Nmap Development mailing list archives

Previous By Date Next
Previous By Thread Next

Wireshark dissections of proposed UDP payloads

From: David Fifield <david () bamsoftware com>
Date: Mon, 10 Aug 2009 14:53:40 -0600
On Wed, Jul 22, 2009 at 11:55:42AM -0600, David Fifield wrote:

On Sat, Jul 04, 2009 at 11:59:23AM +0200, kx wrote:

This sounds like a really good idea! Out of curiosity, have you
played with any of Unicornscan's UDP payloads?

http://osace.svn.sourceforge.net/viewvc/osace/trunk/etc/payloads.conf?view=markup

This is one of the reasons Unicornscan started as udpscan in 2004.

In their faq they recognize another udp scanner:
http://www.geocities.com/fryxar/scanudp.c

This perl script also has a lot of nice UDP payloads, including some from nmap:

https://labs.portcullis.co.uk/application/udp-proto-scanner/
Inside the tgz: udp-proto-scanner.conf


Here's a summary of payloads we might want to incorporate. Of this list,
I think the most likely candidates are 111/rpcbind, 177/xdmcp,
500/isakmp, 520/route, 1645/radius, 1812/radius, 2049/nfs,
5353/zeroconf, 5632/pcanywherestat. Those are the ones in the top 100
UDP ports, anyway. I would appreciate if some experts could examine
those payloads and comment on their safety.


Here are Wireshark dissections of payloads for these protocols. At a
first glance, they all look safe except for {1645,1812}/radius, which
uses a default username and password. Can anyone confirm that these
payloads are safe, that they won't change state on a server, annoy an
admin, or be flagged as an intrusion attempt?

The nmap that sent these payloads can be got with
svn co --username guest --password "" svn://svn.insecure.org/nmap-exp/david/nmap-payloads

David Fifield

User Datagram Protocol, Src Port: 61715 (61715), Dst Port: sunrpc (111)
Remote Procedure Call, Type:Call XID:0x72fe1d13
    XID: 0x72fe1d13 (1929256211)
    Message Type: Call (0)
    RPC Version: 2
    Program: Portmap (100000)
    Program Version: 104316
    Procedure: proc-0 (0)
    Credentials
        Flavor: AUTH_NULL (0)
        Length: 0
    Verifier
        Flavor: AUTH_NULL (0)
        Length: 0
Portmap
    [Program Version: 104316]
    [Procedure: proc-0 (0)]
0000  00 15 05 a2 c7 00 00 50 bf 16 11 61 08 00 45 00   .......P...a..E.
0010  00 44 cc a1 00 00 34 11 f5 44 c0 a8 00 15 01 02   .D....4..D......
0020  03 04 f1 13 00 6f 00 30 9b 15 72 fe 1d 13 00 00   .....o.0..r.....
0030  00 00 00 00 00 02 00 01 86 a0 00 01 97 7c 00 00   .............|..
0040  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00   ................
0050  00 00                                             ..

User Datagram Protocol, Src Port: 61715 (61715), Dst Port: xdmcp (177)
X Display Manager Control Protocol
    Version: 1
    Opcode: Query (0x0002)
    Message length: 1
    Authorization names (0)
0000  00 15 05 a2 c7 00 00 50 bf 16 11 61 08 00 45 00   .......P...a..E.
0010  00 24 71 2f 00 00 25 11 5f d7 c0 a8 00 15 01 02   .$q/..%._.......
0020  03 04 f1 13 00 b1 00 10 49 42 00 01 00 02 00 01   ........IB......
0030  00 00                                             ..

