ISCSI Pentesting
ISCSI (Internet Small Computer System Interface) is a protocol used for establishing and managing connections between storage devices over an IP network. It enables storage devices to be shared and accessed remotely, providing block-level access to storage resources.
ISCSI is commonly used in data centers and enterprise environments for storage area networks (SANs) and virtualization deployments.
Connect
Connect Using ISCSI Initiator
iscsiadm --mode discoverydb --type sendtargets --portal <target-ip>:<target-port> --discover
Connect Using ISCSI Target Portal
You can use tools like ISCSI Initiator or open-iscsi to connect to an ISCSI target portal.
Recon
Identifying an ISCSI Target
You can use Nmap to check if there's an ISCSI target on a target host like this:
nmap -p 3260 X.X.X.X
Banner Grabbing
nc -nv X.X.X.X 3260
Enumeration
ISCSI Target Information
Connect to the ISCSI target and gather information about available LUNs (Logical Unit Numbers), target IQNs (ISCSI Qualified Names), and other configuration details using ISCSI commands.
ISCSI Client Tools
Tools like ISCSI Initiator, open-iscsi, and tgtadm can be used for interacting with ISCSI targets and performing enumeration tasks.
Attack Vectors
Default Credentials
Check for default credentials or weak authentication configurations in ISCSI targets, such as targets using default IQNs or no authentication.
Unauthorized Access
Search for open ISCSI targets that allow unrestricted access, which may be exposed to unauthorized access from the internet.
LUN Manipulation
Exploit vulnerabilities in ISCSI target configurations to access or manipulate LUNs, potentially gaining unauthorized access to sensitive data.
Post-Exploitation
Common iSCSI Commands
| Command | Description | Primary Use Case |
|---|---|---|
iscsiadm -m session | Displays all active iSCSI sessions established on the system. | Enumerating active iSCSI connections |
iscsiadm -m discovery -t sendtargets -p <IP> | Discovers available iSCSI targets from a remote storage server. | Target discovery and storage enumeration |
iscsiadm -m node -l | Authenticates and logs in to a configured iSCSI target. | Connecting to remote storage |
iscsiadm -m node -u | Terminates the connection to a connected iSCSI target. | Disconnecting from remote storage |
iscsiadm -m node -o show | Displays detailed configuration, authentication settings, and target information. | Reviewing target configuration and settings |
iscsiadm -m node | Lists all configured iSCSI nodes known to the initiator. | Enumerating configured targets |
Data Exfiltration
Extract sensitive data by accessing and manipulating LUNs on the ISCSI target.
Ransomware Attacks
Encrypt data on the ISCSI target and demand a ransom for decryption, exploiting vulnerabilities in ISCSI target configurations.
Denial-of-Service (DoS) Attacks
ISCSI targets may be susceptible to DoS attacks, disrupting storage access and causing service downtime.