Re: Adding new NSE discovered targets to Nmap

[Ron <ron () skullsecurity net>]

On dhcp-discovery script, I had to use pcap to receive the packet. Obviously not an ideal solution, but it works. :)

dhcp-* is a little different, though, because the response doesn't come back to the proper ip address (it comes back to 
the new ip address that the dhcp server assigns you), so you have little choice but to use pcap. Typically, pcap 
shouldn't be necessary for receiving broadcast responses (unfortunately, I don't know the right way). 

Ron

On Sun, 15 Aug 2010 22:40:58 +0200 Patrik Karlsson <patrik () cqure net>
wrote:
> So I looked into this a bit more as I was curios to test some new
> ideas out. I managed to make the setbroadcast call and have my NSE
> code send broadcasts out. However, I ran into some trouble as all UDP
> sockets are connected to the destination address.
>
> The man page for connect says:
> "The parameter socket is a socket. If it is of type SOCK_DGRAM, this
> call specifies the peer with which the socket is to be associated;
> this address is that to which datagrams are to be sent, and the only
> address from which data- grams are to be received."
>
> As far as I can tell this makes it difficult to receive any response
> at all to a broadcast request. I made a quick test re-connecting the
> socket with the address family AF_UNSPEC immediately after the send
> was issued.
>
> "Datagram sockets may dissolve the association by connecting to an
>  invalid address, such as a null address or an address with the
> address family set to AF_UNSPEC (the error EAFNOSUPPORT will be
> harmlessly returned)."
>
> This allowed the socket to receive the response from one of the
> clients responding to the broadcast request.
>
> This obviously is NOT the solution, so currently I'm guessing the
> only way to pick up the response is by using pcap? As I'm on OS X
> 10.6.4 that unfortunately doesn't work either. 
>
> Am I missing something terribly obvious? If so could someone more
> familiar with the code please enlighten me?
>
> //Patrik
>
> > Dan
> > _______________________________________________
> > Sent through the nmap-dev mailing list
> > http://cgi.insecure.org/mailman/listinfo/nmap-dev
> > Archived at http://seclists.org/nmap-dev/
>
> --
> Patrik Karlsson
> http://www.cqure.net
> http://www.twitter.com/nevdull77
>
>
>
>
>
> _______________________________________________
> Sent through the nmap-dev mailing list
> http://cgi.insecure.org/mailman/listinfo/nmap-dev
> Archived at http://seclists.org/nmap-dev/


-- 
Ron Bowes
http://www.skullsecurity.org
http://www.twitter.com/iagox86

Attachment: _bin
Description:

_______________________________________________
Sent through the nmap-dev mailing list
http://cgi.insecure.org/mailman/listinfo/nmap-dev
Archived at http://seclists.org/nmap-dev/