Sometimes it pays to do an nmap both inside and outside

[The_Unbeliever]

Consider the following two nmap outputs :

One scan was done outside the network (internet), and the other was done on the LAN.

Scanned from Internet via Zyxel P-660R-T1 router :


Starting Nmap 5.21 ( http://nmap.org ) at 2011-02-28 12:55 SAST
Initiating Ping Scan at 12:55
Scanning testcase.bounceme.net (196.210.168.65) [4 ports]
Completed Ping Scan at 12:55, 0.05s elapsed (1 total hosts)
Initiating Parallel DNS resolution of 1 host. at 12:55
Completed Parallel DNS resolution of 1 host. at 12:55, 0.04s elapsed
Initiating SYN Stealth Scan at 12:55
Scanning testcase.bounceme.net (196.210.168.65) [1000 ports]
Discovered open port 80/tcp on 196.210.168.65
Discovered open port 5900/tcp on 196.210.168.65
Completed SYN Stealth Scan at 12:55, 4.63s elapsed (1000 total ports)
Initiating OS detection (try #1) against testcase.bounceme.net (196.210.168.65)
Retrying OS detection (try #2) against testcase.bounceme.net (196.210.168.65)
Nmap scan report for testcase.bounceme.net (196.210.168.65)
Host is up (0.012s latency).
rDNS record for 196.210.168.65: 196-210-168-65.dynamic.isadsl.co.za
Not shown: 966 filtered ports, 32 closed ports
PORT     STATE SERVICE
80/tcp   open  http
5900/tcp open  vnc
Device type: general purpose|firewall|proxy server|WAP|phone|router
Running (JUST GUESSING) : Linux 2.6.X|2.4.X (95%), SonicWALL embedded (90%), Linksys Linux 2.4.X (89%), Nokia Symbian OS (88%), Linksys embedded (86%)
Aggressive OS guesses: Linux 2.6.15 - 2.6.27 (95%), Smoothwall firewall (Linux 2.6.16.53) (92%), Linux 2.6.23 (91%), Linux 2.6.15 - 2.6.30 (91%), Linux 2.6.18-8.el5 (Red Hat Enterprise Linux 5) (90%), Linux 2.6.20 (90%), Linux 2.6.20 (Ubuntu, x86_64) (90%), Linux 2.6.21 (Arch Linux 0.8, x86) (90%), SonicWALL Aventail EX-6000 VPN appliance (90%), Linux 2.6.22 (89%)
No exact OS matches for host (test conditions non-ideal).
Uptime guess: 6.944 days (since Mon Feb 21 14:16:48 2011)
TCP Sequence Prediction: Difficulty=203 (Good luck!)
IP ID Sequence Generation: All zeros

Read data files from: /usr/share/nmap
OS detection performed. Please report any incorrect results at http://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 9.44 seconds
           Raw packets sent: 2026 (93.164KB) | Rcvd: 72 (4484B)

Directly (local LAN) :


Starting Nmap 5.21 ( http://nmap.org ) at 2011-02-28 13:01 SAST
Initiating ARP Ping Scan at 13:01
Scanning 192.168.0.1 [1 port]
Completed ARP Ping Scan at 13:01, 0.06s elapsed (1 total hosts)
Initiating Parallel DNS resolution of 1 host. at 13:01
Completed Parallel DNS resolution of 1 host. at 13:01, 13.00s elapsed
Initiating SYN Stealth Scan at 13:01
Scanning 192.168.0.1 [1000 ports]
Discovered open port 1025/tcp on 192.168.0.1
Discovered open port 139/tcp on 192.168.0.1
Discovered open port 80/tcp on 192.168.0.1
Discovered open port 135/tcp on 192.168.0.1
Discovered open port 5900/tcp on 192.168.0.1
Discovered open port 21/tcp on 192.168.0.1
Discovered open port 110/tcp on 192.168.0.1
Discovered open port 25/tcp on 192.168.0.1
Discovered open port 143/tcp on 192.168.0.1
Discovered open port 9999/tcp on 192.168.0.1
Discovered open port 3372/tcp on 192.168.0.1
Discovered open port 5800/tcp on 192.168.0.1
Discovered open port 1027/tcp on 192.168.0.1
Completed SYN Stealth Scan at 13:01, 0.09s elapsed (1000 total ports)
Initiating OS detection (try #1) against 192.168.0.1
Nmap scan report for 192.168.0.1
Host is up (0.00028s latency).
Not shown: 987 closed ports
PORT     STATE SERVICE
21/tcp   open  ftp
25/tcp   open  smtp
80/tcp   open  http
110/tcp  open  pop3
135/tcp  open  msrpc
139/tcp  open  netbios-ssn
143/tcp  open  imap
1025/tcp open  NFS-or-IIS
1027/tcp open  IIS
3372/tcp open  msdtc
5800/tcp open  vnc-http
5900/tcp open  vnc
9999/tcp open  abyss
MAC Address: 00:A0:24:A6:7A:E9 (3com)
Device type: general purpose
Running: Microsoft Windows 2000
OS details: Microsoft Windows 2000 SP4
Network Distance: 1 hop
TCP Sequence Prediction: Difficulty=137 (Good luck!)
IP ID Sequence Generation: Busy server or unknown class

Read data files from: /usr/share/nmap
OS detection performed. Please report any incorrect results at http://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 15.20 seconds
           Raw packets sent: 1017 (45.460KB) | Rcvd: 1017 (41.168KB)

This was an eye-opener as I never expected a humble router to block certain type of attacks.

Cool.

But that does not mean that you can expect to get away with it without a firewall and antivirus...

I am currently running said Windows2000 server to see if it will succumb to the wild wild web... and it's on a totally different segment than the company network - meaning that should it be compromised, the ne'er-do-wells cannot gain access to our network at all.

For interested parties, here's the no-ip hostname : testcase.bounceme.net

Should you be interested, do let me know what you have tried, and your results so far.

Regards

Ook.

 

[Grep]

Sorry, I don't get it. So you have 2 ports open and want to be hacked? Why not just throw down a honeypot for the same result? The mind baffles sometimes....