Re: Conficker scanning with nmap

[Ron <ron () skullsecurity net>]

David Fifield wrote:
> I can reproduce this with OpenSSL 0.9.8e and the attached sample script.
> The error only happens for me when encrypting an empty string, not
> decrypting one.
>
> I think you're right about where the problem occurs. It could happen
> when the server sends a zero-length challenge. The challenge comes from
> line 615 of smbauth.lua. It looks like it could be caused by a truncated
> packet.
>
> David Fifield

Good to know!

I can probably default the challenge to "AAAAAAAA" or something.. a 
blank challenge shouldn't happen anyway, it's likely the server would 
ignore the answer either way.

I've added a check to my smb.lua class (haven't committed it yet) that 
automatically changes a blank server challenge to 'AAAAAAAA'.

Do we maybe want to add this check deeper, though? Like, in 
openssl.encrypt(), do a check on the data + the version and return an 
error (or return known bad data) if we end up in the situation?

Ron

_______________________________________________
Sent through the nmap-dev mailing list
http://cgi.insecure.org/mailman/listinfo/nmap-dev
Archived at http://SecLists.Org