snmp scripts v0.2

I found a bug in the Nmap SNMP scripts that would trigger an endless loop if the MIB that they attempt to walk does not exist. This would occur if they’re run against anything else than Windows. I’ve now addressed this and released a 0.2 version of them. They’re available from the nmap-scripts page.

DAAP script for nmap

I’ve added a script that queries a DAAP service for it’s library. Depending on the version of the service it then attempts to query it for for a list of artists, albums and songs. It’s available, together with more other scripts, over at the nmap-scripts page.

Here’s a sample output when running against the Firefly Media Server:

| daap-get-library:
|   BUBBA|TWO
|     Fever Ray
|       Fever Ray (Deluxe Edition)
|         Concrete Walls
|         I’m Not Done
|         Here Before
|         Now’s The Only Time I Know
|         Stranger Than Kindness
|         Dry And Dusty
|         Keep The Streets Empty For Me
|         Triangle Walks
|         If I Had A Heart
|         Seven
|         When I Grow Up
|_       Coconut

SNMP scripts for nmap

I just finished writing a bunch of Windows oriented SNMP scripts for nmap. A zip file containing all of them is available from the nmap-scripts page. The archive currently includes:

  • snmp-get-windows-processes.nse
  • snmp-get-windows-services.nse
  • snmp-get-windows-shares.nse
  • snmp-get-windows-software.nse
  • snmp-get-windows-users.nse

I have included some sample output in the full article.

Continue reading

dns work in nmap

I have been re-working my dns-service-discovery and lexmark-config scripts to make use of the nmap dns library. Why I failed to do this from the beginning is a mystery to me and others. The re-work went well and the end result allowed me to completely ditch the mdns library. In order to achieve what I needed I had to make some slight changes to the dns library which I have posted as a patch to the nmap-dev list.

While re-working the dns-service-discovery script I totally changed the output as well. It’s now less DNS:ish and more focused around the information. Here’s an example of the new format:

As the dns library is in use by other scripts I’ll wait until the changes are tested and confirmed not to break stuff before I post it here. If someone is eager to try the new scripts out the patch and scripts can be found here:

http://seclists.org/nmap-dev/2010/q1/92
http://seclists.org/nmap-dev/2010/q1/87

LDAP for Nmap

Just posted some code (libraries and scripts) that allows Nmap to do LDAP queries. It’s available from the nmap-scripts page. The code consists of two libraries asn1 and ldap that do most of the work. The LDAP library supports the SearchRequest, BindRequest and UnbindRequest operations and therefore supports both unauthenticated and authenticated searches.

The functionality is still somewhat limited and the library has the following shortcomings in my opinion:

  • At the moment it only supports simple bind
  • It lacks filter parsing support. That said, it supports filters, but they need to be supplied using tables rather than their textual representation as described in RFC 2254.
  • SSL is currently not supported mainly because I didn’t have an SSL enabled LDAP server running.
  • Some attributes returned by AD fail parsing and return a blob of hex characters.
  • There’s an annoying GUI indentation bug that needs tending to.

Despite these shortcomings I’m releasing a first version of the library and scripts. The scripts have undergone limited testing against both OpenLDAP and ActiveDirectory.

dns-service-discovery nmap script

I just posted a new Nmap script that uses the DNS Service Discovery protocol to enumerate information from a remote host. The script queries the Multicast DNS Service/Bonjour/ZeroConf for a list of services and then queries each service for additional information. The results are decoded and presented in a list similar to the one below. Systems that are known to ship with this service active include Apple OS X, Ubuntu and many printers.

The script is available over at the Nmap script page and should be run like this:

Here’s some sample output:

PORT     STATE   SERVICE
5353/udp open zeroconf
| dns-service-discovery:
|   Service: _workstation._tcp.local
|     Answers: 5
|       _workstation._tcp.local PTR IN
|         name: _workstation._tcp.local
|       patrik-laptop [08:00:aa:bb:cc:dd]._workstation._tcp.local TXT IN
|       patrik-laptop [08:00:aa:bb:cc:dd]._workstation._tcp.local SRV IN
|         priority: 0
|         weight: 0
|         port: 9
|         target: patrik-laptop.local
|       patrik-laptop.local AAAA IN
|         addr: fe80:0:0:0:a00:27ff:aabb:ccdd
|       patrik-laptop.local A IN
|_        addr: 192.168.0.100

New nmap script afp-showmount

I finished yet another Nmap script that allows for listing of AFP shares and their ACLs. The script currently does so as the public user and does not support authentication at the moment. The script is available from the nmap-script page. Here’s some sample output of the script being run against one of my test systems.

PORT    STATE SERVICE
548/tcp open  afp
| afp-showmount:
|     Yoda’s Public Folder
|       Owner: Search,Read,Write
|       Group: Search,Read
|       Everyone: Search,Read
|       User: Search,Read
|     Vader’s Public Folder
|       Owner: Search,Read,Write
|       Group: Search,Read
|       Everyone: Search,Read
|_      User: Search,Read