Portspoof - Tool to provide Snooping/DOS defenses for PUPs

For discussions about security.
Message
Author
musher0
Posts: 14629
Joined: Mon 05 Jan 2009, 00:54
Location: Gatineau (Qc), Canada

#16 Post by musher0 »

Hi, gcmartin.

Ah. Your AngryIP reminds me of lsof, the real one, not the busybox one. The busybox
lsof does not have any parameters you can control it with. (Why am I not surprised?...)
Whereas here's what you get with lsof --help: :)
[/bin]>lsof -h
lsof 4.87
latest revision: ftp://lsof.itap.purdue.edu/pub/tools/unix/lsof/
latest FAQ: ftp://lsof.itap.purdue.edu/pub/tools/unix/lsof/FAQ
latest man page: ftp://lsof.itap.purdue.edu/pub/tools/unix/lsof/lsof_man
usage: [-?abhKlnNoOPRtUvVX] [+|-c c] [+|-d s] [+D D] [+|-f[gG]] [+|-e s]
[-F [f]] [-g [s]] [-i ] [+|-L [l]] [+m [m]] [+|-M] [-o [o]] [-p s]
[+|-r [t]] [-s [p:s]] [-S [t]] [-T [t]] [-u s] [+|-w] [-x [fl]] [--] [names]
Defaults in parentheses; comma-separated set (s) items; dash-separated ranges.
-?|-h list help -a AND selections (OR) -b avoid kernel blocks
-c c cmd c ^c /c/[bix] +c w COMMAND width (9) +d s dir s files
-d s select by FD set +D D dir D tree *SLOW?* +|-e s exempt s *RISKY*
-i select IPv[46] files -K list tasKs (threads) -l list UID numbers
-n no host names -N select NFS files -o list file offset
-O no overhead *RISKY* -P no port names -R list paRent PID
-s list file size -t terse listing -T disable TCP/TPI info
-U select Unix socket -v list version info -V verbose search
+|-w Warnings (-) -X skip TCP&UDP* files -- end option scan
+f|-f +filesystem or -file names +|-f[gG] flaGs
-F [f] select fields; -F? for help
+|-L [l] list (+) suppress (-) link counts < l (0 = all; default = 0)
+m [m] use|create mount supplement
+|-M portMap registration (-) -o o o 0t offset digits (8)
-p s exclude(^)|select PIDs -S [t] t second stat timeout (15)
-T qs TCP/TPI Q,St (s) info
-g [s] exclude(^)|select and print process group IDs
-i i select by IPv[46] address: [46][proto][@host|addr][:svc_list|port_list]
+|-r [t[m<fmt>]] repeat every t seconds (15); + until no files, - forever.
An optional suffix to t is m<fmt>; m must separate t from <fmt> and
<fmt> is an strftime(3) format for the marker line.
-s p:s exclude(^)|select protocol (p = TCP|UDP) states by name(s).
-u s exclude(^)|select login|UID set s
-x [fl] cross over +d|+D File systems or symbolic Links
names select named files or files on named file systems
Only root can list all files; /dev warnings disabled; kernel ID check disabled.

Ah, isn't information about a program beautiful !! :D

I uploaded a copy here:
http://www66.zippyshare.com/v/79186025/file.html

There's also a thread on lsof here:
http://murga-linux.com/puppy/viewtopic. ... 409#710409

And here's what I get in terminal after launching portspoof:
[/bin]>lsof -i
COMMAND PID USER FD TYPE DEVICE SIZE/OFF NODE NAME
cupsd 3861 root 8u IPv4 4677 0t0 TCP localhost:631 (LISTEN)
portspoof 31058 daemon 3u IPv4 337684 0t0 TCP *:4444 (LISTEN)


Opera is open, on this thread, and is connected to two other sites, and they are not
showing. They're probably gobbled up by portspoof.

