Re: NSE: Packet retransmit breaking rdp-ntlm-info #1682 (Not just rdp-ntml-info but all NSE scripts)

--Apple-Mail=_8DFAD8AB-A834-4CC4-B0D1-F2DA8190D89A
Content-Transfer-Encoding: quoted-printable
Content-Type: text/plain;
	charset=utf-8

Hey Tom,

I just spotted this behavior too on another script when debugging a =
problem Fotis reported me so I=E2=80=99m guessing it is something =
related to packet fragmentation and it is affecting all NSE scripts. =
Similar issue as you described, script was crashing due to packet =
fragmentation. Attaching the pcap that made me spot this.


--Apple-Mail=_8DFAD8AB-A834-4CC4-B0D1-F2DA8190D89A
Content-Disposition: attachment;
	filename=dicom-ping.pcapng
Content-Type: application/octet-stream;
	x-unix-mode=0644;
	name="dicom-ping.pcapng"
Content-Transfer-Encoding: base64

Cg0NCrgAAABNPCsaAQAAAP//////////AgA1AEludGVsKFIpIENvcmUoVE0pIGk3LTg3MDAgQ1BV
IEAgMy4yMEdIeiAod2l0aCBTU0U0LjIpAAAAAwAYAExpbnV4IDQuMTkuMC1rYWxpNS1hbWQ2NAQA
OgBEdW1wY2FwIChXaXJlc2hhcmspIDIuNi44IChHaXQgdjIuNi44IHBhY2thZ2VkIGFzIDIuNi44
LTEpAAAAAAAAuAAAAAEAAABUAAAAAQAAAAAABAACAAQAZXRoMAkAAQAJAAAACwAJAABwb3J0IDEw
NAAAAAwAGABMaW51eCA0LjE5LjAta2FsaTUtYW1kNjQAAAAAVAAAAAYAAABcAAAAAAAAALUXuBUC
crWTOgAAADoAAAAADCkT0hoADClduHoIAEUAACyIzgAALAZ7c8CoBH3AqAS9/OwAaG2QC5cAAAAA
YAIEAJMfAAACBAW0AABcAAAABgAAAFwAAAAAAAAAtRe4FVDCv5M8AAAAPAAAAAAMKV24egAMKRPS
GggARQAALFoYQACABhYpwKgEvcCoBH0AaPzsouC5lG2QC5hgEkAA+pgAAAIEBbQAAFwAAAAGAAAA
WAAAAAAAAAC1F7gVKzPAkzYAAAA2AAAAAAwpE9IaAAwpXbh6CABFAAAoAABAAEAGsEXAqAR9wKgE
vfzsAGhtkAuYAAAAAFAEAACu2AAAAABYAAAABgAAAGwAAAAAAAAAtRe4FaCflZVKAAAASgAAAAAM
KRPSGgAMKV24eggARQAAPFtgQABABlTRwKgEfcCoBL2DFgBorOkBxwAAAACgAnIQirkAAAIEBbQE
AggKrJoKxAAAAAABAwMHAABsAAAABgAAAGwAAAAAAAAAtRe4FZEYm5VKAAAASgAAAAAMKV24egAM
KRPSGggARQAAPFoZQACABhYYwKgEvcCoBH0AaIMWFSUNWazpAcigEkAAeWsAAAIEBbQBAwMABAII
CgIV9d6smgrEAABsAAAABgAAAGQAAAAAAAAAtRe4FeKhm5VCAAAAQgAAAAAMKRPSGgAMKV24eggA
