Newbie Scan Challenge

I am posting this as an exercise for Folks who are very new, and are just getting into ports, security, etc.

Please Friends, I know there are some here who could write a thesis on the the scan log below, but please refrain.

I offer this to our posters here who have asked about how to port scan, what does it mean, etc.

The Challenge:

Below is an actual nmap scan.

The address has been removed as it matters not.

You are given this scan and asked to assess it in terms of potential problems, as well as recommendations.

Please post your observations in two parts:

1. What are your initial observations? (i.e. "port xxxx is open and I don't think it should be")

2. What are your recommendations? (i.e. close port xxxx, disable service xxxx, etc.)


-------------------------------------------- SCAN LOG BELOW --------------------------------------------------


Starting nmap V. 3.00 ( www.insecure.org/nmap/ )

Interesting ports on xxxxxx.xxxx.xxx (xxx.xxx.xx.xxx):
(The 1116 ports scanned but not shown below are in state: closed)
Port State Service
21/tcp open ftp
75/tcp filtered priv-dial
80/tcp open http
135/tcp filtered loc-srv
139/tcp open netbios-ssn
147/tcp filtered iso-ip
208/tcp filtered at-8
443/tcp open https
447/tcp filtered ddm-dfm
487/tcp filtered saft
528/tcp filtered custix
535/tcp filtered iiop
560/tcp filtered rmonitor
582/tcp filtered scc-security
596/tcp filtered smsd
999/tcp filtered garcon
1027/tcp open IIS
1110/tcp filtered nfsd-status
1380/tcp filtered telesis-licman
1426/tcp filtered sas-1
1433/tcp open ms-sql-s
1989/tcp filtered tr-rsrb-p3
2000/tcp open callbook
2001/tcp open dc
2025/tcp filtered ellpack
2028/tcp filtered submitserver
2034/tcp filtered scoremgr
2232/tcp filtered ivs-video
3999/tcp filtered remoteanything
4132/tcp filtered nuts_dem
5191/tcp filtered aol-1
12345/tcp filtered NetBus
13709/tcp filtered VeritasNetbackup
32770/tcp filtered sometimes-rpc3
Remote OS guesses: Baystack Instant Internet 400 SoHo Router, NetScreen-100, FreeBSD 4.0-20000208-CURRENT, Linux 1.3.20 (X86), Solaris 2.5, 2.5.1, Solaris 2.6 - 7 (SPARC), Solaris 2.6 - 7 X86, Solaris 2.6

Nmap run completed -- 1 IP address (1 host up) scanned in 49 seconds

------------------------------------ END OF SCAN ---------------------------------------------------

.: Aftiel

(1) Ports are open that should not be. (2) Close all ports that are not vital and get a firewall that will cloak these ports.

Which ports are open that should not be?

How can we tell that open ports are not already cloaked? (or can we?)

.: Aftiel

rotfl -:) Definitely true.

Now that a Senior Member has weighed in, let's have some truly new Folks see if they can expand on this even farther.


Another question for the Challenge:

What is meant by a "filtered" port? What do you think that repesents?


.: Aftiel

If your using the services, and are staying up to date with updates and vulnerabilities for that particular daemon then you should decrease the worrying level a little bit..But I don't know your internal policies of that particular system, or if it is in a dmz or what the tcp wrapper settings look like..Plus I don't know what ftpd your using or what sql..So unless you have absolutely no use for ftp, then it should definetely be closed..Renaming the port won't work, however because skiddie tools now a days can pretty much find any server on any port... Correct me on the answer if you will, but I have never heard of dc or callbook..Some googling is in order..So what it somes down to is turn off ftp definetely if you don't need it, turn off sql unless you need it...IIS ?

Filtered means there is probably a firewall dropping the packets to that port. You really don't know whether that port is closed/listening or not though.

Correct?!

Yes, filtered means that some kind of firewall is in place (iptables in this case) whether it be zone alarm or whatever...lol yea I did kind of give it a funny look when I saw netbus sitting there....

Excellent observations.

IIS = has been exploited more times than I can count. Endless patches. That would be a prime target for a hacker.

By the way, this is not one of my machines, nor is it on a network I am responsible for. This was a blind scan on an .edu (big surprise.)

Bah! these Senior Members chiming in with the in-depth stuff -- no fair!! -:)

Filtered as I have seen it means that yes, the packets are being dropped, OR the port is filtered to permit only a certain IP Block.

