Linux Host & Network Information Gathering
For this portion of my notes I will be focusing on collecting information useful for someone attempting to leverage a breached system to further their attack. Here I would be talking about some of the tools and resources that is native within a Linux system that may help scope out a scene. Additionally mentioning some tactics the attacker may use when sniffing or scanning an area with minimal detection.
Ifconfig is a tool that details how network interfaces are being used. This tool could help give more context to the attacker on how long this system has been running. Additionally detailing whether how much interaction this system has with other networks. Such context is useful when one needs to limit their traffic production to be within normal levels, therefore minimalizing their presence. Another detail that could be useful is how stable the network connections are. Letting one to know how careful they should be to appear stable when performing any scanning. Below I expanded on some of the output from ifconfig:
Eth0: name of the interface
Link encap: Link encapsulation type, in this case refers to an ethernet wire
HWaddr: MAC address of the system, the first fields can help infer the type of hardware via lookup
Inet addr: ip address of system and type (192.168. Infers that this uses DHCP)
Bcast: broadcast ip that communicate to all ip address (ipv4 255 is the max)
Mask: infers the size of the sub network
Inet6 addr: IPv6 address for the system
MTU: Maximum transmission unit of data of this system
RX packets: Received packets
Errors: Errors occurred within connections
Dropped: Dropped packets within connections
TX packets: transmitted packets
-g: details multicast group memberships by this flag
lo: refers to our loopback interface, which is information that only is directed to the host system
224.0.0.251: a IPv4 reserve multicast ip address
Eth0: refers to a ethernet cable connection
Destination: refers to networks involved in the routing scheme
Default: refers to networking paths default ip route (default gateway)
Genmask: refers to the size of the subnet from a given ip
IFace: refers to the network interface
This table describes details of a system’s interfaces.
Iface: interface name
MTU: Maximum transmission unit
RX-OK: OK received packets
TX-OK: OK received packets
Many of the these details are self explanatory but here are some of which I expended on for further understanding:
Forwarded: entails whether or not the system sends packers on behalf of others similar to a router.
Incoming packets discarded: refers to bad input, a trait an attacker would want to avoid being detected as.
Internet Control Message Protocol, a protocol within the IP suite that manages error messages and management inquiries within a network. For instance it would be used when informing a system of a host within a network being unreachable via pinging. The following output list the activity observed at this system. Such as message received, input/output failed, and echo requests. The following commands like ping may trigger a IDS as this system is seen not to be pinged a lot.
Active connections refers to tcp connections that have been sending data over the network, while passive refers to tcp open connections that have not. The amount of segments sent and received details a system that doesn’t seem to interact with the network too much; within a tcp context.
This output details the amount of packets that are sent and received. Additionally the behavior that is seen from these packets such as any errors. Useful for an attacker to understand how to leverage UDP communication under what appears to be normal behavior.
This details the address resolution protocol tables. Essentially information that helps track down ip addresses and their corresponding MAC addresses. May potentially give context of the machine involved when breached via a MAC address lookup.
A file that details information of databases within a network that this host system knows of.
Details recognized DNS servers.
Using nmap on one's own host will allow some sort of interaction with its own interfaces. Perhaps revealing information on this host that netstat otherwise did not inform us. This will not send packets outside the host. Here we have three open ports. Tor of course being a protocol not typical within a work environment.
Linux Network Information Gathering
Nmap could be a great tool for an attacker attempting to scope out its next host when one wants to pivot. Here is a list of options an attacker may attempt to discover other ports as well as scanning them. Some of which may strategically allow them to scope out these details with minimal notice. For instance when one scans a host with a TCP SYN/Connect(), where within an environment may either drop or start the 3-way handshake.
The -sV flag allows for the attacker to probe what kind of services are running at that port. For instance it could reveal the version of ssh that the system is running. The attacker would count themselves lucky if they found it running ssh version 1, now known to be vulnerable for man-in-the-middle attacks.
Passive OS fingerprinting (p0f) is a form of scanning that is minimal in its work compared to its nmap counterpart. This listens to any traffic with the purpose of identifying other hosts. This is all down without outputting any traffic of its own
Tcpdump is a packet sniffer that details readable information to the user. Some of the details highlighted show information an attacker may infer as useful through this tool. Such as the domain that this ack message is involved with. Additionally the windows size of this packet may infer the typical OS that develops towards this size.
Tshark is the command line version of wireshark. Similar to tcpdump but with more capabilities on how data can be read.
Comments
Post a Comment