HTB Academy Firewall and IDS/IPS Evasion - Medium Lab
HTB Academy Firewall and IDS/IPS Evasion - Medium Lab: After we conducted the first test and submitted our results to our client, the administrators made some changes and improvements to the IDS/IPS and firewall. We could hear that the administrators were not satisfied with their previous configurations during the meeting, and they could see that the network traffic could... • HTB Academy • htb-academy, ids
After we conducted the first test and submitted our results to our client, the administrators made some changes and improvements to the IDS/IPS and firewall. We could hear that the administrators were not satisfied with their previous configurations during the meeting, and they could see that the network traffic could be filtered more strictly.
After the configurations are transferred to the system, our client wants to know if it is possible to find out our target's DNS server version. Submit the DNS server version of the target as the answer.
For this lab I was testing all the different examples of nmap scans they provided then customized them:
there was clear difference between the speed each of the types of scans provided:
Nmap scan report for 10.129.46.67 Host is up (0.012s latency). Not shown: 65527 closed tcp ports (reset) PORT STATE SERVICE VERSION 21/tcp open ftp? 22/tcp open ssh OpenSSH 7.2p2 Ubuntu 4ubuntu2.10 (Ubuntu Linux; protocol 2.0) | ssh-hostkey: | 2048 71:c1:89:90:7f:fd:4f:60:e0:54:f3:85:e6:35:6c:2b (RSA) | 256 e1:8e:53:18:42:af:2a:de:c0:12:1e:2e:54:06:4f:70 (ECDSA) |_ 256 1a:cc:ac:d4:94:5c:d6:1d:71:e7:39:de:14:27:3c:3c (ED25519) 53/tcp filtered domain 80/tcp open http Apache httpd 2.4.18 ((Ubuntu)) |_http-server-header: Apache/2.4.18 (Ubuntu) |_http-title: Apache2 Ubuntu Default Page: It works 110/tcp open pop3 Dovecot pop3d |_pop3-capabilities: SASL RESP-CODES CAPA AUTH-RESP-CODE UIDL TOP PIPELINING 139/tcp open netbios-ssn Samba smbd 4.3.11-Ubuntu (workgroup: WORKGROUP) 143/tcp open imap Dovecot imapd |_imap-capabilities: post-login more Pre-login IDLE have LITERAL+ ID IMAP4rev1 listed capabilities SASL-IR ENABLE LOGINDISABLEDA0001 LOGIN-REFERRALS OK 445/tcp filtered microsoft-ds No exact OS matches for host (If you know what OS is running on it, see https://nmap.org/submit/ ). TCP/IP fingerprint: OS:SCAN(V=7.92%E=4%D=11/2%OT=21%CT=1%CU=39566%PV=Y%DS=2%DC=T%G=Y%TM=63625D4 OS:9%P=x86_64-pc-linux-gnu)SEQ(SP=109%GCD=1%ISR=10B%TI=Z%CI=I%II=I%TS=8)OPS OS:(O1=M539ST11NW7%O2=M539ST11NW7%O3=M539NNT11NW7%O4=M539ST11NW7%O5=M539ST1 OS:1NW7%O6=M539ST11)WIN(W1=7120%W2=7120%W3=7120%W4=7120%W5=7120%W6=7120)ECN OS:(R=Y%DF=Y%T=40%W=7210%O=M539NNSNW7%CC=Y%Q=)T1(R=Y%DF=Y%T=40%S=O%A=S+%F=A OS:S%RD=0%Q=)T2(R=N)T3(R=N)T4(R=Y%DF=Y%T=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)T5(R OS:=Y%DF=Y%T=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)T6(R=Y%DF=Y%T=40%W=0%S=A%A=Z%F OS:=R%O=%RD=0%Q=)T7(R=Y%DF=Y%T=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)U1(R=Y%DF=N% OS:T=40%IPL=164%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=G%RUD=G)IE(R=Y%DFI=N%T=40%CD OS:=S) Network Distance: 2 hops Service Info: Host: HTB984NIFN97CBO783QBNJCPAS984UIN; OS: Linux; CPE: cpe:/o:linux:linux_kernel Host script results: | smb-os-discovery: | OS: Windows 6.1 (Samba 4.3.11-Ubuntu) | Computer name: nix-nmap-medium | NetBIOS computer name: HTB984NIFN97CBO783QBNJCPAS984UIN\x00 | Domain name: \x00 | FQDN: nix-nmap-medium |_ System time: 2022-11-02T13:07:12+01:00 |_clock-skew: mean: -18m00s, deviation: 34m37s, median: 1m58s | smb2-security-mode: | 3.1.1: |_ Message signing enabled but not required |_nbstat: NetBIOS name: HTB984NIFN97CBO, NetBIOS user: , NetBIOS MAC: (unknown) | smb-security-mode: | account_used: guest | authentication_level: user | challenge_response: supported |_ message_signing: disabled (dangerous, but default) | smb2-time: | date: 2022-11-02T12:07:12 |_ start_date: N/A TRACEROUTE (using port 995/tcp) HOP RTT ADDRESS 1 13.07 ms 10.10.14.1 2 13.20 ms 10.129.46.67 OS and Service detection performed. Please report any incorrect results at https://nmap.org/submit/ . Nmap done: 1 IP address (1 host up) scanned in 341.68 seconds
though I fall back on the simplified one:
sudo nmap -sSU -p 53 --script dns-nsid 10.129.46.67 Starting Nmap 7.92 ( https://nmap.org ) at 2022-11-02 12:21 GMT Nmap scan report for 10.129.46.67 Host is up (0.010s latency). PORT STATE SERVICE 53/tcp open domain 53/udp open domain | dns-nsid: |_ bind.version: HTB{GoTtgUnyze9Psw4vGjcuMpHRp} Nmap done: 1 IP address (1 host up) scanned in 0.83 seconds