Chapter 2: Tests and Experiments
2.3. Validation of Preliminary Countermeasures
2.3.3 IP Default TTL
[+] Execution completed.
Xprobe2 was not able to determine what the OS was as it did not receive any ICMP reply packets. Xprobe2 relies purely on the ICMP packets it receives. This is a disadvantage of Xprobe2. Nmap on the other hand was able to detect the OS.
With the ICMP packets disabled there is no need to alter the packets in terms of the amount of data sent in the ICMP error packet.
TR: 1, CN: 0]
Initiating SYN Stealth Scan against pc-wvl-6.cs.ukzn.ac.za (10.0.0.6) [1672 ports]
at 03:47
Discovered open port 22/tcp on 10.0.0.6
The SYN Stealth Scan took 21.38s to scan 1672 total ports.
For OSScan assuming port 22 is open, 113 is closed, and neither are firewalled Host pc-wvl-6.cs.ukzn.ac.za (10.0.0.6) appears to be up ... good.
Interesting ports on pc-wvl-6.cs.ukzn.ac.za (10.0.0.6):
(The 1670 ports scanned but not shown below are in state: filtered) PORT STATE SERVICE
22/tcp open ssh 113/tcp closed auth
MAC Address: 00:0F:FE:31:D9:CF (G-pro Computer) Device type: general purpose|broadband router Running: Linux 2.4.X|2.5.X|2.6.X, D-Link embedded
OS details: Linux 2.4.0 - 2.5.20, Linux 2.4.18 - 2.4.20, Linux 2.4.26, Linux 2.4.27 or D-Link DSL-500T (running linux 2.4), Linux 2.4.7 - 2.6.11, Linux 2.6.0 - 2.6.11 OS Fingerprint:
TSeq(Class=RI%gcd=3%SI=A7336%IPID=Z)
T1(Resp=Y%DF=Y%W=16A0%ACK=S++%Flags=AS%Ops=MNNTNW) T2(Resp=N)
T3(Resp=Y%DF=Y%W=16A0%ACK=S++%Flags=AS%Ops=MNNTNW) T4(Resp=Y%DF=Y%W=0%ACK=O%Flags=R%Ops=)
T5(Resp=Y%DF=Y%W=0%ACK=S++%Flags=AR%Ops=) T6(Resp=Y%DF=Y%W=0%ACK=O%Flags=R%Ops=) T7(Resp=N)
PU(Resp=N)
TCP Sequence Prediction: Class=random positive increments Difficulty=684854 (Good luck!)
IPID Sequence Generation: All zeros
Nmap finished: 1 IP address (1 host up) scanned in 23.758 seconds Raw packets sent: 3364 (135KB) | Rcvd: 19 (996B)
Nmap was not deceived by this alteration.
2.3.3.2 Xprobe2's Results
Xprobe2 was executed to investigate the affect of the alteration on it.
linux:/# xprobe2 10.0.0.6
Xprobe2 v.0.3 Copyright (c) 2002-2005 [email protected], [email protected], [email protected]
[+] Target is 10.0.0.6 [+] Loading modules.
[+] Following modules are loaded:
[x] [1] ping:icmp_ping - ICMP echo discovery module [x] [2] ping:tcp_ping - TCP-based ping discovery module [x] [3] ping:udp_ping - UDP-based ping discovery module
[x] [4] infogather:ttl_calc - TCP and UDP based TTL distance calculation [x] [5] infogather:portscan - TCP and UDP PortScanner
[x] [6] fingerprint:icmp_echo - ICMP Echo request fingerprinting module
[x] [7] fingerprint:icmp_tstamp - ICMP Timestamp request fingerprinting module [x] [8] fingerprint:icmp_amask - ICMP Address mask request fingerprinting module
[x] [9] fingerprint:icmp_port_unreach - ICMP port unreachable fingerprinting module
[x] [10] fingerprint:tcp_hshake - TCP Handshake fingerprinting module [x] [11] fingerprint:tcp_rst - TCP RST fingerprinting module
[x] [12] fingerprint:smb - SMB fingerprinting module [x] [13] fingerprint:snmp - SNMPv2c fingerprinting module [+] 13 modules registered
[+] Initializing scan engine [+] Running scan engine
[-] ping:tcp_ping module: no closed/open TCP ports known on 10.0.0.6. Module test failed
[-] ping:udp_ping module: no closed/open UDP ports known on 10.0.0.6. Module test failed
[-] No distance calculation. 10.0.0.6 appears to be dead or no ports known [+] Host: 10.0.0.6 is up (Guess probability: 50%)
[+] Target: 10.0.0.6 is alive. Round-Trip Time: 0.00026 sec [+] Selected safe Round-Trip Time value is: 0.00051 sec
[-] fingerprint:tcp_hshake Module execution aborted (no open TCP ports known) [-] fingerprint:smb need either TCP port 139 or 445 to run
[-] fingerprint:snmp: need UDP port 161 open [+] Primary guess:
[+] Host 10.0.0.6 Running OS: "Foundry Networks IronWare Version 03.0.01eTc1"
(Guess probability: 91%) [+] Other guesses:
[+] Host 10.0.0.6 Running OS: "Linux Kernel 2.6.0" (Guess probability: 83%) [+] Host 10.0.0.6 Running OS: "Linux Kernel 2.6.1" (Guess probability: 83%) [+] Host 10.0.0.6 Running OS: "Linux Kernel 2.6.2" (Guess probability: 83%) [+] Host 10.0.0.6 Running OS: "Linux Kernel 2.6.3" (Guess probability: 83%) [+] Host 10.0.0.6 Running OS: "Linux Kernel 2.6.4" (Guess probability: 83%) [+] Host 10.0.0.6 Running OS: "Linux Kernel 2.6.5" (Guess probability: 83%) [+] Host 10.0.0.6 Running OS: "Linux Kernel 2.6.6" (Guess probability: 83%) [+] Host 10.0.0.6 Running OS: "Linux Kernel 2.6.7" (Guess probability: 83%) [+] Host 10.0.0.6 Running OS: "Linux Kernel 2.6.8" (Guess probability: 83%) [+] Cleaning up scan engine
[+] Modules deinitialized [+] Execution completed.
