(Windows 7: Lesson 9)

{ Install and Test ZoneAlarm Firewall Against BackTrack }

1. ZoneAlarm Firewall 
   • In ZoneAlarm, program access is controlled by way of "zones", into which all network connections are divided. The "trusted zone" generally includes the user's local area network and can share resources such as files and printers, while the "Internet zone" includes everything not in the trusted zone.
   • The user can specify which "permissions" (trusted zone client, trusted zone server, Internet zone client, Internet zone server) to give to a program before it attempts to access the Internet (e.g. before running it for the first time) or, alternatively, ZoneAlarm will ask the user to give the program permission on its first access attempt.. 
   
   
2. Lab Notes
   • In this lab we will do the following:
     1. Download ZoneAlarm Firewall
     2. Test ZoneAlarm Firewall Against BackTrack (Ping)
     3. Test ZoneAlarm Firewall Against BackTrack (nmap basic scan)
     4. Test ZoneAlarm Firewall Against BackTrack (nmap half-open TCP scan)
     5. Test ZoneAlarm Firewall Against BackTrack (nmap SCTP INIT scan)
     6. Test ZoneAlarm Firewall Against BackTrack (nmap intense scan)
     
     
3. Prerequisites
   • Instructions:
     1. Windows 7: Lesson 1: Installing Windows 7
     2. BackTrack: Lesson 1: Installing BackTrack 5 R1
   
   
4. Legal Disclaimer
   • As a condition of your use of this Web site, you warrant to computersecuritystudent.com that you will not use this Web site for any purpose that is unlawful or that is prohibited by these terms, conditions, and notices.
   • In accordance with UCC § 2-316, this product is provided with "no warranties, either express or implied." The information contained is provided "as-is", with "no guarantee of merchantability."
   • In addition, this is a teaching website that does not condone malicious behavior of any kind.
   • Your are on notice, that continuing and/or using this lab outside your "own" test environment is considered malicious and is against the law.
   • © 2012 No content replication of any kind is allowed without express written permission.

1. Edit Virtual Machine Settings
   • Instructions: 
     1. Click on Windows 7
     2. Click on Edit virtual machine
   • 

    

2. Configure Network Adapter
   • Instructions
     1. Select Network Adapter
     2. Click the radio button "Bridged: Connected directly to the physical network."
     3. Click the Okay button
   • 

    

3. Start Windows 7
   • Instructions: 
     1. Click on Windows 7
     2. Click on Play virtual machine
   • 

    

1. Login
   • Instructions:
     1. Enter Password
     2. Click the Blue Arrow
   • 

1. Bring up Command Prompt
   • Instructions:
     • Start --> Command Prompt
   • 

    

2. Verify IP Address
   • Instructions:
     1. ipconfig
   • Notes:
     • In my case, my IP Address is 192.168.1.119.
     • In your case, your IP Address will probably be different.
   • 

1. Open Internet Explorer
   • Instructions:
     1. Click the Start Button
     2. Type "Internet Explorer" in the search box
     3. Click on Internet Explorer
   • 

    

2. Go to the ZoneAlarm Firewall Site
   • Instructions:
     1. Paste the following website address in the URI box.
        • http://www.zonealarm.com/security/en-us/fza-install-steps.htm
     2. Click on the Blue Security Message, and Click on Download File...
     3. Click on the Run Button
   • 

    

3. User Account Control
   • Instructions:
     1. Click Yes
   • 

    

4. ZoneAlarm Quick Install
   • Instructions:
     1. Click the Quick Install Button
   • 

    

5. Installing the ZoneAlarm Security Toolbar
   • Instructions:
     1. Uncheck the three textboxes
     2. Click I Agree
   • 

    

6. Downloading
   • Note(FYI):
     1. This will take between 5 to 20 minutes depending on your connection.
   • 

    

7. Setup Finished
   • Instructions:
     1. Uncheck the "Inform me" checkbox.
     2. Click the Finish button
   • 

    

8. Bring up Command Prompt
   • Instructions:
     1. Start --> Command Prompt
   • 

    

9. Bring up Command Prompt
   • Instructions:
     1. Start
   • 

1. Open ZoneAlarm Security
   • Instructions:
     1. Double Click on the ZoneAlarm Security Desktop Icon
   • 

    

2. Install ZoneAlarm Antivirus
   • Instructions:
     1. Click on the Antivirus Install Button
   • 

    

3. User Account Control
   • Instructions:
     1. Click Yes.
   • 

    

4. ZoneAlarm Free Antivirus
   • Instructions:
     1. Un-Check the Checkboxes
     2. Click Agree
   • 

    

5. Downloading
   • Note(FYI):
     1. This will take between 5 to 20 minutes depending on your connection.
   • 

    

6. ZoneAlarm Message
   • Instructions:
     1. Click Yes
   • 

    

7. View Details
   • Instructions:
     1. Click Antivirus View Details Button
   • 

    

8. View Antivirus Dashboard
   • Note(FYI):
     1. Verify the Antivirus is up to date and enabled.
   • 

    

1. Open Windows Firewall
   • Instructions:
     1. Click the Start Button
     2. Type firewall in the search box
     3. Click on Windows Firewall
   • 

    

2. Turn Windows Firewall on or off
   • Instructions:
     1. Click on Turn Windows Firewall on or off
   • 

    

3. Customize Windows Firewall Settings
   • Instructions:
     1. Home or work (private) network: Click on Turn on Windows Firewall
     2. Public network location settings: Click on Turn on Windows Firewall
     3. Click on the OK Button
   • 

    

4. Advance Windows Firewall Settings
   • Instructions:
     1. Click on Advanced settings
   • 

    

5. Windows Firewall Properties
   • Instructions:
     1. Click on Windows Firewall Properties
   • 

    

6. Configure Domain Profile
   • Instructions:
     1. Click on Domain Profile
     2. Firewall state: On (recommended)
     3. Click on the OK Button.
   • 

1. Open Your VMware Player
   • Instructions:
     1. On Your Host Computer, Go To
     2. Start --> All Program --> VMWare --> VMWare Player

    

2. Edit BackTrack Virtual Machine Settings
   • Instructions:
     1. Highlight BackTrack5R1
     2. Click Edit virtual machine settings
   • 

    

3. Edit Network Adapter
   • Instructions:
     1. Highlight Network Adapter
     2. Select Bridged
     3. Do not Click on the OK Button.
   • 

1. Start BackTrack VM Instance
   • Instructions:
     1. Start Up VMWare Player
     2. Select BackTrack5R1
     3. Play virtual machine
   • 

    

2. Login to BackTrack
   • Instructions:
     1. Login: root
     2. Password: toor or <whatever you changed it to>.
   • 

    

3. Bring up the GNOME
   • Instructions:
     1. Type startx
   • 

1. Open a console terminal
   • Instructions:
     1. Click on the console terminal
   • 

    

2. Get IP Address
   • Instructions:
     1. ifconfig -a
   • Notes:
     • As indicated below, my IP address is 192.168.1.107.
     • Please record your IP address.
   • 

1. Ping Windows 7
   • Notes:
     • Obtain the IP Address of the Window 7 machine running ZoneAlarm from (Section 3, Step 2)
   • Instructions:
     1. ping -c 5 192.168.1.119
        • -c, this flag indicates the number of pings, which in this example is 5 pings.
        • 192.168.1.119 is the IP Address for my Windows 7 machine.
   • 

    

2. Open ZoneAlarm Security
   • Instructions:
     1. Click on the ZoneAlarm Security Icon
   • 

    

3. View Firewall Events
   • Instructions:
     1. Click on View Details button in the Firewall section
   • 

    

4. Viewing ZoneAlarm Firewall Dashboard
   • Instructions:
     1. Click on "access attempts blocked"
   • 

    

5. More Info
   • Instructions:
     1. Click on BackTrack's IP Address
     2. Click the More Info Button
   • 

    

6. SmartDefense Advisor
   • Instructions:
     1. Read the "What happened?" section.
     2. Click the Technical Info Tab and view the details
   • 