Yess! Over here, kiddy-kiddy-kiddy! ;) I hope you'll like your special copy of
The Little Red Riding Hood! :twisted:

BFN.

musher0
musher0
~~~~~~~~~~
"You want it darker? We kill the flame." (L. Cohen)

User avatar
Flash
Official Dog Handler
Posts: 13071
Joined: Wed 04 May 2005, 16:04
Location: Arizona USA

#17 Post by Flash »

What does Shields Up! say after you've activated Portspoof?

User avatar
NickAu
Posts: 183
Joined: Mon 30 Dec 2013, 04:32
Location: Far North Coast NSW ɹÇ￾punuÊ￾op

#18 Post by NickAu »

.
This tool should be looked at, not as a specific level of defense, rather, it should be looked at as a response mechanism to something which it is trained to follow once something it notes happens on your specific PC.

Thank you that explains it. still love it.
[b]Precise Puppy 5.7.1 Retro Fatty Edition. Hp Compaq 2510p 2x Intel(R) Core(TM) 2 Duo Cpu U7700@ 1.33 ghz,2 gig ram Booting from 8 gig micro USB + 32 gig SD card instead of HDD[/b]

musher0
Posts: 14629
Joined: Mon 05 Jan 2009, 00:54
Location: Gatineau (Qc), Canada

#19 Post by musher0 »

Flash wrote:What does Shields Up! say after you've activated Portspoof?
Hi, Flash.

With portspoof on:
Port Authority Edition — Internet Vulnerability Profile
by Steve Gibson, Gibson Research Corporation.

This textual summary may be printed, or marked and copied
for subsequent pasting into any other application:

----------------------------------------------------------------------

GRC Port Authority Report created on UTC: 2014-03-06 at 03:57:56

Results from scan of ports: 0-1055

0 Ports Open
72 Ports Closed
984 Ports Stealth
---------------------
1056 Ports Tested

NO PORTS were found to be OPEN.

Ports found to be CLOSED were: 0, 1, 2, 3, 4, 5, 6, 31, 61,
62, 91, 93, 121, 123, 153, 154,
182, 184, 212, 213, 242, 243,
272, 273, 304, 305, 333, 335,
363, 365, 394, 395, 424, 425,
454, 456, 485, 486, 515, 516,
545, 546, 576, 607, 637, 639,
668, 669, 698, 699, 728, 729,
759, 760, 788, 789, 818, 820,
848, 850, 879, 880, 907, 910,
936, 937, 964, 967, 994, 995,
1025, 1026

Other than what is listed above, all ports are STEALTH.

TruStealth: FAILED - NOT all tested ports were STEALTH,
- NO unsolicited packets were received,
- A PING REPLY (ICMP Echo) WAS RECEIVED.

---------------------------------------------------------------------
THE EQUIPMENT AT THE TARGET IP ADDRESS
ACTIVELY REJECTED OUR UPnP PROBES!
(That's good news!)

This equipment is not fully “stealthful
musher0
~~~~~~~~~~
"You want it darker? We kill the flame." (L. Cohen)

User avatar
Flash
Official Dog Handler
Posts: 13071
Joined: Wed 04 May 2005, 16:04
Location: Arizona USA

#20 Post by Flash »

I'm not too familiar with the Shields Up! site, but from your results it doesn't look like Portspoof did anything. Perhaps it wasn't configured correctly.

User avatar
NickAu
Posts: 183
Joined: Mon 30 Dec 2013, 04:32
Location: Far North Coast NSW ɹÇ￾punuÊ￾op

#21 Post by NickAu »

Any other test I should have used on that site? (I'm sure I missed something.
I do not think so most of the rest is set up for Windows.


Portspoof not installed on my pc.


That grc test ... umm if port spoof was running it could have given away that the pc was there.

That test is just for firewalls.


The firewall test shows

NO PORTS were found to be OPEN. Just what it says.

Ports found to be CLOSED were: 0, 1, 2, 3, 4, 5, 6, 31, 61,
62, 91, 93, 121, 123, 153, 154,
182, 184, 212, 213, 242, 243,
272, 273, 304, 305, 333, 335,
363, 365, 394, 395, 424, 425,
454, 456, 485, 486, 515, 516,
545, 546, 576, 607, 637, 639,
668, 669, 698, 699, 728, 729,
759, 760, 788, 789, 818, 820,
848, 850, 879, 880, 907, 910,
936, 937, 964, 967, 994, 995,
1025, 1026

These ports are visable on the net during random port scans but report as closed.


TruStealth: FAILED - NOT all tested ports were STEALTH, This is a firewall config. The haxors know you are there now all they have to do is get in. On windows some of those ports are for .. Windows update.. say port 146 ( just an example not the port) now they know how to tailor an attack on that port on that ip.

Not good

Good this was my result
TruStealth: PASSED- All tested ports were STEALTH, Nothing to see here they move on.

