Nmap Security Scanner
*Intro
*Ref Guide
*Install Guide
*Download
*Changelog
*Book
*Docs
Security Lists
*Nmap Hackers
*Nmap Dev
*Bugtraq
*Full Disclosure
*Pen Test
*Basics
*More
Security Tools
*Pass crackers
*Sniffers
*Vuln Scanners
*Web scanners
*Wireless
*Exploitation
*Packet crafters
*More
Site News
Site Search:
Exploit World
Advertising
About/Contact
Credits
Sponsors:
edgeos

Nmap Development: Re: Nmap 4.22SOC7 Released [bit.dll]

Re: Nmap 4.22SOC7 Released [bit.dll]

From: jah <jah_at_zadkiel.plus.com>
Date: Thu, 11 Oct 2007 22:21:09 +0100

bit.dll is required by only two of the nse scripts:
dns-test-open-recursion.nse
zoneTrans.nse

so i decided to do the following scan to make sure the script actually
runs and that bit is called:
nmap -P0 -sS -p53 --script=zoneTrans.nse --script-trace -vv -d2 <target>

and it definitely runs. So definitely no issue that I can reproduce.

Lawrence, are you running 32bit XP and what is your service pack level?
And how do you fancy running Process Monitor
<http://www.microsoft.com/technet/sysinternals/utilities/processmonitor.mspx>
to capture nmaps hunt for bit.dll?

As a comparison with Robs ProcMon output (showing the hunt and then the
finding of bit.dll):

IRP_MJ_CREATE C:\Program Files\Nmap\nselib\bit.lua NAME NOT FOUND
IRP_MJ_CREATE C:\Program Files\Nmap\nselib\bit.lua NAME NOT FOUND
IRP_MJ_CREATE C:\Documents and Settings\jah\bit.lua NAME NOT FOUND
IRP_MJ_QUERY_INFORMATION C:\Documents and Settings\jah SUCCESS
IRP_MJ_CREATE C:\Documents and Settings\jah\bit.lua NAME NOT FOUND
IRP_MJ_CREATE C:\Program Files\Nmap\lua\bit.lua PATH NOT FOUND
IRP_MJ_CREATE C:\Program Files\Nmap\lua\bit.lua PATH NOT FOUND
IRP_MJ_CREATE C:\Program Files\Nmap\lua\bit\init.lua PATH NOT FOUND
IRP_MJ_CREATE C:\Program Files\Nmap\lua\bit\init.lua PATH NOT FOUND
IRP_MJ_CREATE C:\Program Files\Nmap\bit.lua NAME NOT FOUND
IRP_MJ_CREATE C:\Program Files\Nmap\bit.lua NAME NOT FOUND
IRP_MJ_CREATE C:\Program Files\Nmap\bit\init.lua PATH NOT FOUND
IRP_MJ_CREATE C:\Program Files\Nmap\bit\init.lua PATH NOT FOUND
IRP_MJ_CREATE C:\Program Files\Nmap\nselib\bit.dll SUCCESS

