EH-Net

Running nmap with OS detection can generally determine an os running on VMWare, not sure about Zen. As for getting through the router, you will have to find someway to bypass it, I assume. NMAP has features for that as well.

To attack a NAT network, you would simply need a properly configured lab... one router giving you your own network for attacking, and another router being the NAT network with hosts behind it. Most SOHO (linksys/netgear) routers have NAT capability, so get two cheap routers, set one as 10.0.0.0 and one as 192.168.1.0.

I think the issue would be there that you have no outside network... The only legal suggestion that I can provide would be to purchase two internet connections. The problem there is that performing attacks over the internet is not advised... But I know this is done, I don't know how though...

I did a -A scan and got the folllowing line which might be interesting

MAC Address: 00:50:56:BC:7B:D9 (VMware)

If you dont have money to invest then better google pfsence , smoothwall , they are good all in one firewall type solutions and open source .

Agreed, performing OS detection will determine, in my experience, a system running in a VM.

Also, Hak5 did a video on turning a mini-PC into a router/firewall. I enjoyed it u dutil they changed the firewall software they were using in another video...

[sil@asphyxia sil]# nmap -sS -O 10.4.4.79 -T5 -v -P0

Initiating SYN Stealth Scan against 10.4.4.79 [1680 ports] at 16:56

Interesting ports on 10.4.4.79:
Not shown: 1673 filtered ports
PORT     STATE SERVICE
21/tcp   open  ftp
135/tcp  open  msrpc
389/tcp  open  ldap
636/tcp  open  ldapssl
1030/tcp open  iad1
2809/tcp open  corbaloc
9100/tcp open  jetdirect
Device type: general purpose
Running: OpenBSD 3.X
OS details: OpenBSD 3.5 - 3.9, OpenBSD 3.6
TCP Sequence Prediction: Class=truly random
                         Difficulty=9999999 (Good luck!)
IPID Sequence Generation: Randomized

Nmap finished: 1 IP address (1 host up) scanned in 14.416 seconds
               Raw packets sent: 3372 (149.192KB) | Rcvd: 17 (880B)

[sil@asphyxia sil]# nmap -sS -sV -P0 -A -vvv 10.4.4.79

Initiating SYN Stealth Scan against 10.4.4.79 [1680 ports] at 16:47

Interesting ports on 10.4.4.79:
Not shown: 1673 filtered ports
PORT     STATE SERVICE    VERSION
21/tcp   open  ftp?
135/tcp  open  msrpc      Microsoft Windows RPC
389/tcp  open  ldap       Microsoft LDAP server
636/tcp  open  tcpwrapped
1030/tcp open  msrpc      Microsoft Windows RPC
2809/tcp open  corbaloc?
9100/tcp open  jetdirect?


SF-Port2809-TCP:V=4.11%I=7%D=11/19%Time=4CE6F079%P=i686-redhat-linux-gnu%r
SF:(GetRequest,C,"GIOP\x01\x02\0\x06\0\0\0\0")%r(HTTPOptions,C,"GIOP\x01\x
SF:02\0\x06\0\0\0\0")%r(RTSPRequest,C,"GIOP\x01\x02\0\x06\0\0\0\0")%r(RPCC
SF:heck,C,"GIOP\x01\x02\0\x06\0\0\0\0")%r(DNSVersionBindReq,C,"GIOP\x01\x0
SF:2\0\x06\0\0\0\0")%r(DNSStatusRequest,C,"GIOP\x01\x02\0\x06\0\0\0\0")%r(
SF:SSLSessionReq,C,"GIOP\x01\x02\0\x06\0\0\0\0")%r(SMBProgNeg,C,"GIOP\x01\
SF:x02\0\x06\0\0\0\0")%r(X11Probe,C,"GIOP\x01\x02\0\x06\0\0\0\0")%r(FourOh
SF:FourRequest,C,"GIOP\x01\x02\0\x06\0\0\0\0")%r(LDAPBindReq,C,"GIOP\x01\x
SF:02\0\x06\0\0\0\0")%r(LANDesk-RC,C,"GIOP\x01\x02\0\x06\0\0\0\0")%r(NCP,C
SF:,"GIOP\x01\x02\0\x06\0\0\0\0")%r(NotesRPC,C,"GIOP\x01\x02\0\x06\0\0\0\0
SF:")%r(NessusTPv10,C,"GIOP\x01\x02\0\x06\0\0\0\0")%r(WMSRequest,C,"GIOP\x
SF:01\x02\0\x06\0\0\0\0")%r(oracle-tns,C,"GIOP\x01\x02\0\x06\0\0\0\0");

