TFTP Version Script #548

mogigoma · 2016-09-10T21:42:44Z

As suggested here, I've made a TFTP version script.

The script could use a lot more testing on different targets. I have successfully tested against a new free download of SolarWinds TFTP and against non-TFTP services and unrecognized TFTP services.

The way matching against fingerprints occurs is the simplest thing I could think of. If there's a good way to either parse a file of fingerprints to generate the hardwired table, that would be good. Also, regexes are not in use, but could be added if necessary. Couldn't find any PCRE exposed, only LPeg which doesn't match up very well with the fingerprint format. I also removed the probe matches. Not sure if that was appropriate.

Finally, if recvfrom() was exposed to the NSE that would be desirable. I worry about receiving packets from other hosts unintentionally, or receiving packets during the brief window during which we're swapping sockets. Not sure if Nmap has protections against that.

Anyways, if you want things changed or hit bugs, let me know and I'll fix them as soon as I can. Next up: nbd-info!

… except via LPeg.

dmiller-nmap

Exciting! I look forward to testing this, and I hope we can gather a good set of fingerprints to cover lots of different TFTP servers.

dmiller-nmap · 2016-09-19T14:31:23Z

nmap-service-probes

@@ -11691,22 +11691,6 @@ match msrpc m|^\x04\x06\0\0\x10\0\0\0\0\0\0\0|

 match netprobe m|^\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0$| p/Mega System Technologies NetProbe Lite environmental sensor/ d/specialized/

-match tftp m|^\0\x05\0\x02\0The IP address is not in the range of allowable addresses\.\0| p/SolarWinds tftpd/ i/IP disallowed/ o/Windows/ cpe:/a:solarwinds:tftp_server/ cpe:/o:microsoft:windows/a


I think we should leave these match lines here, since they are useful for users who do not use NSE. The tftp-version script could even check to be sure there hasn't already been a match from -sV before proceeding.

Restored probes.

dmiller-nmap · 2016-09-19T14:40:22Z

scripts/tftp-version.nse

+local OPCODE_DATA  = 3
+local OPCODE_ERROR = 5
+
+local responses = {


We could load these fingerprints from an external file like we do for http-default-accounts or ike-version. Need comments to annotate what these fields are for and what format to use. Probably a more compact representation would be helpful, too:

{ 2, "The IP address is not in the range of allowable addresses.", { p="SolarWinds tftpd", i="IP disallowed", o="Windows", cpe={"a:solarwinds:tftp_server", "o:microsoft:windows/a",} } }

or similar. Table keys that are valid identifiers can be specified without the ["brackets-and-quotes"] syntax.

Done, compacted slightly and followed the example of ike-version.

dmiller-nmap · 2016-09-19T14:45:00Z

scripts/tftp-version.nse

+}
+
+local record_match = function(port, sw)
+  if sw.p then


Need to peacefully coexist with version info set by other means (i.e. nmap-service-probes). Check out how other version-category scripts do this: http-server-header, snmp-info, etc. Decide whether to append or replace the existing version info.

Added, should now only append to the version information.

dmiller-nmap · 2016-09-19T14:58:14Z

scripts/tftp-version.nse

+  -- should respond back to the port matching the sending script.
+  --
+  -- Note that due to API limitations, we can't know if the response came from
+  -- the host we sent the request to, so we must assume it does.


I wonder if we could do socket:get_info() after this receive to verify this? I agree, there are better underlying C calls for doing this, but to get it working with what we have, that could be an improvement. Also, we should be able to use stdnse.get_timeout to improve the timeout for the receive from the default 30 seconds. This would allow us to retransmit a couple times if necessary without taking too long.

Added a socket:get_info() check. Not sure what you mean with setting the timeout. Do you mean lower it to something like 5 seconds, and sending something say 3 times if there's no response?

dmiller-nmap · 2016-09-19T14:59:12Z

scripts/tftp-version.nse

+  -- Parse the response.
+  local pkt = parse(res)
+  if not pkt then
+    return nil


Some debug statements for these nil returns would be helpful to know at what point we encountered a problem.

Added, all unsuccessful runs should now have a debug message.

dmiller-nmap · 2016-09-19T15:02:10Z

scripts/tftp-version.nse

+
+author = "Mak Kolybabi <mak@kolybabi.com>"
+license = "Same as Nmap--See https://nmap.org/book/man-legal.html"
+categories = {"default", "discovery", "safe", "version"}


I don't think "discovery" is appropriate, because we're not discovering anything, only determining version, which is already covered by "version." Will have to think about "default" and "safe" vs "intrusive" because we're requesting a nonexistent file. How big of a deal is that? I'd guess not many places check TFTP logs, but do you have a better idea?

