HP OpenView Data Protector & OmniBack detection

Max Kosmach <[email protected]> Tue, 25 Jan 2005 17:46:26 +0300
Newsgroups gmane.comp.security.nessus.devel
Organization НПК ТЦ
Message-ID <[email protected]>
> HP OpenView Omniback detection is allready in find_service2.nasl 
Yes, but in my case Omniback reports banner in unicode report from amap 
below)

> and HP OpenView Storage DataProtector is allready in find_service.nes.
Yes, but looks like DataProtector sometimes report it's banner in unicode

and please compare

 >else if(strstr(line, "hp openview storage protect") != NULL)
 >	mark_hpov_storage(desc, port, origline, trp);

and >  * unknown (5555/tcp)|11154|Security Note|An unknown server is 
running on this
>  * port.\nIf you know what it is, please send this banner to the Nessus team:
>  * 00: 48 50 20 4f 70 65 6e 56 69 65 77 20 53 74 6f 72    HP OpenView Stor
>  * 61 67 65 20 44 61 74 61 20 50 72 6f 74 65 63 74    age Data Protect
>  * 6f 72 20 41 2e 30 35 2e 30 30 3a 20 49 4e 45 54    or A.05.00: INET
>  * 2c 20 69 6e 74 65 72 6e 61 6c 20 62 75 69 6c 64    , internal build
>  * 20 31 39 30 2c 20 62 75 69 6c 74 20 6f 6e 20 54     190, built on T
>  * 75 65 20 4a 75 6c 20 31 36 20 31 37 3a 33 37 3a    ue Jul 16 17:37:
>  * 33 32 20 32 30 30 32 0a                            32 2002.
>  */


> 
> Are you sure plugin dependencies and find_service2.nasl (id 11153) are enabled 
> when you do a scan ?
Yes
All plugins are enabled

--
With Best Wishes
Max

PS. please add me to CC:, i'm not subscribed to nessus-devel

> Nicolas
> 
> 
> Max Kosmach wrote:
> 
> please add detection for HP OmniBack
> 
> 
> ---
> Unrecognized response from xx.xx.xx.xx:5555/tcp (by trigger rpc)
> received.
> Please send this output and the name of the application to
> amap-dev_at_thc.org:
> 0000:  4800 5000 2000 4f00 7000 6500 6e00 5600    [ H.P. .O.p.e.n.V. ]
> 0010:  6900 6500 7700 2000 4f00 6d00 6e00 6900    [ i.e.w. .O.m.n.i. ]
> 0020:  4200 6100 6300 6b00 2000 4900 4900 2000    [ B.a.c.k. .I.I. . ]
> 0030:  4100 2e00 3000 3400 2e00 3100 3000 3a00    [ A...0.4...1.0.:. ]
> 0040:  2000 4900 4e00 4500 5400 2c00 2000 6900    [  .I.N.E.T.,. .i. ]
> 0050:  6e00 7400 6500 7200 6e00 6100 6c00 2000    [ n.t.e.r.n.a.l. . ]
> 0060:  6200 7500 6900 6c00 6400 2000 3100 3700    [ b.u.i.l.d. .1.7. ]
> 0070:  3600 2c00 2000 6200 7500 6900 6c00 7400    [ 6.,. .b.u.i.l.t. ]
> 0080:  2000 6f00 6e00 2000 5400 7500 6500 7300    [  .o.n. .T.u.e.s. ]
> 0090:  6400 6100 7900 2c00 2000 4e00 6f00 7600    [ d.a.y.,. .N.o.v. ]
> 00a0:  6500 6d00 6200 6500 7200 2000 3100 3300    [ e.m.b.e.r. .1.3. ]
> 00b0:  2c00 2000 3200 3000 3000 3100 2000 3600    [ ,. .2.0.0.1. .6. ]
> 00c0:  3a00 3500 3500 2000 4100 4d00 0a00 0000    [ :.5.5. .A.M..... ]
> ---
> 
> 
>     ---
>     telnet xx.xx.xx.xx 5555
>     HP OpenView OmniBack II A.04.10: INET, internal build 176, built on
>     Tuesday, November 13, 2001 6:55 AM
>     ---
> 
> 

-- 
With Best Wishes
Max
CCSA,CCSE
_______________________________________________
Nessus-devel mailing list
[email protected]
http://mail.nessus.org/mailman/listinfo/nessus-devel