Device type: general purpose
Running: OpenBSD 3.X
OS details: OpenBSD 3.5 - 3.9, OpenBSD 3.6
OS Fingerprint:
TSeq(Class=TR%IPID=RD)
T1(Resp=Y%DF=Y%W=4000%ACK=S++%Flags=AS%Ops=MNWNNT)
T2(Resp=Y%DF=Y%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=Y%W=4000%ACK=S++%Flags=AS%Ops=MNWNNT)
T4(Resp=Y%DF=Y%W=0%ACK=O%Flags=R%Ops=)
T5(Resp=N)
T6(Resp=N)
T7(Resp=N)
PU(Resp=N)

TCP Sequence Prediction: Class=truly random
                         Difficulty=9999999 (Good luck!)
IPID Sequence Generation: Randomized
Service Info: OS: Windows

Nmap finished: 1 IP address (1 host up) scanned in 70.602 seconds
               Raw packets sent: 3373 (149.236KB) | Rcvd: 19 (986B)

[sil@asphyxia sil]# nmap -sS -sV -P0  -vvv 10.4.4.79

Initiating SYN Stealth Scan against 10.4.4.79 [1680 ports] at 16:48

Interesting ports on 10.4.4.79:
Not shown: 1673 filtered ports
PORT     STATE SERVICE    VERSION
21/tcp   open  ftp?
135/tcp  open  msrpc      Microsoft Windows RPC
389/tcp  open  ldap       Microsoft LDAP server
636/tcp  open  tcpwrapped
1030/tcp open  msrpc      Microsoft Windows RPC
2809/tcp open  corbaloc?
9100/tcp open  jetdirect?

SF-Port2809-TCP:V=4.11%I=7%D=11/19%Time=4CE6F0D8%P=i686-redhat-linux-gnu%r
SF:(GetRequest,C,"GIOP\x01\x02\0\x06\0\0\0\0")%r(HTTPOptions,C,"GIOP\x01\x
SF:02\0\x06\0\0\0\0")%r(RTSPRequest,C,"GIOP\x01\x02\0\x06\0\0\0\0")%r(RPCC
SF:heck,C,"GIOP\x01\x02\0\x06\0\0\0\0")%r(DNSVersionBindReq,C,"GIOP\x01\x0
SF:2\0\x06\0\0\0\0")%r(DNSStatusRequest,C,"GIOP\x01\x02\0\x06\0\0\0\0")%r(
SF:SSLSessionReq,C,"GIOP\x01\x02\0\x06\0\0\0\0")%r(SMBProgNeg,C,"GIOP\x01\
SF:x02\0\x06\0\0\0\0")%r(X11Probe,C,"GIOP\x01\x02\0\x06\0\0\0\0")%r(FourOh
SF:FourRequest,C,"GIOP\x01\x02\0\x06\0\0\0\0")%r(LDAPBindReq,C,"GIOP\x01\x
SF:02\0\x06\0\0\0\0")%r(LANDesk-RC,C,"GIOP\x01\x02\0\x06\0\0\0\0")%r(NCP,C
SF:,"GIOP\x01\x02\0\x06\0\0\0\0")%r(NotesRPC,C,"GIOP\x01\x02\0\x06\0\0\0\0
SF:")%r(NessusTPv10,C,"GIOP\x01\x02\0\x06\0\0\0\0")%r(WMSRequest,C,"GIOP\x
SF:01\x02\0\x06\0\0\0\0")%r(oracle-tns,C,"GIOP\x01\x02\0\x06\0\0\0\0");
Service Info: OS: Windows

Nmap finished: 1 IP address (1 host up) scanned in 68.101 seconds
               Raw packets sent: 3355 (147.620KB) | Rcvd: 9 (414B)

[sil@asphyxia sil]# nmap -sS -O -v 10.4.4.79

Starting Nmap 4.11 ( http://www.insecure.org/nmap/ ) at 2010-11-19 16:54 EST
Note: Host seems down. If it is really up, but blocking our ping probes, try -P0
Nmap finished: 1 IP address (0 hosts up) scanned in 2.124 seconds
               Raw packets sent: 4 (136B) | Rcvd: 0 (0B)

Be cautious when relying on nmap for detection especially when its VMWare related. The following is an example that illustrates this. Four different scans against my Window7 Ultimate machine:

Don't always rely on one tool