6 (58) abcd::1 > abcd::1 (type=128/code=0) hopl=255 flow=0 payloadlen=1234
RCVD (1.0879s) ICMPv6 (58) abcd::1 > abcd::1 (type=129/code=0) hopl=64 flow=0 payloadlen=1234
SENT (1.1677s) ICMPv6 (58) abcd::1 > abcd::1 (type=2/code=0) hopl=255 flow=0 payloadlen=1222
SENT (1.1678s) ICMPv6 (58) abcd::3 > abcd::1 (type=128/code=0) hopl=255 flow=0 payloadlen=1226
SENT (1.1780s) ICMPv6 (58) abcd::3 > abcd::1 (type=2/code=0) hopl=255 flow=0 payloadlen=1222
Malformed packet received
SENT (1.2095s) TCP abcd::1:57727 > abcd::1:22 SA hopl=255 flow=0 payloadlen=24 seq=3917294393 win=1024 <mss 1460>

David Fifield
_______________________________________________
Sent through the dev mailing list
http://nmap.org/mailman/listinfo/dev
Archived at http://seclists.org/nmap-dev/