mastodonのTLに流れてきて気になったPortsproof
面白そうです．ローカル環境で少し試してみました．
Portsproofをbuild
$ git clone https://github.com/drk1wi/portsproof $ cd portsproof $ ./configure $ make
iptableでTCP全ポートをPortsproofの4444に向ける
$ sudo iptables -t nat -A PREROUTING -i eth0 -p tcp -m tcp --dport 1:65535 -j REDIRECT --to-ports 4444
Portsproofを起動
$ ./src/portspoof -1vd -> Generating fuzzing payloads internally! -> Verbose mode on. -> Syslog logging disabled.
nmapでtcp 1-22をスキャン，元々は22番しか起動していないが1-22全てopenになる
$ nmap -p 1-22 192.168.0.23 Starting Nmap 7.95 ( https://nmap.org ) at 2025-01-03 06:50 JST Nmap scan report for raspberrypi.AirPort (192.168.0.23) Host is up (0.013s latency). PORT STATE SERVICE 1/tcp open tcpmux 2/tcp open compressnet 3/tcp open compressnet 4/tcp open unknown 5/tcp open rje 6/tcp open unknown 7/tcp open echo 8/tcp open unknown 9/tcp open discard 10/tcp open unknown 11/tcp open systat 12/tcp open unknown 13/tcp open daytime 14/tcp open unknown 15/tcp open netstat 16/tcp open unknown 17/tcp open qotd 18/tcp open msp 19/tcp open chargen 20/tcp open ftp-data 21/tcp open ftp 22/tcp open ssh Nmap done: 1 IP address (1 host up) scanned in 1.19 seconds
このときのPortsproofのlogの一部
new conn - thread choosen: 0 - nr. of connections already in queue: 0 new conn - thread choosen: 0 - nr. of connections already in queue: 1 new conn - thread choosen: 0 - nr. of connections already in queue: 2 new conn - thread choosen: 0 - nr. of connections already in queue: 3
OSスキャンをしてみると46分も掛かる(Portsproofを起動しない場合
0m43.604s で終わる)$ time sudo nmap -AO 192.168.0.23 : real 46m1.292s user 0m0.085s sys 0m0.017s
このときのPortsproofのログを見ると適当なsignatureが出力されている
--- Thread nr.0 for port 17 signature sent -> \4c\d8\1a\6d\75\7b\1c\51\89\5d\4\f1\83\ec\e7\e8\3b\b5\1d\2b\36\8f\e2\ad\da\75\e1\ac\ec\96\27\b8\ee\41\a5\65\3c\42\36\c5\9f\3b\b8\a3\28\20\8c\e2\56\aa\8d\8c\3a\71\3a\15\e6\9c\42\53\33\69\c\a2\2b\b1\8\67\73\3e\ad\14\f8\e5\b7\a0\6\c3\84\5c\6e\91\68\28\3\a3\bd\69\bf\00 ---
という感じで面白いです．Tarpit的にも使えそう?
Note | SSH TarpitのEndlesshについてはこちら |
環境
$ git log --pretty=oneline -1 89d5ecc6b681037865a4557ec8c374286302b840 (HEAD -> master, origin/master, origin/HEAD) Merge pull request #51 from AbelLykens/patch-1 $ lsb_release -dr No LSB modules are available. Description: Raspbian GNU/Linux 12 (bookworm) Release: 12 $ arch armv7l $ grep ^Model /proc/cpuinfo Model : Raspberry Pi 3 Model B Rev 1.2