Installing Unicornscan on a current Ubuntu Distro

So get unicornscan from here :

http://unicornscan.org/ -- current version I could find is 0.4.7

you'll need some depenedencies

apt-get install flex bison

apt-get install libpcap0.8-dev libgeoip-dev libltdl3-dev libdumbnet1 libdumbnet-dev

* you may need texlive-extra-utils if you are on a headless system like slicehost or linode, otherwise it will bomb out when it tries to make the documentation :-(

apt-get install texlive-extra-utils

Fix up weird lib issues see at the bottom for where i got this:

blah@blah:$ sudo ln -s /usr/include/dumbnet.h /usr/include/dnet.h

blah@blah:$ for i in `find ./ -type f -exec grep -l 'ldnet' '{}' \;`; do sed -i bak -e 's/ldnet/ldumbnet/g' $i; done

apply this patch

https://www.pentoo.ch/pentoo/browser/portage/trunk/net-analyzer/unicornscan/files/unicornscan-0.4.7-configure.patch

./configure CFLAGS=-D_GNU_SOURCE
make
make install

after that it woud compile and run.

I did have to really crank down the pps to get it to actually run, default is 300 i had to use around 75-100

sudo unicornscan -m U -Ir 75 --show-errors -v externalrange.net/24

Lets test ...

host #1

sudo unicornscan -m U -Ir 75 -v 192.168.1.143

adding 192.168.1.143/32 mode `UDPscan' ports `7,9,11,13,17,19,20,37,39,42,49,52-54,65-71,81,111,161,123,136-170,514-518,630,631,636-640,650,653,921,1023-1030,1900,2048-2050,27900,27960,32767-32780,32831' pps 75
using interface(s) eth0

UDP open domain[ 53] from 192.168.1.143 ttl 50
UDP open netbios-ns[ 137] from 192.168.1.143 ttl 50
UDP open unknown[51468] from 192.168.1.143 ttl 50

msf auxiliary(udp_sweep) > run

[*] Sending 10 probes to 192.168.1.143->192.168.1.143 (1 hosts)
[*] Discovered NTP on 192.168.1.143:123 (NTP v4)
[*] Discovered NetBIOS on 192.168.1.143:137 (INEEDAFW01:<00>:U :INEEDAFW01:<03>:U :INEEDAFW01:<20>:U :__MSBROWSE__:<01>:G :WORKGROUP:<1d>:U :WORKGROUP:<1e>:G :WORKGROUP:<00>:G :00:00:00:00:00:00)
[*] Discovered DNS on 192.168.1.143:53 (BIND 9.4.2-P2)
[*] Scanned 1 of 1 hosts (100% complete)
[*] Auxiliary module execution completed

sudo nmap -sU 192.168.1.143
PORT STATE SERVICE
53/udp open domain
69/udp openfiltered tftp
123/udp open ntp
137/udp open netbios-ns
138/udp openfiltered netbios-dgm

*took approx 13 min for results

Host #2

sudo unicornscan -m U -Ir 75 -v 192.168.1.94
UDP open sunrpc[ 111] from 192.168.1.94 ttl 50
UDP open shilp[ 2049] from 192.168.1.94 ttl 50


msf auxiliary(udp_sweep) > run

[*] Sending 10 probes to 192.168.1.94->192.168.1.94 (1 hosts)
[*] Discovered Portmap on 192.168.1.94:111 (100000 v2 TCP(111), 100000 v2 UDP(111), 100024 v1 UDP(35483), 100024 v1 TCP(34855), 100003 v2 UDP(2049), 100003 v3 UDP(2049), 100003 v4 UDP(2049), 100021 v1 UDP(51021), 100021 v3 UDP(51021), 100021 v4 UDP(51021), 100003 v2 TCP(2049), 100003 v3 TCP(2049), 100003 v4 TCP(2049), 100021 v1 TCP(32771), 100021 v3 TCP(32771), 100021 v4 TCP(32771), 100005 v1 UDP(54730), 100005 v1 TCP(50729), 100005 v2 UDP(54730), 100005 v2 TCP(50729), 100005 v3 UDP(54730), 100005 v3 TCP(50729))
[*] Scanned 1 of 1 hosts (100% complete)
[*] Auxiliary module execution completed

sudo nmap -sU 192.168.1.94 -v
PORT STATE SERVICE
111/udp open rpcbind
639/udp openfiltered unknown
2049/udp open nfs

*took approx 14 min

Quick notes:
unicornscan sucks for NTP, the metasploit udp_sweep is better even though the port is in the scan list it fails to locate NTP servers

you'll probably want to add some port to the /usr/local/etc/unicornscan/unicorn.conf file in the UDP section, namely 1434,1604,5093,& 523 to be consistent for what metasploit is sending probes for.

you may also want to update the ports list in the above folder to be les stupid as well.

