xprobe2 scan of Red Flag Linux (Iive cd)

Xprobe2 v.0.3 Copyright (c) 2002-2005 fyodor@o0o.nu, ofir@sys-security.com, meder@o0o.nu

[+] Target is 192.168.1.151
[+] Loading modules.
[+] Following modules are loaded:
[x] [1] ping:icmp_ping - ICMP echo discovery module
[x] [2] ping:tcp_ping - TCP-based ping discovery module
[x] [3] ping:udp_ping - UDP-based ping discovery module
[x] [4] infogather:ttl_calc - TCP and UDP based TTL distance calculation
[x] [5] infogather:portscan - TCP and UDP PortScanner
[x] [6] fingerprint:icmp_echo - ICMP Echo request fingerprinting module
[x] [7] fingerprint:icmp_tstamp - ICMP Timestamp request fingerprinting module
[x] [8] fingerprint:icmp_amask - ICMP Address mask request fingerprinting module
[x] [9] fingerprint:icmp_port_unreach - ICMP port unreachable fingerprinting module
[x] [10] fingerprint:tcp_hshake - TCP Handshake fingerprinting module
[x] [11] fingerprint:tcp_rst - TCP RST fingerprinting module
[x] [12] fingerprint:smb - SMB fingerprinting module
[x] [13] fingerprint:snmp - SNMPv2c fingerprinting module
[+] 13 modules registered
[+] Initializing scan engine
[+] Running scan engine
[-] ping:tcp_ping module: no closed/open TCP ports known on 192.168.1.151. Module test failed
[-] ping:udp_ping module: no closed/open UDP ports known on 192.168.1.151. Module test failed
[-] No distance calculation. 192.168.1.151 appears to be dead or no ports known
[+] Host: 192.168.1.151 is up (Guess probability: 50%)
[+] Target: 192.168.1.151 is alive. Round-Trip Time: 0.00761 sec
[+] Selected safe Round-Trip Time value is: 0.01522 sec
[-] fingerprint:tcp_hshake Module execution aborted (no open TCP ports known)
[-] fingerprint:smb need either TCP port 139 or 445 to run
[-] fingerprint:snmp: need UDP port 161 open
[+] Primary guess:
[+] Host 192.168.1.151 Running OS: "Linux Kernel 2.4.22" (Guess probability: 100%)
[+] Other guesses:
[+] Host 192.168.1.151 Running OS: "Linux Kernel 2.4.23" (Guess probability: 100%)
[+] Host 192.168.1.151 Running OS: "Linux Kernel 2.4.21" (Guess probability: 100%)
[+] Host 192.168.1.151 Running OS: "Linux Kernel 2.4.20" (Guess probability: 100%)
[+] Host 192.168.1.151 Running OS: "Linux Kernel 2.4.19" (Guess probability: 100%)
[+] Host 192.168.1.151 Running OS: "Linux Kernel 2.4.24" (Guess probability: 100%)
[+] Host 192.168.1.151 Running OS: "Linux Kernel 2.4.25" (Guess probability: 100%)
[+] Host 192.168.1.151 Running OS: "Linux Kernel 2.4.26" (Guess probability: 100%)
[+] Host 192.168.1.151 Running OS: "Linux Kernel 2.4.27" (Guess probability: 100%)
[+] Host 192.168.1.151 Running OS: "Linux Kernel 2.4.28" (Guess probability: 100%)
[+] Cleaning up scan engine
[+] Modules deinitialized
[+] Execution completed.

Nmap scan of Red Flag Linux (live cd)

Starting Nmap 4.85BETA9 ( http://nmap.org ) at 2009-06-14 17:34 UTC
NSE: Loaded 28 scripts for scanning.
Initiating ARP Ping Scan at 17:34
Scanning 192.168.1.151 [1 port]
Completed ARP Ping Scan at 17:34, 0.01s elapsed (1 total hosts)
Initiating Parallel DNS resolution of 1 host. at 17:34
Completed Parallel DNS resolution of 1 host. at 17:34, 0.04s elapsed
Initiating SYN Stealth Scan at 17:34
Scanning 192.168.1.151 [1000 ports]
Discovered open port 111/tcp on 192.168.1.151
Completed SYN Stealth Scan at 17:34, 1.91s elapsed (1000 total ports)
Initiating Service scan at 17:34
Scanning 1 service on 192.168.1.151
Completed Service scan at 17:35, 6.02s elapsed (1 service on 1 host)
Initiating OS detection (try #1) against 192.168.1.151
NSE: Script scanning 192.168.1.151.
NSE: Starting runlevel 1 scan
Initiating NSE at 17:35
Completed NSE at 17:35, 0.08s elapsed
NSE: Script Scanning completed.
Host 192.168.1.151 is up (0.0048s latency).
Interesting ports on 192.168.1.151:
Not shown: 999 closed ports
PORT STATE SERVICE VERSION
111/tcp open rpcbind
| rpcinfo:
| 100000 2,3,4 111/udp rpcbind
| 100024 1 51586/udp status
| 100000 2,3,4 111/tcp rpcbind
|_ 100024 1 52983/tcp status
MAC Address: 00:0C:29:35:59:37 (VMware)
Device type: general purpose
Running: Linux 2.6.X
OS details: Linux 2.6.9 - 2.6.27
Uptime guess: 0.016 days (since Sun Jun 14 17:12:20 2009)
Network Distance: 1 hop
TCP Sequence Prediction: Difficulty=204 (Good luck!)
IP ID Sequence Generation: All zeros

Read data files from: /usr/share/nmap
OS and Service detection performed. Please report any incorrect results at http://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 11.65 seconds
Raw packets sent: 1021 (45.684KB) | Rcvd: 1017 (41.408KB)

xprobe2 scan of Kylin OS v2.1 installation

Xprobe2 v.0.3 Copyright (c) 2002-2005 fyodor@o0o.nu, ofir@sys-security.com, meder@o0o.nu

[+] Target is 192.168.1.150
[+] Loading modules.
[+] Following modules are loaded:
[x] [1] ping:icmp_ping - ICMP echo discovery module
[x] [2] ping:tcp_ping - TCP-based ping discovery module
[x] [3] ping:udp_ping - UDP-based ping discovery module
[x] [4] infogather:ttl_calc - TCP and UDP based TTL distance calculation
[x] [5] infogather:portscan - TCP and UDP PortScanner
[x] [6] fingerprint:icmp_echo - ICMP Echo request fingerprinting module
[x] [7] fingerprint:icmp_tstamp - ICMP Timestamp request fingerprinting module
[x] [8] fingerprint:icmp_amask - ICMP Address mask request fingerprinting module
[x] [9] fingerprint:icmp_port_unreach - ICMP port unreachable fingerprinting module
[x] [10] fingerprint:tcp_hshake - TCP Handshake fingerprinting module
[x] [11] fingerprint:tcp_rst - TCP RST fingerprinting module
[x] [12] fingerprint:smb - SMB fingerprinting module
[x] [13] fingerprint:snmp - SNMPv2c fingerprinting module
[+] 13 modules registered
[+] Initializing scan engine
[+] Running scan engine
[-] ping:tcp_ping module: no closed/open TCP ports known on 192.168.1.150. Module test failed
[-] ping:udp_ping module: no closed/open UDP ports known on 192.168.1.150. Module test failed
[-] No distance calculation. 192.168.1.150 appears to be dead or no ports known
[+] Host: 192.168.1.150 is up (Guess probability: 50%)
[+] Target: 192.168.1.150 is alive. Round-Trip Time: 0.00827 sec
[+] Selected safe Round-Trip Time value is: 0.01654 sec
[-] fingerprint:tcp_hshake Module execution aborted (no open TCP ports known)
[-] fingerprint:smb need either TCP port 139 or 445 to run
[-] fingerprint:snmp: need UDP port 161 open
[+] Primary guess:
[+] Host 192.168.1.150 Running OS: "FreeBSD 5.2" (Guess probability: 100%)
[+] Other guesses:
[+] Host 192.168.1.150 Running OS: "FreeBSD 5.2.1" (Guess probability: 100%)
[+] Host 192.168.1.150 Running OS: "FreeBSD 5.3" (Guess probability: 100%)
[+] Host 192.168.1.150 Running OS: "FreeBSD 5.4" (Guess probability: 100%)
[+] Host 192.168.1.150 Running OS: "Apple Mac OS X 10.2.6" (Guess probability: 100%)
[+] Host 192.168.1.150 Running OS: "Apple Mac OS X 10.2.7" (Guess probability: 100%)
[+] Host 192.168.1.150 Running OS: "Apple Mac OS X 10.2.8" (Guess probability: 100%)
[+] Host 192.168.1.150 Running OS: "Apple Mac OS X 10.3.3" (Guess probability: 96%)
[+] Host 192.168.1.150 Running OS: "Apple Mac OS X 10.3.7" (Guess probability: 96%)
[+] Host 192.168.1.150 Running OS: "Apple Mac OS X 10.4.1" (Guess probability: 96%)
[+] Cleaning up scan engine
[+] Modules deinitialized
[+] Execution completed.

