3260 - Pentesting iSCSI

Basic Information

Internet Small Computer System Interface (iSCSI) carries SCSI commands over TCP. A client called an initiator connects to a target, selects a logical unit (LUN), and receives block-level storage that the operating system treats much like a locally attached disk. It commonly runs over existing IP networks instead of dedicated Fibre Channel infrastructure.^[3]

iSCSI requires CHAP support but does not require deployments to use it, and CHAP over an unencrypted channel has known limitations. An exposed target with no authentication can therefore grant raw read/write access to a LUN; even with CHAP, use IPsec or another protected network when confidentiality is required.^[3]

Default port: 3260

PORT     STATE SERVICE VERSION
3260/tcp open  iscsi?

Enumeration

nmap -sV --script=iscsi-info -p 3260 192.168.xx.xx

This script will indicate if authentication is required.

Brute force

Mount iSCSI on Linux

Note: A SendTargets response may advertise a portal different from the address used for discovery, which is common behind NAT or a virtual IP. Open-iSCSI identifies a persistent node record by both target IQN and portal, so logging in to an unreachable advertised address fails.^[4]

For example, you are trying to connect to an iSCSI target on 123.123.123.123:3260. The target is actually at 192.168.1.2 but exposed through NAT, and iscsiadm registers the internal address rather than the public address:

iscsiadm -m discovery -t sendtargets -p 123.123.123.123:3260
192.168.1.2:3260,1 iqn.1992-05.com.emc:fl1001433000190000-3-vnxe
[...]

Prefer creating an explicit node record for the reachable portal, then configure authentication on that record if required:^[4]

iscsiadm -m node --op new \
  --targetname 'iqn.1992-05.com.emc:fl1001433000190000-3-vnxe' \
  --portal 123.123.123.123:3260
iscsiadm -m node \
  --targetname 'iqn.1992-05.com.emc:fl1001433000190000-3-vnxe' \
  --portal 123.123.123.123:3260 --login

On older installations where an explicit record cannot be created, the legacy workaround is to adjust the generated node record. Discovery creates a directory such as:

/etc/iscsi/nodes/iqn.1992-05.com.emc:fl1001433000190000-3-vnxe/192.168.1.2\,3260\,1/

Within the directory, there is a default file with all the settings necessary to connect to the target.

Rename /etc/iscsi/nodes/iqn.1992-05.com.emc:fl1001433000190000-3-vnxe/192.168.1.2\,3260\,1/ to /etc/iscsi/nodes/iqn.1992-05.com.emc:fl1001433000190000-3-vnxe/123.123.123.123\,3260\,1/
Within /etc/iscsi/nodes/iqn.1992-05.com.emc:fl1001433000190000-3-vnxe/123.123.123.123\,3260\,1/default, change the node.conn[0].address setting to point to 123.123.123.123 instead of 192.168.1.2. This could be done with a command such as sed -i 's/192.168.1.2/123.123.123.123/g' /etc/iscsi/nodes/iqn.1992-05.com.emc:fl1001433000190000-3-vnxe/123.123.123.123\,3260\,1/default

After login, inspect the newly attached block device with lsblk or lsscsi. During an assessment, mount filesystems read-only first (for example, mount -o ro,noload) to avoid journal replay or other writes to evidence and production data.^[1][2]

Mount iSCSI on Windows

Use the built-in Microsoft iSCSI Initiator (iscsicpl.exe), PowerShell iSCSI module, or legacy iscsicli tool to add the target portal, discover the IQN, and connect. For example:^[5]

New-IscsiTargetPortal -TargetPortalAddress <TARGET_IP>
Get-IscsiTarget
Connect-IscsiTarget -NodeAddress '<TARGET_IQN>' -IsPersistent $false
Get-IscsiSession

Apply the same read-only/evidence-handling precautions before bringing discovered disks online. Disconnect the temporary session with Disconnect-IscsiTarget -NodeAddress '<TARGET_IQN>' -Confirm:$false when the assessment is complete.

Manual enumeration

sudo apt-get install open-iscsi

Example from iscsiadm docs:^[1][2]

First of all you need to discover the targets name behind the IP:

iscsiadm -m discovery -t sendtargets -p 123.123.123.123:3260
123.123.123.123:3260,1 iqn.1992-05.com.emc:fl1001433000190000-3-vnxe
[2a01:211:7b7:1223:211:32ff:fea9:fab9]:3260,1 iqn.2000-01.com.synology:asd3.Target-1.d0280fd382
[fe80::211:3232:fab9:1223]:3260,1 iqn.2000-01.com.synology:Oassdx.Target-1.d0280fd382

Note that it will show the IP and port of the interfaces where you can reach those targets. It can even show internal IPs or different IPs from the one you used.

