Re: NSE: RMI Dumpregistry

[Martin Holst Swende <martin () swende se>]

On 11/01/2010 09:52 PM, David Fifield wrote:
> On Thu, Sep 30, 2010 at 11:42:31PM +0200, Martin Holst Swende wrote:
> > Hi list,
> >
> > I have now rewritten and expanded large parts of the rmi registry
> > dumper. I took some inspiration from Patriks OO-approach to java
> > classes/fields, but most of the codebase is still based on the OpenJDK
> > implementation. Some additions that have been made
> > - Better protocol support, now parses out the ip:port to the actual objects
> > - Catches 'custom data' , which actually discloses the classpath in some
> > cases
> > - Tested a lot against rmi registrys I found out on the series of tubes
> >
> > This script could do with some more polishing, but that's mostly
> > documentation and decreasing verbosity. I think it is robust enough for
> > testing, and for that reason I let the output be pretty verbose, so I
> > can interpret any errors that occurs. In the final version, some of the
> > debugging-info should be removed.
> >
> > Scripts are attached, but the latest can also be cloned or downloaded
> > from http://martin.swende.se/hgwebdir.cgi/nsescripts/
> Sorry again for the delay. I added the library and script using the
> files from your branch.
>
> David Fifield

No problem about the delays, I know you have a lot++ things to deal
with, and that rmi-stuff was pretty large. Is it committed already? I am
going to perform some changes and decrease the default verbosity, but
that should be pretty minimal changes and easy to review. 

Also, regarding rmi - I mentioned earlier that rmi seems go undetected
pretty often; here's the reason:
* The RMI registry usually sits on a few ports, e.g 1099 and 1098.
* RMI objects,(which are typically found when querying the registry) are
located on pretty random ports, whatever the runtime chooses. That's why
the registry is needed, so other apps can lookup where they are (the
dumpregistry-script lists the host and port for each object)

Therefore, the currently defined ports in the service fingerprints
definition do a pretty good job at finding rmi registrys, but usually
misses to fingerprint other rmi services (remote objects). So, I would
suggest sending the rmi-probe more often. But I have no hard data to
about how common this is.

Also, if dumping the registry discovers that some objects in this
application are distributed to other hosts, perhaps adding these newly
discovered hosts to the list of targets would be nice? Or is that
something that should only be done by a pre-rule-"discovery"-script?
Right now, nothing about these potential new hosts/ports is stored so
other scripts can access the information.

Regards,
/Martin

_______________________________________________
Sent through the nmap-dev mailing list
http://cgi.insecure.org/mailman/listinfo/nmap-dev
Archived at http://seclists.org/nmap-dev/