Last modified: Wednesday, 28-March-2001 03:17:41 PDT

Stealth Scanning & IDS Evasion Techniques
(Latest version: https://nmap.org/presentations/CanSecWest01/index.html)

Introduction
- Hello; Motivation; Purpose; URL
Nmap & Scanning Intro
- Usage example [1].
Preventing standard host logging
- Logging demo
IDS Evasion
- Demo our guinnea pig IDS
- Demo Simple scan [2]
- One potential solution: Decoys ("nmap -D"). Explanation. Demo [3]
- Slow scan ("-T sneaky" or "-T paranoid")
- Fragmentation attacks ("-f") and other low-level mischief. Great papers/resources:
  - Excellent classic paper by Thomas Ptacek and Timothy Newsham on evading IDS systems -- http://insecure.org/stf/secnet_ids.
  - Fragrouter by Dug Song which implements most of the attacks from the paper above as well as others. -- http://www.anzen.com/research/nidsbench/
- Specific signature evasion.
  - Example: All of the snort rules which refer to Nmap:
```
zardoz~/src/snortrules>grep -i nmap *
icmp.rules:alert icmp $EXTERNAL_NET any -> $HOME_NET any (msg:"ICMP Nmap2.36BETA or HPING2 Echo ";itype:8;dsize:0; reference:arachnids,162;) 
icmp.rules:alert icmp $EXTERNAL_NET any -> $HOME_NET any (msg:"ICMP PING NMAP"; dsize: 0; itype: 8; reference:arachnids,162;) 
scan.rules:alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg:"SCAN nmap fingerprint attempt";flags:SFPU; reference:arachnids,05;) 
scan.rules:alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg:"SCAN nmap TCP";flags:A;ack:0; reference:arachnids,28;) 
zardoz~/src/snortrules>
     
```
  - Don't expect protection just because your IDS is proprietary or expensive.
- Overload via false alarms. Demo [4]
- Crash or exploit the IDS
- Exploit the IDS attacker identification mechanism
  - Vulnerability of various identification mechanisms (IP addy, DNS, NetBIOS)
  - Windentd -- Fun with NMB authentication. Demo [5].
- Use an exploit that is not in the signature database.
More fun
- Icepick. Demo.

The Code:

Before I provide links to the code demonstrated, please allow me to state a few caveats and "rules":

The primary purpose of writing this code was to demonstrate the concepts shown in the presentation. Don't expect them to be full-featured, bug-free examples of clean, elegant programming. They are not really "supported" although you can always write me fyodor@insecure.org with suggestions/fixes/questions. If you want an (IMHO) better example of our code, pick up Nmap.
I am distributing these as tarballs of some .c/.h files and a Makefile. If you don't know how to compile them, you probably shouldn't. If a binary is included, it is probably for Linux/glibc.
These are not documented and their purpose probably won't be clear unless you saw the presentation. The outline above is also probably useless if you missed the presentation. I would prefer that you avoid redistributing the code on web sites such as packetstorm, freshmeat, etc. Pointing people to this page would be better.
These compile and run on my Redhat 7 Linux box. Few other systems have bene tested.
OK, without further ado, here is Icepick and windentd. Enjoy ;).