Nmap & Metasploit - Finding a Zombie

Find a victim, make it a zombie and then use that zombie to bite it!

Many may not realize this but NMAP has the ability to turn a machine into a zombie (well not literally) and use it to perform scanning on other machines. This is another way to use the power of trust of another computer, 'take over' and scan it on the other. Besides, this is way more challenging than using the -D (decoy) switch.

Well, first its not easy to find a potential zombie using NMAP (if anyone has any idea, do share) so we are going to use Metasploit to find potential zombie machines.

Open your terminal and type in

#msfconsole

Once loaded, type

msf > use auxiliary/scanner/ip/ipidseq 

If you wanna see the available options, enter below;

msf auxiliary(ipidseq) > show options

Then lets put in the IP range for them to scan and find potential zombies

msf auxiliary(ipidseq) > set RHOSTS 192,168.71.150-192.168.71.153

msf auxiliary(ipidseq) > set THREADS 50

msf auxiliary(ipidseq) > run

Once ran, the result will be shown and if you see an IP with the remark as 'Incremental!' it means you have a potential zombie!!!!!

So once a potential zombie is found, rifle up the nmap and run the scan 

#nmap -PN -sI <zombie IP> <victim IP>

Basically, what this scan does is to scan another machine using the zombie machine that somehow acts like a proxy. 

In what situation can we apply this?

Let's say you are in the same network but you can perform a scan to a server but the other person beside you can because he is 'trusted' or given special privileges. So the only way is to connect to his machine and use it to scan the server instead. From the server network side, they will see it as a valid traffic NOT from the 'attacker' but from the trusted Zombie itself. :)

Nmap - Finding Open Ports, Services and its Versions + more Juice Info!!

If you are in a restaurant, chances are you are going to order something to eat.

Nmap does more than just scanning for ports, it can also scan the system for the version of the services running against that ports. There are many scanners to do that but i prefer Nmap personally because of its lightweight.

So a typical Nmap scan without any switches will find the open ports and the services running against it. Below is a standard output of a successful completed Nmap scan.

If we want to see more juicy information in detail and the versions of the services running on them, simply input the switch A to the command. A simple switch gives a huge difference.

Look at the details (in the yellow box) of what Nmap -A can provide:

In time to come, i will show how Nmap -A in conjunction with other switches to display more details than i imagined before.