6

Some time back I asked about using metasploit on a virtual machine here. This question is a kind of 'part 2' of it.

My testbed set up consists of 3 physical machines: A, B and C. Each of them have 1 or 2 VMs running on them, each VM running in Bridged mode (this is what was recommended in that answer).

Say machine A has a VM which has BackTrack 5 r2 running on it, which i use to scan my network (Metasploit -> Armitage -> 'Hosts' tab -> nmap scan -> Quick scan (OS detect)). I notice that the VMs running on physical machines B and C are not detected by the scan. While another VM running on the same physical machine (i.e., A here) does get detected. I am not talking of just OS detection, but detection of the presence of the virtual machines itself- even though I can ping any of the VMs from any other.

Is it some limitation concerning the use of VMs for such an environment or some mistake in my approach?

Improve this question
12
  • 2
    Can your 2 VMs communicate directly? Isn't there a firewall or anything between them? Do you use nmap to detect the OS? Does it work if it's not in a virtualized environment? I'd like to know then answer as well. Bridging should leave IP traffic untouched. BTW, I strongly discourage the use of BT in a VM, use a usb stick instead: BT has a lot of drivers for all kind of hardware, emulated interfaces may not implement what you want/need, it's limiting.
    – Aki
    May 31, 2012 at 9:42
  • @Aki What do you mean by "communicate directly"- i can ping them from each other, if that is what you want to know. No there is no firewall and that is so because this is my test network just for the purpose of using these kind of tools. The physical machines are detectly normally by nmap's OS detect scan (or other scans). Virtual machnines give erratic results-sometime get detected too, and most of the times aren't. And yes, thanks for your advice on BT. I was using VMs only because I am new to these things and wanted to play safe.
    – pnp
    May 31, 2012 at 10:15
  • 1
    When you say 'does not detect'....what do you mean? What does nmap return? Can you try running the OS detect scan with the -Pn flag to skip host discovery (I know you said they can ping but just as a test) -> nmap -A -Pn x.x.x.x.
    – Mark Hillick
    May 31, 2012 at 15:55
  • 2
    I run BT in VMs without issues and I have set up complex testing networks on a single virtual server. My advice: re-write your question leaving out BT, but reference the tools you are using instead. That might clear some things up: "Metasploit on a VM, scanning other VMs on the same VirtualBox host server, all VMs in bridged mode. Metasploit VM can ping the other VMs but can't get OS detection" - how close am I?
    – schroeder ♦
    May 31, 2012 at 18:28
  • 2
    I've never experienced the problems you're talking about and I've used VMs in Xen, VirtuaMachine & VMware across all platforms. To truly understand nmap and OS detection, you should begin to use the command line. From the cli, run the following "nmap -A -Pn x.x.x.x", where x.x.x.x is the IP address of the VM and post the results. Regarding detection, to clarify do you mean it doesn't detect the VM is up or it doesn't detect the OS?
    – Mark Hillick
    Jun 1, 2012 at 13:47

1 Answer 1

Reset to default
7

Because you are running the scan from within a VM on MachineA, scanning the VMs on MachineB and MachineC and doing it in bridged mode, you ARE going to get odd responses. The host machines are going to make subtle changes to the traffic because the hosts are acting a little like routers. If you have firewalls on the hosts, they will cause their own interference.

Nmap uses TCP/IP stack analysis to perform OS detection. Although Bridged Mode is supposed to bypass the TCP stack of the host, there is still some interaction.

Zenmap
As for Zenmap, the UI gives you the commandline it is running in the "Command: " line. You can add to that with your own modifications like @MarkHillick suggested. (-Pn)

Improve this answer
7
  • Thanks a lot to you and @MarkHillick for your patience and expertise in getting the correct details from me. The question is now updated as per your suggestions. Schroeder, you answer does point to the problem, but i still await a solution. What do you people recommend me to do?
    – pnp
    Jun 2, 2012 at 6:00
  • @pnp, one possible solution may be: Don't run these systems in a VM. Or at least don't do the scan from within a VM; run it on bare metal.
    – D.W.
    Jun 3, 2012 at 4:29
  • @D.W. I heartily agree with the solution. It will save a lot of hassles. Or, maybe i will have all VMs on a single physical system. Any better solutions Schroeder?
    – pnp
    Jun 3, 2012 at 5:39
  • 1
    removing the VMs as a potential problem is a valid diagnostic step, but there might be some questions to ask before you do that. The VMs you are targeting, are they Windows? If they are, then nmap should be able to detect them, and in your scenario, the VMs are a problem. If they are Linux, then we need to know if they have services configured. For instance, do they have a web server running, or FTP, SSH, something for nmap to try to connect to. If they do, then the VMs are an issue. If they don't, then get a service running and retest.
    – schroeder ♦
    Jun 3, 2012 at 20:23
  • 1
    Let's take nmap out of it. Do you know which service/port is open on your VMs? Say it's http/https/ssh/ftp on port 80/443/22/21, can you connect to port 80 from the BT VM to the others using telnet or netcat -> "telnet x.x.x.x 80" or "nc x.x.x.x 80"?
    – Mark Hillick
    Jun 4, 2012 at 7:44

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .