Re: Follow up to NMAP on Snow Leopard with VMWARE Fusion installed

[Walt Scrivens <walts () gate net>]

Sorry, I should have remembered that.
As a user, it runs:
======================================
testcomputer:nmap walts$ ./nmap -T4 -A -v -PE -PS22,25,80 - 
PA21,23,80,3389 192.168.1.1
Warning:  You are not root -- using TCP pingscan rather than ICMP

Starting Nmap 5.05BETA1 ( http://nmap.org ) at 2009-09-23 08:17 EDT
Warning: File ./nmap-services exists, but Nmap is using /usr/local/ 
share/nmap/nmap-services for security and consistency reasons.  set  
NMAPDIR=. to give priority to files in your local directory (may  
affect the other data files too).
NSE: Loaded 30 scripts for scanning.
Initiating Ping Scan at 08:17
Scanning 192.168.1.1 [6 ports]
Completed Ping Scan at 08:17, 0.01s elapsed (1 total hosts)
Initiating Parallel DNS resolution of 1 host. at 08:17
Completed Parallel DNS resolution of 1 host. at 08:17, 0.02s elapsed
Initiating Connect Scan at 08:17
Scanning 0ur1an (192.168.1.1) [1000 ports]
Discovered open port 23/tcp on 192.168.1.1
Discovered open port 80/tcp on 192.168.1.1
Discovered open port 53/tcp on 192.168.1.1
Completed Connect Scan at 08:17, 2.15s elapsed (1000 total ports)
Initiating Service scan at 08:17
Scanning 3 services on 0ur1an (192.168.1.1)
Completed Service scan at 08:17, 6.07s elapsed (3 services on 1 host)
NSE: Script scanning 192.168.1.1.
NSE: Starting runlevel 1 scan
Initiating NSE at 08:17
Completed NSE at 08:17, 0.00s elapsed
NSE: Script Scanning completed.
Host 0ur1an (192.168.1.1) is up (0.077s latency).
Interesting ports on 0ur1an (192.168.1.1):
Not shown: 997 closed ports
PORT   STATE SERVICE VERSION
23/tcp open  telnet  DD-WRT telnetd 23 SP2 std (c) 2006 NewMedia-NET  
GmbH
53/tcp open  domain  dnsmasq 2.33
80/tcp open  http    Linksys wrt54g DD-WRT firmware http config
Service Info: OS: Linux; Device: WAP

Read data files from: /usr/local/share/nmap
Service detection performed. Please report any incorrect results at http://nmap.org/submit/ 
 .
Nmap done: 1 IP address (1 host up) scanned in 8.79 seconds
testcomputer:nmap walts$
================================================

But as root it dies:

================================================

testcomputer:nmap walts$ sudo ./nmap -T4 -A -v -PE -PS22,25,80 - 
PA21,23,80,3389 192.168.1.1
Password:
Warning: File ./nmap-os-db exists, but Nmap is using /usr/local/share/ 
nmap/nmap-os-db for security and consistency reasons.  set NMAPDIR=.  
to give priority to files in your local directory (may affect the  
other data files too).

Starting Nmap 5.05BETA1 ( http://nmap.org ) at 2009-09-23 08:20 EDT
NSE: Loaded 30 scripts for scanning.
Warning: Unable to open interface vmnet8 -- skipping it.
Warning: Unable to open interface vmnet1 -- skipping it.
Initiating ARP Ping Scan at 08:20
Scanning 192.168.1.1 [1 port]

^C AFTER 2 MINUTES

testcomputer:nmap walts$

=================================================

FWIW, I got the same result with NMAPDIR=.

Walt

On Sep 22, 2009, at 9:22 PM, David Fifield wrote:

> On Mon, Sep 21, 2009 at 07:28:50AM -0400, Walt Scrivens wrote:
> > Here's some more info - this time with 5.00.  I did the same scan
> > through Zenmap, running natively under Snow Leopard, and running as a
> > Windows 7 VM under VMWare Fusion under Snow Leopard.  Same computer,
> > same network.
> > I used the "canned" Intense Scan profile in Zenmap from the Windows  
> > vm,
> > and copy/pasted it into the Mac Zenmap since its version of Intense  
> > Scan
> > did not include the -PE -PS22,25,80 -PA21,23,80,3389
> >
> > It looks to me as if the Mac user scan worked correctly, being the  
> > same
> > as the Windows scan less that which requires root to run.  The Mac  
> > root
> > scan fails miserably.
> >
> > Now the Mac version:
> > ======================================
> > nmap -T4 -A -v -PE -PS22,25,80 -PA21,23,80,3389 192.168.1.1
> >
> > Starting Nmap 5.00 ( http://nmap.org ) at 2009-09-21 07:10 EDT
> > NSE: Loaded 30 scripts for scanning.
> > Initiating ARP Ping Scan at 07:10
> > Scanning 192.168.1.1 [1 port]
> > Completed ARP Ping Scan at 07:10, 0.21s elapsed (1 total hosts)
> > Read data files from: /usr/local/share/nmap
> > Note: Host seems down. If it is really up, but blocking our ping  
> > probes,
> > try -PN
> > Nmap done: 1 IP address (0 hosts up) scanned in 0.47 seconds
> >           Raw packets sent: 2 (84B) | Rcvd: 0 (0B)
> >
> > =======================================
>
> This is a known problem that has already been fixed in Subversion. Can
> you reproduce it with a recent checkout? The problem exists in the  
> 5.00
> release.
>
> David Fifield
>
> _______________________________________________
> Sent through the nmap-dev mailing list
> http://cgi.insecure.org/mailman/listinfo/nmap-dev
> Archived at http://SecLists.Org


_______________________________________________
Sent through the nmap-dev mailing list
http://cgi.insecure.org/mailman/listinfo/nmap-dev
Archived at http://SecLists.Org