User Datagram Protocol, Src Port: 61715 (61715), Dst Port: isakmp (500)
Internet Security Association and Key Management Protocol
    Initiator cookie: 4D13F384E6A3EDAF
    Responder cookie: 0000000000000000
    Next payload: Security Association (1)
    Version: 1.0
    Exchange type: Identity Protection (Main Mode) (2)
    Flags: 0x00
        .... ...0 = Not encrypted
        .... ..0. = No commit
        .... .0.. = No authentication
    Message ID: 0x00000000
    Length: 336
    Security Association payload
        Next payload: NONE (0)
        Payload length: 308
        Domain of interpretation: IPSEC (1)
        Situation: IDENTITY (1)
        Proposal payload # 1
            Next payload: NONE (0)
            Payload length: 296
            Proposal number: 1
            Protocol ID: ISAKMP (1)
            SPI Size: 0
            Proposal transforms: 8
            Transform payload # 1
                Next payload: Transform (3)
                Payload length: 36
                Transform number: 1
                Transform ID: KEY_IKE (1)
                Encryption-Algorithm (1): 3DES-CBC (5)
                Hash-Algorithm (2): SHA (2)
                Authentication-Method (3): PSK (1)
                Group-Description (4): Alternate 1024-bit MODP group (2)
                Life-Type (11): Seconds (1)
                Life-Duration (12): Duration-Value (28800)
            Transform payload # 2
                Next payload: Transform (3)
                Payload length: 36
                Transform number: 2
                Transform ID: KEY_IKE (1)
                Encryption-Algorithm (1): 3DES-CBC (5)
                Hash-Algorithm (2): MD5 (1)
                Authentication-Method (3): PSK (1)
                Group-Description (4): Alternate 1024-bit MODP group (2)
                Life-Type (11): Seconds (1)
                Life-Duration (12): Duration-Value (28800)
            Transform payload # 3
                Next payload: Transform (3)
                Payload length: 36
                Transform number: 3
                Transform ID: KEY_IKE (1)
                Encryption-Algorithm (1): DES-CBC (1)
                Hash-Algorithm (2): SHA (2)
                Authentication-Method (3): PSK (1)
                Group-Description (4): Alternate 1024-bit MODP group (2)
                Life-Type (11): Seconds (1)
                Life-Duration (12): Duration-Value (28800)
            Transform payload # 4
                Next payload: Transform (3)
                Payload length: 36
                Transform number: 4
                Transform ID: KEY_IKE (1)
                Encryption-Algorithm (1): DES-CBC (1)
                Hash-Algorithm (2): MD5 (1)
                Authentication-Method (3): PSK (1)
                Group-Description (4): Alternate 1024-bit MODP group (2)
                Life-Type (11): Seconds (1)
                Life-Duration (12): Duration-Value (28800)
            Transform payload # 5
                Next payload: Transform (3)
                Payload length: 36
                Transform number: 5
                Transform ID: KEY_IKE (1)
                Encryption-Algorithm (1): 3DES-CBC (5)
                Hash-Algorithm (2): SHA (2)
                Authentication-Method (3): PSK (1)
                Group-Description (4): Default 768-bit MODP group (1)
                Life-Type (11): Seconds (1)
                Life-Duration (12): Duration-Value (28800)
            Transform payload # 6
                Next payload: Transform (3)
                Payload length: 36
                Transform number: 6
                Transform ID: KEY_IKE (1)
                Encryption-Algorithm (1): 3DES-CBC (5)
                Hash-Algorithm (2): MD5 (1)
                Authentication-Method (3): PSK (1)
                Group-Description (4): Default 768-bit MODP group (1)
                Life-Type (11): Seconds (1)
                Life-Duration (12): Duration-Value (28800)
            Transform payload # 7
                Next payload: Transform (3)
                Payload length: 36
                Transform number: 7
                Transform ID: KEY_IKE (1)
                Encryption-Algorithm (1): DES-CBC (1)
                Hash-Algorithm (2): SHA (2)
                Authentication-Method (3): PSK (1)
                Group-Description (4): Default 768-bit MODP group (1)
                Life-Type (11): Seconds (1)
                Life-Duration (12): Duration-Value (28800)
            Transform payload # 8
                Next payload: NONE (0)
                Payload length: 36
                Transform number: 8
                Transform ID: KEY_IKE (1)
                Encryption-Algorithm (1): DES-CBC (1)
                Hash-Algorithm (2): MD5 (1)
                Authentication-Method (3): PSK (1)
                Group-Description (4): Default 768-bit MODP group (1)
                Life-Type (11): Seconds (1)
                Life-Duration (12): Duration-Value (28800)
0000  00 15 05 a2 c7 00 00 50 bf 16 11 61 08 00 45 00   .......P...a..E.
0010  01 6c 10 ee 00 00 28 11 bb d0 c0 a8 00 15 01 02   .l....(.........
0020  03 04 f1 13 01 f4 01 58 69 18 4d 13 f3 84 e6 a3   .......Xi.M.....
0030  ed af 00 00 00 00 00 00 00 00 01 10 02 00 00 00   ................
0040  00 00 00 00 01 50 00 00 01 34 00 00 00 01 00 00   .....P...4......
0050  00 01 00 00 01 28 01 01 00 08 03 00 00 24 01 01   .....(.......$..
0060  00 00 80 01 00 05 80 02 00 02 80 03 00 01 80 04   ................
0070  00 02 80 0b 00 01 00 0c 00 04 00 00 70 80 03 00   ............p...
0080  00 24 02 01 00 00 80 01 00 05 80 02 00 01 80 03   .$..............
0090  00 01 80 04 00 02 80 0b 00 01 00 0c 00 04 00 00   ................
00a0  70 80 03 00 00 24 03 01 00 00 80 01 00 01 80 02   p....$..........
00b0  00 02 80 03 00 01 80 04 00 02 80 0b 00 01 00 0c   ................
00c0  00 04 00 00 70 80 03 00 00 24 04 01 00 00 80 01   ....p....$......
00d0  00 01 80 02 00 01 80 03 00 01 80 04 00 02 80 0b   ................
00e0  00 01 00 0c 00 04 00 00 70 80 03 00 00 24 05 01   ........p....$..
00f0  00 00 80 01 00 05 80 02 00 02 80 03 00 01 80 04   ................
0100  00 01 80 0b 00 01 00 0c 00 04 00 00 70 80 03 00   ............p...
0110  00 24 06 01 00 00 80 01 00 05 80 02 00 01 80 03   .$..............
0120  00 01 80 04 00 01 80 0b 00 01 00 0c 00 04 00 00   ................
0130  70 80 03 00 00 24 07 01 00 00 80 01 00 01 80 02   p....$..........
0140  00 02 80 03 00 01 80 04 00 01 80 0b 00 01 00 0c   ................
0150  00 04 00 00 70 80 00 00 00 24 08 01 00 00 80 01   ....p....$......
0160  00 01 80 02 00 01 80 03 00 01 80 04 00 01 80 0b   ................
0170  00 01 00 0c 00 04 00 00 70 80                     ........p.

