Be sure to get it at http://nmap.org/6 !
I’ve just committed an updated version of the TNS library to Nmap, adding support for running Oracle database queries from Nmap scripts. I’ve put a considerable amount of work into trying to understand how the protocol works, due to the lack of documentation, and think that I’ve finally succeeded.
In addition I’ve posted two new scripts to the nmap-dev mailing list that make use of this new functionality:
- oracle-query – runs a given query against the Oracle database server and returns the results
- oracle-hash-dump – dumps the password hashes from an Oracle database server
In case you have the possibility to test this new code against Oracle 10g and 11g, please let me know how it works out. I’ll hopefully commit the two scripts to Nmap within the next few days.
Thank’s to some great effort put into the smb libraries by the folks over at nmap-dev, porting mbenum to Nmap wasn’t as hard as I’ve imagined. A first version has been committed to subversion a while ago but I forgot to publish this blog post at the time. Feel free to try it out! If you haven’t used mbenum before it’s a tool that allows you to get a good picture of a network by querying a single system.
Mbenum or the Nmap script smb-mbenum relies on being able to query the master browser for a particular domain or workgroup. You can find the master browser by sending a netbios query for the __MSBROWSE__ name. The Nmap script broadcast-netbios-master-browser can be used to identify the master browser for your broadcast domain by sending a netbios query to the broadcast address.
While doing a security review the other day I came across Novell eDirectory running on Windows. It’s been a while since I looked at eDirectory and while it’s a lot of LDAP, the servers were also running the Netware Core Protocol (NCP). I noticed that there wasn’t any NCP support in Nmap so I decided that I would implement some basic support. I ended up writing a NCP library and the following two scripts:
- ncp-enum-users – enumerates eDirectory users
- ncp-serverinfo – lists some basic server information
The scripts should work against NCP running on both Netware, Linux and Windows. Here’s some sample output from both scripts:
| Server name: LINUX-L84T
| Tree Name: CQURE-TREE
| OS Version: 5.70 (rev 7)
| Product version: 6.50 (rev 7)
| OS Language ID: 4
| 10.0.200.33 524/udp
| 10.0.200.33 524/tcp
In addition to the NCP scripts I wrote a LDAP script (ldap-novell-getpass) that extract the plain-text password of a given user, in case the “Allow admin to retrieve passwords” option is enabled in the password policy. On success, the script returns the following result:
| Account: CN=patrik,OU=security,O=cqure
|_ Password: foobar
All of the scripts have been committed to Nmap and are available through subversion.
I’ve been working on a Nmap script for auditing MySQL databases against the CIS 1.0.2 benchmark for a while. I haven’t committed it to subversion yet, but it’s available to download for anyone who feels up to testing it. While it isn’t perfect nor does it contain all CIS controls, it provides Nmap users with the possibility to quickly scan a database to see whether it complies with the CIS recommendations or not.
A few hours ago I committed a new script created by Vikas Singhal to Nmap. It implements the functionality to initiate a tftp transfer of a Cisco configuration through SNMP. In order to do so, the device obviously needs to support this functionality, and you need to know the private SNMP-community string.
The script can either save the configuration to a file in a directory specified as a script argument or displays it on screen. In order to achieve this, I’ve contributed with a minimal tftp server, implemented as a Nmap NSE library. This eliminates the need to setup and configure a separate tftp-server as it’s all being taken care of transparently by Nmap.
In order to try it out you can either update from subversion or download the tftp library and the snmp-ios-config script and place them in nselib and the scripts directory. For more information on how to run the script, check out the documentation.
Chris Woodbury and I have been working on some new exciting features and enhancements to the ms-sql scripts and library in Nmap lately. We’ve been working in a separate branch which will hopefully get merged to trunk really soon. Chris work has been of high quality and very inspiring! It got me to pick up some of the stuff I meant to implement, but hadn’t got to, and has brought a number of new great ideas. For a good summary of changes consult the following nmap-dev mailing list thread.
Among the many new features and enhancements I’m really happy to see are:
- Support for more precise version checking, by using the prelogin packet (same technique as SQLPing)
- Support for connections using named pipes, rather than tcp-sockets
- Support for integrated authentication (Ntlmv1) in addition to the existing SQL authentication
- Support for connecting to named instances in addition to specific tcp ports
- Support for running each of the ms-sql scripts against all instances detected by the discovery mechanisms
If you would like to give the scripts a run they’re available from here, and will hopefully be merged to trunk really soon.
Nmap 5.50 is out, make sure to check it out. It contains a lot of new NSE stuff, including support for broadcast, pre- and post-rules and most of the scripts I, and many others, have created during the last year. For more information check out the official post http://seclists.org/nmap-hackers/2011/0
I just posted 15 new nmap scripts to the nmap-dev mailing list. For anyone curios to check them out have a look over here. I’ve been working on these new scripts for a while and they add yet more database support to nmap allowing users to perform password guessing against both Oracle and Informix servers. In addition custom SQL queries can be made to Informix servers directly from nmap.
I’ve also created a number of scripts which can be suitable when pen testing Lotus Domino. These scripts include support for collecting Internet password hashes and user ID files. ID files can be collected both as an authenticated user from the person web view or unauthenticated using the vulnerability CVE-2006-5835. Oh, and you can add Lotus Domino 8.5 to the list of vulnerable versions in that advisory. There are also two scripts that allow you to interact with the IBM Lotus Domino remote console. One script allows for password guessing, while the other one allows you to interact with the console ones your authenticated.
There’s a tiny script in the zip file that supports querying for registered objects in a ORB Naming Service using the GIOP protocol.
Last but not least I’ve created a framework for other password guessing scripts to use. The framework runs using multiple worker threads and does all the looping, iteration and other basic logic used by most of my previous brute scripts.
The zip file included in the nmap-dev post can be downloaded from here. Please help me out testing the scripts so that they can be added to the subversion version of nmap!
During the development of my AFP library for Nmap I came a cross a critical vulnerability in Apple’s implementation of AFP on Snow Leopard. The vulnerability occurs due to improper input validation and allows an attacker to access (list, read, and/or write) files in the parent directory of any AFP sharepoint.