5

Having trouble firewalking. I am trying to determine all the open ports on my firewall/gateway. Here is my lab network diagram:

Network Diagram

(Skip to the bottom of the following explanation for a direct list of my questions)

Configuration Details:

  • Firewall is an ASA 5505 with static routes.
  • The firewall will respond to ICMP echo requests at 192.168.1.2.
  • The firewall has TCP port 31337 left intentionally open so that we can detect it as part of the exercise.
  • The "Host" at 192.168.1.4 is acting as the "attacker" trying to determine the open ports.
  • The "Attacker" is running Kali linux.
  • The "Target" host is running Windows Web Server 2008 (not sure that matters).

Attempted Methods:

I have tried both the "Firewalk" tool by Packetfactory and also the Nmap firewalk script. Here are examples of the syntax I am using:

Nmap: nmap --traceroute --script=firewalk --script-args=firewalk.max-probed-ports=-1 192.168.3.11

CORRECT SYNTAX FOR NMAP: (solved this!) nmap --traceroute --script=firewalk 192.168.3.11 -p1-65535

  • NMAP only scans common ports by default. The full port range must be specified.

I simply needed to add the nmap port scan switches in as those are not arguments that can be passed into the firewalk script. I'm still learning...

Firewalk: firewalk 192.168.1.2 192.168.3.11

Current Results of firewalking methods:

Nmap (This list is incomplete but shouldn't be - port 31337 has been opened intentionally on this firewall)

 Starting Nmap 6.47 ( http://nmap.org ) at 2015-03-17 11:15 EDT
 Nmap scan report for 192.168.3.11
 Host is up (0.0026s latency).
 Not shown: 987 closed ports
 PORT      STATE    SERVICE
 80/tcp    open     http
 111/tcp   filtered rpcbind
 135/tcp   filtered msrpc
 139/tcp   filtered netbios-ssn
 445/tcp   filtered microsoft-ds
 1720/tcp  filtered H.323/Q.931
 2000/tcp  filtered cisco-sccp
 5060/tcp  filtered sip
 49152/tcp filtered unknown
 49153/tcp filtered unknown
 49154/tcp filtered unknown
 49155/tcp filtered unknown
 49156/tcp filtered unknown

 Host script results:
 | firewalk: 
 | HOP  HOST          PROTOCOL  BLOCKED PORTS
 |_0    192.168.1.43  tcp       111,135,139,445,1720,2000,5060,49152-49156

 TRACEROUTE (using port 1025/tcp)
 HOP RTT     ADDRESS
 1   3.19 ms 192.168.3.11

Firewalk

 Firewalk 5.0 [gateway ACL scanner]
 Firewalk state initialization completed successfully. UDP-based scan.
 Ramping phase source port: 53, destination port: 33434
 Hotfoot through 192.168.1.2 using 192.168.3.11 as a metric.
 Ramping Phase:
 1 (TTL  1): *no response*
 2 (TTL  2): *no response*
 ...
 25 (TTL 25): *no response*
 Scan aborted: hopcount exceeded.

Questions:

  • Why doesn't the "Firewalk" tool ever see the target gateway (firewall at 192.168.1.2)? Nmap appears to be able to.
  • Why doesn't the Nmap firewalk script show me all the open ports?
  • How do I configure the Nmap firewalk script arguments to ONLY check the firewall for port 31337 TCP? (figured this out! -p31337 or -p1-65535. Duh - see the corrected syntax above)

P.S. also thanks to "Gliffy" for the awesome online network diagramming tool :)

  • Can you try specifying more flags for firewalk(1)? e.g., `firewalk -n -pTCP -S25,53,80,443,465,587,5353 192.168.1.2 192.168.3.11'. Maybe it's a name resolution or ICMP/UDP issue? – atdre Mar 17 '15 at 18:17
  • Hmmm seems like it fails during ramping phase and the other flags don't matter... Any switches that I can change that would bypass the ramping phase? – Shrout1 Mar 17 '15 at 18:30
  • Perhaps it would be `firewalk -d 80 -n -pTCP 192.168.1.2 192.168.3.11''? See the man page -- freebsd.org/cgi/… – atdre Mar 17 '15 at 18:34
  • @atdre Different error now! But that seems like progress... metric responded before target; must not be en route – Shrout1 Mar 17 '15 at 18:47
  • Great detailed question! – Citizen Mar 18 '15 at 20:13
2

According to the man page, firewalk looks to need the following flags in order to properly scan when you are one hop from your gateway (as seen in your pretty Gliffy picture).

firewalk -d 49152 -r 192.168.1.2 192.168.3.11

  • Thanks but no dice for me! I am still getting no response in the ramping phase. The ramping phase fails and then firewalk aborts. – Shrout1 Mar 17 '15 at 18:45
  • @ Shrout1: Did you try putting them both together like the above? – atdre Mar 17 '15 at 19:06
  • Yep! Did a copy paste and my ramping phase still fails – Shrout1 Mar 17 '15 at 19:36
  • Try the -t, -T, and -x flags with values that make sense to your environment as well – atdre Mar 17 '15 at 23:26
  • Hey! Tried -t, -x and -T but it still seems like the ramping phase fails. – Shrout1 Mar 18 '15 at 20:53

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.