I will not presume to say how the app interacts with the above. But. When you did the shields up scan they scanned your ip for stuff. that scan resulted in your pc replying to unsolicited requests from grc to connect to your pc. Thats how they know you have unstealthed ports . this means anybody scanning your ip will know there is a pc there and connected.

TruStealth

They scanned my pc the same way my pc did not respond to any request as far as they know there is no evidence of a pc existing on this ip.

For a dedicated attack TruStealth is useless.

For a random scan Its great as they cant see your pc.

I will also not argue the validity of the test or if ports should be stealth or just closed. Do not know about it in linux. In windows stealth is better than closed. If random scans cant see you they cant target you.

Try running windows without a firewall or puppy for that matter go to grc and do the trustealth test and see how many ports are wide open to the net.

Again I do not know much but I do not want a port sitting there open to anybody that can run a scanner and connect to another pc.

Question? what is a ping if there is nothing for it to bounce back from.
[b]Precise Puppy 5.7.1 Retro Fatty Edition. Hp Compaq 2510p 2x Intel(R) Core(TM) 2 Duo Cpu U7700@ 1.33 ghz,2 gig ram Booting from 8 gig micro USB + 32 gig SD card instead of HDD[/b]

gcmartin

#22 Post by gcmartin »

[quote="Musher0 in an earlier post"] ... This equipment is not fully “stealthful

User avatar
NickAu
Posts: 183
Joined: Mon 30 Dec 2013, 04:32
Location: Far North Coast NSW ɹÇ￾punuÊ￾op

#23 Post by NickAu »

PortSpoof is suppose to be designed to do its job should an attacker start after the PC. The article and the literature is clear that it will make an attacker wait and wait and wait and
Thats how i see it.

So i was kinda right second line defence first being that they cant see you.
This is a good example of an external site which doesn't know what to make of the PC it is trying to talk to.

inasmuch as it did respond to our probing. Thus hackers will know that some equipment exists at this IPv4 address
No, the point is that site shouldnt know you are even there or that any equipment exists on that ip. The pc should stay silent to any unsolicited requests. Even responding to a ping is bad.
Last edited by NickAu on Sun 09 Mar 2014, 04:39, edited 5 times in total.
[b]Precise Puppy 5.7.1 Retro Fatty Edition. Hp Compaq 2510p 2x Intel(R) Core(TM) 2 Duo Cpu U7700@ 1.33 ghz,2 gig ram Booting from 8 gig micro USB + 32 gig SD card instead of HDD[/b]

musher0
Posts: 14629
Joined: Mon 05 Jan 2009, 00:54
Location: Gatineau (Qc), Canada

#24 Post by musher0 »

gcmartin wrote:[(...)
Maybe its time to invite the author to this forum's thread to assert the tool's operation to this audience.
That would be really wonderful!
musher0
~~~~~~~~~~
"You want it darker? We kill the flame." (L. Cohen)

musher0
Posts: 14629
Joined: Mon 05 Jan 2009, 00:54
Location: Gatineau (Qc), Canada

#25 Post by musher0 »

I gather we're stumped?
musher0
~~~~~~~~~~
"You want it darker? We kill the flame." (L. Cohen)

gcmartin

#26 Post by gcmartin »

This tool can be helpful if employed with a little discretion. It, in and of itself, is NOT a complete firewall but can be helpful in being a deterrent should someone attempting a breach. That someone would be unsuspecting that he is being wrongly steered.

This is an effective means for something simple that works to make life a "nightmare" for an attacker.

Hope this helps
Edited: 2nd sentence edit to correct its interpretation.
Last edited by gcmartin on Mon 10 Mar 2014, 04:19, edited 1 time in total.

User avatar
Flash
Official Dog Handler
Posts: 13071
Joined: Wed 04 May 2005, 16:04
Location: Arizona USA

#27 Post by Flash »

Keeping in mind that it was probably designed for use only with servers, how can we test to see if it is really doing what we think it says it will?

drk1wi
Posts: 5
Joined: Wed 12 Mar 2014, 09:31

#28 Post by drk1wi »

Hi everyone,

I am the author of Portspoof. I can support you with some insight in how the tool was designed/implemented and how it works in general ;)

At the moment you can run it on any Linux that has NAT support enabled (this is the default case in most distros) and the easiest way to check if everything is working properly is to use one of the port scanners.
For example just : nmap -sS -p - -v your_internal_ip

'Shields Up' will only show you some results in case you are not behind a NAT.

