Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

Some time back I asked about using metasploit on a virtual machine here. This question is a kind of 'part 2' of it.

My test bed set up consists of 3 physical machines: A, B and C. Each of them have 1 or 2 VMs running on them, each VM running in Bridged mode (this is what was recommended in that answer).

Say machine A has a VM which has BackTrack 5 r2 running on it, which i use to scan my network (Metasploit -> Armitage -> 'Hosts' tab -> nmap scan -> Quick scan (OS detect)). I notice that the VMs running on physical machines B and C are not detected by the scan. While another VM running on the same physical machine (i.e., A here) does get detected. I am not talking of just OS detection, but detection of the presence of the virtual machines itself- even though i can ping any of the VMs from any other.

Is it some limitation concerning the use of VMs for such an environment or some mistake in my approach?

share|improve this question
2  
Can your 2 VMs communicate directly? Isn't there a firewall or anything between them? Do you use nmap to detect the OS? Does it work if it's not in a virtualized environment? I'd like to know then answer as well. Bridging should leave IP traffic untouched. BTW, I strongly discourage the use of BT in a VM, use a usb stick instead: BT has a lot of drivers for all kind of hardware, emulated interfaces may not implement what you want/need, it's limiting. –  Aki May 31 '12 at 9:42
    
@Aki What do you mean by "communicate directly"- i can ping them from each other, if that is what you want to know. No there is no firewall and that is so because this is my test network just for the purpose of using these kind of tools. The physical machines are detectly normally by nmap's OS detect scan (or other scans). Virtual machnines give erratic results-sometime get detected too, and most of the times aren't. And yes, thanks for your advice on BT. I was using VMs only because I am new to these things and wanted to play safe. –  pnp May 31 '12 at 10:15
1  
When you say 'does not detect'....what do you mean? What does nmap return? Can you try running the OS detect scan with the -Pn flag to skip host discovery (I know you said they can ping but just as a test) -> nmap -A -Pn x.x.x.x. –  Mark Hillick May 31 '12 at 15:55
2  
I run BT in VMs without issues and I have set up complex testing networks on a single virtual server. My advice: re-write your question leaving out BT, but reference the tools you are using instead. That might clear some things up: "Metasploit on a VM, scanning other VMs on the same VirtualBox host server, all VMs in bridged mode. Metasploit VM can ping the other VMs but can't get OS detection" - how close am I? –  schroeder May 31 '12 at 18:28
2  
I've never experienced the problems you're talking about and I've used VMs in Xen, VirtuaMachine & VMware across all platforms. To truly understand nmap and OS detection, you should begin to use the command line. From the cli, run the following "nmap -A -Pn x.x.x.x", where x.x.x.x is the IP address of the VM and post the results. Regarding detection, to clarify do you mean it doesn't detect the VM is up or it doesn't detect the OS? –  Mark Hillick Jun 1 '12 at 13:47
show 7 more comments

1 Answer

up vote 6 down vote accepted

Now we have the info we needed.

Because you are running the scan from within a VM on MachineA, scanning the VMs on MachineB and MachineC and doing it in bridged mode, you ARE going to get odd responses. The host machines are going to make subtle changes to the traffic because the hosts are acting a little like routers. If you have firewalls on the hosts, they will cause their own interference.

Nmap uses TCP/IP stack analysis to perform OS detection. Although Bridged Mode is supposed to bypass the TCP stack of the host, there is still some interaction.

Zenmap
As for Zenmap, the UI gives you the commandline it is running in the "Command: " line. You can add to that with your own modifications like @MarkHillick suggested. (-Pn)

Advice on Posting
When posting questions like this, you need to include things like the basic network setup, what tools are being used, and the actual responses, but in brief. It will help you and us get to the heart of the problem much faster.

Please edit your question to include the extra details you have provided over time because there is not much value in your question to others without more context. And it turned out to be actually something that others can learn from.

share|improve this answer
    
Thanks a lot to you and @MarkHillick for your patience and expertise in getting the correct details from me. The question is now updated as per your suggestions. Schroeder, you answer does point to the problem, but i still await a solution. What do you people recommend me to do? –  pnp Jun 2 '12 at 6:00
    
@pnp MUCH better question. Thanks for editing. –  schroeder Jun 2 '12 at 16:51
    
@pnp, one possible solution may be: Don't run these systems in a VM. Or at least don't do the scan from within a VM; run it on bare metal. –  D.W. Jun 3 '12 at 4:29
1  
removing the VMs as a potential problem is a valid diagnostic step, but there might be some questions to ask before you do that. The VMs you are targeting, are they Windows? If they are, then nmap should be able to detect them, and in your scenario, the VMs are a problem. If they are Linux, then we need to know if they have services configured. For instance, do they have a web server running, or FTP, SSH, something for nmap to try to connect to. If they do, then the VMs are an issue. If they don't, then get a service running and retest. –  schroeder Jun 3 '12 at 20:23
1  
Let's take nmap out of it. Do you know which service/port is open on your VMs? Say it's http/https/ssh/ftp on port 80/443/22/21, can you connect to port 80 from the BT VM to the others using telnet or netcat -> "telnet x.x.x.x 80" or "nc x.x.x.x 80"? –  Mark Hillick Jun 4 '12 at 7:44
show 3 more comments

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.