Re: Always practice safe software: a lesson from UnrealIRCd

[Ron <ron () skullsecurity net>]

On Mon, 14 Jun 2010 08:17:56 +0200 Vlatko Kosturjak <kost () linux hr>
wrote:
> Great. I see you have even implemented 127.0.0.1 already! I have
> tested it additionaly against standard ircd and hybrid and it's OK.
> Only problem I have spotted is fast reconnects. It's the problem of
> the original(kill it) and this timing implementation. i.e. if you run
> script with something like this:
> ./nmap -sV -d2 -p6667,6697,8067 --script=irc-unrealircd-backdoor.nse
> localhost
>
> You'll get false-negative: it should be vulnerable, but server refused
> connections because of fast reconnects due to HANGONRETRYDELAY
> #define in unrealircd. That's because -sV already connects to the
> service). Here's the debug output:
>
> [...]
>
> As I'm not aware of any clever scheduling in NSE (i.e. to tell script
> to reconnect after x seconds to same service and let other scripts
> execute in the meantime), I come up with KISS (keep simple and
> stupid) solution in beginning of the script:
>         -- get rid of fast reconnecting annoyance
>         stdnse.sleep(100)
>
> This helps with this and original script.
> I have also fixed @output part. New script is in attachment.
>
> Let me know the comments,
>
> Kost

stdnse.sleep(100) will fix the problem, but I don't like the idea of waiting 100 seconds before running a script. I 
tried waiting for 2 or 5 seconds, and that didn't help at all. The only reasonable measure I could think of is printing 
a warning message when it boots us off, and hope that's enough. 

I also added arguments for running arbitrary commands and brought back your 'kill' code, plus a 'kill' command for 
Windows, which is untested (though I know the command runs). 

Finally, I added a bunch more documentation. 

The newest version is attached. Let me know if you think it's ready to go! 

-- 
Ron Bowes
http://www.skullsecurity.org
http://www.twitter.com/iagox86

Attachment: irc-unrealircd-backdoor.nse
Description:

Attachment: _bin
Description:

_______________________________________________
Sent through the nmap-dev mailing list
http://cgi.insecure.org/mailman/listinfo/nmap-dev
Archived at http://seclists.org/nmap-dev/