Monthly Archives: February 2011

Pulling Cisco configs with Nmap

A few hours ago I committed a new script created by Vikas Singhal to Nmap. It implements the functionality to initiate a tftp transfer of a Cisco configuration through SNMP. In order to do so, the device obviously needs to support this functionality, and you need to know the private SNMP-community string.

The script can either save the configuration to a file in a directory specified as a script argument or displays it on screen. In order to achieve this, I’ve contributed with a minimal tftp server, implemented as a Nmap NSE library. This eliminates the need to setup and configure a separate tftp-server as it’s all being taken care of transparently by Nmap.

In order to try it out you can either update from subversion or download the tftp library and the snmp-ios-config script and place them in nselib and the scripts directory. For more information on how to run the script, check out the documentation.

Nmap mssql scripts feature boost

Chris Woodbury and I have been working on some new exciting features and enhancements to the ms-sql scripts and library in Nmap lately. We’ve been working in a separate branch which will hopefully get merged to trunk really soon. Chris work has been of high quality and very inspiring! It got me to pick up some of the stuff I meant to implement, but hadn’t got to, and has brought a number of new great ideas. For a good summary of changes consult the following nmap-dev mailing list thread.

Among the many new features and enhancements I’m really happy to see are:

  • Support for more precise version checking, by using the prelogin packet (same technique as SQLPing)
  • Support for connections using named pipes, rather than tcp-sockets
  • Support for integrated authentication (Ntlmv1) in addition to the existing SQL authentication
  • Support for connecting to named instances in addition to specific tcp ports
  • Support for running each of the ms-sql scripts against all instances detected by the discovery mechanisms

If you would like to give the scripts a run they’re available from here, and will hopefully be merged to trunk really soon.