From b0a0142437bc56796b01f33dcea4294d44fcdd7c Mon Sep 17 00:00:00 2001 From: Shane Williams Date: Thu, 9 Sep 2021 08:00:03 -0500 Subject: [PATCH] Changed generic unix RPC service name to sunrpc instead of rpcbind; added explicit unknown-sunrpc port.version.name when rpc grinder can't identify RPC service --- nmap-service-probes | 12 ++++++------ nselib/rpc.lua | 10 +++++----- scripts/rpc-grind.nse | 22 ++++++++++++---------- scripts/rpcinfo.nse | 2 +- 4 files changed, 24 insertions(+), 22 deletions(-) diff --git a/nmap-service-probes b/nmap-service-probes index 3e5b17114..86652f3b8 100644 --- a/nmap-service-probes +++ b/nmap-service-probes @@ -12284,11 +12284,11 @@ match ossec-agent m=^\xdf\x06\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\x01\x97\|\0\ match riverbed-stats m|^a\x0f\x02\x04fiji\x02\x01\0\x02\x01\0\x02\x01\0$| p/Riverbed Steelhead Mobile caching proxy statistics/ d/proxy server/ #RPC Response, MSG_ACCEPTED, any AUTH type -match rpcbind m|^\x80\0\0.\x72\xfe\x1d\x13\0\0\0\x01\0\0\0\0\0\0\0[\x00-\x03\x06]| +match sunrpc m|^\x80\0\0.\x72\xfe\x1d\x13\0\0\0\x01\0\0\0\0\0\0\0[\x00-\x03\x06]| # RPC Response, MSG_DENIED, RPC_MISMATCH -match rpcbind m|^\x80\0\0.\x72\xfe\x1d\x13\0\0\0\x01\0\0\0\x01\0\0\0\x00\0\0\0[\x00-\x02]\0\0\0[\x00-\x02]| +match sunrpc m|^\x80\0\0.\x72\xfe\x1d\x13\0\0\0\x01\0\0\0\x01\0\0\0\x00\0\0\0[\x00-\x02]\0\0\0[\x00-\x02]| # RPC Response, MSG_DENIED, AUTH_ERROR, any status -match rpcbind m|^\x80\0\0.\x72\xfe\x1d\x13\0\0\0\x01\0\0\0\x01\0\0\0\x01\0\0\0[\x00-\x07]| +match sunrpc m|^\x80\0\0.\x72\xfe\x1d\x13\0\0\0\x01\0\0\0\x01\0\0\0\x01\0\0\0[\x00-\x07]| match rtdscchcch m|^\x03\x11\0\x02V1\xec\xe7\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\xdd\0\x04\0\0| p/SIX Market Data Feed (MDF)/ cpe:/a:six_group:market_data_feed/ @@ -12362,8 +12362,8 @@ match slp-srvreg m|^\x02\x05\0\0\x12\0\0\0\0\0\0\x02\0\x02en\0\x0e$| p/IBM Direc match radius m|^\x03\xfe\0\x14................$|s p/Juniper Steel-Belted Radius radiusd/ -match rpcbind m|^\x72\xFE\x1D\x13\0\0\0\x01\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\x01| -match rpcbind m|^\x72\xFE\x1D\x13\0\0\0\x01\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\x02| +match sunrpc m|^\x72\xFE\x1D\x13\0\0\0\x01\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\x01| +match sunrpc m|^\x72\xFE\x1D\x13\0\0\0\x01\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\x02| # OpenAFS 1.2.10 on Linux 2.4.22 match kerberos-sec m|^\x04\n\0\0\0\0\0\0\0\0\0\0\x04code = 4: packet version number unknown\0| p/OpenAFS/ cpe:/a:openafs:openafs/ # talk-server-0.17 (linux), ports 517-518/udp @@ -14875,7 +14875,7 @@ match megaraid-monitor m|^\x02\0\0\0\0\0\0/\0\0\0\0\0\0\0\0\0@\x1f\0\0\0\0\0\0\0 match routeros-api m|^\x06!fatal\rnot logged in\0| p/MikroTik RouterOS API/ o/RouterOS/ cpe:/o:mikrotik:routeros/ # Interesting service: Not sure if it's RPC -match rpcbind m|^\x18\0\x01\x02Invalid packet length\0| p/Amanda voicemail system/ d/telecom-misc/ +match sunrpc m|^\x18\0\x01\x02Invalid packet length\0| p/Amanda voicemail system/ d/telecom-misc/ # Moved this from SSLSessionReq because it seems more reliable. # May need to generalize and grab the language if we see non-"en" responses match srvloc m|^\x02\x02\0\0\x12\0\0\0\0\0\0\0\0\x02en\0\x02$| p/Apple slpd/ o/Mac OS/ cpe:/o:apple:mac_os/a diff --git a/nselib/rpc.lua b/nselib/rpc.lua index 6d0595062..1a50c977b 100644 --- a/nselib/rpc.lua +++ b/nselib/rpc.lua @@ -102,16 +102,16 @@ _ENV = stdnse.module("rpc", stdnse.seeall) -- RPC args using the nmap.registry.args RPC_args = { - ["rpcbind"] = { proto = 'rpc.protocol' }, + ["sunrpc"] = { proto = 'rpc.protocol' }, ["nfs"] = { ver = 'nfs.version' }, ["mountd"] = { ver = 'mount.version' }, } -- Defines the order in which to try to connect to the RPC programs -- TCP appears to be more stable than UDP in most cases, so try it first -local RPC_PROTOCOLS = (nmap.registry.args and nmap.registry.args[RPC_args['rpcbind'].proto] and - type(nmap.registry.args[RPC_args['rpcbind'].proto]) == 'table') and -nmap.registry.args[RPC_args['rpcbind'].proto] or { "tcp", "udp" } +local RPC_PROTOCOLS = (nmap.registry.args and nmap.registry.args[RPC_args['sunrpc'].proto] and + type(nmap.registry.args[RPC_args['sunrpc'].proto]) == 'table') and +nmap.registry.args[RPC_args['sunrpc'].proto] or { "tcp", "udp" } -- used to cache the contents of the rpc datafile local RPC_PROGRAMS @@ -121,7 +121,7 @@ local mutex = nmap.mutex("rpc") -- Supported protocol versions RPC_version = { - ["rpcbind"] = { min=2, max=4 }, + ["sunrpc"] = { min=2, max=4 }, ["nfs"] = { min=1, max=3 }, ["mountd"] = { min=1, max=3 }, } diff --git a/scripts/rpc-grind.nse b/scripts/rpc-grind.nse index a89067b53..8d26101f9 100644 --- a/scripts/rpc-grind.nse +++ b/scripts/rpc-grind.nse @@ -50,9 +50,9 @@ portrule = function(host, port) if (nmap.port_is_excluded(port.number, port.protocol)) then return false end - if port.service ~= nil and port.version.service_dtype ~= "table" and port.service ~= 'rpcbind' then + if port.service ~= nil and port.version.service_dtype ~= "table" and port.service ~= 'sunrpc' then -- Exclude services that have already been detected as something - -- different than rpcbind. + -- different than sunrpc. return false end return nmap.version_intensity() >= 7 @@ -63,22 +63,22 @@ end --@param port Port table as commonly used in Nmap. --@return status boolean True if target port uses RPC protocol, false else. local isRPC = function(host, port) - -- If rpcbind is already set up by -sV + -- If sunrpc is already set up by -sV -- which does practically the same check as in the "else" part. - -- The nmap-services-probe entry "rpcbind" is not correctly true, and should - -- be changed to something like "sunrpc" - if port.service == 'rpcbind' then + -- The nmap-services-probe entry "rpcbind" was not correctly true, and has + -- been changed to "sunrpc" + if port.service == 'sunrpc' then return true else -- this check is important if we didn't run the scan with -sV. -- If we run the scan with -sV, this check shouldn't return true as it is pretty much similar - -- to the "rpcbind" service probe in nmap-service-probes. + -- to the "sunrpc" service probe in nmap-service-probes. local rpcConn, status, err, data, rxid, msgtype, _ -- Create new socket - -- rpcbind is not really important, we could have used another protocol from rpc.lua + -- sunrpc is not really important, we could have used another protocol from rpc.lua -- such as nfs or mountd. Same thing for version 2. - rpcConn = rpc.Comm:new("rpcbind", 2) + rpcConn = rpc.Comm:new("sunrpc", 2) status, err = rpcConn:Connect(host, port) if not status then stdnse.debug1("%s", err) @@ -165,7 +165,7 @@ local rpcGrinder = function(host, port, iterator, result) -- We use a random, most likely unsupported version so that -- we also trigger min and max version disclosure for the target service. version = math.random(12345, 123456789) - rpcConn = rpc.Comm:new("rpcbind", version) + rpcConn = rpc.Comm:new("sunrpc", version) rpcConn:SetCheckProgVer(false) status, err = rpcConn:Connect(host, port) @@ -264,6 +264,8 @@ action = function(host, port) nmap.set_port_version(host, port, "hardmatched") else stdnse.debug1("Couldn't determine the target RPC service. Running a service not in nmap-rpc ?") + port.version.name = "unknown-sunrpc" + nmap.set_port_version(host, port, "incomplete") end return nil end diff --git a/scripts/rpcinfo.nse b/scripts/rpcinfo.nse index 87edfc7bc..37d02d6e2 100644 --- a/scripts/rpcinfo.nse +++ b/scripts/rpcinfo.nse @@ -104,7 +104,7 @@ action = function(host, port) if nmapport and (nmapport.state == "open" or nmapport.state == "open|filtered") then nmapport.version = nmapport.version or {} -- If we don't already know it, or we only know that it's "rpcbind" - if nmapport.service == nil or nmapport.version.service_dtype == "table" or port.service == "rpcbind" then + if nmapport.service == nil or nmapport.version.service_dtype == "table" or port.service == "sunrpc" then nmapport.version.name = rpc.Util.ProgNumberToName(progid) nmapport.version.extrainfo = "RPC #" .. progid if #v2.version > 1 then