Image
 
linkedin_logo.png rss_logo.jpg
twitter_logo.png youtube_logo.jpg
Latest Additions
 
EH-Net Login
Welcome Guest.






Lost Password?
No account yet? Register
Who's Online
We have 33 guests and 3 members online
 
Free Business and Tech Magazines and eBooks

You are here: Home arrow Ethical Hacking Discussions and Related Certificationsarrow Network Pen Testingarrow Learning Phase on Pentest - De-ICE
EH-Net
May 19, 2013, 10:16:59 PM *
Welcome, Guest. Please login or register.
Did you miss your activation email?

Login with username, password and session length
News: Go back to The Ethical Hacker Network Online Magazine Home Page
 
   Home   Help Calendar Login Register  
Pages: [1] 2   Go Down
  Print  
Author Topic: Learning Phase on Pentest - De-ICE  (Read 14088 times)
0 Members and 1 Guest are viewing this topic.
vp75
Jr. Member
**
Offline Offline

Posts: 78


View Profile
« on: July 13, 2011, 05:33:38 PM »

Hi Guys,

Hope you can help me,

I got lab setup with BT5 & Installed De-Ice.net 192.168.1.100 (first series).

It seems by default it is set up with 192.168.100.1, my router asusual has 192.168.0.x. I'm not able to ping to De-Ice distro....

My question is without logging into De-Ice i cannot change the ipaddress....Similarly I tried changing ipaddress in my router for 192.168.1.x series to enable to connect accordingly.....Seems I'm missing something & not sure how to overcome the situation....
Your help is much appreciated...

Cheers
Vp
Logged

eCPPT
hayabusa
Hero Member
*****
Offline Offline

Posts: 1630



View Profile
« Reply #1 on: July 13, 2011, 06:22:46 PM »

Perhaps boot it in a vm with a network configured for that subnet.  For that matter, if you're on a hub (your router,) just put your workstation on the same subnet.  They can hit each other that way, so long as both are on same side of your router.  (ie - you're not trying to go PAST the router)
« Last Edit: July 13, 2011, 06:25:27 PM by hayabusa » Logged

~ hayabusa ~ 

"All men can see these tactics whereby I conquer, but what none can see is the strategy out of which victory is evolved." - Sun Tzu, 'The Art of War'


OSCE, OSCP , GPEN, C|EH
lorddicranius
Sr. Member
****
Offline Offline

Posts: 447



View Profile WWW
« Reply #2 on: July 13, 2011, 06:46:14 PM »

I would think that changing the subnet on your router to 192.168.1.x would work, that's exactly what I had to do...hmm.  Make sure your not testing connectivity to the .1.100 De-ICE disc via ping - it won't reply.  You can test by trying to FTP or SSH to it (should get a login prompt).
Logged

GSEC, eCPPT, Sec+
hayabusa
Hero Member
*****
Offline Offline

Posts: 1630



View Profile
« Reply #3 on: July 13, 2011, 07:01:15 PM »

Heh...  Been so long since I played with De-ice, forgot he won't be able to ping it.  Didn't it even mention that in one of the readme's?
Logged

~ hayabusa ~ 

"All men can see these tactics whereby I conquer, but what none can see is the strategy out of which victory is evolved." - Sun Tzu, 'The Art of War'


OSCE, OSCP , GPEN, C|EH
vp75
Jr. Member
**
Offline Offline

Posts: 78


View Profile
« Reply #4 on: July 13, 2011, 07:04:46 PM »

Hi Hayabusa

I got my Lab setup in Mac.....I believe Mac version of VM (vm fusion) available only in trial version....(else got to buy it)....

Any other option.....?

Cheers
Vp
Logged

eCPPT
hayabusa
Hero Member
*****
Offline Offline

Posts: 1630



View Profile
« Reply #5 on: July 13, 2011, 07:25:28 PM »

Yeah...  See lorddicranius' post, above.  You WON'T be able to ping.  Apologies, as I'd forgotten about that with DE-Ice.  It won't respond to icmp.  Try ssh, or ftp, or run nmap with common ports, and see if it replies.

