Fool the Network Hunters (Hackers)

April 30, 2014 by

Chintan Gurjar

Portspoof is meant to be a lightweight, fast, portable, and secure addition to any firewall system or security system. The general goal of the program is to make the information-gathering phase slow and bothersome for your attackers as much as possible. This is quite a change to the standard 5s nmap scan that will give a full view of your system's running services.

So let's start directly. This is how the common structure of portspoof looks. First I will mention the normal network structure without using portspoof and then with portspoof. The figure below shows the normal structure of my network.

Learn Network Security Fundamentals

Build your skills with seven hands-on courses covering network models and protocols, wireless and mobile security, network security best practices and more.

Start Learning

Here, when an attacker scans the CentOS server's network then first request will be sent to Iptables and, according to the iptables rule, it will send the response to the server. So rules have been set in my iptables standard.

As you can see, port 22 is open and any connection thorough the client machine to the server's ssh service is allowed. So if I scan this network through NMAP from my KALI Linux, which I am considering an attacker's machine, it will show me the result.

Now let's check the network configuration with portspoof. Make sure portspoof's default port is 4444. You can change it according to your need.

As we can see in the above picture, when an attacker sends an nmap scan request to the centos server, first it gets received by the iptables. Then, rather than responding to the attacker machine, iptables forwards that request to the portspoof on 4444 port and it enables portspoof to respond to the attacker's machine in order to show all 65535 ports open.

Let's Start Demonstration

Firstly, I am flushing all the rules of iptables and I am allowing all packets into my network. To do so, there is the following command:

Iptables –f

After giving this command, if you want to see the current policy, you can check it with this command:

iptables –l

Now it's time to configure our iptables with the portspoof. For that, let's download and install portspoof. I have downloaded the rpm package of portspoof. This command installs that package:

rpm –ivh portspoof-1.0-5.1.i686.rpm

Next thing to do is to flush all the current firewall rules. As we already checked, we do not have any rules set in our current firewall. So apply those iptables –f and –l command to your server to cross-verify our process.

Then we can see from the above picture that our firewall is up and running and it is allowing all packets from any network. Now it is time to forward those packets to portspoof in order to reply the client machine. To do so, use the following command:

iptables –t nat –A PREROUTING –i eth0 –p tcp –m tcp --dport 1:65535 –j REDIRECT --to-ports 4444

The last few words in this command are very important; first, it will collect all the packets accepted by iptables and then it will forward them to the 4444 port, which is by default a port of our portspoof tool.

Now let's scan the target. (Keep in mind that we have not configured our portspoof.)

It shows that our host (CentOS) is live and running but it is not showing any list of open ports. This suggests that we have successfully configured our iptables with the portspoof. So our iptables is successfully sending all incoming packets to the portspoof. Now it is time to configure portspoof.

Portspoof runs with its two main files which is lying in /etc/ folder, as shown below:

In the config file, all the rules have been written about how and what portspoof should reply to the client machine and in signatures there are lots of signature of various scanning tools.

For example, if I do a normal nmap of 1 host, it will only show me that port xyz is open and it will also show me the port number. But, if I use nmap with –sV command, then it will also try to fetch the service name that is used by the server and it will show me at the client side. So these other signatures are detected by the portspoof and it gives false results according to the request.

To start portspoof, let's check the help to determine which options are provided to us.

Two mandatory options are needed to run the portspoof. The command to run portspoof is:

portspoof –c /etc/portspoof.conf –s /etc/portspoof_signatures

Once you give this command it will look like this:

Now it is time to scan from our attacker machine (Kali Linux).

As you can see, starting from 1, it will show all 65535 ports open. Actually these ports are not actually open and some don't eve exist, but this is how we are fooling the attacker to make him see all 65535 ports are opened.

If you want to scan that host with any signature within nmap then it will show as below. I am using nmap with the –v and –A options. Then the result, will be as shown below:

You may remember that, when we started portspoof, it was in verbose mode. So if we check the host machine now, it will show some information about which kinds of threads have been coming in and which kind of signature reply that portspoof tool has given in respond to that request. This information will be shown like this:

Conclusion

Thus how you can fool the attacker or a noob. If you configure this, he will be confused and out of his mind about which port is actually and legitimately open. If he is a pro noob then he will start hunting from port 1^st to 65535 (I hope so). So this is a very lightweight small tool to fool attackers as well as to increase the amount of attack time in which you might trace the actual attacker.

Learn Network Security Fundamentals

Build your skills with seven hands-on courses covering network models and protocols, wireless and mobile security, network security best practices and more.

Start Learning

References

1. http://linux.about.com/od/commands/l/blcmdl8_rpm.htm
2. http://www.centos.org/docs/4/html/rhel-rg-en-4/s1-iptables-options.html