TCP RPC Scan |
| Attack Pattern ID: 307 (Detailed Attack Pattern Completeness: Stub) | Typical Severity: Low | Status: Draft |
DescriptionSummary
An attacker scan for RPC services listing on a Unix/Linux host. This type of scan can be obtained via native operating system utilities or via port scanners like nmap. When performed by a scanner, an RPC datagram is sent to a list of UDP ports and the response is recorded. Particular types of responses can be indicative of well known RPC services running on a UDP port.
1. Speed: Direct RPC scans that bypass portmapper/sunrpc are typically slow compare to other scan types
2. Stealth: RPC scanning is not stealthy, as IPS/IDS systems detect RPC queries
3. Open Port: Can only detect open ports when an RPC service responds
4. Closed Port: Detects closed ports on the basis of ICMP diagnostic messages.
5. Filtered Port: Cannot identify filtered ports
6. Unfiltered Port: Cannot identify unfiltered ports
There are two general approaches to RPC scanning. One is to use a native operating system utility, or script, to query the portmapper/rpcbind application running on port 111. Portmapper will return a list of registered RPC services. Alternately, one can use a port scanner or script to scan for RPC services directly. Discovering RPC services gives the attacker potential targets to attack, as some RPC services are insecure by default.
Target Attack SurfaceTarget Attack Surface Description
Targeted OSI Layers: Transport Layer
Target Attack Surface Localities
Target Attack Surface Types: Host Service
Attack PrerequisitesRPC scanning requires no special privileges when it is performed via a native system utility.
Resources RequiredThe ability to craft custom RPC datagrams for use during network reconnaissance. By tailoring the bytes injected one can scan for specific RPC-registered services. Depending upon the method used it may be necessary to sniff the network in order to see the response.
Related Attack Patterns| Nature | Type | ID | Name | Description | View(s) this relationship pertains to |
|---|---|---|---|---|---|
| ChildOf |  Attack Pattern | 300 | Port Scanning | Mechanism of Attack1000 |
References