RQAANFthQABABlTYwKgEfcCoBL2DFgBorOkByBUlDVqAEADlirEAAAEBCAqsmgrFAhX13gAAZAAA
AAYAAAA4AQAAAAAAALUXuBV2352VFQEAABUBAAAADCkT0hoADClduHoIAEUAAQdbYkAAQAZUBMCo
BH3AqAS9gxYAaKzpAcgVJQ1agBgA5YuEAAABAQgKrJoKxQIV9d4BAAAAAM0AAQAAQU5ZLVNDUCAg
ICAgICAgIEVDSE9TQ1UgICAgICAgICAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABAA
ABUxLjIuODQwLjEwMDA4LjMuMS4xLjEgAAAuAQAAADAAABExLjIuODQwLjEwMDA4LjEuMUAAABEx
LjIuODQwLjEwMDA4LjEuMlAAADpRAAAEAABAAFIAABsxLjIuMjc2LjAuNzIzMDAxMC4zLjAuMy42
LjJVAAAPT0ZGSVNfRENNVEtfMzYyAAAAOAEAAAYAAABoAAAAAAAAALUXuBXkcm+XSAAAAEgAAAAA
DClduHoADCkT0hoIAEUAADpaGkAAgAYWGcCoBL3AqAR9AGiDFhUlDVqs6QKbgBg/LaV4AAABAQgK
AhX14ayaCsUCAAAAAKZoAAAABgAAAGQAAAAAAAAAtRe4FesNcJdCAAAAQgAAAAAMKRPSGgAMKV24
eggARQAANFtjQABABlTWwKgEfcCoBL2DFgBorOkCmxUlDWCAEADlirEAAAEBCAqsmgrjAhX14QAA
ZAAAAAYAAABkAAAAAAAAALUXuBUgIHOXQgAAAEIAAAAADCkT0hoADClduHoIAEUAADRbZEAAQAZU
1cCoBH3AqAS9gxYAaKzpApsVJQ1ggBEA5YqxAAABAQgKrJoK5AIV9eEAAGQAAAAGAAAACAEAAAAA
AAC1F7gVas93l+gAAADoAAAAAAwpXbh6AAwpE9IaCABFAADaWhtAAIAGFXjAqAS9wKgEfQBogxYV
JQ1grOkCnIAYPy3RgAAAAQEICgIV9eGsmgrkAAEAAEFOWS1TQ1AgICAgICAgICBFQ0hPU0NVICAg
ICAgICAgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAVMS4yLjg0MC4xMDAwOC4z
LjEuMS4xIQAAGQEAAABAAAARMS4yLjg0MC4xMDAwOC4xLjJQAAAoUQAABAAAQABSAAAVMS4yLjM5
Mi4xMDAyMjQuMS4yMDAxVQAAAzMuMAgBAAAGAAAAWAAAAAAAAAC1F7gVrhl4lzYAAAA2AAAAAAwp
E9IaAAwpXbh6CABFAAAoAABAAEAGsEXAqAR9wKgEvYMWAGis6QKcAAAAAFAEAADyUQAAAABYAAAA
BgAAAGQAAAAAAAAAtRe4FYrWeJdCAAAAQgAAAAAMKV24egAMKRPSGggARQAANFocQACABhYdwKgE
vcCoBH0AaIMWFSUOBqzpApyAET8tp18AAAEBCAoCFfXhrJoK5AAAZAAAAAYAAABYAAAAAAAAALUX
uBWQaXmXNgAAADYAAAAADCkT0hoADClduHoIAEUAACgAAEAAQAawRcCoBH3AqAS9gxYAaKzpApwA
AAAAUAQAAPJRAAAAAFgAAAAFAAAAbAAAAAAAAABijwUAGs9ZOwEAHABDb3VudGVycyBwcm92aWRl
ZCBieSBkdW1wY2FwAgAIAGKPBQCSfqE6AwAIAGKPBQDszlk7BAAIAA4AAAAAAAAABQAIAAAAAAAA
AAAAAAAAAGwAAAA=
--Apple-Mail=_8DFAD8AB-A834-4CC4-B0D1-F2DA8190D89A
Content-Transfer-Encoding: quoted-printable
Content-Type: text/plain;
	charset=us-ascii



