New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Service Detection: Add Ubiquiti Discovery Service on 10001/udp #1454

Closed
wants to merge 6 commits into
base: master
from

Conversation

Projects
None yet
3 participants
@TomSellers
Copy link

TomSellers commented Feb 1, 2019

This PR adds UDP service probe and match lines for Ubiquiti Discovery Service on 10001/udp.

NOTE : The PR has been updated to include coverage of v2 of the protocol.

The Discovery Service is used by various Ubiquiti networking gear. The Ubiquiti Discovery Tool sends a 4 byte payload of \x01\0\0\0 and devices with the service will respond with hostname, model, firmware, MAC addresses, IP Addresses, etc.

v1 output

PORT      STATE SERVICE            REASON       VERSION
10001/udp open  ubiquiti-discovery udp-response Ubiquiti Discovery Service (v1 protocol)

v2 output

PORT      STATE SERVICE            REASON       VERSION
10001/udp open  ubiquiti-discovery udp-response Ubiquiti Discovery Service (v2 protocol)

This is related to PR #1457

Context: https://blog.rapid7.com/2019/02/01/ubiquiti-discovery-service-exposures/

If there aren't any objections or changes requested I will commit this code and the corresponding Changelog entry this weekend.

TomSellers added some commits Feb 1, 2019

TomSellers added some commits Feb 5, 2019

@TomSellers

This comment has been minimized.

Copy link
Author

TomSellers commented Feb 5, 2019

@dmiller-nmap - I added an entry to nmap-payloads for the v1 protocol. I'd add one for v2 but it appears you can only have one entry in nmap-payloads per port. I think this is because the port is used as the key.

nmap/payload.cc

Lines 352 to 358 in a0418c0

for (p = 0; p < count; p++) {
struct proto_dport key(IPPROTO_UDP, ports[p]);
struct payload payload;
payload.data = payload_data;
payloads[key] = payload;
}

@TomSellers

This comment has been minimized.

Copy link
Author

TomSellers commented Feb 9, 2019

Additional examples that show short model name. This output aligns with output from the script.

Version 1

PORT      STATE SERVICE            REASON              VERSION
10001/udp open  ubiquiti-discovery udp-response ttl xx Ubiquiti Discovery Service (v1 protocol, ERPro-8)
10001/udp open  ubiquiti-discovery udp-response ttl xx Ubiquiti Discovery Service (v1 protocol, ER-X)
10001/udp open  ubiquiti-discovery udp-response ttl xx Ubiquiti Discovery Service (v1 protocol, WOM5AMiMo)
10001/udp open  ubiquiti-discovery udp-response ttl xx Ubiquiti Discovery Service (v1 protocol, P5B-300)
10001/udp open  ubiquiti-discovery udp-response ttl xx Ubiquiti Discovery Service (v1 protocol, AirCam)
10001/udp open  ubiquiti-discovery udp-response ttl xx Ubiquiti Discovery Service (v1 protocol, NBE-5AC-19)

PORT      STATE SERVICE            REASON              VERSION
10001/udp open  ubiquiti-discovery udp-response ttl xx Ubiquiti Discovery Service (v1 protocol, AirCamDome)
Service Info: CPE: cpe:/h:ubnt:aircam_dome:

Version 2, some with software version

PORT      STATE SERVICE            REASON       VERSION
10001/udp open  ubiquiti-discovery udp-response Ubiquiti Discovery Service (v2 protocol, UCK software ver. 5.9.29)
10001/udp open  ubiquiti-discovery udp-response Ubiquiti Discovery Service (v2 protocol, UCK-v2 software ver. 5.9.29)
10001/udp open  ubiquiti-discovery udp-response Ubiquiti Discovery Service (v2 protocol, UCK-v3 software ver. 5.9.29)

@nmap-bot nmap-bot closed this in 5d5e11d Feb 9, 2019

@TomSellers TomSellers deleted the TomSellers:ubiquiti_discovery branch Feb 9, 2019

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment