CAPEC-307 TCP RPC Scan

An adversary scans for RPC services listing on a Unix/Linux host.

This type of scan can be obtained via native operating system utilities or via port scanners like nmap. When performed by a scanner, an RPC datagram is sent to a list of UDP ports and the response is recorded. Particular types of responses can be indicative of well-known RPC services running on a UDP port. Discovering RPC services gives the adversary potential targets to attack, as some RPC services are insecure by default. Direct RPC scans that bypass portmapper/sunrpc are typically slow compare to other scan types, are easily detected by IPS/IDS systems, and can only detect open ports when an RPC service responds. ICMP diagnostic message responses can help identify closed ports, however filtered and unfiltered ports cannot be identified through TCP RPC scans. There are two general approaches to RPC scanning: One is to use a native operating system utility, or script, to query the portmapper/rpcbind application running on port 111. Portmapper will return a list of registered RPC services. Alternately, one can use a port scanner or script to scan for RPC services directly.

1. [Experiment] An adversary sends RCP packets to target ports. 2. [Experiment] An adversary uses the response from the target to determine which, if any, RPC service is running on that port. Responses will vary based on which RPC service is running.

• RPC scanning requires no special privileges when it is performed via a native system utility.

• Confidentiality: Other • Confidentiality, Access Control, Authorization: Bypass Protection Mechanism, Hide Activities

• Typically, an IDS/IPS system is very effective against this type of attack.