4

I was wondering, how can I bypass the port knocking method. Is there any public vulnerability or method for attacking port knocking services?

For example: I know an SSH port is behind a port knocking service, and I want to find a way to exploit the port knocking service. Any ideas?

I thought it could be bypassed by brute-forcing, but I couldn't find a stable solution.

5

The basic port knocking method uses a fixed sequence of ports. This method is not protected cryptographically so there are the following attacks possible:

  1. brute-force — If you use the full range of possible ports 1—65535 then even very short knocking sequences give impressive number of combinations to test. For example for 3 knocks with randomly generated sequence it is 65535³ ≈ 2.8×10¹⁴. Another aspect to consider is that the port which will open after the knocking could be unknown so the attacker would have to repeatedly scan the ports during the port knocking attempts. — The number of combinations to try can be lowered if some information about the ports being used is known (for example a subset of ports) or if there is a successful random number generator attack.
    Measure against such attacks except securing the mentioned possible vulnerabilities could be disabling of the access from the attacker source IP address after certain number of unsuccessful attempts during certain time period. Unfortunately this makes the system vulnerable to DoS attacks by attacker locking your access by using your IP address as a spoofed source address.
  2. sniffing — The port knocking sequence is not protected cryptographically so an attacker can sniff the successful port knocking sequence. The port knocking sequence could also leak from logs of the destination system itself of from a network monitoring system.
    Measure against this attack is use of one-time knocking sequences (analogy of one-time passwords). The one-time sequence could be a hash computed from a secret and some of the following: source IP address, time, event counter etc.
  3. man in the middle — Captured one-time knocking sequences cannot be reused but a port-knocking access can be exploited by a man-in-the-middle attack. The attacker in the path of your communication (possibly redirected) can relay your successful communication, see and modify anything.
    The port-knocking itself is performed by one-way communication as such it cannot be protected against MITM. Also the communication following the port knocking must be secured against MITM to retain the security. To ensure this we can use standard encrypted protocols like SSL or SSH.
  • 1
    Sniffing is the most reliable way to do this. Cracking the network monitoring system is a cool idea, too. – schroeder Oct 20 '14 at 14:45
  • There are port knocking demons that use encrypted payloads - fwknop. It should be immune to brute-force and sniffing. The default configuration should be immune to MITM as well, though some NAT-IP-resolution settings would make MITM possible. – voidvector Sep 8 '17 at 16:39

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.