Cheers,
Piotr

User avatar
Flash
Official Dog Handler
Posts: 13071
Joined: Wed 04 May 2005, 16:04
Location: Arizona USA

#29 Post by Flash »

Thank you for joining the forum.

So what is Shields Up seeing? Is it the ports of the NAT server?

musher0
Posts: 14629
Joined: Mon 05 Jan 2009, 00:54
Location: Gatineau (Qc), Canada

#30 Post by musher0 »

Hi, drk1wi.

Indeed, thanks for joining this thread. It's a pleasure to have you among us.

I did find my internal ip address, but hmm... there is no nmap utility on my UpupRaring 3.9.9.2....

Best regards.

musher0
musher0
~~~~~~~~~~
"You want it darker? We kill the flame." (L. Cohen)

musher0
Posts: 14629
Joined: Mon 05 Jan 2009, 00:54
Location: Gatineau (Qc), Canada

#31 Post by musher0 »

Hello again, people.

I found two ready-made archives that made nmap work out of the box on my
Raring Puppy.

nmap itself from Ubuntu 12.10 LTS
http://archive.ubuntu.com/ubuntu/pool/m ... 1_i386.deb

And the requested lua library from the Debian Squeeze archive
http://ftp.br.debian.org/debian/pool/ma ... 5_i386.deb
(this one intentionally for a lower glibc, the glibc version for ubuntu seemed a little high.)

YMMV...

This is getting better. What should we do next, Piotr?

BFN.

musher0
Attachments
nmap.jpg
Proof! :)
(39.1 KiB) Downloaded 408 times
musher0
~~~~~~~~~~
"You want it darker? We kill the flame." (L. Cohen)

drk1wi
Posts: 5
Joined: Wed 12 Mar 2014, 09:31

#32 Post by drk1wi »

@Flash

What does Shields Up! say after you've activated Portspoof?

I am not that familiar with this service, but from a networking point of view they can only scan your visible (public IP), so unless you have a dedicated public IP they just scan you internet providers gateway.

drk1wi
Posts: 5
Joined: Wed 12 Mar 2014, 09:31

#33 Post by drk1wi »

musher0 wrote:Hello again, people.

I found two ready-made archives that made nmap work out of the box on my
Raring Puppy.

nmap itself from Ubuntu 12.10 LTS
http://archive.ubuntu.com/ubuntu/pool/m ... 1_i386.deb

And the requested lua library from the Debian Squeeze archive
http://ftp.br.debian.org/debian/pool/ma ... 5_i386.deb
(this one intentionally for a lower glibc, the glibc version for ubuntu seemed a little high.)

YMMV...

This is getting better. What should we do next, Piotr?

BFN.

musher0


It seems like iptables isn't configured properly.
Can you paste it (iptables-save) and your ifconfig?

What you have to do is to configure your FW rules to redirect all of the "unwanted" traffic to the application (by default it's listening on port 4444).

Did you try this startup script ?

https://github.com/drk1wi/portspoof/blo ... rtspoof.sh

Cheers,
Piotr

musher0
Posts: 14629
Joined: Mon 05 Jan 2009, 00:54
Location: Gatineau (Qc), Canada

#34 Post by musher0 »

Hello, Piotr.

Many thanks for the feedback.

Downloaded your script. Results of my ifconfig is attached.
As to iptables -save, it just gives the help lines, same as iptables -h.

There's something I'm not getting, obviously.
Probably I have to change the lightbulb over my head? :lol:

Best regards.

musher0
Attachments
ifconfig-musher0.txt.zip
(530 Bytes) Downloaded 146 times
musher0
~~~~~~~~~~
"You want it darker? We kill the flame." (L. Cohen)

drk1wi
Posts: 5
Joined: Wed 12 Mar 2014, 09:31

#35 Post by drk1wi »

musher0 wrote:Hello, Piotr.

Many thanks for the feedback.

Downloaded your script. Results of my ifconfig is attached.
As to iptables -save, it just gives the help lines, same as iptables -h.

There's something I'm not getting, obviously.
Probably I have to change the lightbulb over my head? :lol:

Best regards.

musher0
Hey musher0.

Try 'iptables-save' :) Basically, if the software is listening on 4444 and you have a proper iptables configuration then everything should work. Though, iptables config can be sometimes a pain.

Piotr

Post Reply