Telnet fingerprinting nse #1083
Conversation
Please make these changes. |
Original idea from telnetfp by Palmers of Team TESO. | ||
Please send new or incorrect fingerprint data to daniel@planethacker.net |
rewanth1997
Dec 11, 2017
Contributor
Avoid putting your email address here, leave a general dev@nmap.org or completely skip it.
Avoid putting your email address here, leave a general dev@nmap.org or completely skip it.
|
||
|
||
-- Fingerprint table. Please keep in alphabetical order! | ||
fp_table = {} |
rewanth1997
Dec 11, 2017
Contributor
Prefer using local variables.
Prefer using local variables.
end | ||
|
||
-- Search table for matches | ||
output.Match = "No matches found. Please submit fingerprints to daniel@planethacker.net" |
rewanth1997
Dec 11, 2017
Contributor
Avoid putting your email address here, leave a general dev@nmap.org or completely skip it.
Avoid putting your email address here, leave a general dev@nmap.org or completely skip it.
@@ -0,0 +1,96 @@ | |||
local stdnse = require "stdnse" | |||
local shortport = require "shortport" | |||
local comm = require "comm" |
rewanth1997
Dec 11, 2017
Contributor
Remove unused libraries.
Remove unused libraries.
|
||
-- Fingerprint table. Please keep in alphabetical order! | ||
fp_table = {} | ||
fp_table["255 251 1"] = "APC, Windows CE" |
rewanth1997
Dec 11, 2017
Contributor
Add reference links for these fingerprints in the description above.
Add reference links for these fingerprints in the description above.
droberson
Dec 11, 2017
Author
This is the only item I was unsure about. I do not know what you mean by adding reference links in the description.
This is the only item I was unsure about. I do not know what you mean by adding reference links in the description.
I did the recommended fixes with the exception of adding reference links to the fingerprints, because I was unsure what was meant by this. |
@droberson I'm sure you didn't create the fingerprints on your own, you must have got them from somewhere, right? By reference links to the fingerprints , I meant the list of websites from which you were able to get these fingerprints. |
@rewanth1997 I referenced the RFC and original tool which does not have a website anymore and hasn't been maintained since 2004. I gathered these fingerprints myself by connecting to multiple devices that I was able to positively identify; I own the devices personally, they are devices that I administer at work or stuff at friends' houses. When you connect to a telnet service, they typically send a series of options requests/other commands. These come in a 3-byte format: 0xff command value This script extracts those commands and outputs them as the decimal value of their ASCII values so they can be copied and pasted easily. Connecting to several dozen Cisco IOS devices of different models and versions will yield the same "fingerprint" regardless of if someone has changed or removed the banner because they share the same implementation of a telnet server. The same applies to Linux telnetd, regardless of distro, the architecture of the device, or if the administrator has set a non-stock banner. In practice, most telnet implementations will have a unique "fingerprint" based on the data sent by the server upon connection. This has been a very reliable method of identifying at least the manufacturer/vendor of a device running telnet. |
@cldrn @dmiller-nmap This looks good to me and is working good. Final confirmation please. |
I appreciate your work on this script, but I don't see why we can't make these into service matches in
You will notice that we already have one exactly like this for Huawei devices. Can you try this and let us know if it produces results you would expect? The service matching engine is much faster than NSE when it comes to this sort of thing, and more people use it. |
Shucks. This is a way better solution. I should have looked into this more beforehand. |
@droberson If you can confirm these softmatch lines look/work OK, we will add them and still credit you in the CHANGELOG. |
@dmiller-nmap Many of these signatures were present already in nmap-service-probes Order mattered for some of these, too. For instance HP laserjet and Moxa devices: This was incorrectly reporting Moxa devices as LaserJet printers. The following have been verified and did not have entries in this file to my knowledge: softmatch telnet m|^\xff\xfd\x18(?!\xff)| p/GE Multilin/ |
Ah, I see I was missing a backslash in the negative lookahead. I'll fix that and commit; that should fix the order problem. Thanks! |
This fingerprints telnet services. Based on the old telnetfp tool.