But again, make sure your attack machine is setup with an ip on same subnet as de-ice.
Logged

~ hayabusa ~ 

"All men can see these tactics whereby I conquer, but what none can see is the strategy out of which victory is evolved." - Sun Tzu, 'The Art of War'


OSCE, OSCP , GPEN, C|EH
nicklauscombs
Newbie
*
Offline Offline

Posts: 28



View Profile
« Reply #6 on: July 13, 2011, 09:18:48 PM »

Heh...  Been so long since I played with De-ice, forgot he won't be able to ping it.  Didn't it even mention that in one of the readme's?

ha this just happened to me the other day as well... probably a good year since i've played with it (forgetting of course it can't be pinged).... 5 minutes later.... OH YEAH CRAP
Logged
lorddicranius
Sr. Member
****
Offline Offline

Posts: 447



View Profile WWW
« Reply #7 on: July 14, 2011, 12:28:32 AM »

Heh...  Been so long since I played with De-ice, forgot he won't be able to ping it.  Didn't it even mention that in one of the readme's?

I'm not sure honestly.  I don't think I've ever seen a readme for the de-ice discs.  The discs I got were .iso's (not tarballed or anything).  I know the heorot.net forums contains downloads and scenario info, but there isn't anything there about the discs other than the disc IP.  I remember seeing a wiki with all the info too, but I'm having a helluva time finding it haha.  I don't recall the wiki saying too much more about them either though.
Logged

GSEC, eCPPT, Sec+
nicklauscombs
Newbie
*
Offline Offline

Posts: 28



View Profile
« Reply #8 on: July 14, 2011, 02:48:12 AM »

I remember seeing a wiki with all the info too, but I'm having a helluva time finding it haha.  I don't recall the wiki saying too much more about them either though.

I remember there being a wiki or forum entry about it not being pingable though you are right in saying that it is extremely difficult to find.
Logged
vp75
Jr. Member
**
Offline Offline

Posts: 78


View Profile
« Reply #9 on: July 14, 2011, 03:50:16 AM »

Hi Lord/Nick/hayabusa,

I will try it again as per your suggestions....

It was around early morning 2am (GMT) i went to bed after banging my head on it. I remember i did tried the nmap with the De-Ice ipaddress(i was getting as host down), but not sure as i have been playing around the network adapter with NAT/Bridged/Host etc....

I will give a try again with bridged which is  how i have setup all my other distros & let you know....

Thanks guys, though we havent met each other.....thru forum sharing knowledge is brilliant....
Cheers
Vp
Logged

eCPPT
Grendel
Full Member
***
Offline Offline

Posts: 241


View Profile WWW
« Reply #10 on: July 14, 2011, 09:01:20 AM »

I designed the De-ICE disks to imitate the real world, and one thing I always did as a sysadmin was turn off things like ping... So, I did the same with the 1.100 disk. The educational purpose behind turning it off was to teach people to use multiple tools to validate everything they do. As my students hear me say (too frequently), "always be cynical and use more than one tool for each task."
Logged

- Thomas Wilhelm, MSCS MSM
ISSMP CISSP SCSECA SCNA IEM

Web Site:
Author:
  • Professional Penetration Testing
  • Ninja Hacking
  • Penetration Tester's Open Source Toolkit
  • Metasploit Toolkit for Penetration Testing
  • Netcat Power Tools
vp75
Jr. Member
**
Offline Offline

Posts: 78


View Profile
« Reply #11 on: July 14, 2011, 03:31:52 PM »

Hi Grendel,

good to see your reply (The Designer of De-Ice).

I checked again, In BT5, I'm able to see the IPAddress 192.168.1.100 while using netdiscover, but nmap says @Host is down. My network setup is Bridged....is that were I'm making a mistake....? (i believe for nmap it should show the open ports / services....)

