From 17a5e77e0ae6b363a95d9584c088ef79e86b0f5e Mon Sep 17 00:00:00 2001 From: dmiller Date: Tue, 27 Jan 2015 02:31:11 +0000 Subject: [PATCH] Add ARP_HRD_IEEE80211_PRISM identifier --- CHANGELOG | 55 ++++++++++++++++------------- libdnet-stripped/NMAP_MODIFICATIONS | 27 ++++++++++++++ libdnet-stripped/include/dnet/arp.h | 1 + libdnet-stripped/src/addr.c | 1 + 4 files changed, 59 insertions(+), 25 deletions(-) diff --git a/CHANGELOG b/CHANGELOG index ee66bd90b..ac2b45af5 100644 --- a/CHANGELOG +++ b/CHANGELOG @@ -1,6 +1,11 @@ # Nmap Changelog ($Id$); -*-text-*- -o [NSE] Added http-shellshock to detect web applications vulnerable to +o Fixed a bug that caused Nmap to fail to find any network interface when a + Prism interface is in monitor mode. The fix was to define the + ARP_HRD_IEEE80211_PRISM header identifier in the libdnet-stripped code. + [Brad Johnson] + +o [NSE] Added http-shellshock to detect web applications vulnerable to Shellshock (CVE2014-6271). [Paulino Calderon] o Added a version probe for Tor. [David Fifield] @@ -13,9 +18,9 @@ o [Zenmap] New Chinese-language (zh) translation from Jie Jiang. o [NSE] Added snmp-info to get the enterprise number and other information from the snmpEngineID in an SNMPv3 response packet. [Daniel Miller] -o [NSE] Add support to citrix-enum-apps-xml for reporting if Citrix - published applications in the list are enforcing/requiring the level - of ICA/session data encryption shown in the script result. +o [NSE] Add support to citrix-enum-apps-xml for reporting if Citrix + published applications in the list are enforcing/requiring the level + of ICA/session data encryption shown in the script result. [Tom Sellers] o [NSE] Added targets-ipv6-wordlist to generate target IPv6 addresses @@ -34,18 +39,18 @@ o [NSE] Rework ssl-enum-ciphers to actually score the strength of the SSL/TLS This is similar to Qualys's SSL Labs scanner, and means that we no longer maintain a list of scores per ciphersuite. [Daniel Miller] -o [NSE] Add the signature algorithm that was used to sign the target port's +o [NSE] Add the signature algorithm that was used to sign the target port's x509 certificate to the output of ssl-cert.nse [Tom Sellers] o [NSE] Fixed a bug in the sslcert.lua library that was triggered against certain services when version detection was used. [Tom Sellers] - + o [NSE] Added ssl-poodle to detect CVE-2014-3566 [Daniel Miller] -o [NSE] vulns.Report:make_output() now generates XML structured output +o [NSE] vulns.Report:make_output() now generates XML structured output reports automatically. [Paulino Calderon] -o [NSE] Added http-avaya-ipoffice-users script to enumerate users in Avaya +o [NSE] Added http-avaya-ipoffice-users script to enumerate users in Avaya IP Office 7.x systems. [Paulino Calderon] o [NSE] Added docker-version script for detecting Docker [Claudio Criscione] @@ -72,7 +77,7 @@ o Improve OS detection; If a port is detected to be 'tcpwrapped', then it will not be used for OS detection. This helps in cases where a firewall might be the port to be 'tcpwrapped' [Jay Bosamiya] -o [Zenmap] Reduce noise generated in Topology View due to anonymous +o [Zenmap] Reduce noise generated in Topology View due to anonymous hops [Jay Bosamiya] o --reason is enabled for verbosity > 2 @@ -92,7 +97,7 @@ o Catch badly named output files (such as those unintentionally caused by o [NSE] Added the script supermicro-ipmi-conf to exploit Supermicro IPMI/BMC controllers. [Paulino Calderon] -o [NSE] Added mikrotik-routeros-brute script to perform password auditing +o [NSE] Added mikrotik-routeros-brute script to perform password auditing attacks against Mikrotik's RouterOS API. [Paulino Calderon] o [NSE] Add s7-info script to get device information from Siemens PLCs via the @@ -220,7 +225,7 @@ o NOTE THAT THE CHANGELOG FOR THIS RELEASE IS INCOMPLETE. We plan to o [NSE] Add ssl-heartbleed script to detect the Heartbleed bug in OpenSSL CVE-2014-0160 [Patrik Karlsson] - + o [NSE] Fixed an error-handling bug in socks-open-proxy that caused it to fail when scanning a SOCKS4-only proxy. Reported on IRC by Husky. [Daniel Miller] @@ -307,8 +312,8 @@ o [NSE] Removed a fixed value (28428) which was being set for the Request ID in instead. [jah] o [NSE] Add http-iis-short-name-brute script that detects Microsoft IIS - servers vulnerable to a file/folder name disclosure and a denial of - service vulnerability. The script obtains the "shortnames" of the + servers vulnerable to a file/folder name disclosure and a denial of + service vulnerability. The script obtains the "shortnames" of the files and folders in the webroot folder. [Paulino Calderon] o Idle scan now supports IPv6. IPv6 packets don't usually come with @@ -1314,7 +1319,7 @@ o [NSE] Updated mssql.lua library to support additional data types, Sellers] o [Nping] Nping now prints out an error and exists when the user tries to use - the -p flag for a scan option where that is meaningless. [Sean Rivera] + the -p flag for a scan option where that is meaningless. [Sean Rivera] o [NSE] Added spoolss functions and constants to msrpc.lua. [Aleksandar Nikolic] @@ -1339,7 +1344,7 @@ o [NSE] lltd-discovery scripts now parses for hostnames and outputs network card manufacturer. [Hani Benhabiles] o Added protocol specific payloads for IPv6 hop-by-hop (0x00), routing (0x2b), - fragment (0x2c), and destination (0x3c). [Sean Rivera] + fragment (0x2c), and destination (0x3c). [Sean Rivera] o [NSE] Added support for decoding OSPF Hello packets to broadcast-listener. [Hani Benhabiles] @@ -1348,7 +1353,7 @@ o [NSE] Fixed a false positive in http-vuln-cve2011-3192.nse, which detected Apache 2.2.22 as vulnerable. [Michael Meyer] o [NSE] Modified multiple scripts that operated against HTTP based services - so as to remove false positives that were generated when the target service + so as to remove false positives that were generated when the target service answers with a 200 response to all requests. [Tom Sellers] o [NSOCK] Fixed an epoll-engine-specific bug. The engine didn't recognized FDs @@ -1832,7 +1837,7 @@ o [NSE] Added authentication support to the MongoDB library and o [NSE] Added support to broadcast-listener for extracting address, native VLAN and management IP address from CDP packets. [Tom Sellers] - + o [NSE] Added RPC Call CALLIT to the RPC library and modified UDP sockets to be unconnected in order to support broadcast. [Patrik Karlsson] @@ -2272,7 +2277,7 @@ o [NSE] Added new functionality and fixed some bugs in the brute library: o [NSE] Re-enabled support for guessing the username in addition to password that was incorrectly removed from the metasploit-xmlrpc-brute in previous commit. [Patrik] - + o [NSE] Fixed bug that would prevent brute scripts from running if no service field was present in the port table. [Patrik] @@ -2643,7 +2648,7 @@ o [NSE] Added more than 100 new signatures to http-enum (many for known vulnerabilities). They are in the categories: general, attacks, cms, security, management and database [Paulino] -o [NSE] Updated account status text in brute force password discovery +o [NSE] Updated account status text in brute force password discovery scripts in an effort to make the reporting more consistent across all scripts. This will have an impact on any code that parses these values. [Tom Sellers] @@ -2676,7 +2681,7 @@ o Fixed a bug that would make Nmap segfault if it failed to open an interface using pcap. The bug details and patch are posted at http://seclists.org/nmap-dev/2011/q3/365 [Patrik] -o Ncat SCTP mode now supports connection brokering +o Ncat SCTP mode now supports connection brokering (--sctp --broker). [Shinnok] o Consolidated a bunch of duplicate code between Ncat's listen @@ -2710,7 +2715,7 @@ o [NSE] Applied patch from Chris Woodbury that adds the following additional information to the output of smb-os-discovery: NetBIOS computer name, NetBIOS domain name, FQDN, and forest name. -o [NSE] Updated smb-brute to add detection for valid credentials where the +o [NSE] Updated smb-brute to add detection for valid credentials where the target account was expired or limited by time or login host constraints. [Tom Sellers] @@ -2725,7 +2730,7 @@ o Fixed broken XML output in the case of timed-out hosts; the o [NSE] Multiple