1

I am pentesting an infotainment platform that is still under development. I did a nmap scan (for all ports with option -p-) of the platform and found a few open ports.

111/tcp   open  rpcbind
3490/tcp  open  colubris
5355/tcp  open  llmnr
8888/tcp  open  sun-answerbook
9999/tcp  open  abyss
16509/tcp open  unknown
51331/tcp open  unknown
58485/tcp open  unknown

Doing a netcat on the ports did not yield any information except for port 3490. On port 3490, I could read some logs that are being used by the IVI-Graphics, some IP logs (with service IDs), etc. I have also obtained some process and thread IDs of applications that are running on the system. I have also tried telnet on all open ports and it did not yield me any more information. I have done service version scans on all ports as well, it did not yield any significant information. I have searched for metasploit modules, but for the services mentioned above, there are not any existing ones.

However, now I am stuck and unable to proceed any further. Does anyone have any other suggestions on going further?

Secondly, I know that the IVI system runs Linux and Android. Right now, I am in the subnet of Linux. Linux and Android have a private virtual network between them. Is there any way, I can reach the virtual network and perform further pentest of android?

I did a bit of digging with `rpcbind` and found out the below information. 
Kali Machine : 192.168.1.20
Infotainment system : 192.168.1.11

$ rpcinfo  192.168.1.11
program version netid     address                service    owner
    100000    4    tcp6      ::.0.111               portmapper superuser
    100000    3    tcp6      ::.0.111               portmapper superuser
    100000    4    udp6      ::.0.111               portmapper superuser
    100000    3    udp6      ::.0.111               portmapper superuser
    100000    4    tcp       0.0.0.0.0.111          portmapper superuser
    100000    3    tcp       0.0.0.0.0.111          portmapper superuser
    100000    2    tcp       0.0.0.0.0.111          portmapper superuser
    100000    4    udp       0.0.0.0.0.111          portmapper superuser
    100000    3    udp       0.0.0.0.0.111          portmapper superuser
    100000    2    udp       0.0.0.0.0.111          portmapper superuser
    100000    4    local     /run/rpcbind.sock      portmapper superuser
    100000    3    local     /run/rpcbind.sock      portmapper superuser

I wanted to investigate which applications are using the current open ports mentioned in the nmap scan. Hence I used netstat on the infotainment system. The system does not support lsof or ss. The netstat also lacks the -p option that provides program information. netstat supports the following options [-ral] [-tuwx] [en].
Here is the output of netstat


root@infotainment-system:~# netstat -lutxn
Active Internet connections (only servers)
Proto Recv-Q Send-Q Local Address           Foreign Address         State
tcp        0      0 0.0.0.0:5355            0.0.0.0:*               LISTEN
tcp        0      0 0.0.0.0:48717           0.0.0.0:*               LISTEN
tcp        0      0 0.0.0.0:9999            0.0.0.0:*               LISTEN
tcp        0      0 0.0.0.0:111             0.0.0.0:*               LISTEN
tcp        0      0 127.0.0.1:53            0.0.0.0:*               LISTEN
tcp        0      0 0.0.0.0:8888            0.0.0.0:*               LISTEN
tcp        0      0 0.0.0.0:16509           0.0.0.0:*               LISTEN
tcp        0      0 0.0.0.0:50753           0.0.0.0:*               LISTEN
tcp        0      0 :::5355                 :::*                    LISTEN
tcp        0      0 :::111                  :::*                    LISTEN
tcp        0      0 ::1:53                  :::*                    LISTEN
tcp        0      0 :::22                   :::*                    LISTEN
tcp        0      0 :::16509                :::*                    LISTEN
tcp        0      0 :::3490                 :::*                    LISTEN
udp        0      0 0.0.0.0:5353            0.0.0.0:*
udp        0      0 0.0.0.0:5355            0.0.0.0:*
udp        0      0 0.0.0.0:30490           0.0.0.0:*
udp        0      0 10.23.0.2:30490         0.0.0.0:*
udp        0      0 10.23.0.2:30499         0.0.0.0:*
udp        0      0 0.0.0.0:55897           0.0.0.0:*
udp        0      0 127.0.0.1:53            0.0.0.0:*
udp        0      0 0.0.0.0:111             0.0.0.0:*
udp        0      0 0.0.0.0:60805           0.0.0.0:*
udp        0      0 :::5353                 :::*
udp        0      0 :::5355                 :::*
udp        0      0 :::57031                :::*
udp        0      0 ::1:53                  :::*
udp        0      0 :::111                  :::*

With this information, it is unable to find out which programs are actually using the ports that are open.

