Re: UDP payload for STUN
Gordon Fyodor Lyon <[email protected]> Fri, 6 Dec 2019 12:52:42 -0800
| Newsgroups | gmane.comp.security.nmap.devel |
|---|---|
| Message-ID | <CAJjO9MnkujCyY88T_venARCG=Bjb2f9qSuS+570H3M2G9ZwmpQ@mail.gmail.com> |
--===============7448817962409300930== Content-Type: multipart/alternative; boundary="000000000000409a3605990f3c1e" --000000000000409a3605990f3c1e Content-Type: text/plain; charset="UTF-8" Thanks David! Please check it in. -Fyodor On Fri, Dec 6, 2019 at 12:51 PM David Fifield <[email protected]> wrote: > Here is a UDP payload for STUN, which normally runs on port 3478/udp. > The payload is a Binding request, which asks the STUN server to return > the client's external IP address. It's the same payload sent by the > stun-info script, except that it has an all-zero transaction ID instead > of a random one. > > Before: > # nmap -n -Pn -sU -p 3478 --reason stun.ekiga.net > Starting Nmap 7.80SVN ( https://nmap.org ) > Nmap scan report for stun.ekiga.net (216.93.246.18) > Host is up, received user-set. > > PORT STATE SERVICE REASON > 3478/udp open|filtered stun no-response > > Nmap done: 1 IP address (1 host up) scanned in 2.12 seconds > > After: > # nmap -n -Pn -sU -p 3478 --reason stun.ekiga.net > Starting Nmap 7.80SVN ( https://nmap.org ) > Nmap scan report for stun.ekiga.net (216.93.246.18) > Host is up, received user-set (0.080s latency). > > PORT STATE SERVICE REASON > 3478/udp open stun udp-response ttl 48 > > Nmap done: 1 IP address (1 host up) scanned in 0.20 seconds > > > From 8513abc4eb3fb34ba159a74899432a019a2ad206 Mon Sep 17 00:00:00 2001 > From: David Fifield <[email protected]> > Date: Fri, 6 Dec 2019 13:48:02 -0700 > Subject: [PATCH] Add UDP payload for STUN. > > --- > CHANGELOG | 3 +++ > nmap-payloads | 7 +++++++ > 2 files changed, 10 insertions(+) > > diff --git a/CHANGELOG b/CHANGELOG > index 45b8b680e..9244d4c5e 100644 > --- a/CHANGELOG > +++ b/CHANGELOG > @@ -57,6 +57,9 @@ o [NSE][GH#1665] The HTTP library no longer crashes when > code requests digest > o [NSE] Fixed a bug in http-wordpress-users.nse that could cause > extraneous output to be captured as part of a username. [Duarte Silva] > > +o [NSE] Added a UDP payload for STUN (Session Traversal Utilities for > NAT). > + [David Fifield] > + > Nmap 7.80 [2019-08-10] > > o [Windows] The Npcap Windows packet capturing library ( > https://npcap.org/) > diff --git a/nmap-payloads b/nmap-payloads > index e13971302..9138fcc7f 100644 > --- a/nmap-payloads > +++ b/nmap-payloads > @@ -218,6 +218,13 @@ udp 2302 > "\x00\x02\xf1\x26\x01\x26\xf0\x90\xa6\xf0\x26\x57\x4e\xac\xa0\xec\xf8\x > # Apple Remote Desktop (ARD) > udp 3283 "\0\x14\0\x01\x03" > > +# STUN Binding request, see RFC 5389 Section 6 > +# message type = 0x001, Binding (see Section 18.1) > +# message length = 0 > +# magic cookie = 0x2112a442 > +# transaction ID = "\x00"*12 > +udp 3478 > "\x00\x01\x00\x00\x21\x12\xa4\x42\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" > + > # Sun