The results show that Xprobe2 was effected in some way. Its primary guess was still Foudary IronWare, but with the other tests it performed it guessed the OS of the target to be Linux, with an 83% probability. Interestingly enough, it was found that when the TTL value was set to 255, Xprobe2 gave a different result, but Nmap was not effected.
The following results were found from Xprobe2.
linux:/# xprobe2 10.0.0.6
Xprobe2 v.0.3 Copyright (c) 2002-2005 [email protected], [email protected], [email protected]
[+] Target is 10.0.0.6 [+] Loading modules.
[+] Following modules are loaded:
[x] [1] ping:icmp_ping - ICMP echo discovery module [x] [2] ping:tcp_ping - TCP-based ping discovery module [x] [3] ping:udp_ping - UDP-based ping discovery module
[x] [4] infogather:ttl_calc - TCP and UDP based TTL distance calculation [x] [5] infogather:portscan - TCP and UDP PortScanner
[x] [6] fingerprint:icmp_echo - ICMP Echo request fingerprinting module
[x] [7] fingerprint:icmp_tstamp - ICMP Timestamp request fingerprinting module [x] [8] fingerprint:icmp_amask - ICMP Address mask request fingerprinting module
[x] [9] fingerprint:icmp_port_unreach - ICMP port unreachable fingerprinting module
[x] [10] fingerprint:tcp_hshake - TCP Handshake fingerprinting module [x] [11] fingerprint:tcp_rst - TCP RST fingerprinting module
[x] [12] fingerprint:smb - SMB fingerprinting module [x] [13] fingerprint:snmp - SNMPv2c fingerprinting module [+] 13 modules registered
[+] Initializing scan engine [+] Running scan engine
[-] ping:tcp_ping module: no closed/open TCP ports known on 10.0.0.6. Module test failed
[-] ping:udp_ping module: no closed/open UDP ports known on 10.0.0.6. Module test failed
[-] No distance calculation. 10.0.0.6 appears to be dead or no ports known [+] Host: 10.0.0.6 is up (Guess probability: 50%)
[+] Target: 10.0.0.6 is alive. Round-Trip Time: 0.00362 sec [+] Selected safe Round-Trip Time value is: 0.00724 sec
[-] fingerprint:tcp_hshake Module execution aborted (no open TCP ports known) [-] fingerprint:smb need either TCP port 139 or 445 to run
[-] fingerprint:snmp: need UDP port 161 open [+] Primary guess:
[+] Host 10.0.0.6 Running OS: "Linux Kernel 2.4.5" (Guess probability: 91%) [+] Other guesses:
[+] Host 10.0.0.6 Running OS: "Linux Kernel 2.2.1" (Guess probability: 91%) [+] Host 10.0.0.6 Running OS: "Linux Kernel 2.2.5" (Guess probability: 91%) [+] Host 10.0.0.6 Running OS: "Linux Kernel 2.2.20" (Guess probability: 91%) [+] Host 10.0.0.6 Running OS: "Linux Kernel 2.2.24" (Guess probability: 91%) [+] Host 10.0.0.6 Running OS: "Linux Kernel 2.4.16" (Guess probability: 91%) [+] Host 10.0.0.6 Running OS: "NetBSD 2.0" (Guess probability: 91%)
[+] Host 10.0.0.6 Running OS: "Linux Kernel 2.2.0" (Guess probability: 91%) [+] Host 10.0.0.6 Running OS: "Linux Kernel 2.2.4" (Guess probability: 91%) [+] Host 10.0.0.6 Running OS: "Linux Kernel 2.2.19" (Guess probability: 91%) [+] Cleaning up scan engine
[+] Modules deinitialized [+] Execution completed.
From the results Xprobe2's primary guess was that the target's OS was Linux. The other guesses were that the OS of the target is Linux and in one situation that it was NETBSD 2.0. This shows that the TTL value has some effect on Xprobe2, but it does not fully deceive it.