Re: ssl/irc not detected

[David Fifield <david () bamsoftware com>]

On Tue, Dec 07, 2010 at 11:01:49AM -0800, Corey Quinn wrote:
> On Nov 10, 2010, at 8:30 PM, David Fifield wrote:
>
> > On Wed, Nov 10, 2010 at 05:13:55PM -0800, Matt Selsky wrote:
> > > IRC servers running behind SSL don't seem to be detected as such.
> > > freenode runs non-SSL on port 6667, and SSL on port 7000 and 7070.
> > >
> > > $ ./nmap --datadir=. -d -sV -p 6667,7000,7070 --version-trace
> > > irc.freenode.net
> > >
> > > Starting Nmap 5.35DC18 ( http://nmap.org ) at 2010-11-10 17:06 PST
> > > Starting probes against new service: 82.96.64.4:7000 (tcp)
> > > NSOCK (2.2170s) TCP connection requested to 82.96.64.4:7000 (IOD #2) EID 16
> > > NSOCK (2.3860s) Callback: CONNECT SUCCESS for EID 16 [82.96.64.4:7000]
> > > Service scan sending probe NULL to 82.96.64.4:7000 (tcp)
> > > NSOCK (2.3860s) Read request from IOD #2 [82.96.64.4:7000] (timeout:
> > > 6000ms) EID 42
> > > NSOCK (8.3860s) Callback: READ TIMEOUT for EID 42 [82.96.64.4:7000]
> > > Service scan sending probe RPCCheck to 82.96.64.4:7000 (tcp)
> > > NSOCK (8.3860s) Write request for 44 bytes to IOD #2 EID 59
> > > [82.96.64.4:7000]: ...(r..................|....................
> > > NSOCK (8.3860s) Read request from IOD #2 [82.96.64.4:7000] (timeout:
> > > 5000ms) EID 66
> > > NSOCK (8.3870s) Callback: WRITE SUCCESS for EID 59 [82.96.64.4:7000]
> > > NSOCK (8.3870s) Callback: WRITE SUCCESS for EID 75 [82.96.64.4:7070]
> > > NSOCK (8.5570s) Callback: READ ERROR [Connection reset by peer (54)] for
> > > EID 66 [82.96.64.4:7000]
> > > NSOCK (8.5570s) TCP connection requested to 82.96.64.4:7000 (IOD #5) EID 96
> > > NSOCK (8.7260s) Callback: CONNECT SUCCESS for EID 96 [82.96.64.4:7000]
> > > Service scan sending probe DNSVersionBindReq to 82.96.64.4:7000 (tcp)
> > > NSOCK (8.7260s) Write request for 32 bytes to IOD #5 EID 123
> > > [82.96.64.4:7000]: ...............version.bind.....
> > > NSOCK (8.7260s) Read request from IOD #5 [82.96.64.4:7000] (timeout:
> > > 5000ms) EID 130
> > > NSOCK (8.7260s) Callback: WRITE SUCCESS for EID 123 [82.96.64.4:7000]
> > > NSOCK (8.9030s) Callback: READ SUCCESS for EID 130 [82.96.64.4:7000] (42
> > > bytes): ERROR :Reconnecting too fast, throttled...
> > > Service scan match (Probe DNSVersionBindReq matched with NULL):
> > > 82.96.64.4:7000 is irc.  Version: |Unreal ircd|||
> > > Completed Service scan at 17:06, 6.69s elapsed (3 services on 1 host)
> > >
> > > I would expect something like the following:
> > >
> > > PORT     STATE SERVICE REASON  VERSION
> > > 6667/tcp open  irc     syn-ack
> > > 7000/tcp open  ssl/irc syn-ack Unreal ircd
> > > 7070/tcp open  ssl/irc syn-ack Unreal ircd
> > >
> > > Am I doing something wrong?
> >
> > I think it's this match line:
> >
> > match irc m|^ERROR :Reconnecting too fast, throttled\.\r\n$| p/Unreal ircd/
> ...which is itself a misfire; we're running freenode on ircd-seven, which is a branch of charybdis.

Thanks. I have corrected the match line to

match irc m|^ERROR :Reconnecting too fast, throttled\.\r\n$| p/ratbox, charybdis, or ircd-seven ircd/

I couldn't find the string in the source code of Unreal, but it was in
the three listed.

David Fifield
_______________________________________________
Sent through the nmap-dev mailing list
http://cgi.insecure.org/mailman/listinfo/nmap-dev
Archived at http://seclists.org/nmap-dev/