Service Tag Discovery protocol (stdiscover) > # > http://arc.opensolaris.org/caselog/PSARC/2006/638/stdiscover_protocolv2.pdf > # Would work better with a varying cookie; the second and later sends of > this > -- > 2.20.1 > > _______________________________________________ > Sent through the dev mailing list > https://nmap.org/mailman/listinfo/dev > Archived at http://seclists.org/nmap-dev/ > --000000000000409a3605990f3c1e Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable <div dir=3D"ltr">Thanks David!=C2=A0 Please check it in.<div><br></div><div= >-Fyodor</div></div><br><div class=3D"gmail_quote"><div dir=3D"ltr" class= =3D"gmail_attr">On Fri, Dec 6, 2019 at 12:51 PM David Fifield <<a href= =3D"mailto:[email protected]">[email protected]</a>> wrote:<br><= /div><blockquote class=3D"gmail_quote" style=3D"margin:0px 0px 0px 0.8ex;bo= rder-left:1px solid rgb(204,204,204);padding-left:1ex">Here is a UDP payloa= d for STUN, which normally runs on port 3478/udp.<br> The payload is a Binding request, which asks the STUN server to return<br> the client's external IP address. It's the same payload sent by the= <br> stun-info script, except that it has an all-zero transaction ID instead<br> of a random one.<br> <br> Before:<br> =C2=A0 =C2=A0 =C2=A0 =C2=A0 # nmap -n -Pn -sU -p 3478 --reason <a href=3D"h= ttp://stun.ekiga.net" rel=3D"noreferrer" target=3D"_blank">stun.ekiga.net</= a><br> =C2=A0 =C2=A0 =C2=A0 =C2=A0 Starting Nmap 7.80SVN ( <a href=3D"https://nmap= .org" rel=3D"noreferrer" target=3D"_blank">https://nmap.org</a> )<br> =C2=A0 =C2=A0 =C2=A0 =C2=A0 Nmap scan report for <a href=3D"http://stun.eki= ga.net" rel=3D"noreferrer" target=3D"_blank">stun.ekiga.net</a> (216.93.246= .18)<br> =C2=A0 =C2=A0 =C2=A0 =C2=A0 Host is up, received user-set.<br> <br> =C2=A0 =C2=A0 =C2=A0 =C2=A0 PORT=C2=A0 =C2=A0 =C2=A0STATE=C2=A0 =C2=A0 =C2= =A0 =C2=A0 =C2=A0SERVICE REASON<br> =C2=A0 =C2=A0 =C2=A0 =C2=A0 3478/udp open|filtered stun=C2=A0 =C2=A0 no-res= ponse<br> <br> =C2=A0 =C2=A0 =C2=A0 =C2=A0 Nmap done: 1 IP address (1 host up) scanned in = 2.12 seconds<br> <br> After:<br> =C2=A0 =C2=A0 =C2=A0 =C2=A0 # nmap -n -Pn -sU -p 3478 --reason <a href=3D"h= ttp://stun.ekiga.net" rel=3D"noreferrer" target=3D"_blank">stun.ekiga.net</= a><br> =C2=A0 =C2=A0 =C2=A0 =C2=A0 Starting Nmap 7.80SVN ( <a href=3D"https://nmap= .org" rel=3D"noreferrer" target=3D"_blank">https://nmap.org</a> )<br> =C2=A0 =C2=A0 =C2=A0 =C2=A0 Nmap scan report for <a href=3D"http://stun.eki= ga.net" rel=3D"noreferrer" target=3D"_blank">stun.ekiga.net</a> (216.93.246= .18)<br> =C2=A0 =C2=A0 =C2=A0 =C2=A0 Host is up, received user-set (0.080s latency).