In this case nmap gave consistent results, just took forever


compile stuff from here:
http://itbloggen.se/cs/blogs/olle_lindgren/archive/2009/01/08/unicornscan-on-ubuntu-8-10-intrepid-ibex.aspx?CommentPosted=true#commentmessage

http://geek00l.blogspot.com/2009/01/ubuntu-unicornscan-revisit.html

Its not nmap but it gets the job done -- portqry

Scanning once you are on the LAN can pose a problem. Nmap requires installing pcap and usually an interactive install (metacab is an option depending on scope) and some AV's will flag on those types of things (which is understandable). Since there is no native scanning capability in windows you are forced to either install something or upload a standalone binary. Foundstone's scanline is one option but its not one of my favorites. You can write your own and upload that but I'd hate to have some custom code submitted to some AV vendor by some motivated admin. Or you can upload Microsoft's portqry.

C:\>portqry -n server1.company.com -e 3389
Querying target system called:
server1.company.com
Attempting to resolve name to IP address...
Name resolved to 10.1.1.1
querying...
TCP port 3389 (unknown service): LISTENING

Checking out the KB article on portqry will give you some of its more useful features.
Some fun options are its ability to send default ldap queries:

portqry -n myserver -p udp -e 389

UDP port 389 (unknown service): LISTENING or FILTERED
Sending LDAP query to UDP port 389...

LDAP query response:

currentdate: 12/13/2003 05:42:40 (unadjusted GMT)
subschemaSubentry: CN=Aggregate,CN=Schema,CN=Configuration,DC=domain,DC=example,DC=com
dsServiceName: CN=NTDS Settings,CN=myserver,CN=Servers,CN=Default-First-Site-Name,CN=Sites,CN=Configuration,DC=domain,DC=example,DC=com
namingContexts: DC=domain,DC=example,DC=com
defaultNamingContext: DC=domain,DC=example,DC=com
schemaNamingContext: CN=Schema,CN=Configuration,DC=domain,DC=example,DC=com
configurationNamingContext: CN=Configuration,DC=domain,DC=example,DC=com
rootDomainNamingContext: DC=domain,DC=example,DC=com
supportedControl: 1.2.840.113556.1.4.319
supportedLDAPVersion: 3
supportedLDAPPolicies: MaxPoolThreads
highestCommittedUSN: 4259431
supportedSASLMechanisms: GSSAPI
dnsHostName: myserver.domain.example.com
ldapServiceName: domain.example.com:myserver$@domain.EXAMPLE.COM
serverName: CN=myserver,CN=Servers,CN=Default-First-Site-Name,CN=Sites,CN=Configuration,DC=domain,DC=example,DC=com
supportedCapabilities: 1.2.840.113556.1.4.800
isSynchronized: TRUE
isGlobalCatalogReady: TRUE
domainFunctionality: 0
forestFunctionality: 0
domainControllerFunctionality: 2

======== End of LDAP query response ========

UDP port 389 is LISTENING

and "sqlpings"

portqry -n 192.168.1.20 -e 1434 -p udp

You receive the following output:

Querying target system called:

192.168.1.20

querying...

UDP port 1434 (ms-sql-m service): LISTENING or FILTERED

Sending SQL Server query to UDP port 1434...

Server's response:

ServerName SQL-Server1
InstanceName MSSQLSERVER
IsClustered No
Version 8.00.194
tcp 1433
np \\SQL-Server1\pipe\sql\query

==== End of SQL Server query response ====

UDP port 1434 is LISTENING

It also does snmp queries and ISA queries and evidently RPC end-point mapping as well.

There are other fun features and the localhost options are worth looking into as well.

Some of the not so fun stuff. No randomizing ports. You can do an ordered list or ranges but no random. ONLY ONE HOST AT A TIME :-( but that's what batch files are for.

If anyone else is using this for pentests please let me know your thoughts.

Additional information on metacab: http://www.phx2600.org/forum/viewtopic.php?t=951&start=0

The Importance Of Internal Monitoring

So last assessment I got caught on the first internal port scan. Seems that all the internal routing was done via static routes so when I tried to scan a subnet that wasn't being used those packets would hit the firewall and then create a syslog error which in turn would display on the big TV in the NOC. Bummer for me...of course I didn't know this at the time, I just knew they saw me.

Second try. I had 2 class B's to look at so I took one of the shells from the snapshot viewer exploit and had it ping .0 of every class C in the network range. Whatever replied I took as a "good" subnet and if it didn't I marked it as not having anything listening and removed it from subsequent scans. Did I miss some boxes? Probably...didn't matter in this case.

Armed with my new ranges, minus off limit ones and dead ones, I started a new nmap scan looking for just a few ports that I had exploits for and let it roll at a blistering T2 pace. It did its thing and finished like 40 hours later and then I did my thing trying to do some manual enumeration and exploitation.

I upped the intensity as the week went on and never had any other trouble or any of my "worker bees" taken off line for misbehaving. So all was good.

At the outbrief it was determined that I found a fatal flaw with their system that there was no internal IDS monitoring for suspicious activity on the LAN. Had their been I probably would have been seen again but they had figured that anyone getting into the network would make the same mistake I had made the first time and scan or try to exploit non-used networks and they would catch them. I lucked out that 1) my ping sweep wasn't logged (should have been) or wasn't noticed after the fact and 2) I had more than one box on the LAN...I figured it was 50/50 that I would get seen with the ping sweep and worst case it would lead back to one of their boxes and not mine.

