HTB Academy Firewall and IDS/IPS Evasion - Easy Lab

Firewall and IDS/IPS Evasion - Easy Lab

  Now let's get practical. A company hired us to test their IT security defenses, including their `IDS` and `IPS` systems. Our client wants to increase their IT security and will, therefore, make specific improvements to their `IDS/IPS` systems after each successful test. We do not know, however, according to which guidelines these changes will be made. Our goal is to find out specific information from the given situations.

We are only ever provided with a machine protected by IDS/IPS systems and can be tested. For learning purposes and to get a feel for how IDS/IPS can behave, we have access to a status web page at:

Our client wants to know if we can identify which operating system their provided machine is running on. Submit the OS name as the answer.

For this lab I was testing all the different examples of nmap scans they provided then customized them:

Firewall and IDS/IPS Evasion - Easy Lab

🎯 Objective

Identify the operating system running on the target that sits behind IDS/IPS controls, and submit the OS name as the answer.

Status page accessible for learning; target exposed services respond to scans with varying sensitivity.

🧭 Enumeration & Evasion Attempts

I tried multiple scan styles to see what slips past controls and still yields useful banners/fingerprints.

Quick reachability / banner check

ncat -nv --source-port 53 10.129.2.80 10001
# Result (excerpt)
# Host is up (0.16s latency).
# Ports open: 22/tcp (ssh), 80/tcp (http), 10001/tcp (scp-config)

Mixed ACK/SYN and trace to gauge filtering

sudo nmap 10.129.2.80 -p 21,22,25 -sA -Pn -n --disable-arp-ping --packet-trace
sudo nmap 10.129.2.80 -p 21,22,25 -sS -Pn -n --disable-arp-ping --packet-trace
# Results showed:
# 21/tcp unfiltered, 22/tcp unfiltered, 25/tcp filtered

Full service/version detection (worked best)

nmap -A -p- 10.129.2.80

Output (key lines):

22/tcp open  ssh   OpenSSH 7.2p2 Ubuntu 4ubuntu2.10 (Ubuntu Linux; protocol 2.0)
80/tcp open  http  Apache httpd 2.4.18 ((Ubuntu))
|_http-title: Apache2 Ubuntu Default Page: It works
|_http-server-header: Apache/2.4.18 (Ubuntu)
10001/tcp open  scp-config?
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel

🔎 Reasoning → OS Identification

Multiple independent banners explicitly reference Ubuntu:

• OpenSSH 7.2p2 Ubuntu 4ubuntu2.10
• Apache/2.4.18 (Ubuntu)
• Default Apache landing page title: “Apache2 Ubuntu Default Page: It works”

While Nmap’s generic OS CPE points to Linux, the service banners and server header pin this to Ubuntu Linux (very likely an older LTS based on versions).

✅ Final Answer

Ubuntu

🧰 Commands Recap

# broad version detect
nmap -A -p- 10.129.2.80

# selective ports with different scan types
sudo nmap 10.129.2.80 -p 21,22,25 -sA -Pn -n --disable-arp-ping --packet-trace
sudo nmap 10.129.2.80 -p 21,22,25 -sS -Pn -n --disable-arp-ping --packet-trace

# banner poke on high port with spoofed source port
ncat -nv --source-port 53 10.129.2.80 10001

🧪 Notes

• IDS/IPS may throttle or drop certain scan styles; fingerprint gently, then escalate.
• Headers/banners often betray the OS even when OS detection is fuzzy.
• If banners are stripped, look for distro‑specific defaults (e.g., default Apache pages) or TLS JA3, DHCP/DNS hints, etc.