= <br> <br> =C2=A0 =C2=A0 =C2=A0 =C2=A0 PORT=C2=A0 =C2=A0 =C2=A0STATE SERVICE REASON<br= > =C2=A0 =C2=A0 =C2=A0 =C2=A0 3478/udp open=C2=A0 stun=C2=A0 =C2=A0 udp-respo= nse ttl 48<br> <br> =C2=A0 =C2=A0 =C2=A0 =C2=A0 Nmap done: 1 IP address (1 host up) scanned in = 0.20 seconds<br> <br> <br> From 8513abc4eb3fb34ba159a74899432a019a2ad206 Mon Sep 17 00:00:00 2001<br> From: David Fifield <<a href=3D"mailto:[email protected]" target=3D"= _blank">[email protected]</a>><br> Date: Fri, 6 Dec 2019 13:48:02 -0700<br> Subject: [PATCH] Add UDP payload for STUN.<br> <br> ---<br> =C2=A0CHANGELOG=C2=A0 =C2=A0 =C2=A0| 3 +++<br> =C2=A0nmap-payloads | 7 +++++++<br> =C2=A02 files changed, 10 insertions(+)<br> <br> diff --git a/CHANGELOG b/CHANGELOG<br> index 45b8b680e..9244d4c5e 100644<br> --- a/CHANGELOG<br> +++ b/CHANGELOG<br> @@ -57,6 +57,9 @@ o [NSE][GH#1665] The HTTP library no longer crashes when = code requests digest<br> =C2=A0o [NSE] Fixed a bug in http-wordpress-users.nse that could cause<br> =C2=A0 =C2=A0extraneous output to be captured as part of a username. [Duart= e Silva]<br> <br> +o [NSE] Added a UDP payload for STUN (Session Traversal Utilities for NAT)= .<br> +=C2=A0 [David Fifield]<br> +<br> =C2=A0Nmap 7.80 [2019-08-10]<br> <br> =C2=A0o [Windows] The Npcap Windows packet capturing library (<a href=3D"ht= tps://npcap.org/" rel=3D"noreferrer" target=3D"_blank">https://npcap.org/</= a>)<br> diff --git a/nmap-payloads b/nmap-payloads<br> index e13971302..9138fcc7f 100644<br> --- a/nmap-payloads<br> +++ b/nmap-payloads<br> @@ -218,6 +218,13 @@ udp 2302 "\x00\x02\xf1\x26\x01\x26\xf0\x90\xa6\xf= 0\x26\x57\x4e\xac\xa0\xec\xf8\x<br> =C2=A0# Apple Remote Desktop (ARD)<br> =C2=A0udp 3283 "\0\x14\0\x01\x03"<br> <br> +# STUN Binding request, see RFC 5389 Section 6<br> +# message type =3D 0x001, Binding (see Section 18.1)<br> +# message length =3D 0<br> +# magic cookie =3D 0x2112a442<br> +# transaction ID =3D "\x00"*12<br> +udp 3478 "\x00\x01\x00\x00\x21\x12\xa4\x42\x00\x00\x00\x00\x00\x00\x0= 0\x00\x00\x00\x00\x00"<br> +<br> =C2=A0# Sun Service Tag Discovery protocol (stdiscover)<br> =C2=A0# <a href=3D"http://arc.opensolaris.org/caselog/PSARC/2006/638/stdisc= over_protocolv2.pdf" rel=3D"noreferrer" target=3D"_blank">http://arc.openso= laris.org/caselog/PSARC/2006/638/stdiscover_protocolv2.pdf</a><br> =C2=A0# Would work better with a varying cookie; the second and later sends= of this<br> -- <br> 2.20.1<br> <br> _______________________________________________<br> Sent through the dev mailing list<br> <a href=3D"https://nmap.org/mailman/listinfo/dev" rel=3D"noreferrer" target= =3D"_blank">https://nmap.org/mailman/listinfo/dev</a><br> Archived at <a href=3D"http://seclists.org/nmap-dev/" rel=3D"noreferrer" ta= rget=3D"_blank">http://seclists.org/nmap-dev/</a><br> </blockquote></div> --000000000000409a3605990f3c1e-- --===============7448817962409300930== Content-Type: text/plain; charset="us-ascii" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit Content-Disposition: inline _______________________________________________ Sent through the dev mailing list https://nmap.org/mailman/listinfo/dev Archived at http://seclists.org/nmap-dev/ --===============7448817962409300930==--