Then you catch the 2nd part of the printed string of each line (iqn.1992-05.com.emc:fl1001433000190000-3-vnxe from the first line) and try to login:

iscsiadm -m node --targetname="iqn.1992-05.com.emc:fl1001433000190000-3-vnxe" -p 123.123.123.123:3260 --login
Logging in to [iface: default, target: iqn.1992-05.com.emc:fl1001433000190000-3-vnxe, portal: 123.123.123.123,3260] (multiple)
Login to [iface: default, target: iqn.1992-05.com.emc:fl1001433000190000-3-vnxe, portal: 123.123.123.123,3260] successful.

Then, you can log out using --logout:

iscsiadm -m node --targetname="iqn.1992-05.com.emc:fl1001433000190000-3-vnxe" -p 123.123.123.123:3260 --logout
Logging out of session [sid: 6, target: iqn.1992-05.com.emc:fl1001433000190000-3-vnxe, portal: 123.123.123.123,3260]
Logout of [sid: 6, target: iqn.1992-05.com.emc:fl1001433000190000-3-vnxe, portal: 123.123.123.123,3260] successful.

We can find more information about it by just using without any --login/--logout parameter

iscsiadm -m node --targetname="iqn.1992-05.com.emc:fl1001433000190000-3-vnxe" -p 123.123.123.123:3260
# BEGIN RECORD 2.0-873
node.name = iqn.1992-05.com.emc:fl1001433000190000-3-vnxe
node.tpgt = 1
node.startup = manual
node.leading_login = No
iface.hwaddress = <empty>
iface.ipaddress = <empty>
iface.iscsi_ifacename = default
iface.net_ifacename = <empty>
iface.transport_name = tcp
iface.initiatorname = <empty>
iface.bootproto = <empty>
iface.subnet_mask = <empty>
iface.gateway = <empty>
iface.ipv6_autocfg = <empty>
iface.linklocal_autocfg = <empty>
iface.router_autocfg = <empty>
iface.ipv6_linklocal = <empty>
iface.ipv6_router = <empty>
iface.state = <empty>
iface.vlan_id = 0
iface.vlan_priority = 0
iface.vlan_state = <empty>
iface.iface_num = 0
iface.mtu = 0
iface.port = 0
node.discovery_address = 192.168.xx.xx
node.discovery_port = 3260
node.discovery_type = send_targets
node.session.initial_cmdsn = 0
node.session.initial_login_retry_max = 8
node.session.xmit_thread_priority = -20
node.session.cmds_max = 128
node.session.queue_depth = 32
node.session.nr_sessions = 1
node.session.auth.authmethod = None
node.session.auth.username = <empty>
node.session.auth.password = <empty>
node.session.auth.username_in = <empty>
node.session.auth.password_in = <empty>
node.session.timeo.replacement_timeout = 120
node.session.err_timeo.abort_timeout = 15
node.session.err_timeo.lu_reset_timeout = 30
node.session.err_timeo.tgt_reset_timeout = 30
node.session.err_timeo.host_reset_timeout = 60
node.session.iscsi.FastAbort = Yes
node.session.iscsi.InitialR2T = No
node.session.iscsi.ImmediateData = Yes
node.session.iscsi.FirstBurstLength = 262144
node.session.iscsi.MaxBurstLength = 16776192
node.session.iscsi.DefaultTime2Retain = 0
node.session.iscsi.DefaultTime2Wait = 2
node.session.iscsi.MaxConnections = 1
node.session.iscsi.MaxOutstandingR2T = 1
node.session.iscsi.ERL = 0
node.conn[0].address = 192.168.xx.xx
node.conn[0].port = 3260
node.conn[0].startup = manual
node.conn[0].tcp.window_size = 524288
node.conn[0].tcp.type_of_service = 0
node.conn[0].timeo.logout_timeout = 15
node.conn[0].timeo.login_timeout = 15
node.conn[0].timeo.auth_timeout = 45
node.conn[0].timeo.noop_out_interval = 5
node.conn[0].timeo.noop_out_timeout = 5
node.conn[0].iscsi.MaxXmitDataSegmentLength = 0
node.conn[0].iscsi.MaxRecvDataSegmentLength = 262144
node.conn[0].iscsi.HeaderDigest = None
node.conn[0].iscsi.DataDigest = None
node.conn[0].iscsi.IFMarker = No
node.conn[0].iscsi.OFMarker = No
# END RECORD

There is a script to automate basic subnet enumeration process available at iscsiadm

Shodan

port:3260 AuthMethod