Nmap scan of Kylin OS v2.1 installation

Starting Nmap 4.85BETA9 ( http://nmap.org ) at 2009-06-03 21:31 Eastern Daylight Time
NSE: Loaded 28 scripts for scanning.
Initiating ARP Ping Scan at 21:32
Scanning 192.168.1.150 [1 port]
Completed ARP Ping Scan at 21:32, 0.30s elapsed (1 total hosts)
Initiating Parallel DNS resolution of 1 host. at 21:32
Completed Parallel DNS resolution of 1 host. at 21:32, 0.02s elapsed
Initiating SYN Stealth Scan at 21:32
Scanning 192.168.1.150 [1000 ports]
Discovered open port 22/tcp on 192.168.1.150
Discovered open port 6000/tcp on 192.168.1.150
Increasing send delay for 192.168.1.150 from 0 to 5 due to max_successful_tryno increase to 5
Completed SYN Stealth Scan at 21:32, 6.86s elapsed (1000 total ports)
Initiating Service scan at 21:32
Scanning 2 services on 192.168.1.150
Completed Service scan at 21:32, 6.02s elapsed (2 services on 1 host)
Initiating OS detection (try #1) against 192.168.1.150
NSE: Script scanning 192.168.1.150.
NSE: Starting runlevel 1 scan
Initiating NSE at 21:32
Completed NSE at 21:32, 0.52s elapsed
NSE: Script Scanning completed.
Host 192.168.1.150 is up (0.00s latency).
Interesting ports on 192.168.1.150:
Not shown: 998 closed ports
PORT STATE SERVICE VERSION
22/tcp open ssh OpenSSH 3.6.1p2 (protocol 1.99)
|_ sshv1: Server supports SSHv1
| ssh-hostkey: 1024 cd:e6:34:91:7a:67:f0:44:b4:56:5e:d5:b8:c3:55:67 (RSA1)
| 1024 0e:ed:49:15:ea:64:12:c8:27:b5:40:a7:e0:d0:64:cc (DSA)
|_ 1024 5d:30:80:4f:8e:7c:b2:fe:e5:2a:48:5d:98:cc:d4:d5 (RSA)
6000/tcp open X11 (access denied)
MAC Address: 00:0C:29:22:A2:A1 (VMware)
Device type: general purpose
Running: FreeBSD 5.X
OS details: FreeBSD 5.4 or 5.5 (x86)
Uptime guess: 0.197 days (since Wed Jun 03 16:48:28 2009)
Network Distance: 1 hop
TCP Sequence Prediction: Difficulty=254 (Good luck!)
IP ID Sequence Generation: Incremental
Service Info: OS: Unix

Read data files from: C:\Program Files\Security Tools\Nmap
OS and Service detection performed. Please report any incorrect results at http://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 18.72 seconds
Raw packets sent: 1353 (60.292KB) | Rcvd: 1018 (41.172KB)

IPodLinux update

A while back (here, I posted my experiment with running Linux on my IPod. Here is what I wrote:

Here are some problems I encountered:

1. Playback was a different story. I chose a few songs at random: some played ok, others played too fast, some played with significant delays and static, some didn't play at all. Seems like none of my "Purchased" music plays correctly. I either get a "malloc failed" or the song tries to play in mono and all I get is static.

Are playback issues related to the overall quality of the MP3? I have no idea.

2. Also, I haven't had luck using the rewind/fast-forward buttons while a song is playing, i.e., you can't use the fast-forward button to skip ahead or goto the next song.

3. Further, when one song ends, it just returns to the song selection list rather than playing the next song.

4. The power meter showed full in Linux despite the fact that the battery was nearly dead. Rebooting to Apple showed correctly, an almost dead battery.

I didn't go too much further, but I was hoping I could perhaps find solutions to these issues. Alas, I did not. So I updated the Apple firmware which restored the original configuration.

IPodLinux

My IPod now dual-boots both the original Apple firmware and IPodLinux.

http://sourceforge.net/projects/ipodlinuxinst/

http://forum.defcon.org/showthread.php?p=58864#post58864

I have a third generation IPod, a 15GB model and I figured what the heck so I installed IPodLinux on it.

I first connected my IPod and waited until it updated. After that was complete, I downloaded the (Windows) installer program, unzipped to a temp directory, and ran ipodlinux-installer.exe.

It searched for and downloaded the updated kernel. I chose linux as the default boot (it leaves the original apple firmware intact and can be uninstalled without problems).

At this point it will prompt you to close ITunes or whatever else is connected to the IPod. It then installs Linux and took all of about 15 seconds or so on my computer.

When it's finished, it asks you to disconnect your IPod, upon which it should (and did) reboot. If it doesn't, holding menu and play for 5 seconds will manually reboot.

Upon the reboot, the familiar apple logo shows, followed by the familiar Penguin logo. After that, the screen scrolls quickly as Linux boots up. A few seconds later, your new Podzilla menu is loaded. To load the non-default, reboot and hold the rewind button. The apple logo will appear, followed by the Penguin, and then instead of scrolling through the Linux boot-up, the "normal" Apple firmware loads.

Here are some problems I encountered:

1. Playback was a different story. I chose a few songs at random: some played ok, others played too fast, some played with significant delays and static, some didn't play at all. Seems like none of my "Purchased" music plays correctly. I either get a "malloc failed" or the song tries to play in mono and all I get is static.

Are playback issues related to the overall quality of the MP3? I have no idea.

2. Also, I haven't had luck using the rewind/fast-forward buttons while a song is playing, i.e., you can't use the fast-forward button to skip ahead or goto the next song.

3. Further, when one song ends, it just returns to the song selection list rather than playing the next song.

4. The power meter showed full in Linux despite the fact that the battery was nearly dead. Rebooting to Apple showed correctly, an almost dead battery.

My initial verdict is that IPodLinux is fun to play around with and test out, but if you want to be able to play all of your songs without problems, boot to the Apple firmware. I plan to keep playing around with it to hopefully discover what might be causing the playback problems...stay tuned.

Feel free to email me or ask any questions.