BONUS QUESTION:

Is there any way to tell if this server is behind a firewall from looking at the scan?

.: Aftiel

Quote:

---

BONUS QUESTION:

Is there any way to tell if this server is behind a firewall from looking at the scan?

---

Aren't the ports with the filtered state an indication that this is the case?

Actually nmap returns 'filtered' when the packets are explicity 'rejected' by the server(or en route),while 'dropping' the packets will not return any reply and subsequently the port will not be logged by the scanner. It is more common to find 'filtered' ports on routers and other older network devices and OS's as it is becoming increasingly common for firewalls to simply 'drop' the packets because even rejects cause the server to process the packets as well as create unneccesary traffic which can result in a DoS. Although some times perimeter firewalls reject packets to many commonly exploited ports in an attempt to discourage kiddies from scanning their subnet (once the attacker sees the packets will all be rejected)

-Maestr0

If we make the assumption that the server is in fact "behind" a firewall (assuming a HW Firewall here,) then how did a fast scan provide so much information?

i.e. does it appear the firewall is set up correctly? Or is the rule set simply too loose?

opinions?

.: Aftiel

Good info there Maestr0.

:)

Excellent reply Maestro!

I have not ( and will not) explore this particular site any further than this simple scan.

However, my guess is that the filtered ports are in fact accessible from their intranet. Those ports simply dropped my outside (and unrecognized) attempts, but would probably allow internal trusted hosts access.

For example, on my personal network, ports that allow access only to my intranet (i.e. 172.16.1.) get reported by nmap as filtered. Outside atttempts to scan them are promptly dropped. So you are dead on correct on that.

It appears they allow students to turn in homework, as well as running remote admin. The OS guess reflects some possible holes as well.

If my guess proved to be correct, then hijacking a student account, or simply getting to a terminal on campus would allow many possibilities.

My guess also is that IIS may be patched, but probably not to the current level.

The remote Admin possiblilities certainly look interesting as well.

.: Aftiel

I think one of the most vulnerable ports would be 139 the open ss netbios port. Anyone with their printer file sharing enabled makes them an easy target for would be hackers. Well here is the dance for microsoft.http://www.ebaumsworld.com/microsoftdance.html

I will take a stab at this.

Quote:

---

Starting nmap V. 3.00 ( www.insecure.org/nmap/ )

---

First, NMAP is now on version 3.48, so running this older version could impact the OS detection. Version 3.00 has a datestamp of July 28, 2002. So, right there, I do not trust the nmap-os-fingerprints file used in the scan. Old data is not that realiable as newer data.

Ports 135, 139, 445 and 1433 are all running. Only 1 is filtered, the rest are just plain open. This really says to me this is a Windows machine, probably a Windows Server, due to the port 1433, which is MS SQL Server port. So, I am already guessing NT4/Win2K/Win2k3.

With port 80 and 443 running, it has a web server. I would connect to this server on port 80 (through an anonymous proxy server) and look at the web server header info to see if it is IIS running the web page (probably, with the port 1027 being open). If it is IIS, you will get the exact Windows OS version. IIS 4.0 is NT4; IIS 5.0 is Win2K; IIS 5.1 is XP; IIS 6.0 is Win2k3. Instead of IIS, it could be Apache running as the web server, but I just doubt it. Call it a gut instinct.

Yes, you could connect to the FTP service it is running and see similar results as the web server headers, if the FTP headers have not been turned off (difficult to do in IIS though without the IISLockdown tool).

I do not see port 389 or the port Windows Active Directory uses for the Global Catalogue (I forget what port that is right now), so this is probably NOT a Win2k/Win2k3 AD server. Don't laugh. I have seen AD servers in port scans come up before!

So, a stand-alone server (or it could be a NT4 PDC/BDC, but I feel that that is of a lower chance; gotta look at the web server header info) or a domain member server.

Quote:

---

2000/tcp open callbook
2001/tcp open dc

---

From what I found, those might be trojan programs running on those open ports. So, this server could very well be compromised. With the NetBIOS ports open, I wouldn't doubt this. And yes, I see that Netbus is running filtered. Hmmm.

This is probably a warez server by this time, or a zombie, or both most likely. Whoever ownes it should take it offline and see if it has been 0wned!

As for the remaining ports, I would guess that at least some are coming from the firewall that is in front of the web server. I really think it is being screened by a firewall. Another gut feeling. It is just not screened very well!

Just my thoughts.
Thanks for the quiz.