So what's the point? You need something watching your internal network even if its for the straight up blatant shit that could be happening. Had something been in place they would have definitely caught later port scans, enumeration, and exploit attempts.

playing with tnscmd.pl for oracle version identification

doing a little bit of playing with tnscmd.pl on oracle

cg@segfault:~/evil/scanners$ perl tnscmd.pl version -h 192.168.0.242 --indent
sending (CONNECT_DATA=(COMMAND=version)) to 192.168.0.242:1521
writing 90 bytes
reading
.M.......6.........-. ..........
DESCRIPTION=
TMP=
VSNNUM=169869824
ERR=0

.\........TNSLSNR for Linux: Version 10.2.0.2.0 - Production..TNS for Linux: Version 10.2.0.2.0 - Production..Unix Domain Socket IPC NT Protocol Adaptor for Linux: Version 10.2.0.2.0 - Production..Oracle Bequeath NT Protocol Adapter for Linux: Version 10.2.0.2.0 - Production..TCP/IP NT Protocol Adapter for Linux: Version 10.2.0.2.0 - Production,,.........@

or

cg@segfault:~/evil/scanners$ perl tnscmd.pl status -h 192.168.1.114 --indent
sending (CONNECT_DATA=(COMMAND=status)) to 192.168.1.114:1521
writing 89 bytes
reading
. .......6.........m. ...........w........
DESCRIPTION=
TMP=
VSNNUM=153093376
ERR=0
ALIAS=LISTENER
SECURITY=OFF
VERSION=TNSLSNR for Linux: Version 9.2.0.5.0 - Production
START_DATE=13-AUG-2007 19:01:21
SIDNUM=1
LOGFILE=/u01/app/oracle/product/9.2.0.1.0/network/log/listener.log
PRMFILE=/u01/app/oracle/product/9.2.0.1.0/network/admin/listener.ora
TRACING=off
UPTIME=71462092
SNMP=OFF
PID=3833

.#........
ENDPOINT=
HANDLER=
HANDLER_MAXLOAD=0
HANDLER_LOAD=0
ESTABLISHED=0
REFUSED=0
HANDLER_ID=379BDD72B603-9E0F-E040-007F01000EF9
PRE=any
SESSION=NS
DESCRIPTION=
ADDRESS=
PROTOCOL=ipc
KEY=EXTPROC
,,
ENDPOINT=
HANDLER=
HANDLER_MAXLOAD=0
HANDLER_LOAD=0
ESTABLISHED=0
REFUSED=0
HANDLER_ID=379BDD72B604-9E0F-E040-007F01000EF9
PRE=any
SESSION=NS
DESCRIPTION=
ADDRESS=
PROTOCOL=tcp
HOST=OracleServer
PORT=1521
,,
ENDPOINT=
HANDLER=
STA=ready
HANDLER_MAXLOAD=0
HANDLER_LOAD=0
ESTABLISHED=0
REFUSED=0
HANDLER_ID=379BDD72B60C-9E0F-E040-007F01000EF9
PRE=http
SESSION=RAW
DESCRIPTION=
ADDRESS=
PROTOCOL=tcp
HOST=OracleServer
PORT=8080

Presentation=HTTP
Session=RAW
,,
ENDPOINT=
HANDLER=
STA=ready
HANDLER_MAXLOAD=0
HANDLER_LOAD=0
ESTABLISHED=0
REFUSED=0
HANDLER_ID=379BDD72B60D-9E0F-E040-007F01000EF9
PRE=FTP
SESSION=RAW
DESCRIPTION=
ADDRESS=
PROTOCOL=tcp
HOST=OracleServer
PORT=2100

Presentation=FTP
Session=RAW
,,
SERVICE=
SERVICE_NAME=PLSExtProc
INSTANCE=
INSTANCE_NAME=PLSExtProc
NUM=1
INSTANCE_STATUS=UNKNOWN
NUMREL=1
,,
SERVICE=
SERVICE_NAME=orcl
INSTANCE=
INSTANCE_NAME=orcl
NUM=1
INSTANCE_STATUS=UNKNOWN
NUMREL=1

INSTANCE=
INSTANCE_NAME=orcl
NUM=2
NUMREL=1
,,
SERVICE=
SERVICE_NAME=orclXDB
INSTANCE=
INSTANCE_NAME=orcl
NUM=2
NUMREL=1

-------------
Interesting TNS Listener commands

ping Pings the listener

version Provides output of the listener version and platform information

status Returns the current status and variables used by the listener

debug Dumps debugging information to the listener log

reload Reloads the listener config file

services Dumps service data

save_config Writes the listener config file to a backup location

stop Shuts down the listener Shuts down the listener

-------------
LINKS!, everyone loves links...

tnscmd available from: http://www.jammed.com/~jwa/hacks/security/tnscmd/tnscmd

tnscmd documentation:
http://www.jammed.com/~jwa/hacks/security/tnscmd/tnscmd-doc.html

useful post on identifying oracle:
http://www.pentest.co.uk/documents/ora_db_on_network.htm

-CG

Nmap's ircServerInfo script

This summary is not available. Please click here to view the post.