Cheers
VP
Logged

eCPPT
lorddicranius
Sr. Member
****
Offline Offline

Posts: 447



View Profile WWW
« Reply #12 on: July 14, 2011, 04:30:29 PM »

Just to make sure we're all on the same page:

  • The router is configured to use the 192.168.1.x subnet
  • The BackTrack VM is configured for bridged networking
  • The BackTrack VM has an IP address in the 192.168.1.x subnet (a DHCP addresses leased from the router?)
  • The De-ICE 1.100 disc is configured for bridged networking
  • You can see the De-ICE .1.100 disc from the BackTrack VM using netdiscover
  • You can't get a list of open ports when you scan the De-ICE .1.100 disc using nmap

What's the nmap command you are using?
« Last Edit: July 14, 2011, 05:39:48 PM by lorddicranius » Logged

GSEC, eCPPT, Sec+
vp75
Jr. Member
**
Offline Offline

Posts: 78


View Profile
« Reply #13 on: July 15, 2011, 01:39:35 AM »

Hi Lord

(The router is configured to use the 192.168.1.x subnet , I hope you are referring the  ipaddress on router, as subnet slightly confused me)
1. Router is configured on defualt 192.168.0.1
2. BT VM is configured on Bridged Net
3. BT VM has IP address 192.168.0.x (a DHCP addresses leased from the router?) not sure of this part), I can see there is a option for DHCP Client if required with no value in my mac laptop (i didnt provide any value)
4. The De-ICE 1.100 disc is configured for bridged net
5. I can see the De-ICE .1.100 disc from the BackTrack VM using netdiscover
NetDiscover shows IP, Mac Addr, Count, Len, Mac vendor as some xxxxxxx

I used nmap -sS -O 192.168.1.100
Host seems down is the message i received

Cheers
Vp
Logged

eCPPT
lorddicranius
Sr. Member
****
Offline Offline

Posts: 447



View Profile WWW
« Reply #14 on: July 15, 2011, 02:02:05 AM »

I'm slightly confused as to the router configuration.  What kind of router is it - wireless router?  A DHCP server is functionality found on most consumer routers now days.  The service will lease IP addresses to other devices that connect to it.  Usually the IP address you configure for the router will reside on the same subnet that it leases IP addresses for.  For example, if you configure the router to have an IP address of 192.168.1.1, the DHCP service will lease addresses on the 192.168.1.x subnet (e.g. 192.168.1.10, 192.168.1.11, etc).  Here's a screenshot of the configuration page for my router (Linksys WRT54G2) where I define the local router IP.  You can see that it auto-filled the 3rd octet with "1" so that the IP addresses it leases are on the same network as the router itself.



It looks like your router is still configured for the default 192.168.0.x subnet and the BT VM is getting a DHCP IP addresses from the router for that same 192.168.0.x subnet.  Since the De-ICE disc has a static IP address of 192.168.1.100 while the BT VM and router are on the 192.168.0.x subnet, there's no route from the BT VM to the router to the De-ICE VM.  I think as soon as you get the router configured for the 192.168.1.x subnet and make it so that the DHCP server on the router leases IP's on the same 192.168.1.x subnet, you should be good to go.

As for why your BT VM is finding the De-ICE disc using netdiscover...since netdiscover uses ARP to discover devices, my guess is that the BT VM is picking up the ARP traffic that's being broadcast by the De-ICE disc.
« Last Edit: July 15, 2011, 02:06:58 AM by lorddicranius » Logged

GSEC, eCPPT, Sec+
Pages: [1] 2   Go Up
  Print  
 
Jump to:  

Powered by MySQL Powered by PHP Powered by SMF 1.1.18 | SMF © 2013, Simple Machines
Joomla Bridge by JoomlaHacks.com
Valid XHTML 1.0! Valid CSS!
Page created in 0.077 seconds with 23 queries.
 
Exclusive Deal

sansfire13_245x90_cw90.jpg
SANSFIRE 2013
June 15 - 22

5% Off w/ Code: EHN_5

SANS Deals 4 EH-Netters
5% OFF Any SANS Course in Any Format!
Coupon Code: EHN_5 Including SANS Rocky Mountain 2013 & SANS Boston 2013
Polls
Compared to this year, 2013 will be:
 
Recent Forum Topics
EH-Net News Feeds
Latest Additions
 
         
Free Business and Tech Magazines and eBooks

© 2013 The Ethical Hacker Network
Joomla! is Free Software released under the GNU/GPL License.