Nmap Development mailing list archives

Previous By Date Next
Previous By Thread Next

Re: dev Digest, Vol 129, Issue 16

From: "Mike ." <dmciscobgp () hotmail com>
Date: Mon, 14 Dec 2015 06:14:07 +0000
actually , after i look at it. it isn't segment size, it looks like i have too small a window scale being generated and 
sent . true? notice the large window from RPCDUMP that the target matches back. notice that lacking with NMAP script. 
thanks

________________________________________
From: dev <dev-bounces () nmap org> on behalf of dev-request () nmap org <dev-request () nmap org>
Sent: Monday, December 14, 2015 6:04 AM
To: dev () nmap org
Subject: dev Digest, Vol 129, Issue 16

Send dev mailing list submissions to
        dev () nmap org

To subscribe or unsubscribe via the World Wide Web, visit
        https://nmap.org/mailman/listinfo/dev
or, via email, send a message with subject or body 'help' to
        dev-request () nmap org

You can reach the person managing the list at
        dev-owner () nmap org

When replying, please edit your Subject line so it is more specific
than "Re: Contents of dev digest..."


Today's Topics:

   1. Re: another SNMP error? (Daniel Miller)
   2. Re: odd scanning error (Daniel Miller)
   3. RPC enumeration script anomalies ATTN: Aleksandar Nikolic (Mike .)
   4. re: RPC anamoly/etc (Mike .)


----------------------------------------------------------------------

Message: 1
Date: Sun, 13 Dec 2015 15:41:49 -0600
From: Daniel Miller <bonsaiviking () gmail com>
To: "Mike ." <dmciscobgp () hotmail com>
Cc: nmap-group <dev () nmap org>
Subject: Re: another SNMP error?
Message-ID:
        <CABmvJnPLNmvoKjy1w9wEF8HOk7-sdVvW6CgGda67WLusxiy2HA () mail gmail com>
Content-Type: text/plain; charset="utf-8"

Mike,

Thanks for the report. I'm not sure why this is happening, but I added a
couple checks for bad values in r35519 so it should not happen again.

Dan

On Sun, Dec 13, 2015 at 12:45 AM, Mike . <dmciscobgp () hotmail com> wrote:


sorry again, but ran into another error i have never seen. in doing a scan
for an SNMP device, and finding an open V1 cable modem, i got this error
when running the snmp script for interfaces. not sure why i got the error,
since it says it detected "176 lines". can someone decipher this. and thank
you


Mike


C:\Program Files\Nmap/scripts\snmp-interfaces.nse:310: attempt to index
local 'item' (a nil value)
stack traceback:
        C:\Program Files\Nmap/scripts\snmp-interfaces.nse:310: in function
'process_ips'
        C:\Program Files\Nmap/scripts\snmp-interfaces.nse:440: in function
<C:\Program Files\Nmap/scripts\snmp-interfaces.nse:391>
        (...tail calls...)


_______________________________________________
Sent through the dev mailing list
https://nmap.org/mailman/listinfo/dev
Archived at http://seclists.org/nmap-dev/


-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://nmap.org/mailman/private/dev/attachments/20151213/6e52c14f/attachment.html>

------------------------------

Message: 2
Date: Sun, 13 Dec 2015 15:45:09 -0600
From: Daniel Miller <bonsaiviking () gmail com>
To: "Mike ." <dmciscobgp () hotmail com>
Cc: nmap-group <dev () nmap org>
Subject: Re: odd scanning error
Message-ID:
        <CABmvJnOoaydWyQguYm6yO+VOhhQnU0aQtqc78328h61H5HnkxA () mail gmail com>
Content-Type: text/plain; charset="utf-8"

Mike,

Thanks for the report. We had a check for this error, but it was mistakenly
added inside an #ifndef WIN32 when it was meant to go inside #ifdef WIN32.
Since it has been in that place since 2012 (r29097) I just put it in
unconditionally in r35518.

Dan

On Sun, Dec 13, 2015 at 12:32 AM, Mike . <dmciscobgp () hotmail com> wrote:


hello


so i have never seen this error before. can someone elaborate? i was just
doing a -iR random scan for snmp devices using -sUV. i got this error
halfway through:


Unexpected error in NSE_TYPE_READ callback.  Error code: 10052 (The
connection has been broken due to keep-alive activity detecting a failure
while the operation was in progress. )
QUITTING!


thanks

Mike

_______________________________________________
Sent through the dev mailing list
https://nmap.org/mailman/listinfo/dev
Archived at http://seclists.org/nmap-dev/


-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://nmap.org/mailman/private/dev/attachments/20151213/c602d11f/attachment.html>

------------------------------

Message: 3
Date: Mon, 14 Dec 2015 05:46:26 +0000
From: "Mike ." <dmciscobgp () hotmail com>
To: nmap-group <dev () nmap org>
Subject: RPC enumeration script anomalies ATTN: Aleksandar Nikolic
Message-ID:
        <BLUPR13MB03721762746992994A89C192C6ED0 () BLUPR13MB0372 namprd13 prod outlook com>

