1

OVERVIEW:

My professor runs some kind of live Ubuntu OS image on top of the classroom computer he uses to lecture then portals into his linux box located in his office. He has informed me his hostname and the OS he is running on his box which is Ubuntu. Somehow he has hardened his box through some NSA documentation. His IP address changes or is masked in some way as he has hinted.

He has challenged me to leave a message on his computer. Therefore, my tasks consist of finding his IP from the hostname he gave me, scan for open ports and figure which port he uses. He has informed me there is no password for the very reason of this challenge he gave me.

ENVIRONMENT VARIABLES:

Hostname:

Epiphyte-ix

Network:

There are three networks at our school. The administrative network, student network, experimental network. He is connected to the administrative network which, as being an IT student employee, I have access too.

My Computer:

Running Kali Linux

TROUBLE I'M HAVING

He has hinted that his computer changes it's IP address once "something" expires. What exactly expires i don't know. I'm guessing it's some kind of DHCP service running on whatever port he is using. If I ask anything else he just chuckles and says he is still waiting for a message.

I'm getting permission from my IT boss to nmap the whole admin network from my Kali system. I've tried a few commands already in looking up the hostname but not having any luck. Right now i'm putting a list of nmap commands and additional scans I could possibly do but since his IP address is changing I would like guidance.

I would like some direction from you guys before i go on some ridiculous web search. I really have no idea where to start as I'm an electrical engineering student not a informations security or networking student. I do have a basic grasp on networking and i'm fairly efficient from the command line.

WANT I'M HOPING TO GET FROM THIS POST:

namp parameters that might hold a high potential in detecting his computer

other reconnaissance tactics to gain more information on his IP address and system

additional directions that you might suggest I take

IN CONCLUSION:

Thanks for any help/advice you might have for me. I may of posted a similar discussion on this topic here but cannot recall if I did. Therefore, if I did I apologize and did so in creating a better in detail description of my tasks and environment variables.

NOTE: I may of misused a few words and phrases as i'm not a genius in networking vocabulary. These may be the following...

1.)

"runs some kind of live Ubuntu OS image on top of the classroom computer"

I know for a fact he plugs in a hard drive of some kind and then portals into his linux box so i'm guessing this is some kind of live ISO image. I did my homework and researched his hostname "epiphyte-ix". Epiphyte is a plant that lives/grows on another plant so i'm guessing this applies as I hinted it to him and he replied "very good".

2.)

"His IP addresss changes or is masked"

I asked if he hidden the linux box from the network in someway and he said "its hard to detect". He also informed me that his IP changes the minute something expires.

2
  • 1
    Essencially, this question is not about Ubuntu. It's more or less about using nmap, so not sure why ask here. Do you even use Ubuntu? Aug 16, 2014 at 22:42
  • @mikewhatever Being about nmap doesn't make this off-topic; the target's Ubuntu, and there's enough info here for answerers to really make use of that fact. I think very general questions about advanced port scanning technique might possibly be considered off-topic and referred to Super User or Security.SE. But it seems to me that Oli's answer (which extensively addresses and leverages the target's Ubuntuness) shows this can be faithfully interpreted as well within our scope. Aug 17, 2014 at 19:47

1 Answer 1

1

I'm not sure how evil he's being but here are a couple of stumbling blocks:

  • A deliberately hidden computer will not respond to nmap. At all. It could simply ignore any network activity from any host that hasn't registered the correct port knock. This is a fairly obscure technique that is effective nonetheless.

  • Dynamic IP/DHCP lease/etc can all be circumvented via external DNS. My computer tells Linode (a web host with DNS servers) my network's public IP so it resolves via a home.example.com domain name. He could be doing exactly the same with an internal IP.

Tracking down an intentionally hidden computer is likely going to require some serious man-in-the-middle network sniffing. I strongly suggest you avoid even asking the IT department about this.


But if he's playing fair and using a standard Ubuntu setup and is actually using the hostname that he's given you, you might have a fair chance.

Ubuntu uses Avahi to broadcast its mDNS/Bonjour/zero-conf local DNS. A simple ping Epiphyte-ix.local from another Ubuntu box should do it. Once you have that, a simple

nmap <ip>

... will scan ports 1-1024 and will likely find you your services.

If that fails, try nmap -p- <ip> to scan all 65535 ports.

If you get a service you don't recognise (and googling "port ..." doesn't work) you can always try connecting to it with telnet <ip> <port>. Some things might blurt a banner out. Some things won't.

If you only find a SSH server, he's probably tunnelling whatever remote desktop software over that. A common technique in untrusted networks.


The NSA document you mentioned is freely available to anybody. If he has mentioned it, perhaps there's a clue in there.

1
  • thanks for the direction. I will check out the documentation. He has told me that I should be able to do this so I'm assuming he has made it somewhat doable for me to achieve.
    – Shane Yost
    Aug 16, 2014 at 22:51

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .