From 24461539b9946ca60c262758449285314182df9f Mon Sep 17 00:00:00 2001 From: fyodor Date: Tue, 29 Oct 2013 07:30:09 +0000 Subject: [PATCH] Update some time-based signatures so they cover times further in the future (and ignore times which are now well into the past) --- nmap-service-probes | 19 ++++++++++--------- 1 file changed, 10 insertions(+), 9 deletions(-) diff --git a/nmap-service-probes b/nmap-service-probes index 99752b2e8..2ce7094c5 100644 --- a/nmap-service-probes +++ b/nmap-service-probes @@ -1812,9 +1812,10 @@ match mysql m|^.\0\0\0\n(0[\w._-]+)\0| p/MySQL instance manager/ v/$1/ # TIME # This is a random 128-byte IV followed by a four-byte timestamp. -# 0x46000000 = Tue Mar 20 09:38:40 2007 -# 0x53FFFFFF = Thu Aug 28 22:22:23 2014 -match nagios-nsca m|^.{128}[\x46-\x53]...$|s p/Nagios NSCA/ +# 0x52000000 = Mon Aug 5 12:41:52 2013 +# 0x5FFFFFFF = Thu Jan 14 00:25:35 2021 +# Calculating: perl -MPOSIX -le 'print ctime(0x5FFFFFFF)' +match nagios-nsca m|^.{128}[\x52-\x5F]...$|s p/Nagios NSCA/ match nbd m|^NBDMAGIC\0\0B| p/Network Block Device/ @@ -4034,15 +4035,15 @@ match tinc m|^0 \w+ 17\n| p/tinc vpn daemon/ # TIME # This will match systems with clocks set between the # following 2 dates: -# 0xCA000000 = Thu May 24 14:13:52 2007 -# 0xD7FFFFFF = Sat Nov 1 18:57:35 2014 +# 0xD5000000 = Fri Mar 29 04:56:48 2013 +# 0xE2FFFFFF = Sun Sep 6 17:40:31 2020 # Calculate this with the Python program: # python -c 'import datetime; print datetime.datetime.fromtimestamp(0xca000000 - 2208988800).ctime()' # Also needs updating (search for TIME): # UDP Help # TCP NULL -match time m|^[\xca-\xd7]...$|s i/32 bits/ -match time m|^[\xca-\xd7]....\0\0\0$|s i/64 bits/ +match time m|^[\xd5-\xe2]...$|s i/32 bits/ +match time m|^[\xd5-\xe2]....\0\0\0$|s i/64 bits/ # Need more examples... -Doug match timeedit m|^\0\0\0H\0\0\0\x02\x0fTimeEdit131\.| p/Evolvera TimeEdit/ v/1.3.1/ @@ -9916,8 +9917,8 @@ match daytime m|^\d\d:\d\d:\d\d \d\d.\d\d.20\d\d\n$| p/Microsoft Windows Interna match daytime m|^\w\w\w \w\w\w \d\d \d\d:\d\d:\d\d \d\d\d\d\r\n$| p/AIX daytime/ o/AIX/ cpe:/o:ibm:aix/a match daytime m|^(\w\w\w \w\w\w \d\d \d\d:\d\d:\d\d \w+ \d\d\d\d)\r\n\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0 \0\0\0\x7f\xff\xec0\0\0\0\0\0\0\0\0\0\0\0\0\x04\x01Q\xa0\0\0\0\0\0\x01\0\x15\x90-d\0\0\0\0\0\0\0\0\x1c\0\0\xff\xfe\xff\xff\xff\xff\xc5:H\0\0\x16\xc3\xd8\0\0\0\0\0\0\0\0\0\0\0\0\0\0\xff\xff\xac\x10\x0b\x05\0\xff\0\x06T\xa3\0\0 !\"#\$%&'\(\)\*\+,-\./0123456789:;<=>\?@ABCDEFGHIJKLMNO\xd3\$\x12\xccTUVWOy\x94L\0\r\xd1z\0\0\0\0\x04\x02\x1b`\0\0\0\0\x04\x02\x1b`| i/time: $1/ # TIME -match time m|^[\xca-\xd7]...$|s i/32 bits/ -match time m|^[\xca-\xd7]....\0\0\0$|s i/64 bits/ +match time m|^[\xd5-\xe2]...$|s i/32 bits/ +match time m|^[\xd5-\xe2]....\0\0\0$|s i/64 bits/ # Solaris Internet Name Server (42/udp), see ien116.txt match nameserver m|^help\r\n\r\n\0\0\0\0\x20CKAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\0\0!\0\x01| p/Solaris Internet Name Server/ i/IEN 116/ o/Solaris/ cpe:/o:sun:sunos/a match nameserver m|^\x03\x03\x02$| p/Solaris Internet Name Server/ i/IEN 116/ o/Solaris/ cpe:/o:sun:sunos/a