I found out that the portmapper is vulnerable to port amplification attacks. So I used the following metasploit module to further initiate an attack:

msf5 > use auxiliary/scanner/portmap/portmap_amp 

msf5 auxiliary(scanner/portmap/portmap_amp) > set RHOSTS => 192.168.1.11
msf5 auxiliary(scanner/portmap/portmap_amp) > run

[*] Sending Portmap RPC probes to 192.168.1.11->192.168.1.11 (1 hosts)
[+] 192.168.1.11:111 - Vulnerable to Portmap RPC DUMP (Program version: 3) amplification: No packet amplification and a 17x, 644-byte bandwidth amplification
[+] 192.168.1.11:111 - Vulnerable to Portmap RPC GETSTAT amplification: No packet amplification and a 7x, 244-byte bandwidth amplification
[*] Scanned 1 of 1 hosts (100% complete)
[*] Auxiliary module execution completed

Executing the metasploit attack, the output states that the target is vulnerable to rpc-dump and rpc getstat. I am new to metasploit, so I am not aware of how metasploit interprets the attack and spits the output. I have read about port amplification attack and can understand what's happening. However, I do not understand the output of metasploit.

Does it mean that my target is vulnerable to these attacks? If so, what is the simplest way in which I can create a small concept for the attack?

Improve this question
19
  • Are you able to gain a copy of the firmware, or a shell on the device? Those would be my next steps.
    – multithr3at3d
    Dec 29, 2020 at 23:48
  • Since the system is under development, I am able to get a SSH on the device. Port 22 is also open, but I did not mention it above in the question. The reason being that with the final system, the SSH access will be blocked. I am unable to get a shell via any of the other ports mentioned above. Also coming to a copy of firmware, this is available however, from the internal repository that we have. Is there a way to extract the firmware from the system itself?
    – gst
    Dec 30, 2020 at 10:46
  • 1
    yes, it may be possible if any shell access is gained, or with physical access to the device. I get that things will be locked down for the final deployment, but it can speed up the vulnerability discovery process if you are able to introspect things.
    – multithr3at3d
    Dec 30, 2020 at 23:12
  • Port 111 being open implies it might have NFS services exposed.
    – Polynomial
    Dec 31, 2020 at 0:05
  • 1
    "port amplification" just means a small UDP packet can get a big UDP packet (or many packets) in response, which can be used as an amplifier in a DDoS attack on some other target. It's not a vulnerability, it's a threat.
    – bonsaiviking
    Jan 7, 2021 at 16:33

1 Answer 1

Reset to default
1

In your situation, not knowing for sure the protocols you are facing I might be tempted to look more closely at the packets, so one thing you could do is use a tool like Scapy for probing ports and perhaps capture the exchange with Wireshark too.

Nmap is a wonderful tool, but it also makes educated guesses and interprets results for you, which is not always sufficient.

But let's assume you are on the same local network and that a LLMNR service is indeed running on that machine. You could perhaps send queries to it in an effort to try to gain more insight into the network (this is after all a resolver). Nmap even has a script for this: llmnr-resolve

An even better scenario (but which is far from certain) is that other machines are sending broadcast requests to that service, then you could possibly intercept those queries and send poisoned responses with a tool like Responder, to trick those machines into talking to a malicious host controlled by you. See below for an article which explains the attack in details.

Last but not least, by default nmap only scans the 1000 most common ports on TCP, which means that if run with default options, you could miss interesting ports. I am mentioning this since you did not provide the nmap command line that was used to gather the results.

References

NetBIOS and LLMNR: The Gifts That Keep on Giving (Away Credentials)

Improve this answer
2
  • I have used nmap with the -p- option. (updated in the question). I did use the script llmnr-resolve earlier as part of exploring the options for nmap. The result is as shown: $ sudo nmap --script llmnr-resolve --script-args 'llmnr-resolve.hostname=`www.google.com' -p 5355 192.168.1.11 NSE: [llmnr-resolve] Nsock connect failed immediately Nmap scan report for 192.168.1.11 PORT STATE SERVICE 5355/tcp open llmnr MAC Address: 00:12:34:56:78:90 (Camille Bauer) Nmap done: 1 IP address (1 host up) scanned in 0.30 seconds
    – gst
    Dec 30, 2020 at 11:09
  • As with the second case you mentioned about 'other machines sending broadcast requests'. This is not currently the case. Currently, the system is an ARM A.76 processor, that runs Linux and Android. I am on local network with Linux. Linux and Android share a virtual network between them to interact. There are no external devices connected for now.
    – gst
    Dec 30, 2020 at 11:24

Not the answer you're looking for? Browse other questions tagged .