cqure.net

15 new nmap scripts

Patrik Karlsson — Sun, 08 Aug 2010 17:27:46 +0000

I just posted 15 new nmap scripts to the nmap-dev mailing list. For anyone curios to check them out have a look over here. I’ve been working on these new scripts for a while and they add yet more database support to nmap allowing users to perform password guessing against both Oracle and Informix servers. In addition custom SQL queries can be made to Informix servers directly from nmap.

I’ve also created a number of scripts which can be suitable when pen testing Lotus Domino. These scripts include support for collecting Internet password hashes and user ID files. ID files can be collected both as an authenticated user from the person web view or unauthenticated using the vulnerability CVE-2006-5835. Oh, and you can add Lotus Domino 8.5 to the list of vulnerable versions in that advisory. There are also two scripts that allow you to interact with the IBM Lotus Domino remote console. One script allows for password guessing, while the other one allows you to interact with the console ones your authenticated.

There’s a tiny script in the zip file that supports querying for registered objects in a ORB Naming Service using the GIOP protocol.

Last but not least I’ve created a framework for other password guessing scripts to use. The framework runs using multiple worker threads and does all the looping, iteration and other basic logic used by most of my previous brute scripts.

The zip file included in the nmap-dev post can be downloaded from here. Please help me out testing the scripts so that they can be added to the subversion version of nmap!

Updated rdesktop patch

Patrik Karlsson — Sun, 09 May 2010 07:37:19 +0000

I’ve got an e-mail from someone who had trouble with my old rdesktop password guessing patch. So, I took a new look at it and updated it to do more than just dump core

It’s available for download from the rdesktop page.

Detecting Apple Mac OS X AFP vulnerability CVE-2010-0533 with Nmap

Patrik Karlsson — Mon, 29 Mar 2010 17:53:56 +0000

During the development of my AFP library for Nmap I came a cross a critical vulnerability in Apple’s implementation of AFP on Snow Leopard. The vulnerability occurs due to improper input validation and allows an attacker to access (list, read, and/or write) files in the parent directory of any AFP sharepoint.

By default, when enabling AFP, the Public folder in each user’s home directory is shared as Public Folder. In my case “Patrik Karlsson’s Public Folder”. Since the Public folder is a subdirectory of a user’s home directory, exploiting this share provides access to all of that user’s home directory files (but not subdirectories or files with restrictive filesystem permissions).

As the name suggests, the Public shares are available to anyone without authentication. Given the default permissions on home directories (world read+execute) and the default umask (world read), this has a serious impact – as unauthenticated users can read all files in a user’s home directory. The attack also works for authenticated users against shares requiring authentication.

Technically the attack is not very challenging and relies on a classic directory traversal attack. It is strikingly similar to the famous Windows SMB filesharing vulnerability from 1995. However, sending such a path to the server without interpreting and translating it on the client is somewhat more challenging. I’ve developed a number of different scripts while researching the vulnerability that list, read and write files in the parent directory. In order to do so I’ve added the necessary code to the AFP library which is essentially the core of these NSE scripts.

At this time I’m releasing two scripts afp-path-vuln, afp-brute and library. The vulnerability detection script attempts to determine whether the scanned servers are vulnerable or not and outputs the contents of the parent directory if they are. The script and library are as of now available from the latest subversion version of Nmap and can also be downloaded here:

http://nmap.org/svn/scripts/afp-path-vuln.nse
http://nmap.org/svn/scripts/afp-brute.nse
http://nmap.org/svn/nselib/afp.lua

You can run the scripts either from your current version of Nmap or from the current subversion release. If you want to run the script with user credentials it needs the subversion release of Nmap as adding the support for AFP authentication involved patching the LUA to OpenSSL API.

For documentation on how to add scripts to your current Nmap installation have a look at Ron Bowes blog post “How-to: install an Nmap script” over here. The afp.lua library should be copied to the nselib directory which is located in the same parent directory as the scripts directory described in the blog post.

Last, but not least, here is the syntax for running the scripts against a system or network to detect vulnerable hosts:

nmap -p 548 --script afp-path-vuln

If the server is vulnerable it will show the following output:

Solution
Apple has released Mac OS X 10.6.3 which addresses the vulnerability. It can be downloaded from here:
http://support.apple.com/kb/HT1222

Credits
Thanks to Fyodor and David Fifield for great suggestions, moral support, and review of the code.

Timeline
2010-02-10 – Security vulnerability disclosed to Apple together with PoC
2010-02-10 – Apple responds and have been able to reproduce vulnerability
2010-02-15 – Request of status update
2010-02-18 – Request of status update
2010-02-22 – Request of status update
2010-02-22 – Apple responds with DRAFT advisory and timing for disclosure (week starting 02/28)
2010-03-06 – Disclosure date overdue, request for status update
2010-03-08 – Apple responds with a new date for disclosure (week starting 03/15)
2010-03-17 – Request status update
2010-03-17 – Apple responds with a new date for disclosure (week starting 03/23)
2010-03-17 – Apple corrects the disclosure date to the 29th of March

Inspect it is hiring

patrik — Mon, 15 Mar 2010 18:05:52 +0000

My employer (Inspect it) is hiring in Stockholm (Sweden). Inspect it is looking for people that currently work with IT- and information-security or have a strong desire to do so. Applicants should have experience within one or more of the following areas:

- Penetration- and Application-security testing
- Application & System security reviews
- Incident response and IT-forensics
- Security training

If your interested or have any questions contact me directly or send an e-mail to jobs[at]inspectit[dot]se

Nmap-scripts cleanup

Patrik Karlsson — Wed, 17 Feb 2010 11:36:39 +0000

I’ve cleaned up the Nmap scripts page a bit to better reflect reality. Most of the scripts published on that page have been commited to the Nmap development release. I’m actively working on getting the remainder commited to. Once the scripts have been commited, they’re no longer maintained here. So, in order to try them out I recommend you to install the latest development release of Nmap. In order to do so, follow the steps outlined here.

5 new SNMP scripts in Nmap SVN

Patrik Karlsson — Wed, 17 Feb 2010 11:23:13 +0000

As of yesterday there are now 5 new SNMP scripts in the development release of Nmap. I commited a new ASN.1 library a re-worked SNMP library and 5 new scripts. The new scripts are:

snmp-netstat shows listening and connected sockets
snmp-processes shows process information including name, pid, path and parameters
snmp-win32-services shows the names of running Windows services
snmp-win32-shares shows the names and path of Windows shares
snmp-win32-software shows a list of installed Windows software
snmp-win32-users shows a list of local Windows users

Make sure to check them out over at insecure.org. In order to use them you need to check out the development sources from subversion. More info on that over here.

nfs-showmount total re-write

Patrik Karlsson — Mon, 25 Jan 2010 19:44:15 +0000

I received a bug report for my Nmap nfs-showmount script a few days ago. I ended up re-writing the whole thing as it was my first script, which is short for “ugly as hell”. I moved all NFS and RPC stuff into a new library called rpc.lua and added some more functionality as well.

I’ve also added two more scripts that make use of the library nfs-get-stats and nfs-get-dirlist. The first retrieves disk usage for each export and the second lists files on a share. They’re both available from the nmap-scripts page as usual.

Nmap does more MySQL

Patrik Karlsson — Sat, 23 Jan 2010 21:48:44 +0000

I’ve just added some code to my Nmap MySQL library that enables query support. With this code in place it’s possible to run queries against MySQL directly from a Nmap script. In order to illustrate this I’ve added three scripts: mysql-list-users, mysql-list-databases and mysql-show-variables.

While messing around with the library I also cleaned up the code for mysql-brute and mysql-empty-password. All of the scripts that query the database obviously require credentials to do so. These can be provided on the command line using script arguments mysqluser and mysqlpassword or by running the mysql-brute or mysql-empty-password on the same time. There are dependencies set up so that the query scripts wait until these two scripts have collected the credentials. Here’s some sample output from the scripts …

New scripts added to Nmap svn

Patrik Karlsson — Thu, 21 Jan 2010 07:13:06 +0000

Two more scripts of my scripts were added to the development release of nmap, afp-showmount and dns-service-discovery. You can try them out either by downloading them from the nmap-scripts page or by checking out the latest development release over here.

Nmap goes 5.20

Patrik Karlsson — Thu, 21 Jan 2010 07:09:31 +0000

If anyone missed this the Nmap project released their 5.20 version yesterday! Make sure to check it out at http://nmap.org/download.html.