1

Due to the recent increase of reflection attacks noted by Akamais security teams using original RIP(classful, depreciated) I'm interested to see if some of the CPE running within a network segment here is still open to such abuse. Theres a rather large fleet of a certain model that I strongly suspect is.

My problem is that NMAP cant determine if ports are closed or filtered with UDP.

nmap -p 520 -v -sU -Pn ??.??.0.0/13

This will produce

520/udp open|filtered route

On every address.

Is there an adjustment I can make to properly probe in this manner?

  • Maybe using nc rather than nmap, and feed it data where you know the response you will get, then check the response is what it would be for that UDP based protocol – barlop Jul 9 '15 at 10:44
1

Since at least version 5.35DC1, Nmap has included a UDP payload for RIPv1, which is sent when scanning UDP port 520:

# Routing Information Protocol version 1. Special-case request for the entire
# routing table (address family 0, address 0.0.0.0, metric 16). RFC 1058,
# section 3.4.1.
udp 520
  "\x01\x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
  "\x00\x00\x00\x00\x00\x00\x00\x10"

This 24-byte request is intended to elicit a response from RIPv1 services, and should be the same one that attackers are using for DDoS reflection. When Nmap receives a packet in response to this probe, it marks the port as open.

If you see a flaw in this payload, please send a correction to dev@nmap.org so that other users can benefit. If your version of Nmap does not include the nmap-payloads file, please update to the latest version.

| improve this answer | |
  • Running 6.49BETA4, so should be able to use the payload. As I read it nmap will use a known payload when it attempts that port, so I'm currently sending it? – Linef4ult Jul 10 '15 at 14:34
  • 1
    @Linef4ult Should be, but you can verify by using --packet-trace or a packet sniffer. – bonsaiviking Jul 10 '15 at 18:34
  • @ bonsaiviking See pastebin.com/wRtRB1zn, its locally exposed anyways. Not sure if the Juniper gear in between me and the pool is filtering 520 or if its non responsive on WAN. Unfortunately I dont have a DSLAM to test the WAN interface. Thanks for the help! – Linef4ult Jul 10 '15 at 22:53
  • can you include the nmap command line – barlop Jul 11 '15 at 14:47

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.