Rob Nicholls wrote:
> SOC7 seems to work okay for me too. I tried "nmap -sC 192.168.x.x -vv" with
> other versions I have and SOC5 and SOC6 also work fine (or at least don't
> crash).
>
> However, I did come across an issue with a version of SOC6 (SVN rev 5916)
> that I had previously compiled with VS.NET 2003, which popped up an error
> message in Windows Vista (and logged the same text as an Application Popup
> in the Event Log, with no more info to go on that I can see):
>
> nmap.exe - Unable To Locate Component
> This application has failed to start because MSVCR71D.dll was not
> found. Re-installing the application may fix this problem.
>
> This dll is apparently a debug version of msvcr71.dll, so I suspect I must
> have built a debug version instead of a release version (something I'll look
> into later). And nmap said a similar (but not identical) error message to
> what Lawrence saw:
>
> SCRIPT ENGINE: Initiating script scanning.
> LUA INTERPRETER in c:\xxxxxxxxxxxx\nmap-svn-
> 5916\nmap\nse_init.cc:698: error loading module 'bit' from file
> 'C:\tools\win32\
> nmap-4.22SOC6-svn-5916\nselib\bit.dll':
> The specified module could not be found.
>
> SCRIPT ENGINE: Aborting script scan.
>
> I believe line 698 is the last line of:
>
> /* load the *.nse file, set the closure and execute (init) the test
> * */
> SCRIPT_ENGINE_LUA_TRY(luaL_loadfile(l, filename));
> lua_pushvalue(l, -2);
> lua_setfenv(l, -2);
> SCRIPT_ENGINE_LUA_TRY(lua_pcall(l, 0, 0, 0));
>
> This appears to be the very same line (711) as Lawrence saw in his SOC7
> error message. Is this perhaps a problem encountered by people that have
> compiled the binaries themselves? It's an odd one that I can't seem to
> reliably reproduce: the very same version I had compiled worked fine on
> another Vista machine and on a Windows 2003 machine (the latter was used to
> compile the binary).
>
> I ran Process Monitor on the laptop (where I get the error message mentioned
> above) and noticed a few quirks:
>
> I spotted it trying to access *nix locations for some random numbers:
>
> 4718 41:07.2 nmap.exe 4960 CreateFile C:\dev\arandom
> 4719 41:07.2 nmap.exe 4960 CreateFile C:\dev\urandom
>
> Anyone know why it's doing that on Windows?
>
> Then I saw it looking for "bit" related stuff (even though bit.lua and
> init.lua don't appear to exist anywhere, including source code, nor do bit
> or lua folders), followed by a desperate search for the (debug) dll I
> mentioned:
>
> CreateFile C:\[snip]\svn-5916\nselib\bit.lua NAME NOT FOUND
> CreateFile C:\[snip]\svn-5916\bit.lua NAME NOT FOUND
> CreateFile C:\[snip]\svn-5916\lua\bit.lua PATH NOT FOUND
> CreateFile C:\[snip]\svn-5916\lua\bit\init.lua PATH NOT FOUND
> CreateFile C:\[snip]\svn-5916\bit.lua NAME NOT FOUND
> CreateFile C:\[snip]\svn-5916\bit\init.lua PATH NOT FOUND
> CreateFile C:\[snip]\svn-5916\nselib\bit.dll SUCCESS
> CloseFile C:\[snip]\svn-5916\nselib\bit.dll SUCCESS
> QueryOpen C:\[snip]\svn-5916\nselib\bit.dll FAST IO DISALLOWED
> CreateFile C:\[snip]\svn-5916\nselib\bit.dll SUCCESS
> QueryBasicInformationFile C:\[snip]\svn-5916\nselib\bit.dll
> SUCCESS
> CloseFile C:\[snip]\svn-5916\nselib\bit.dll SUCCESS
> CreateFile C:\[snip]\svn-5916\nselib\bit.dll SUCCESS
> CloseFile C:\[snip]\svn-5916\nselib\bit.dll SUCCESS
> QueryOpen C:\[snip]\svn-5916\nselib\bit.dll FAST IO DISALLOWED
> CreateFile C:\[snip]\svn-5916\nselib\bit.dll SUCCESS
> QueryBasicInformationFile C:\[snip]\svn-5916\nselib\bit.dll
> SUCCESS
> CloseFile C:\[snip]\svn-5916\nselib\bit.dll SUCCESS
> CreateFile C:\[snip]\svn-5916\nselib\bit.dll SUCCESS
> CloseFile C:\[snip]\svn-5916\nselib\bit.dll SUCCESS
> QueryOpen C:\[snip]\svn-5916\MSVCR71D.dll FAST IO DISALLOWED
> CreateFile C:\[snip]\svn-5916\MSVCR71D.dll NAME NOT FOUND
> QueryOpen C:\Windows\System32\MSVCR71D.dll FAST IO DISALLOWED
