How to Detect NMAP Scan Using Snort

Today we are going to discuss how to Detect NMAP scan using Snort but before moving ahead kindly read our privious both articles releted to Snort Installation (Manually or using apt-respiratory)and its rule configuration to enable it as IDS for your network.

Basically in this article we are testing Snort against NMAP various scan which will help network security analyst to setup snort rule in such a way so that they become aware of any kind of NMAP scanning.

Requirement

Attacker: Kali Linux (NMAP Scan)

Target: Ubuntu (Snort as IDS)

Optional: Wireshark (we have added it in our tutorial so that we can clearly confirm all incoming and outgoing packet of network)

Let’s Begins!!

Identify NMAP Ping Scan

As we know any attacker will start attack by identifying host status by sending ICMP packet using ping scan. Therefore be smart and add a rule in snort which will analyst NMAP Ping scan when someone trying scan your network for identifying live host of network.

Execute given below command in ubuntu’s terminal to open snort local rule file in text editor.

sudo gedit /etc/snort/rules/local.rules

Now add given below line which will capture the incoming traffic coming on 192.168.1.105(ubuntu IP) network for ICMP protocol.

alert icmp any any -> 192.168.1.105 any (msg: "NMAP ping sweep Scan "; dsize:0;sid:10000004; rev: 1;)

Turn on IDS mode of snort by executing given below command in terminal:

sudo snort -A console -q -u snort -g snort -c /etc/snort/snort.conf -i eth0

Now using attacking machine execute given below command to identify status of target maching i.e. host is UP or Down.

nmap   -sP 192.168.1.105 --disable-arp-ping

If you will execute above command without parameter “disable arp-ping” then will work as default ping sweep scan which will send arp packets inspite of sending ICMP on targets network and may be snort not able to capture NMAP Ping scan in that sinario, therefore we had use parameter “disable arp-ping” in above command.

As I had declaimed above why we are involving wireshark in this tutorial so that you can clearly see the packet sends form attacker network to targets network. Hence in given below image you can notice ICMP request packet as well as ICMP reply packets both are part of network traffic.

Come back to over your target machine where snort is capturing all in coming traffic here your will observe that it is generating alert for NMAP Ping Sweep scan. . Hence you can block attacker’s IP to protect your network from further scanning.

Identify NMAP TCP Scan

Now in order to connect with target network, attacker may go with networking enumeration either using TCP Protocol or UDP protocol. Let assume attacker may choose TCP scanning for network enumeration then in that situation we can apply following rule in snort local rule file.

alert tcp any any -> 192.168.1.105 22 (msg: "NMAP TCP Scan"; sid:10000005; rev:2; )

Above rule is only applicable for port 22 so if you want to scan any other port then replace 22 from the port you want to scan else you can also use “any” to analysis all ports. Enable NIDS mode of snort as done above.

Now again using attacker machine execute the given below command for TCP scan on port 22.

nmap -sT -p22 192.168.1.105

From given below image you can observe wireshark has captured TCP packets from 192.168.1.104 to 192.168.1.105

Here you can confirm that our snort is absolutely working when attacker is scanning port 22 using nmap TCP scan and it is showing attacker’s IP from where traffic is coming on port 22. Hence you can block this IP to protect your network from further scanning.

Identify NMAP XMAS Scan

As we know that TCP communication follows three way handshake to established TCP connection with target machine but sometimes instead of using SYN, SYN/ACK,ACK flag attacker choose XMAS scan to connect with target by sending data packets through Fin, PSH & URG flags.

 Let assume attacker may choose XMAS scanning for network enumeration then in that situation we can apply following rule in snort local rule file.

alert tcp any any -> 192.168.1.105 22 (msg:"Nmap XMAS Tree Scan"; flags:FPU; sid:1000006; rev:1;)

Again above rule is only applicable for port 22  which will listen for incoming traffic when packets come from Fin, PSH & URG flags .So if you want to scan any other port then replace 22 from the port you want to scan else you can also use “any” to analysis all ports. Enable NIDS mode of snort as done above.

Now again using attacker machine execute the given below command for XMAS scan on port 22.

nmap -sX -p22 192.168.1.105

From given below image you can observe that wireshark is showing 2 packets from attacker machine to target machine has been send using FIN, PSH, URG flags.

