ssh-brute stops working with a large amount of open hosts

[2knarf]

Hi, ssh-brute plugin stops working if you define a large number of hosts, 1-10 goes fine. a /24 however does not work, I tried to have it running for 18hours straight but no proggress.

NSE: Active NSE Script Threads: 75 (75 waiting)
NSE Timing: About 81.48% done; ETC: 13:41 (0:00:13 remaining)
NSE: Waiting: ssh-brute M:55e95b2c7ff8 against xxxxxxx:22
stack traceback:
[C]: in local 'condvar'
/usr/local/bin/../share/nmap/nselib/brute.lua:1220: in method 'start'
/usr/local/bin/../share/nmap/scripts/ssh-brute.nse:109: in function </usr/local/bin/../share/nmap/scripts/ssh-brute.nse:100>
(...tail calls...)

[dmiller-nmap]

Is it still making connections? In ordinary interactive terminal mode, you can press the p key to start packet tracing (press Shift+P to stop tracing) which will show you connections and traffic as it is sent. You could also use tcpdump to check that the script is still sending out SSH traffic.

I would also be interested to know the performance impact of running this many script threads. The libssh2 capabilities like ssh-brute are pretty new, and I don't know if it could have some memory use problems. You can use ps u $(pidof nmap) to get some idea of this, and output would be helpful for us.

Also, it would be helpful to know how many targets with port 22 open are in your scan, what --script-args you are using, and how many lines are in your username and password files.

[2knarf]

Hi, there are 119 hosts open on port 22.

Command:

nmap -p 22 --script ssh-brute --script-args ssh-brute.timeout=4s --script-args userdb=/home/frank/users.lst,passdb=/home/frank/pass.lst x.x.x.1/24

The username and password is both 8 chars.

Packet tracing does not show anything, the last it shows before stopping is:

NSE: TCP 10.0.1.38:41740 > x1:22 | CLOSE
NSOCK INFO [46.5650s] nsock_iod_delete(): nsock_iod_delete (IOD #200)
NSE: TCP 10.0.1.38:41742 > x2:22 | CLOSE
NSOCK INFO [46.5650s] nsock_iod_delete(): nsock_iod_delete (IOD #201)
NSE: TCP 10.0.1.38:58836 > x3:22 | CLOSE
NSOCK INFO [46.6410s] nsock_iod_delete(): nsock_iod_delete (IOD #196)
NSE: TCP 10.0.1.38:37208 > x4:22 | CLOSE
NSOCK INFO [46.6410s] nsock_iod_delete(): nsock_iod_delete (IOD #187)

ps:

USER PID %CPU %MEM VSZ RSS TTY STAT START TIME COMMAND
frank 32348 80.1 0.1 65620 25788 pts/9 R+ 11:25 1:54 nmap -p 22 --sc