Paulino Calderon Pale || @calderpwn on Twitter || =
http://www.calderonpale.com



> On Aug 10, 2019, at 3:24 PM, Tom Sellers <[email protected]> wrote:
>=20
> All,
>  I'm tossing a copy of GitHub issue #1682 ( =
https://github.com/nmap/nmap/issues/1682 ) here so that more people may =
see it.
>=20
> Copied from the issue:
>=20
>=20
>=20
> I've seen some reports, which I was able to reproduce, that =
rdp-ntlm-info didn't work against Windows 7. While testing I noticed =
that some of the packets were being sent twice which was breaking the =
protocol negotiation. This seems to happen when scanning with -sS but =
not -sT.
>=20
> This appears to be an issue with Nmap or NSE and how raw packets are =
handled.
>=20
> You can observe the retransmission using Wireshark / tcpdump.
>=20
> Reproduce error
>=20
> sudo nmap -sS --script rdp-ntlm-info -p 3389  -n   target_ip
>=20
>=20
> Workaround
>=20
> sudo nmap -sT --script rdp-ntlm-info -p 3389  -n   target_ip
>=20
>=20
> When running with --packet-trace I only see Nmap send the packet once =
(in the output) in either case.
>=20
> If you view the traffic with Wireshark you can see that it is =
re-transmitted.
>=20
> In the image linked below Packet 15 is the original, packet 16 is the =
retransmission:
> =
https://user-images.githubusercontent.com/6500426/62826433-14768e00-bb81-1=
1e9-8f05-24b17fe265dc.png
>=20
>=20
>=20
> I was able to create a simple reproducer which removes the protocol =
from the equation.
>=20
> Command
>=20
> sudo nmap -sS --script +test -p 3389 target_ip
>=20
> Script named 'test.nse'
>=20
> local nmap =3D require "nmap"
> local stdnse =3D require "stdnse"
> local shortport =3D require "shortport"
>=20
> categories =3D {"safe"}
>=20
> portrule =3D shortport.port_or_service("3389", "ms-wbt-server")
>=20
> action =3D function( host, port )
>=20
>  socket =3D nmap.new_socket()
>  socket:set_timeout(5000)
>  if ( not(socket:connect(host, port)) ) then
>    return false, "Failed connecting to server"
>  end
>=20
>  local status, err =3D socket:send("If a packet hits a pocket on a =
socket on a port..")
>  if ( not(status) ) then
>    return false, err
>  end
>=20
>  stdnse.debug1("Sent, now waiting...")
>  _, data =3D socket:receive()
>=20
>  stdnse.debug1("Closing")
>  socket:close()
>  return data
> end
>=20
>=20
> Environment
>=20
> $ nmap --version
> Nmap version 7.70SVN ( https://nmap.org )
> Platform: x86_64-unknown-linux-gnu
> Compiled with: nmap-liblua-5.3.5 openssl-1.1.1 libssh2-1.8.0 =
libz-1.2.11 nmap-libpcre-7.6 libpcap-1.8.1 nmap-libdnet-1.12 ipv6
> Compiled without:
> Available nsock engines: epoll poll select
>=20
> Linux sammich 5.0.0-23-generic #24~18.04.1-Ubuntu SMP Mon Jul 29 =
16:12:28 UTC 2019 x86_64 x86_6
>=20
>=20
> - Tom
> _______________________________________________
> Sent through the dev mailing list
> https://nmap.org/mailman/listinfo/dev
> Archived at http://seclists.org/nmap-dev/


--Apple-Mail=_8DFAD8AB-A834-4CC4-B0D1-F2DA8190D89A
Content-Type: text/plain; charset="us-ascii"
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
Content-Disposition: inline

_______________________________________________
Sent through the dev mailing list
https://nmap.org/mailman/listinfo/dev
Archived at http://seclists.org/nmap-dev/
--Apple-Mail=_8DFAD8AB-A834-4CC4-B0D1-F2DA8190D89A--