ldap-brute changes by Tom Sellers: + Added support for 2008 R2 functional level Active Directory instances - + Added detection for valid credentials where the target account was + + Added detection for valid credentials where the target account was expired or limited by time or login host constraints. + Added support for specifying a UPN suffix to be appended to usernames when brute forcing Microsoft Active Directory accounts. @@ -2735,12 +2740,12 @@ o [NSE] Multiple ldap-brute changes by Tom Sellers: o [NSE] ldap-search.nse - Added support for saving search results to CSV. This is done by using the ldap.savesearch script argument to - specify an output filename prefix. [Tom Sellers] + specify an output filename prefix. [Tom Sellers] o Handle an unconventional IPv6 internal link-local address convention used by Mac OS X. See http://seclists.org/nmap-dev/2011/q3/906. [David] - + o [NSE] Optimized stdnse.format_output (changing the data structures) to improve performance for scripts which produce a lot of output. See http://seclists.org/nmap-dev/2011/q3/623. [Djalal] @@ -14030,5 +14035,5 @@ o Changed the makefile 'all' target to use install-sh rather than o Documentation updated and clarified slightly. -o Added this CHANGELOG file to the distribution. +o Added this CHANGELOG file to the distribution. diff --git a/libdnet-stripped/NMAP_MODIFICATIONS b/libdnet-stripped/NMAP_MODIFICATIONS index f7053e59c..26e490ab7 100644 --- a/libdnet-stripped/NMAP_MODIFICATIONS +++ b/libdnet-stripped/NMAP_MODIFICATIONS @@ -1980,3 +1980,30 @@ index 184c077..2df6a4d 100644 if (ioctl(intf->fd, SIOCGIFHWADDR, &ifr) < 0) return (-1); if (addr_ston(&ifr.ifr_addr, &entry->intf_link_addr) < 0) + +o Support 802.11 Prism interfaces in monitor mode + +diff --git a/libdnet-stripped/include/dnet/arp.h b/libdnet-stripped/include/dnet/arp.h +index 9bfdcaf..728f8c3 100644 +--- a/libdnet-stripped/include/dnet/arp.h ++++ b/libdnet-stripped/include/dnet/arp.h +@@ -42,6 +42,7 @@ struct arp_hdr { + #define ARP_HRD_INFINIBAND 0x0020 /* InfiniBand */ + #define ARP_HRD_APPLETALK 0x0309 /* AppleTalk DDP */ + #define ARP_HDR_IEEE80211 0x0321 /* IEEE 802.11 */ ++#define ARP_HRD_IEEE80211_PRISM 0x0322 /* IEEE 802.11 + prism header */ + #define ARP_HRD_IEEE80211_RADIOTAP 0x0323 /* IEEE 802.11 + radiotap header */ + #define ARP_HRD_VOID 0xFFFF /* Void type, nothing is known */ + +diff --git a/libdnet-stripped/src/addr.c b/libdnet-stripped/src/addr.c +index 8953b5b..05a0692 100644 +--- a/libdnet-stripped/src/addr.c ++++ b/libdnet-stripped/src/addr.c +@@ -321,6 +321,7 @@ addr_ston(const struct sockaddr *sa, struct addr *a) + case ARP_HRD_APPLETALK: /* AppleTalk DDP */ + case ARP_HRD_INFINIBAND: /* InfiniBand */ + case ARP_HDR_IEEE80211: /* IEEE 802.11 */ ++ case ARP_HRD_IEEE80211_PRISM: /* IEEE 802.11 + prism header */ + case ARP_HRD_IEEE80211_RADIOTAP: /* IEEE 802.11 + radiotap header */ + a->addr_type = ADDR_TYPE_ETH; + a->addr_bits = ETH_ADDR_BITS; diff --git a/libdnet-stripped/include/dnet/arp.h b/libdnet-stripped/include/dnet/arp.h index 9bfdcaf1b..728f8c30d 100644 --- a/libdnet-stripped/include/dnet/arp.h +++ b/libdnet-stripped/include/dnet/arp.h @@ -42,6 +42,7 @@ struct arp_hdr { #define ARP_HRD_INFINIBAND 0x0020 /* InfiniBand */ #define ARP_HRD_APPLETALK 0x0309 /* AppleTalk DDP */ #define ARP_HDR_IEEE80211 0x0321 /* IEEE 802.11 */ +#define ARP_HRD_IEEE80211_PRISM 0x0322 /* IEEE 802.11 + prism header */ #define ARP_HRD_IEEE80211_RADIOTAP 0x0323 /* IEEE 802.11 + radiotap header */ #define ARP_HRD_VOID 0xFFFF /* Void type, nothing is known */ diff --git a/libdnet-stripped/src/addr.c b/libdnet-stripped/src/addr.c index 8953b5be2..05a06924e 100644 --- a/libdnet-stripped/src/addr.c +++ b/libdnet-stripped/src/addr.c @@ -321,6 +321,7 @@ addr_ston(const struct sockaddr *sa, struct addr *a) case ARP_HRD_APPLETALK: /* AppleTalk DDP */ case ARP_HRD_INFINIBAND: /* InfiniBand */ case ARP_HDR_IEEE80211: /* IEEE 802.11 */ + case ARP_HRD_IEEE80211_PRISM: /* IEEE 802.11 + prism header */ case ARP_HRD_IEEE80211_RADIOTAP: /* IEEE 802.11 + radiotap header */ a->addr_type = ADDR_TYPE_ETH; a->addr_bits = ETH_ADDR_BITS;