Two more scripts of my scripts were added to the development release of nmap, afp-showmount and dns-service-discovery. You can try them out either by downloading them from the nmap-scripts page or by checking out the latest development release over here.
If anyone missed this the Nmap project released their 5.20 version yesterday! Make sure to check it out at http://nmap.org/download.html.
I found a bug in the Nmap SNMP scripts that would trigger an endless loop if the MIB that they attempt to walk does not exist. This would occur if they’re run against anything else than Windows. I’ve now addressed this and released a 0.2 version of them. They’re available from the nmap-scripts page.
I’ve added a script that queries a DAAP service for it’s library. Depending on the version of the service it then attempts to query it for for a list of artists, albums and songs. It’s available, together with more other scripts, over at the nmap-scripts page.
Here’s a sample output when running against the Firefly Media Server:
| Fever Ray
| Fever Ray (Deluxe Edition)
| Concrete Walls
| I’m Not Done
| Here Before
| Now’s The Only Time I Know
| Stranger Than Kindness
| Dry And Dusty
| Keep The Streets Empty For Me
| Triangle Walks
| If I Had A Heart
| When I Grow Up
I’ve update the nmap-script page with two scripts for MySQL. The first simply checks whether the root user has a blank password set. The second script allows to perform online password guessing against MySql.
I just finished writing a bunch of Windows oriented SNMP scripts for nmap. A zip file containing all of them is available from the nmap-scripts page. The archive currently includes:
I have included some sample output in the full article.
I was notified about a bug in the afp-showmount script that failed to show any results if a single share was found. This bug has been addressed in this version which is available from the nmap-scripts page.
I have been re-working my dns-service-discovery and lexmark-config scripts to make use of the nmap dns library. Why I failed to do this from the beginning is a mystery to me and others. The re-work went well and the end result allowed me to completely ditch the mdns library. In order to achieve what I needed I had to make some slight changes to the dns library which I have posted as a patch to the nmap-dev list.
While re-working the dns-service-discovery script I totally changed the output as well. It’s now less DNS:ish and more focused around the information. Here’s an example of the new format:
PORT STATE SERVICE REASON
5353/udp open zeroconf udp-response
| 548/tcp afpovertcp
| Address=192.168.0.2 fe80:0:0:0:223:6cff:1234:5678
| 3689/tcp daap
| iTSh Version=196609
| Database ID=6FA9761FE123456
| Machine Name=Patrik KarlssonxE2x80x99s Library
| Media Kinds Shared=1
| Machine ID=8945A7123456
|_ Address=192.168.0.2 fe80:0:0:0:223:6cff:1234:5678
As the dns library is in use by other scripts I’ll wait until the changes are tested and confirmed not to break stuff before I post it here. If someone is eager to try the new scripts out the patch and scripts can be found here:
Just posted some code (libraries and scripts) that allows Nmap to do LDAP queries. It’s available from the nmap-scripts page. The code consists of two libraries asn1 and ldap that do most of the work. The LDAP library supports the SearchRequest, BindRequest and UnbindRequest operations and therefore supports both unauthenticated and authenticated searches.
The functionality is still somewhat limited and the library has the following shortcomings in my opinion:
- At the moment it only supports simple bind
- It lacks filter parsing support. That said, it supports filters, but they need to be supplied using tables rather than their textual representation as described in RFC 2254.
- SSL is currently not supported mainly because I didn’t have an SSL enabled LDAP server running.
- Some attributes returned by AD fail parsing and return a blob of hex characters.
- There’s an annoying GUI indentation bug that needs tending to.
Despite these shortcomings I’m releasing a first version of the library and scripts. The scripts have undergone limited testing against both OpenLDAP and ActiveDirectory.
I just posted a new Nmap script that uses the DNS Service Discovery protocol to enumerate information from a remote host. The script queries the Multicast DNS Service/Bonjour/ZeroConf for a list of services and then queries each service for additional information. The results are decoded and presented in a list similar to the one below. Systems that are known to ship with this service active include Apple OS X, Ubuntu and many printers.
The script is available over at the Nmap script page and should be run like this:
nmap -sU -p 5353 --script dns-service-discovery <host or ip>
Here’s some sample output:
PORT STATE SERVICE
5353/udp open zeroconf
| Service: _workstation._tcp.local
| Answers: 5
| _workstation._tcp.local PTR IN
| name: _workstation._tcp.local
| patrik-laptop [08:00:aa:bb:cc:dd]._workstation._tcp.local TXT IN
| patrik-laptop [08:00:aa:bb:cc:dd]._workstation._tcp.local SRV IN
| priority: 0
| weight: 0
| port: 9
| target: patrik-laptop.local
| patrik-laptop.local AAAA IN
| addr: fe80:0:0:0:a00:27ff:aabb:ccdd
| patrik-laptop.local A IN
|_ addr: 192.168.0.100