Re: Service Submission Question

[Brandon Enright <bmenrigh () ucsd edu>]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

On Thu, 11 Sep 2008 15:51:02 -0700
Jay Chandler <lists () sequestered net> wrote:

> Howdy.  We've got a bunch of NRPE (remote Nagios agent) clients on
> our networking listening on port 5666.  nmap doesn't know what to
> make of these, and due to the way our local infrastructure is
> designed, they won't respond to non SSL requests, nor requests from
> non-allowed hosts.
>
> What's the best way to elicit a service fingerprint for
> classification? If nothing else we can use the standard port (5666)
> as the designated nrpe port, but thought there might be a more
> elegant way to handle this...

Assuming you are scanning from an "allowed" host Nmap should either
detect that the service is SSL tunneled or it should spit out a
fingerprint from the SSLSessionReq probe.

If you do get a response to the SSLSessionReq probe then you can add a
match with service type 'ssl' for that response.  As long as you keep
the service type as 'ssl', Nmap will detect the SSL tunnel and then it
will retry all of the probes but inside of an SSL tunnel.  It is
somewhat likely that once SSL'd, some other probe of Nmap's will illicit
a response from the service for which a fingerprint can be written.

If you aren't able to get an existing Probe to return any response from
the SSL tunnel then you may need to make a new probe.  To do that you
could capture the traffic Nagios sends to the agents.  You can decrypt
the Nagios stream if you give Wireshark the private key for the SSL
cert used to encrypt the session.

If that doesn't sound reasonable, you can also set up a socat <-> socat
relay to perform an SSL man-in-the-middle attack to read the protocol
plain.

Brandon

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v2.0.9 (GNU/Linux)

iEYEARECAAYFAkjJosAACgkQqaGPzAsl94IulQCeLfvvI+waw2fgSbBLHblaYnG5
wOYAnj90vWzfbpEb0P3Q1s57UUl611jz
=rMEo
-----END PGP SIGNATURE-----

_______________________________________________
Sent through the nmap-dev mailing list
http://cgi.insecure.org/mailman/listinfo/nmap-dev
Archived at http://SecLists.Org