Re: Follow up to NMAP on Snow Leopard with VMWARE Fusion installed

[Jay Fink <jay.fink () gmail com>]

On Tue, Sep 22, 2009 at 9:22 PM, David Fifield <david () bamsoftware com> wrote:
> On Mon, Sep 21, 2009 at 07:28:50AM -0400, Walt Scrivens wrote:
> > Here's some more info - this time with 5.00.  I did the same scan
> > through Zenmap, running natively under Snow Leopard, and running as a
> > Windows 7 VM under VMWare Fusion under Snow Leopard.  Same computer,
> > same network.
> > I used the "canned" Intense Scan profile in Zenmap from the Windows vm,
> > and copy/pasted it into the Mac Zenmap since its version of Intense Scan
> > did not include the -PE -PS22,25,80 -PA21,23,80,3389
> >
> > It looks to me as if the Mac user scan worked correctly, being the same
> > as the Windows scan less that which requires root to run.  The Mac root
> > scan fails miserably.
> >
> > Now the Mac version:
> > ======================================
> > nmap -T4 -A -v -PE -PS22,25,80 -PA21,23,80,3389 192.168.1.1
> >
> > Starting Nmap 5.00 ( http://nmap.org ) at 2009-09-21 07:10 EDT
> > NSE: Loaded 30 scripts for scanning.
> > Initiating ARP Ping Scan at 07:10
> > Scanning 192.168.1.1 [1 port]
> > Completed ARP Ping Scan at 07:10, 0.21s elapsed (1 total hosts)
> > Read data files from: /usr/local/share/nmap
> > Note: Host seems down. If it is really up, but blocking our ping probes,
> > try -PN
> > Nmap done: 1 IP address (0 hosts up) scanned in 0.47 seconds
> >            Raw packets sent: 2 (84B) | Rcvd: 0 (0B)
> >
> > =======================================
>
> This is a known problem that has already been fixed in Subversion. Can
> you reproduce it with a recent checkout? The problem exists in the 5.00
> release.

This is using svn r15553 on osX 10.5.8 against a vm that uses NAT'd networking.
Note from my previous email it does the *reverse* on a vm that uses
bridged networking.
It does not seem to matter what OS the vm is running - this looks to
be particular to
fusion:


[08:24:00 :~/src/nmap]$ ./nmap -T4 -A -v -PE -PS22,25,80 -PA21,23,80,3389 pradu
Warning:  You are not root -- using TCP pingscan rather than ICMP

Starting Nmap 5.05BETA1 ( http://nmap.org ) at 2009-09-23 08:35 EDT
NSE: Loaded 33 scripts for scanning.
Initiating Ping Scan at 08:35
Scanning 172.16.0.128 [6 ports]
Completed Ping Scan at 08:35, 1.10s elapsed (1 total hosts)
Initiating Connect Scan at 08:35
Scanning pradu (172.16.0.128) [1000 ports]
Discovered open port 22/tcp on 172.16.0.128
Completed Connect Scan at 08:35, 5.49s elapsed (1000 total ports)
Initiating Service scan at 08:35
Scanning 1 service on pradu (172.16.0.128)
Completed Service scan at 08:35, 0.12s elapsed (1 service on 1 host)
NSE: Script scanning 172.16.0.128.
NSE: Starting runlevel 1 scan
Initiating NSE at 08:35
Completed NSE at 08:35, 0.32s elapsed
NSE: Script Scanning completed.
Host pradu (172.16.0.128) is up (0.00086s latency).
Interesting ports on pradu (172.16.0.128):
Not shown: 999 closed ports
PORT   STATE SERVICE VERSION
22/tcp open  ssh     OpenSSH 5.2p1 (FreeBSD 20090522; protocol 2.0)
|  ssh-hostkey: 1024 5f:6b:c0:8b:44:db:6c:08:3c:f1:7a:61:3b:e2:33:da (DSA)
|_ 2048 13:7d:b0:52:36:c3:1c:df:f6:20:58:de:f8:73:e5:77 (RSA)
Service Info: OS: FreeBSD

Read data files from: .
Service detection performed. Please report any incorrect results at
http://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 7.22 seconds
[08:35:43 :~/src/nmap]$ sudo ./nmap -T4 -A -v -PE -PS22,25,80
-PA21,23,80,3389 pradu
Password:

Starting Nmap 5.05BETA1 ( http://nmap.org ) at 2009-09-23 08:35 EDT
NSE: Loaded 33 scripts for scanning.
Warning: Unable to open interface vmnet8 -- skipping it.
Warning: Unable to open interface vmnet1 -- skipping it.
Initiating Ping Scan at 08:35
Scanning 172.16.0.128 [8 ports]
Completed Ping Scan at 08:35, 2.06s elapsed (1 total hosts)
Read data files from: .
Note: Host seems down. If it is really up, but blocking our ping probes, try -PN
Nmap done: 1 IP address (0 hosts up) scanned in 2.31 seconds
           Raw packets sent: 16 (640B) | Rcvd: 0 (0B)


j

_______________________________________________
Sent through the nmap-dev mailing list
http://cgi.insecure.org/mailman/listinfo/nmap-dev
Archived at http://SecLists.Org