This feels non-intrusive to me because:

Most other intrusive scripts are exploits, bruteforcing, or enumeration

There's a small chance of accessing sensitive information due to the random filename

The traffic generated is very minimal

dmiller-nmap · 2016-09-19T15:06:27Z

scripts/tftp-version.nse

+
+  -- Populate the service information by referencing our list of software
+  -- responses.
+  identify_software(pkt, port)


What about unidentified software? Have identify_software return the match info instead of setting it in the port object directly. Then do the port.version setting here in the action function; if there's no match, return output showing the message and code that were returned and requesting user to submit it to dev@nmap.org.

dmiller-nmap · 2016-10-21T18:56:14Z

Been doing some testing, here are my observations:

Sometimes (localhost with -sV) the script misses the response because it happens while the script is waiting on something else and has not bound the new socket to the local port. This could probably be fixed by the recvfrom binding you mentioned, but I'm not sure. What do you think?
The format for fingerprints could stand to be documented better. Pretty simple, I figured it out, but a comment on the first one could be helpful.
When run with -sV, the script output is not shown, so the user doesn't get the prompt to submit. We can use stdnse.verbose to print it instead or in addition.

And here's another fingerprint:

table.insert(fingerprints, {
    1, "File not found", {
      p = "Netkit tftpd or atftpd",
      cpe = {"a:netkit:netkit", "a:lefebvre:atftpd"},                                           
  }})

… output.

mogigoma · 2016-11-01T04:21:52Z

Added the fingerprint format info, the new fingerprint, and the stdnse.verbose() fingerprint submission info.

Assuming I'm reading the man pages right, switching to using a single socket, then calling sendto() followed by recvfrom() will fix the race condition.

dmiller-nmap · 2022-09-28T20:59:44Z

Just pushed this script! Made some changes based on research into #608 as well as trying to support more indicators for the future (other opcodes, malformed packets, etc. that might be returned by clumsy tftp servers). Looking forward to using it!

mogigoma added 10 commits September 10, 2016 05:04

Initial version of TFTP version check, crashes due to regex issue.

4094682

Flip around (un)pack to use it as an instance method.

210d5c7

Back down from using regexes, since they don't appear to be available…

00f5105

… except via LPeg.

Remove debug statement.

69657fc

Exit silently on success, all our data is in the port setting.

f363698

Remove probe matches. Unsure whether this is appropriate.

2d09f18

Add script to database, to ensure it gets run.

9350af1

Add match for newest SolarWinds.

0ce0005

Invert logic to be extensible and match the rest of the function.

a28e872

Remove unused library.

a49d6c2

dmiller-nmap reviewed Sep 19, 2016

View reviewed changes

mogigoma added 7 commits September 20, 2016 00:18

Remove 'discovery' category.

06a5508

Add debug statements to elucidate failures.

5a95fa4

Add -sV coexistence logic.

1e74c34

Suggest fingerprint submission on failure.

e7f992b

Restore -sV probes.

3de6a31

Externalize TFTP fingerprints.

4c6d9b6

Ensure that we only accept responses from the target.

dee4ad9

mogigoma added 4 commits October 31, 2016 21:35

Added fingerprint.

d8f319e

Add example fingerprint and reference to relevant Nmap book table.

a68a61d

Make variable local.

762eae2

Ensure the message shows up in the verbose messages, and possibly the…

fc9446f

… output.

dmiller-nmap mentioned this pull request Dec 9, 2016

Add unconnected UDP socket capability to Nsock #608

Closed

dmiller-nmap mentioned this pull request Dec 6, 2021

nmap incorrectly detects TFTP port as open|filtered #2406

Open

nmap-bot closed this in 894bfd4 Sep 28, 2022

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

TFTP Version Script #548

TFTP Version Script #548

mogigoma commented Sep 10, 2016

dmiller-nmap left a comment

dmiller-nmap Sep 19, 2016

mogigoma Sep 20, 2016

dmiller-nmap Sep 19, 2016

mogigoma Sep 20, 2016

dmiller-nmap Sep 19, 2016

mogigoma Sep 20, 2016

dmiller-nmap Sep 19, 2016

mogigoma Sep 20, 2016

dmiller-nmap Sep 19, 2016

mogigoma Sep 20, 2016

dmiller-nmap Sep 19, 2016

mogigoma Sep 20, 2016

dmiller-nmap Sep 19, 2016

mogigoma Sep 20, 2016

dmiller-nmap commented Oct 21, 2016

mogigoma commented Nov 1, 2016

dmiller-nmap commented Sep 28, 2022

		@@ -11691,22 +11691,6 @@ match msrpc m\|^\x04\x06\0\0\x10\0\0\0\0\0\0\0\|

		match netprobe m\|^\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0$\| p/Mega System Technologies NetProbe Lite environmental sensor/ d/specialized/

		match tftp m\|^\0\x05\0\x02\0The IP address is not in the range of allowable addresses\.\0\| p/SolarWinds tftpd/ i/IP disallowed/ o/Windows/ cpe:/a:solarwinds:tftp_server/ cpe:/o:microsoft:windows/a

TFTP Version Script #548

TFTP Version Script #548

Conversation

mogigoma commented Sep 10, 2016

dmiller-nmap left a comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

dmiller-nmap commented Oct 21, 2016

mogigoma commented Nov 1, 2016

dmiller-nmap commented Sep 28, 2022