Come back to over your target machine where snort is capturing all in coming traffic here your will observe that it is generating alert for NMAP XMAP scan. . Hence you can block attacker’s IP to protect your network from further scanning.

Identify NMAP FIN Scan

Instead of using SYN, SYN/ACK and ACK flag to established TCP connection with target machine may attacker choose FIN scan to connect with target by sending data packets through Fin flags only.

 Let assume attacker may choose FIN scanning for network enumeration then in that situation we can apply following rule in snort local rule file.

alert tcp any any -> 192.168.1.1045 22 (msg:"Nmap FIN Scan"; flags:F; sid:1000008; rev:1;)

Again above rule is only applicable for port 22 which will listen for incoming traffic when packets come from Fin Flags. So if you want to scan any other port then replace 22 from the port you want to scan else you can also use “any” to analysis all ports. Enable NIDS mode of snort as done above.

Now again using attacker machine execute the given below command for FIN scan on port 22.

nmap -sF -p22 192.168.1.105

From given below image you can observe that wireshark is showing 2 packets from attacker machine to target machine has been send using FIN flags.

Come back to over your target machine where snort is capturing all in coming traffic here your will observe that it is generating alert for NMAP FIN scan. Hence you can block attacker’s IP to protect your network from further scanning.

Identify NMAP NULL Scan

Instead of using SYN, SYN/ACK and ACK flag to established TCP connection with target machine may attacker choose NULL scan to connect with target by sending data packets through NONE flags only.

 Let assume attacker may choose FIN scanning for network enumeration then in that situation we can apply following rule in snort local rule file.

alert tcp any any -> 192.168.1.105 22 (msg:"Nmap NULL Scan"; flags:0; sid:1000009; rev:1;)

Again above rule is only applicable for port 22 which will listen for incoming traffic when packets come from NONE Flags. So if you want to scan any other port then replace 22 from the port you want to scan else you can also use “any” to analysis all ports. Enable NIDS mode of snort as done above.

Now again using attacker machine execute the given below command for NULL scan on port 22.

nmap -sN -p22 192.168.1.105

From given below image you can observe that wireshark is showing 2 packets from attacker machine to target machine has been send using NONE flags.

Come back to over your target machine where snort is capturing all in coming traffic here your will observe that it is generating alert for NMAP Null scan. Hence you can block attacker’s IP to protect your network from further scanning.

Identify NMAP UDP Scan

In order to Identify open UDP port and running services attacker may chose NMAP UDP scan to establish connection with target machine for network enumeration then in that situation we can apply following rule in snort local rule file.

alert UDP any any -> 192.168.1.105 68 (msg:"Nmap UDPScan"; sid:1000010; rev:1;)

Again above rule is only applicable for port 68 which will listen for incoming traffic when packets come from NONE Flags. So if you want to scan any other port then replace 68 from the port you want to scan else you can also use “any” to analysis all ports. Enable NIDS mode of snort as done above.Identify NMAP UDP Scan

In order to Identify open UDP port and running services attacker may chose NMAP UDP scan to establish connection with target machine for network enumeration then in that situation we can apply following rule in snort local rule file.

alert UDP any any -> 192.168.1.105 68 (msg:"Nmap UDPScan"; sid:1000010; rev:1;)

Again above rule is only applicable for port 68 which will listen for incoming traffic when packets come from NONE Flags. So if you want to scan any other port then replace 68 from the port you want to scan else you can also use “any” to analysis all ports. Enable NIDS mode of snort as done above.

Now again using attacker machine execute the given below command for NULL scan on port 22.

nmap -sU -p68 192.168.1.105

From given below image you can observe that wireshark is showing 2 packets from attacker machine to target machine has been send over UDP Port.

Come back to over your target machine where snort is capturing all in coming traffic here your will observe that it is generating alert for NMAP UDP scan. Hence you can block attacker’s IP to protect your network from further scanning.

Understating Guide of Windows Security Polices and Event Viewer

Hello friends! This article will be helpful to considerate the importance of event viewer and how to read the logs generated by event view that help in troubleshoot of any system or application problem.  