1. Conduct Basic nmap scan
   • Instructions:
     1. nmap 192.168.1.119
   • Notes:
     • Obtain the IP Address of the Window 7 machine running ZoneAlarm from (Section 3, Step 2)
   • 

    

2. Open ZoneAlarm Security
   • Instructions:
     1. Click on the ZoneAlarm Security Icon
   • 

    

3. View Firewall Events
   • Instructions:
     1. Click on View Details button in the Firewall section
   • 

    

4. Viewing ZoneAlarm Firewall Dashboard
   • Note(FYI):
     • Notice how the attempted blocks exponentially grew.
   • Instructions:
     1. Click on "access attempts blocked"
   • 

    

5. Viewing Firewall Alerts
   • Instructions:
     1. Show Last: Click All
     2. Highlight some alerts and click more info.
     3. When finished click the OK button.
   • Note(FYI):
     • Port 445 - Microsoft SMB
     • Port 23 - telnetd
     • Port 80 - Microsoft IIS
   • 

1. Conduct nmap TCP half-open stealth scan
   • Instructions:
     1. nmap -sS 192.168.1.119
   • Notes:
     • Obtain the IP Address of the Window 7 machine running ZoneAlarm from (Section 3, Step 2).
     • -sS, This technique is often referred to as half-open scanning, because you don't open a full TCP connection. You send a SYN packet, as if you are going to open a real connection and then wait for a response. It is also relatively unobtrusive and stealthy since it never completes a TCP connections.
   • 

    

2. Open ZoneAlarm Security
   • Instructions:
     1. Click on the ZoneAlarm Security Icon
   • 

    

3. View Firewall Events
   • Instructions:
     1. Click on View Details button in the Firewall section
   • 

    

4. Viewing ZoneAlarm Firewall Dashboard
   • Note(FYI):
     • Notice how the attempted blocks grew again.
   • Instructions:
     1. Click on "access attempts blocked"
   • 

    

5. Viewing Firewall Results
   • Instructions:
     1. Scroll all the way to the bottom.
   • Notes:
     • Notice there are some new ports that were scanned.
     • Port 3306 - mysqld
     • Port 5900 - VNC
   • 

1. Conduct nmap SCTP INIT scan
   • Instructions:
     1. nmap -sY 192.168.1.119
        • Replace 192.168.1.119 with the Windows 7 IP Address obtain from (Section 3, Step 2).
   • Notes:
     • This technique is often referred to as half-open scanning, because you don't open a full SCTP association. You send an INIT chunk, as if you are going to open a real association and then wait for a response.
     • SCTP is a relatively new alternative to the TCP and UDP protocols, combining most characteristics of TCP and UDP, and also adding new features like multi-homing and multi-streaming. SCTP INIT scan is the SCTP equivalent of a TCP SYN scan. It can be performed quickly, scanning thousands of ports per second on a fast network not hampered by restrictive firewalls. Like SYN scan, INIT scan is relatively unobtrusive and stealthy, since it never completes SCTP associations.
   • 

    

1. Conduct nmap intense scan
   • Instructions:
     1. nmap -T4 -A -v 192.168.1.119
        • Replace 192.168.1.119 with the Windows 7 IP Address obtain from (Section 3, Step 2).
   • Notes(FYI):
     • -T, is a timing template with the following settings: paranoid (0), sneaky (1), polite (2), normal (3), aggressive (4), and insane (5). The first two are for IDS evasion.
     • -A, to enable OS and version detection, script scanning, and traceroute.
     • -v, is verbose mode.
   • Findings:
     • ZoneAlarm does a pretty good job of not disclosing Operating System details.
     • Consequently, in the previous Comodo Lab, Comodo was not able to protect again many of the above nmap scans. 
   • 

1. Proof of Lab Instructions
   • Instructions:
     1. Bring up a Command Prompt
     2. cd ../../
     3. cd C:\ProgramData\CheckPoint\ZoneAlarm\Logs
     4. dir | findstr ZALog
     5. date
     6. Press <Enter>
     7. echo "Your Name"
        • Replace the string "Your Name" with your actual name.
        • e.g., echo "John Gray"
     8. Do a PrtScn
     9. Paste into a word document
     10. Upload to Moodle
   •