[Last Call] Learn how to a build a cloud-first strategyRegister Now

x
  • Status: Solved
  • Priority: Medium
  • Security: Public
  • Views: 189
  • Last Modified:

Disguise a Server

Does anyone know how to disguise your box to look like a Windows Server to nmap (instead of a Linux Server)?
0
OutOfAmmo
Asked:
OutOfAmmo
1 Solution
 
kblack05Commented:
Yeah you can simply use SINFP to change the OS reporting for the TCP Stack:

http://www.gomor.org/cgi-bin/sinfp.pl?mode=view;page=sinfp_description
0
 
giltjrCommented:
I'm confused.  SINFP seems to be another program like nmap that tries and detects what OS a computer is running.

I don't think you want to change your Linux box to look like a Windows box.  What software does to try and finger print a OS is to look at how the IP stack responds to specific situations.  In order to make your Linux box look like it Windows you would need to change the IP stack code to respond as if it were Windows.  Which means changing the IP source code.
0
 
slyongCommented:
I agree with what giltjr suggest that you "do not" want to make your Linux boxes look like a Windows boxes and it is probably no way to do that.  There are however, a few ways that I knew from an old article (http://insecure.org/nmap/misc/defeat-nmap-osdetect.html) that you can foil nmap OS fingerprinting.  They are written at the time of 2.2 / 2.4 series of kernels.  I am not sure if there exists anything for kernel 2.6.
0
Concerto Cloud for Software Providers & ISVs

Can Concerto Cloud Services help you focus on evolving your application offerings, while delivering the best cloud experience to your customers? From DevOps to revenue models and customer support, the answer is yes!

Learn how Concerto can help you.

 
kblack05Commented:
As posted in your other comment, you tune the OS area of the TCP stack.

http://www.zog.net/Docs/nmap.html
0
 
kblack05Commented:
This modifies the TCP OS Fingerprint area of the TCP stack, and is not harmful. Many people do this, though it is only going to foil a less experienced attacker. If someone scans your box and it shows up as an atari 2600, it might just urge them to probe deeper, and will not change the vulnerability of the box. You should focus more on security and less on disquise. Here is a great guide to get started:

http://www.ecst.csuchico.edu/~dranch/LINUX/TrinityOS/cHTML/TrinityOS-c.html
0
 
OutOfAmmoAuthor Commented:
Thanks for all of the input.  I posted this question for a friend who was given this assignment by her instructor in a security class with very little explanation, but it sounds as if you are all on the right track with your suggestions.  I will pass this info along to her and try to close out this question or post additional information ASAP.
0
 
OutOfAmmoAuthor Commented:
My apologies for failing to get back on this.  My friend dropped the issue because her instructor didn't seem to even know the answer and wasn't sure what the results were supposed to be.  Based on what I could glean from the limited information, I think everyone was basically on the correct path.  Because kblack05 posted the most thorough information, I have accepted that as the solution.
0

Featured Post

Windows Server 2016: All you need to know

Learn about Hyper-V features that increase functionality and usability of Microsoft Windows Server 2016. Also, throughout this eBook, you’ll find some basic PowerShell examples that will help you leverage the scripts in your environments!

Tackle projects and never again get stuck behind a technical roadblock.
Join Now