 In order to view Event logs press “window key + R” to open run command and type “eventvwr.msc” then hit enter key.

Windows Event Viewer is a tool which monitors activity of your system by maintaining some kinds of log such as application log, system log and etc. It start automatically when you turn on your system assemble the details critical state about hardware and software. These logs help a system administrator to troubleshoot the problems of machine and identify with what is going on. He could use Event Viewer to view and manage the event logs.

From below image you can observe the window screen is categories into three panels as describe below:

The left side contains some folders which keep records of every task perform by machine such as windows log i.e. system or security.

 The middle part contains a list of events, it contains detail of every event occurred by recording their logs which is known as Event type such as “information, warning or error” and their details.

The right side presents list of some other actions such as creating custom views, filtering, or even creating a scheduled task depends on a specific event.

Most Important Event Logs

Remarkably there are three kinds of Event Logs:

System Log: Any action or task performed by operating system such as such unexpected shutdown and turn ON/OFF of any service is recorded under the System log.

Application Log: The Application log records all events by programs such as successful installation or stop responding while running.

Security Log:  The Security log records security events, such as legitimate and unacceptable logon attempts which will represent as audit success for valid attempt and audit failure for invalid attempt.  These logs help in identifying any possible breaches to security. By default security log is disabled you need to enable them for you system through local security policy.

Enable Local Security Policy for Security logs

Now open Local security policy logs press “window key + R” to open run command and type “secpol.msc” then hit enter key, then change security setting for Audit policy under security setting > Local policies> Audit policy in order to receive its log inside event viewer security logs.

Form given below image you can observe that there is not any single security policy is auditing, which means it will not create any security log inside event viewer. 

Let’s enable any one policy for auditing to test what kind of security log will be generated when we will move into event viewer security log. Here I had chosen “Audit account logon event” for auditing.

It will open a new window for its property setting you as shown in given image Enable the check box for Success and Failure, click on apply to enable this policy for auditing.

Hence when a user will Enter password on logon screen it will generate log as audit success for valid login attempt and audit failure logs for invalid attempt. 

Now you can observe from given below image it is showing auditing: success & failure for account logon event.

Check by Practical

You can check it by login into your system and type wrong password as invalid attempt and then finally enter correct password for valid attempt and then verify generated security logs for you this kind of action.

In order to view Security Event logs press “window key + R” to open run command and type “eventvwr.msc” then hit enter key.

Now explore Security event logs under Windows logs, here you will observe some log entries generated by Security-Auditing as Audit success for valid login attempt and Audit failure for invalid login attempt.

Event Types

The details of logs are depends upon different types of event and event logs mainly classify in five categories as describe below:

Event Type	Definition
Error	A considerable trouble, such as loss of data or loss of functionality or fault in problem execution.
Warning	This type of event that might not be considerable, but might point out a future problem.
Information	An event that describes the successful operation of an application, driver, or service.
Success Audit	An audited security access attempt that succeeds. {In security logs}
Failure Audit	An audited security access attempt that fails. {In security logs}

From given below image you can observe that the logs are records in 5 columns to store their important details

Level: displays event type

Date and time: displays the date and time of event type when it generated

Source: source of event type due to which event log is created.

Event Id: The Event Viewer uses event IDs to describe the uniquely identifiable events that a Windows computer can come upon. 

Task category: Used to represent an activity of the event launcher program.

General Details of Event Log

Admin can took help of General property in order to read brief description of event log which could be helpful in troubleshoot of some problems. He can also read complete detail of property for any occurred event which is stored under Details Tab.

General property contains following information of an event log: 

Property name	Description
Log Name	Window log category it may be system, application or security logs.
Source	The source that produced the event. It might be any application or system component
Event Id	The Event Viewer uses event IDs to describe the uniquely identifiable events that a Windows computer can come upon.
Level	Information, Warning, Error, Success Audit and Failure Audit
User	Display user name who has logged onto the computer when the event occurred
OpCode	Operational code Contains a numeric value that identifies the activity or a point within an activity that the application was performing when it raised the event. For example, initialization or closing.
Logged	The name of the log where the event was recorded
Task category:	Used to represent an activity of the event launcher program.
Keywords	It can be used to filter or search for events. Such as “audit failure” or "Respond time."
Computer	The computer where the event occurred

Clear Logs

If you want to remove entire records of logs then move your cursor at right side of window screen and click on option “clear log” under Action tab as shown in given below image. Then a dialog box will pop up to confirm your action, here it let you to save the previous log in other location.   

Create Custom Event

If you want to keep record of specific event type for a particular task occurred then you can use “custom event” which will only keep records of those event type which you have defined for a particular service or application.

Again move your cursor at right side of window screen and click on option “custom event” under Action tab as shown in given below image.

A window screen will pop up which will generate a customize log according to you. From given below image you can observe that I wish to get few event type for which check box is enabled from event source as Remote access only for invalid login attempt.

This custom event log will saved in a new folder “RDP” under event viewer > custom view. Enter the name for your event log and description as shown in given below image. It decreases the level of records and makes an ease in problem troubleshoot.

Deleting Event viewer from victims system

This section is applicable only for hacked system, so if you have hacked any windows machine using Kali Linux and obtain victim’s meterpreter session then run given below command for deleting all record of logs from his system. Preserve yourself from being caught by any kind of investigation.

Meterpreter> clearev

Confgiure Snort in Ubuntu (Easy Way)

In our previous article we had discussed “Manually Snort Installation” in your system but there is another method also available by apt-repository which reduce your manually effort and automatically configure snort in your system.

Snort is software created by Martin Roesch, which is widely use as Intrusion Prevention System [IPS] and Intrusion Detection System [IDS] in network. It is separated into the five most important mechanisms for instance: Detection engine, Logging and alerting system, Packet decoder, Preprocessor and Output modules.

The program is quite famous to carry out real-time traffic analysis, also used to detect query or attacks, packet logging on Internet Protocol networks, to detect malicious activity, denial of service attacks and port scans by monitoring network traffic, buffer overflows, server message block probes, and stealth port scans.

Snort can be configured in three main modes:

·         Sniffer mode: it will observe network packets and present them on the console.

·         Packet logger mode: it will record packets to the disk.

·         Intrusion detection mode: the program will monitor network traffic and analyze it against a rule set defined by the user.

After that the application will execute a precise action depend upon what has been identified.

Let’s Begin!!

Snort Installation

We had chosen ubuntu 16.02 operating system for installation and configuration of snort. Earlier than installing snort in your machine, you should need to install necessary dependencies of ubuntu.

Check your network interface configuration by executing ifconfig command; from here I came to know 192.168.1.107 is my network IP.

Earlier than installing snort in your machine, you should need to install necessary dependencies of ubuntu. Therefore open the terminal and type given below command to install pre-requisites by a making update.

sudo apt-get update

It is an easiest way to install and configure the snort is your system because all its requirement whether it is snort rules directory or logging directory every packages is are stored by apt repository. Enter given below command to begin the snort installations. 

sudo apt-get install snort*

By defaut eth0 is listening interface is set in snort configuration since my network belongs to ens33,  therefore I choose it as listening interface as shown in given below image.

In next configuration step it will ask to enter CIDR value for address range for local network. From given image you can observe I had mention CIDR 192.168.1.1/24 for a range of 256 address.

You can also multiple values by using comma without space to separate those address

After then open the configuration file using gedit for making some changes inside.

sudo gedit /etc/snort/snort.conf

Scroll down the text file near line number 45 to specify your network for protection as shown in given image.

#Setup the network addresses you are protecting

 ipvar HOME_NET 192.168.1.1/24

Now run given below command to enable IDS mode of snort

sudo snort -A console -i ens33 -c /etc/snort/snort.conf

Now it will compile the complete file and test the configuration setting automatically as shown in given below image:

Great!! We had successfully configured snort as IDS for protecting our network.

[Note: If apt- repository get failed to install snort then go with manual configuration from here.]

Post Exploitation for Remote Windows Password

In this article you will leran how to extract Windows users password and change extracted password using metasploit framework. 

Here you need to exploit target machine once to obtain meterpreter session and then bypass UAC for admin privilege.

