Re: Always practice safe software: a lesson from UnrealIRCd

[Vlatko Kosturjak <kost () linux hr>]

On 06/14/2010 05:21 PM, Ron wrote:
> stdnse.sleep(100) will fix the problem, but I don't like the idea of waiting 100 seconds before running a script. I 
> tried waiting for 2 or 5 seconds, and that didn't help at all. 

I agree. I don't like it too. Also timings if I can say :)

> The only reasonable measure I could think of is printing a warning message when it boots us off, and hope that's 
> enough. 
> I also added arguments for running arbitrary commands and brought back your 'kill' code, plus a 'kill' command for 
> Windows, which is untested (though I know the command runs). 
> Finally, I added a bunch more documentation. 

Just checked this approach. Script prints warning message which says
just to run with -sS same scan. This would not solve:
- if unrealircd is listening on multiple ports (SSL-based or not)
- if -sV is used (this should be recommended to turn off too for this
approach)
- if another scripts are used during scanning (i.e. script=all) which
are irc based (like irc-info.nse), they will also connect/reconnect

There are just too much recommendations to put in order to check to be
reliable, that's why I introduced irc-unrealircd-backdoor.wait argument
which you can pass sleep time. So, recommendations is pretty simple: try
to set irc-unrealircd-backdoor.wait to 100 (or higher) if block is
detected.

New version of the script is in the attachment. Hopefully - final! :)

Kost

Attachment: irc-unrealircd-backdoor.nse
Description:

_______________________________________________
Sent through the nmap-dev mailing list
http://cgi.insecure.org/mailman/listinfo/nmap-dev
Archived at http://seclists.org/nmap-dev/