Potential Windows SP2 Fix: Nmap 3.55-SP2

[Fyodor <fyodor () insecure org>]

-----BEGIN PGP SIGNED MESSAGE-----

Hello everyone,

Since my post yesterday to nmap-hackers about Microsoft breaking Nmap
with SP2, I've been posting anti-MS rants on Slashdot and e-mailing
flames to all of my friends who work there.  Fortunately, Dana Epp
(dana(a)vulscan.com) and Andy Lutomirski (luto(a)stanford.edu) are far
more productive.  They got to work identifying the problems and
looking for solutions.  In addition to blocking TCP sends on raw
sockets (an idiotic change), Microsoft also made its ARP system more
paranoid to prevent spoofing (this one makes sense).  Dana sent me a
patch which uses raw ethernet mode when SP2 is detected (the same
technique Nmap has long used for Win95/98/NT), and also (we hope)
fixes the ARP problem.  I have built nmap-3.55-SP2, which is just Nmap
3.55 with Dana's patch, and made it available at:

http://www.insecure.org/nmap/dist/nmap-3.55-SP2-win32.zip

The MD5Sum is df343e87703f483b58e361c310d2e108 

If you get a chance, and have SP2 installed, please give it a try and
let me know how it works for you.  If all seems well, I'll post it to
the official download page.

By the way, MS has also apparently now throttles TCP connect()
requests as of SP2.  This will probably slow down -sT substantially,
but I haven't played with it yet.  I know the P2P users are up in arms
about it.

Cheers,
Fyodor

PS: I'll send Dana's patch under separate cover so the PGP sig doesn't
mangle it.
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.0.4 (GNU/Linux)
Comment: For info see http://www.gnupg.org

iQCVAwUBQRxu+c4dPqJTWH2VAQHe8QQAy3Afi5elWY/kMHJawtqDSTM9t05JEaBC
pzcm/oUH9JvChLWsBdAjag9Wv7W/n5T6B5pFP+dmGqCdhuHcGmjY/niC2N1bet1H
21bKXYMPSJOtCFi5f5idatccZzwfLYAXWv8F709DodOzyOMRj6+boakZHe33HX0/
MJ65g4nbzzY=
=tCiQ
-----END PGP SIGNATURE-----

---------------------------------------------------------------------
For help using this (nmap-dev) mailing list, send a blank email to 
nmap-dev-help () insecure org . List archive: http://seclists.org