RPC enumeration script anomalies ATTN: Aleksandar Nikolic

["Mike ." <dmciscobgp () hotmail com>]

group


i am wanting to send this directly to the script provider but had to go this route because i couldn't find an email for 
him. this is strange to say the least. supposedly the MSRPC script is supposed to mimic the RPCDUMP tool, right? i ran 
them side by side yesterday and found something odd and mystifying. i will enclose the ip i used to test it, because i 
want to see if this is just on my end. when i ran the nmap script, i got nothing back at all for output. when i ran the 
RPCDUMP, i got the proper dump for registered endpoint lists. why is this? are they not sending the exact same packet 
out? as i looked at them next to each other, what i found, the odd part, is that the NMAP script for some reason fires 
off a RETRANSMITTED PACKET?? i will show you what i am referring to, this from tshark full decode:


            [Expert Info (Note/Sequence): This frame is a (suspected) spurious retransmission]
                [This frame is a (suspected) spurious retransmission]
                [Severity level: Note]
                [Group: Sequence]
            [Expert Info (Note/Sequence): This frame is a (suspected) retransmission]
                [This frame is a (suspected) retransmission]
                [Severity level: Note]
                [Group: Sequence]


now, this is windump capture. first lines are NMAP (notice the RST i  generate, why?) , then the valid RPCDUMP output 
(notice the proper PSH sequences)
IP (tos 0x0, ttl  40, id 31583, offset 0, flags [none], proto: TCP (6), length:
44) 192.168.0.16.59801 > 64.69.79.246.135: S, cksum 0x3130 (correct), 791345335:
791345335(0) win 1024 <mss 1460>
IP (tos 0x0, ttl 117, id 31743, offset 0, flags [DF], proto: TCP (6), length: 44
) 64.69.79.246.135 > 192.168.0.16.59801: S, cksum 0x4bd4 (correct), 4207464065:4
207464065(0) ack 791345336 win 8192 <mss 1460>
IP (tos 0x0, ttl 128, id 14671, offset 0, flags [DF], proto: TCP (6), length: 40
) 192.168.0.16.59801 > 64.69.79.246.135: R, cksum 0x2506 (correct), 791345336:79
1345336(0) win 0

below is RPCDUMP:

IP (tos 0x0, ttl 128, id 14785, offset 0, flags [DF], proto: TCP (6), length: 52
) 192.168.0.16.52831 > 64.69.79.246.135: S, cksum 0x7c49 (correct), 896695680:89
6695680(0) win 8192 <mss 1460,nop,wscale 2,nop,nop,sackOK>
IP (tos 0x0, ttl 117, id 31753, offset 0, flags [DF], proto: TCP (6), length: 52
) 64.69.79.246.135 > 192.168.0.16.52831: S, cksum 0x7a98 (correct), 3925350305:3
925350305(0) ack 896695681 win 8192 <mss 1460,nop,wscale 8,nop,nop,sackOK>
IP (tos 0x0, ttl 128, id 14786, offset 0, flags [DF], proto: TCP (6), length: 40
) 192.168.0.16.52831 > 64.69.79.246.135: ., cksum 0x9b42 (correct), ack 1 win 16
425
IP (tos 0x0, ttl 128, id 14787, offset 0, flags [DF], proto: TCP (6), length: 15
6) 192.168.0.16.52831 > 64.69.79.246.135: P 1:117(116) ack 1 win 16425
IP (tos 0x0, ttl 117, id 31754, offset 0, flags [DF], proto: TCP (6), length: 12


as you can see, this script is NOT sending out the exact packets that RPCDUMP does. i don't really see the difference 
in that tool and the script? they both try and call the function RpcMgmtEpEltInqBegin, right? so again, sorry for 
bombarding
you guys with many questions over here, but the things i keep running into make no sense to me. ty

Mike

(ip to test for above: 64.69.79.246)





_______________________________________________
Sent through the dev mailing list
https://nmap.org/mailman/listinfo/dev
Archived at http://seclists.org/nmap-dev/