Chapter 15 netfilter and system security services
the unauthorized reproduction in whole or in part of this publication in any form is prohibited.
We will now check using telnet which Damon s s h d version is installed on the tested server.
So let's connect with port 22.
As we can see we also managed to obtain very valuable information.
The exact version of the remote system in this case Free BSD.
This information is not always made available in order to overcome this.
We will use special software.
Therefore we will copy the files we need.
We will now unpack compile and install the applications in the system.
The compiling process will take a couple of minutes depending on the hardware resources available to
us.
After round 2 minutes of compiling the unmap application is ready for installation the installation
should be made from the root level.
Let's perform the operations for the program
after the software installation.
We can start our tests.
Let's check which system version is installed on the tested server.
We managed to obtain information independently on the system version
the aim of this lesson is to demonstrate how the core modules that use the features of the netfilter
subsystem work we will therefore learn to modify the behavior of the network stack which will enable
us to receive the tools for the remote identification of the system version.
But let's start by introducing a simple module that after uploading writes the information to the core
logs
after looking at the example we can proceed with using netfilter our next module will have to reject
all packets.
Let's familiarize ourselves with the structures we will use in our modules.
This information is located in the netfilter h file in the kernel sources.
The main structure of our module is an F under slash hook ups.
Let's have a look at it.
Another important structure is S-K under slash buff it stores all packets going through the network
device.
Let's compile and test the functioning of our module before compiling.
We will make a slight correction to the make file.
As we can see after uploading the module all packets going to the device are being rejected.
After unloading the module everything returned to normal and the ping program registers subsequent echo
reply packets our next modules task is to reject the packets on the eath zero interface and to print
the information about the event in the core log.
As we can notice all when according to our plans therefore it is time to describe another example
next module takes advantage of filtering the IP address and the port by controlling these meters it
is possible to reject only chosen files.
As we can see after uploading the module the connection with port 22 was not possible.
Our IP address 1 2 7 0 0 1 has been recognized.
Our next example has been extended by the modification of the pair meters window and TTL for each x
y in packet.
First let's write the information on the fingerprint of the Free BSD system.
We will use this in our next example.
Now let's test the functioning of the module.
We'll see what PLF returns before as well as after it uploads
as we can see we manage to mislead the program and change the window and TTL values into the ones defined
earlier.
The last example shows how we can change other packet pair meters enabling us to pretend to be any operating
system.
Here we will use information obtained earlier from the signature database of the program for the Free
BSD system.
We will now test the module.
We have been successful.
Our system has been recognized as Free BSD version 5.1 although we are working in the Linux system.
While it is true that the unmap program didn't recognize us as Free BSD by changing the packet properties
we made identification of the system impossible.