Re: Updated DHCP scripts

[Ron <ron () skullsecurity net>]

On Fri, 27 Aug 2010 23:40:10 +0200 Patrik Karlsson <patrik () cqure net>
wrote:
> I've made a few changes to the patches I submitted earlier in order
> to be able to do some more testing. Broadcasting is interesting from
> more than the prerule perspective I think. There are a lot of scripts
> that could benefit from it. While testing the patch I've adapted a
> few of the scripts so that they can be used when using broadcast. The
> patch allows the scripts to send a single packet to the
> broadcast/multicast address and receive responses from multiple hosts.
>
> As the approach is a little different I've moved some chunks of code
> around in some of the scripts to accomplish my tasks. The patches are
> quick-n-dirty and meant to get stuff running, so please see them that
> way for now and not as a suggestion for permanent change. When doing
> broadcast one packet is sent to the broadcast address and one or more
> packets are then received as response. This means that we need to
> loop over the socket:receive call and also resolve the ip from which
> the response was received. I've changed my previous patch that broke
> sending on the same socket after the first response was received.
> Each script supporting broadcast basically needs to do this:
>
> socket:send( nifty_packet )
>
> while(true) do
>   local status, response = socket:receive_bytes(1)
>   if ( not(status) ) then break end
>
>   local status, _, _, peer_ip, peer_port = socket:get_info()
>   result_part = parse_response(response)
>   result_part.name = peer_ip
>
>   table.insert( result, result_part )
> end
>
> return stdnse.format_output( true, result )
>
> As we can receive multiple responses most of the changes I've made
> stuff the response in a table and add the ip as "name". The response
> from each host is then stuffed into the another table and returned
> using stdnse.format_output at the end.
>
> I've attached the patches if someone want's to try them out. Here are
> a few examples on how to run them: sudo ./nmap -n -p 1900 -sU
> 239.255.255.250 --script upnp-info -d sudo ./nmap -n -p 5353 -sU
> 255.255.255.255 --script dns-service-discovery -d
>
> The same principle applies for the rest of the scripts. Oh, and yes
> the dhcp-discover script also seemed to work. In addition to the
> patches I'm also attaching a new script, db2-discover, that detects
> db2 servers using broadcast.

Excellent, I'll give it a try this weekend! 

dhcp-discover is kind of special because the response comes back to the wrong ip/mac address. So I'm going to send it 
out with the standard send(), then read the reply with pcap. 

Once the add-targets script is ready, I'm going to add the ability to scan the current subnet assigned by DHCP. I wrote 
a script to do that awhile back, but it was only a quick and dirty PoC (it needs to be re-done almost from scratch). 

-- 
Ron Bowes
http://www.skullsecurity.org
http://www.twitter.com/iagox86

Attachment: _bin
Description:

_______________________________________________
Sent through the nmap-dev mailing list
http://cgi.insecure.org/mailman/listinfo/nmap-dev
Archived at http://seclists.org/nmap-dev/