> CreateFile C:\Windows\System32\MSVCR71D.dll NAME NOT FOUND
> QueryOpen C:\Windows\system\MSVCR71D.dll FAST IO DISALLOWED
> CreateFile C:\Windows\system\MSVCR71D.dll NAME NOT FOUND
> QueryOpen C:\Windows\MSVCR71D.dll FAST IO DISALLOWED
> CreateFile C:\Windows\MSVCR71D.dll NAME NOT FOUND
> QueryOpen C:\[snip]\svn-5916\MSVCR71D.dll FAST IO DISALLOWED
> CreateFile C:\[snip]\svn-5916\MSVCR71D.dll NAME NOT FOUND
> QueryOpen C:\Perl\bin\MSVCR71D.dll FAST IO DISALLOWED
> CreateFile C:\Perl\bin\MSVCR71D.dll NAME NOT FOUND
> QueryOpen C:\Windows\System32\MSVCR71D.dll FAST IO DISALLOWED
> CreateFile C:\Windows\System32\MSVCR71D.dll NAME NOT FOUND
> QueryOpen C:\Windows\MSVCR71D.dll FAST IO DISALLOWED
> CreateFile C:\Windows\MSVCR71D.dll NAME NOT FOUND
> QueryOpen C:\Windows\System32\wbem\MSVCR71D.dll FAST IO DISALLOWED
> CreateFile C:\Windows\System32\wbem\MSVCR71D.dll NAME NOT FOUND
> QueryOpen C:\[snip]\MSVCR71D.dll FAST IO DISALLOWED
> CreateFile C:\[snip]\MSVCR71D.dll NAME NOT FOUND
> QueryOpen C:\Program Files\Microsoft SQL
> Server\90\Tools\Binn\MSVCR71D.dll FAST IO DISALLOWED
> CreateFile C:\Program Files\Microsoft SQL
> Server\90\Tools\Binn\MSVCR71D.dll NAME NOT FOUND
>
> I might try recompiling SOC6 and compiling SOC5 and SOC7 later tonight and
> see what happens then. Hopefully someone will find something useful out of
> all the above, as I can't see anything obvious!
>
>
> Rob
>
>
> -----Original Message-----
> From: jah [mailto:jah_at_zadkiel.plus.com]
> Sent: 11 October 2007 18:40
> To: nmap-dev
> Subject: Re: Nmap 4.22SOC7 Released
>
> I'm not seeing the issue with nmap installed in it's default location.
> If I install nmap to an alternative location (with winpcap in the same
> place or in it's default), I also don't see the issue.
> Scan was nmap -sC <target>
>
> Here's error 14001 from winerror.h:
> //
> // MessageId: ERROR_SXS_CANT_GEN_ACTCTX
> //
> // MessageText:
> //
> // This application has failed to start because the application
> configuration is incorrect. Reinstalling the application may fix this
> problem.
> //
> #define ERROR_SXS_CANT_GEN_ACTCTX 14001L
>
> which doesn't say much to me, but there may be a clue in the Windows
> Application event log.
>
> And for a windows strace, Process Monitor may be able to shed some light:
> http://www.microsoft.com/technet/sysinternals/utilities/processmonitor.mspx
>
> Christoph J. Thompson wrote:
>
>> On Thu, 11 Oct 2007 11:51:36 -0400
>> "Lawrence Waterhouse" <lawrence.waterhouse_at_gmail.com> wrote:
>>
>>
>>> Hi folks,
>>>
>>> Platform is WinXP here, I am getting this error when launching a
>>> Script Scan (-sC)
>>>
>>> SCRIPT ENGINE: Initiating script scanning.
>>> LUA INTERPRETER in ..\nse_init.cc:711: error loading module 'bit'
>>> from file 'd:\ tools\nmap\nselib\bit.dll':
>>> system error 14001
>>>
>>> Just verified with SOC6, had the same error.
>>>
>>>
>> Do you have access to strace or something like it on Windows so we can see
>>
> where it's looking for bit.dll?
>
>> _______________________________________________
>> Sent through the nmap-dev mailing list
>> http://cgi.insecure.org/mailman/listinfo/nmap-dev
>> Archived at http://SecLists.Org
>>
>> --
>> This email has been verified as Virus free
>> Virus Protection and more available at http://www.plus.net
>>
>>
>>
>
> _______________________________________________
> Sent through the nmap-dev mailing list
> http://cgi.insecure.org/mailman/listinfo/nmap-dev
> Archived at http://SecLists.Org
>
>
> --
> This email has been verified as Virus free
> Virus Protection and more available at http://www.plus.net
>
>

_______________________________________________
Sent through the nmap-dev mailing list
http://cgi.insecure.org/mailman/listinfo/nmap-dev
Archived at http://SecLists.Org
Received on Oct 11 2007

[ Nmap | Sec Tools | Mailing Lists | Site News | About/Contact | Advertising | Privacy ]