Re: [NSE] nat-pmp-info

[Patrik Karlsson <patrik () cqure net>]

On 16 sep 2010, at 18.57, Patrik Karlsson wrote:

> Hi,
>
> I noticed my router was running the nat-pmp protocol the other day and I quickly looked it up, wrote a script and 
> disabled it ;)
> The protocol is used to map a port on the external interface to a port on the internal LAN.
> The communication is performed over udp 5351 and there's no authentication.
> So pretty much anyone on the internal LAN can request a port to be forwarded.
> I haven't implemented the mapping part but a request that retrieves the external IP of the router.
>
> This request consist of two bytes both being zero and I noticed the response is triggered by several of the version 
> scan probes.
> However I failed to extract the IP as information in the matchline as the ip is not returned as text but rather as 4 
> bytes.
>
> I'm attaching the script and if you find it useful and something we should add to Nmap let me know and I'll commit it.
>
> The specs are here:
> http://files.dns-sd.org/draft-cheshire-nat-pmp.txt
>
> <nat-pmp-info.nse>
>
> //Patrik
> --
> Patrik Karlsson
> http://www.cqure.net
> http://www.twitter.com/nevdull77

Did anyone have a chance to test this script?
According to Wikipedia [1] most Apple routers, OpenWRT and Linksys should support the protocol.
There's also a natpmp daemon that I've tested it against available over here [2]

The easiest way of testing is to copy the script from my previous post [3] into the scripts directory of Nmap and the 
run:
sudo ./nmap -sU -p 5351 <router_ip> --script nat-pmp-info

If successful, the script should return the external IP of your router.

//Patrik

[1] http://en.wikipedia.org/wiki/NAT_Port_Mapping_Protocol
[2] http://savannah.nongnu.org/projects/natpmp/
[3] http://seclists.org/nmap-dev/2010/q3/738
--
Patrik Karlsson
http://www.cqure.net
http://www.twitter.com/nevdull77





_______________________________________________
Sent through the nmap-dev mailing list
http://cgi.insecure.org/mailman/listinfo/nmap-dev
Archived at http://seclists.org/nmap-dev/