Requirement:

Attacker: kali Linux

Target: windows 7

 Let’s Begin

Extracting User Account Password

1^st method

 So when your get meterpreter session of target system then follows given below steps:  

Execute given below command which will dump Hash value of all saved password of all windows users as shown in given below image.

meterpreter> hashdump

Now copy all hash value in a text file as shown below and save it. I had saved it as hash.txt on the desktop. It contains hash value of 4 users with SID value as 500: Administrator; 501: Guest; 1001: Penetst; 1000: Raj with their hash password.

Run your capture session in background:

meterpreter > background

Now a new terminal and use john the ripper to crack the hash by executing given below command:

john --wordlist=/root/Desktop/pass.txt --format=NT /root/Desktop/hashes.txt

/root/Desktop/pass.txt contain path of your password dictionary

/root/Desktop/hashes.txt contain path of hash password value

From given below image you can confirm we had successfully retrieved the password: 123 for user: raj by cracking its hash value.

2^nd Method

This module will dump the local user accounts from the SAM database using the registry.

use post/windows/gather/hashdump

msf post(hashdump) > set session 2

msf post(hashdump) > exploit

From given below image you can observe again we obtained hash value for local user account, repeat above step to crack these value using john the ripper.

If you will notice the highlighted text then you will observe that it has capture password hint for user RAJ: “first three digits”

3rd Method

This will dump local accounts from the SAM Database. If the target host is a Domain Controller, it will dump the Domain Account Database using the proper technique depending on privilege level, OS and role of the host.

use post/windows/gather/smart_hashdump

msf post(smart_hashdump) > set session 2

msf post(smart_hashdump) > exploit

From given below image you can observe again we obtained hash value for RAJ and Administrator account, repeat above step to crack these value using john the ripper. Moreover it has capture same password hint for User Raj.

4^th Method

This module harvests credentials found on the host and stores them in the database.

use post/windows/gather/credentials/credential_collector

msf post(credential_collector) > set sessions 2

msf post(credential_collector) > exploit

This exploit also work in same manner and dump the hash value for local user account as shown in given below image, repeat above step to crack these value using john the ripper.

5^th Method

This module will collect clear text Single Sign On credentials from the Local Security Authority using the Mimikatz extension. Blank passwords will not be stored in the database.

use post/windows/gather/credentials/sso   

msf post(sso) > set sessions 2

msf post(sso) > exploit

This exploit will dump clear text password of login user as shown in given below image user: raj and password: 123

6^th Method

At meterpereter session we can enable option “kiwi” which work similarly as “mimikatz” in windows, execute given below command: 

meterprerter > load kiwi

Now run following command which will extract all saved credential of local user account as shown in given below image, here also we had successfully  retrieve  password: 123 of user: raj

meterpreter > cred all

7^th Method

This module is able to perform a phishing attack on the target by popping up a login prompt. When the user fills credentials in the login prompt, the credentials will be sent to the attacker. The module is able to monitor for new processes and popup a login prompt when a specific process is starting.

use post/windows/gather/phish_windows_credentials

 msf post(phish_windows_credentials) > set session 2

msf post(phish_windows_credentials) > exploit

As define above it will launch fake login prompt which will appear genuine to victim on his logon screen and wait for user to his credential.

At logon screen user will get a fake pop for his credential as his will enter his username and password for login into his system, attacker at background will sniff the entered credential.

From given below image you can observe the sniff credential for user raj. It saved username, domain and password in a table.

Change password of victims system

1^st Method

This module will attempt to change the password of the targeted account. The typical usage is to change a newly created account's password on a remote host to avoid the error, 'System error 1907 has occurred,' which is caused when the account policy enforces a password change before the next login.

use post/windows/manage/change_password

msf post(change_password) > set smbuser raj

msf post(change_password) > set old_password 123

msf post(change_password) > set new_password 987

msf post(change_password) > set session 1

msf post(change_password) > exploit

Since after knowing logging user “raj” password you can easily change his password by exploiting above command. From given below image you can observe we had change password 123 into 987.

2^nd Method

As we known meterepreter itself is a set of various options for post exploits it allows attacker to open command prompt of victims system without his permission by executing shell command as given below.

meterepreter> shell

net user

net user raj 123

Hence in 1^st method we had change password into 987 from 123 and now again in 2^nd method we had change password from 987 to 123 using simple CMD net user command as shown in given below command.