Re: Sergey. [Status report 16/17]

[Sergey Khegay <g.sergeykhegay () gmail com>]

Hello Daniel,

Thank you for the feedback!

As far as I remember the reason for the use of pcalls in ssh-brute.nse is
precisely that "libssh2 error: EOF". I will see how can I make changes to
remove pcalls.

As for this ERROR: Too many retries, aborted ...", this is an issue with
brute.lua. I think Fotis asked you about this, but generally the problem is
that if brute.retries (default: 3) is reached on one account then the whole
Engine will shut down. I fixed this in my gsoc-brute. (I sent a PR on
github to merge gsoc-brute).

One more thing, it seems like the current version of nmap on the github has
a bug when running on Windows. I get a segmentation fault even performing a
simple scan.

$ ./nmap.exe 52.91.234.209 -n -d


Starting Nmap 7.25SVN ( https://nmap.org ) at 2016-08-18 15:22 Eastern
Daylight Time

PORTS: Using top 1000 ports found open (TCP:1000, UDP:0, SCTP:0)

Winpcap present, dynamic linked to: WinPcap version 4.1.3 (packet.dll
version 4.1.0.2980), based on libpcap version 1.0 branch 1_0_rel0b
(20091008)

--------------- Timing report ---------------

  hostgroups: min 1, max 100000

  rtt-timeouts: init 1000, min 100, max 10000

  max-scan-delay: TCP 1000, UDP 1000, SCTP 1000

  parallelism: min 0, max 0

  max-retries: 10, host-timeout: 0

  min-rate: 0, max-rate: 0

---------------------------------------------

Initiating Ping Scan at 15:22

Segmentation fault

Sergey.

On Thu, Aug 18, 2016 at 9:14 AM, Daniel Miller <bonsaiviking () gmail com>
wrote:

> Sergey,
>
> I checked out your gsoc-ssh branch to try, and it's looking very good.
> I'll keep looking at it, but for now I had these few feedback items:
>
> 1. It would be best if we could avoid needing pcall for so many calls to
> libssh2 functions. The prevailing convention with other libraries is to
> either return a "status" along with the expected return value, or to return
> nil and an error message in the error case. It actually looks like this is
> the case for most of the library, so I would have to dig further to see why
> pcall is used so much.
>
> 2. Running ssh-brute against localhost results in the script ending
> quickly with "ERROR: Too many retries, aborted ...", which doesn't seem
> right. At debug level 2, it shows "libssh2 error: EOF" which seems to me
> like it's not handling the SSH server's limit on login attempts per
> connection very well. I don't know if we need to override brute.retries or
> what.
>
> 3. Very minor issue, but from a code cleanliness aspect, there are lots of
> whitespace errors, mostly trailing whitespace.
>
> I'll let you know if I have other feedback, but it's looking pretty good
> for now!
>
> Dan
>
> On Tue, Aug 16, 2016 at 5:12 AM, Sergey Khegay <g.sergeykhegay () gmail com>
> wrote:
>
> > [Report 16/17]
> > Hello Nmap,
> >
> > Accomplishments:
> > - Cleaned libssh2 integration code.
> >
> > - Fixed the problem of not including libz (libssh2 dependency) to
> >   the build if --with-libssh2=included option was used. Thanks to
> >   Vincent for pointing it out.
> >
> > - Performed ssh-brute runs against the test server.
> >
> >
> > Goals:
> > o: Make final edits
> > o: Import other Devin's scripts which use libssh2
> >
> > _______________________________________________
> > Sent through the dev mailing list
> > https://nmap.org/mailman/listinfo/dev
> > Archived at http://seclists.org/nmap-dev/
_______________________________________________
Sent through the dev mailing list
https://nmap.org/mailman/listinfo/dev
Archived at http://seclists.org/nmap-dev/