Content-Type: text/plain; charset="iso-8859-1"

group


i am wanting to send this directly to the script provider but had to go this route because i couldn't find an email for 
him. this is strange to say the least. supposedly the MSRPC script is supposed to mimic the RPCDUMP tool, right? i ran 
them side by side yesterday and found something odd and mystifying. i will enclose the ip i used to test it, because i 
want to see if this is just on my end. when i ran the nmap script, i got nothing back at all for output. when i ran the 
RPCDUMP, i got the proper dump for registered endpoint lists. why is this? are they not sending the exact same packet 
out? as i looked at them next to each other, what i found, the odd part, is that the NMAP script for some reason fires 
off a RETRANSMITTED PACKET?? i will show you what i am referring to, this from tshark full decode:


            [Expert Info (Note/Sequence): This frame is a (suspected) spurious retransmission]
                [This frame is a (suspected) spurious retransmission]
                [Severity level: Note]
                [Group: Sequence]
            [Expert Info (Note/Sequence): This frame is a (suspected) retransmission]
                [This frame is a (suspected) retransmission]
                [Severity level: Note]
                [Group: Sequence]


now, this is windump capture. first lines are NMAP (notice the RST i  generate, why?) , then the valid RPCDUMP output 
(notice the proper PSH sequences)
IP (tos 0x0, ttl  40, id 31583, offset 0, flags [none], proto: TCP (6), length:
44) 192.168.0.16.59801 > 64.69.79.246.135: S, cksum 0x3130 (correct), 791345335:
791345335(0) win 1024 <mss 1460>
IP (tos 0x0, ttl 117, id 31743, offset 0, flags [DF], proto: TCP (6), length: 44
) 64.69.79.246.135 > 192.168.0.16.59801: S, cksum 0x4bd4 (correct), 4207464065:4
207464065(0) ack 791345336 win 8192 <mss 1460>
IP (tos 0x0, ttl 128, id 14671, offset 0, flags [DF], proto: TCP (6), length: 40
) 192.168.0.16.59801 > 64.69.79.246.135: R, cksum 0x2506 (correct), 791345336:79
1345336(0) win 0

below is RPCDUMP:

IP (tos 0x0, ttl 128, id 14785, offset 0, flags [DF], proto: TCP (6), length: 52
) 192.168.0.16.52831 > 64.69.79.246.135: S, cksum 0x7c49 (correct), 896695680:89
6695680(0) win 8192 <mss 1460,nop,wscale 2,nop,nop,sackOK>
IP (tos 0x0, ttl 117, id 31753, offset 0, flags [DF], proto: TCP (6), length: 52
) 64.69.79.246.135 > 192.168.0.16.52831: S, cksum 0x7a98 (correct), 3925350305:3
925350305(0) ack 896695681 win 8192 <mss 1460,nop,wscale 8,nop,nop,sackOK>
IP (tos 0x0, ttl 128, id 14786, offset 0, flags [DF], proto: TCP (6), length: 40
) 192.168.0.16.52831 > 64.69.79.246.135: ., cksum 0x9b42 (correct), ack 1 win 16
425
IP (tos 0x0, ttl 128, id 14787, offset 0, flags [DF], proto: TCP (6), length: 15
6) 192.168.0.16.52831 > 64.69.79.246.135: P 1:117(116) ack 1 win 16425
IP (tos 0x0, ttl 117, id 31754, offset 0, flags [DF], proto: TCP (6), length: 12


as you can see, this script is NOT sending out the exact packets that RPCDUMP does. i don't really see the difference 
in that tool and the script? they both try and call the function RpcMgmtEpEltInqBegin, right? so again, sorry for 
bombarding
you guys with many questions over here, but the things i keep running into make no sense to me. ty

Mike

(ip to test for above: 64.69.79.246)





-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://nmap.org/mailman/private/dev/attachments/20151214/1700d16f/attachment.html>

------------------------------

Message: 4
Date: Mon, 14 Dec 2015 06:04:21 +0000
From: "Mike ." <dmciscobgp () hotmail com>
To: nmap-group <dev () nmap org>
Subject: re: RPC anamoly/etc
Message-ID:
        <BLUPR13MB03724C2E7885F25AF9307E42C6ED0 () BLUPR13MB0372 namprd13 prod outlook com>

Content-Type: text/plain; charset="iso-8859-1"

so after looking at this more closely, but still perplexed, i notice 2 things that might or might not be important. for 
whatever reason, when i use the nmap MSRPC enum script, the TTL starts out at 40, but ends up being 128 after i send 
out the RST. not sure i get that. is it being that the 128 is my own box generating that RST from the stack as opposed 
to the NMAP utility handling it?


lastly, the MSS seems to be sent by NMAP as 1024, i beleive. is that too small? when i use RPCDUMP it creates a much 
larger value to handle all that endpoint data coming back. is this a bug that NMAP is setting this scale value too 
small? i'm just guessing at all this. i am more a novice, i'll admit


ty

Mike
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://nmap.org/mailman/private/dev/attachments/20151214/b441c1b8/attachment.html>

------------------------------

Subject: Digest Footer

_______________________________________________
dev mailing list
dev () nmap org
https://nmap.org/mailman/listinfo/dev


------------------------------

End of dev Digest, Vol 129, Issue 16
************************************
_______________________________________________
Sent through the dev mailing list
https://nmap.org/mailman/listinfo/dev
Archived at http://seclists.org/nmap-dev/
Previous By Date Next
Previous By Thread Next

Current thread: