Route 5: DNS and Network Enumeration

Do you remember our last day before the break, how there were some problems and at they asked students to not begin any exams? All exercises stopped working, and we waited for an hour or so for the fix. In the end, when service was restored, the facilitator mentioned that the problem originated from a DNS problem.

If you look back the post on Route 3, a DNS problem could be the direct cause of no response from [vcenter].  We may just have the wrong IP.

I mean, I don't know their network, and I certainly don't know which IP should be the vcenter server.

But, I bet we can figure it out if we allow ourselves to do some network enumeration.

Using a for loop, we can scan the /24 network.

for /L %g in (1,1,254) do ping -n 1 x.x.x.%g >> ne_result.txt

This command could take a few minutes to complete.  There are probably faster ways to do this.  A program that would send out all of the pings at once, instead of waiting for a response before sending the next would work quicker.  But, meh.  A command line for loop is good enough for me.

Searching through the ne_result.txt file for 'reply' I've found that there are 14 active boxes on the /24 network.

With a list of active IPs, we can check to see if any of them respond to vcenter's administration port 9443.  Two of the fourteen boxes were already identified in Route 3, leaving twelve left to scan.

nmap -sS [ip] -p 9443

This scan does a dns probe as well, so I got a dns name for all but one of the responding boxes. 

1. [ad2] is filtered
2. [chat] is closed
3. [media] is closed
4. [report] is filtered
5. [esxi3] is filtered
6. [esxi4] is filtered
7. [esxi5] is filtered
8. [esxi6] is filtered
9. [esxi7] is filtered
10. [esxi8] is filtered
11. [unk] is closed 
12. [metting] is closed

Unfortunatly, nothing responded on port 9443.  This indicates that it is not a DNS problem.  It's more likely that the vcenter box is currently off, or there is an authentication problem on my part.

It's Christmas eve now, and I've got to go put presents under the tree.  Have a great night and thanks for troubleshooting with me!

-dh