gvb84 / Pbscan

SUMMARY

polarbearscan is an attempt to do faster and more efficient banner grabbing and port scanning. It combines two different ideas which hopefully will make it somewhat worthy of your attention and time.

The first of these ideas is to use stateless SYN scanning using cryptographically protected cookies to parse incoming acknowledgements. To the best of the author's knowledge this technique was pioneered by Dan Kaminsky in scanrand. Scanrand was itself part of Paketto Keiretsu, a collection of scanning utilities, and it was released somewhere in 2001-2002. A mirror of this code can be found at Packet Storm [1].

The second idea is use a patched userland TCP/IP stack such that the scanner can restore state immediately upon receiving a cryptographically verified packet with both the SYN and ACK flags set. The userland stack being used here by polarbearscan is called libuinet [2]. Unlike some of the other userland TCP/IP stacks out there this one is very mature as it's simply a port of FreeBSD's TCP/IP stack.

By patching the libuinet stack one can then construct a socket and complete the standard TCP 3-way handshake by replying with a proper ACK. Doing it this way a fully functional TCP connection is immediately established. This as opposed to other scanners (such as nmap) who would have to, after noting that a TCP port is open, now perform a full TCP connect via the kernel to do things such as banner grabbing or version scanning. A full TCP connect leads leads to a whole new TCP 3-way handshake being performed. This completely discards the implicit state which was built up by the initial two packets being exchanged between the hosts. By avoiding this one can reduce bandwidth usage and immediately go from detecting that a port is open to connecting to it. This connection can then simply sit back and receive data in banner grab mode or it could send out an HTTP request.

Please note that the scanner right now only supports IPv4 based scanning and it will only work properly over Ethernet-type (wired or wireless) interfaces. There are no plans to support IPv6 or different interfaces in the near future.

INSTALLATION

Compiling the code is pretty straightforward. One just needs a working connection to the net and git needs to be installed such that the required dependencies can be downloaded. Besides that standard development utilities (gcc, make, patch), development editions of libraries (pthread, pcap, OpenSSL). On Debian based distributions one can simply install all the packages listed in the DEPENDENCIES file. After that one should be able to just type 'make' and the external dependencies will be checked out using git and the entire scanner will be build. This binary can then be copied to /usr/bin or /usr/local/bin or the like.

If compilation fails please email the author (contact details below) and include the error output, kernel version, libc version and anything else that might help with reproducing and fixing the problem. Your help is kindly appreciated.

USAGE

Running the tool should be pretty straightforward. You will need root privileges. The -h option shows brief usage information and the options explained. In most cases one whould not need more than specifying the type of scan to perform, the port lists to scan and the target IP or IP-ranges. CIDR- noation is supported for the IP ranges.

There are four different scan types which are specified with -s.

-sB: This does a standard banner grab. The scanner will not send any data as it will simply wait and receive data and display it up until the first newline or carriage return received.

-sH: This mode sends a "GET / HTTP/1.1" request to every successfully setup connection. It's very useful for quickly identifying HTTP servers.

-sT: TLS scanning mode sends a TLS1.0 NULL probe with zero options and zero algorithms specified. However if there's a valid TLS server on the receiving end it will parse out and try to figure out if it's a valid TLS Error response which will then be dispalyed.

-sC: Custom scanning wich will load a payload from a file (specified with -d) and send this payload out to every successfully established socket. Can be useful for quickly probing very specific protocols

-p: The list of TCP ports to scan which can be a range of ports or single ports with ranges and single ports seperated by comma's. Some examples: -p22,80,8080-9000,143 will scan port 22,80,143 and the range of 8080 to 9000.

-b : The bandwidth limit to apply for the outgoing probes. This does not apply to the data sent and received over the sockets so only to the actual SYN probes being sent out. Examples: -b300k, -b67m, -b500b would yield bandwidth limits of 300kbps, 76mbps and 500bps respectively.

-d : Filename of the file containing the payload used to the custom scan. The entire file will be sent up until a maximum of 128kB which should be more than enough for most purposes.

-t: This specifies the amount of seconds that the scanner will wait after it has sent out all the probes with receiving data back over the still connected sockets. That is assuming there are any otherwise it will bail out the moment there's no more work left to do.

-x: This forces the tool to alwyas dump output received in hexadecimal notation. Otherwise it will only dump data in hexadecimal notation if non-printable characters are found.

-v: This specifies some verbose output. It's mostly only useful for debugging.

-i : The interface to use for selecting the source IP and setting up the pcap backend. This should not be necessary on standard machines with just one properly configured NIC but with multiple NICs one might need it.

-r : The random seed to use for the RNG being used. Mostly useful for debugging and making sure that one can get the tool to generate the exact same sequence of packets again. The argument is an integer and can be specified in hexadecimal and decimal notation.

-T : Override the default IP TTL value to use in SYN probes. Not really necessary for anything but included for the sake of completeness.

-W : Override the default TCP Window size value to use in SYN probes. Not really necessary for anything but included for the sake of completeness.

-I : Override the default IP ID value to use in SYN probes. Not really necessary for anything but included for the sake of completeness.

-n: This option should only be used if you know what you're doing. It will make sure the tool does NOT set the firewall rule to drop all outgoing RST packets. If this is used then the scanner will not fork and one has the responsibility to set this rule by hand as otherwise the kernel will send RST packets back for every SYNACK packet received. This will make the tool simply not work. The rule as it's being set on Linux is the following:

 $ /sbin/iptables -A OUTPUT -p tcp --tcp-flags RST RST -j DROP

-o: This option does not do the I/O redirection so one will see more output of the uinet internals. It's only added for the sake of completeness or for debugging scenario's as it's not very useful otherwise.

-h: The usage information.

Some examples on how to use the tool. To do a banner grab of port 22 on a /24 range use like:

 ./pbscan -sB -p22 x.x.x.x/24

To do an HTTP scan on several common HTTP ports for a single IP with the output in hexadecimal mode use:

 ./pbscan -sH -x -p80,8080-9000 x.x.x.x

During scanning when you press a key on standard input you see some stats being printed out, such as the amount of open ports identified, the amount of valid TCP acks received the number of currently active connections, and how many SYN probes of the total have already been sent out. This will look something like:

 sent: 1.97% (of 254), open: 0, active: 2, acks: 2

AUTHOR

This tool was written by Vincent Berg. Contact me by emailing [email protected] or visit my website http://santarago.org for updated releases/news on this scanner.

THANKS

Much appreciation for several folks that helped out testing, porting this cool and reporting bugs. Thanks to Ehab, Joseph, Alejandro, Julian and Diego.

REFERENCES

[1] http://packetstormsecurity.com/files/30489/paketto-1.10.tar.gz.html

[2] http://wanproxy.org/libuinet.shtml