User Datagram Protocol, Src Port: 61715 (61715), Dst Port: router (520)
Routing Information Protocol
    Command: Request (1)
    Version: RIPv1 (1)
    Address not specified, Metric: 16
        Address Family: Unspecified (0)
        Metric: 16
0000  00 15 05 a2 c7 00 00 50 bf 16 11 61 08 00 45 00   .......P...a..E.
0010  00 34 fc 52 00 00 2e 11 cb a3 c0 a8 00 15 01 02   .4.R............
0020  03 04 f1 13 02 08 00 20 46 be 01 01 00 00 00 00   ....... F.......
0030  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00   ................
0040  00 10                                             ..

User Datagram Protocol, Src Port: 61715 (61715), Dst Port: radius (1812)
Radius Protocol
    Code: Access-Request (1)
    Packet identifier: 0x86 (134)
    Length: 53
    Authenticator: 6005909077740814E8FAB968963DD1BA
    Attribute Value Pairs
        AVP: l=3  t=User-Name(1): a
            User-Name: a
        AVP: l=18  t=User-Password(2): Encrypted
            User-Password: \321\226\340`I"\265h\312\300\323\374\325UC/
        AVP: l=6  t=NAS-IP-Address(4): 255.255.255.255
            NAS-IP-Address: 255.255.255.255 (255.255.255.255)
        AVP: l=6  t=NAS-Port(5): 1
            NAS-Port: 1
0000  00 15 05 a2 c7 00 00 50 bf 16 11 61 08 00 45 00   .......P...a..E.
0010  00 51 22 4b 00 00 39 11 9a 8e c0 a8 00 15 01 02   .Q"K..9.........
0020  03 04 f1 13 07 14 00 3d 7f dd 01 86 00 35 60 05   .......=.....5`.
0030  90 90 77 74 08 14 e8 fa b9 68 96 3d d1 ba 01 03   ..wt.....h.=....
0040  61 02 12 d1 96 e0 60 49 22 b5 68 ca c0 d3 fc d5   a.....`I".h.....
0050  55 43 2f 04 06 ff ff ff ff 05 06 00 00 00 01      UC/............

User Datagram Protocol, Src Port: 61715 (61715), Dst Port: nfs (2049)
Remote Procedure Call, Type:Call XID:0x12345678
    XID: 0x12345678 (305419896)
    Message Type: Call (0)
    RPC Version: 2
    Program: NFS (100003)
    Program Version: 2
    Procedure: NULL (0)
    Credentials
        Flavor: AUTH_NULL (0)
        Length: 0
    Verifier
        Flavor: AUTH_NULL (0)
        Length: 0
Network File System
    [Program Version: 2]
    [V2 Procedure: NULL (0)]
0000  00 15 05 a2 c7 00 00 50 bf 16 11 61 08 00 45 00   .......P...a..E.
0010  00 44 6a 1d 00 00 25 11 66 c9 c0 a8 00 15 01 02   .Dj...%.f.......
0020  03 04 f1 13 08 01 00 30 52 61 12 34 56 78 00 00   .......0Ra.4Vx..
0030  00 00 00 00 00 02 00 01 86 a3 00 00 00 02 00 00   ................
0040  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00   ................
0050  00 00                                             ..

User Datagram Protocol, Src Port: 61715 (61715), Dst Port: mdns (5353)
Domain Name System (query)
    Transaction ID: 0x0000
    Flags: 0x0000 (Standard query)
        0... .... .... .... = Response: Message is a query
        .000 0... .... .... = Opcode: Standard query (0)
        .... ..0. .... .... = Truncated: Message is not truncated
        .... ...0 .... .... = Recursion desired: Don't do query recursively
        .... .... .0.. .... = Z: reserved (0)
        .... .... ...0 .... = Non-authenticated data OK: Non-authenticated data is unacceptable
    Questions: 1
    Answer RRs: 0
    Authority RRs: 0
    Additional RRs: 0
    Queries
        _services._dns-sd._udp.local: type PTR, class IN, "QM" question
            Name: _services._dns-sd._udp.local
            Type: PTR (Domain name pointer)
            .000 0000 0000 0001 = Class: IN (0x0001)
            0... .... .... .... = "QU" question: False
0000  00 15 05 a2 c7 00 00 50 bf 16 11 61 08 00 45 00   .......P...a..E.
0010  00 4a 06 02 00 00 2f 11 c0 de c0 a8 00 15 01 02   .J..../.........
0020  03 04 f1 13 14 e9 00 36 fe a8 00 00 00 00 00 01   .......6........
0030  00 00 00 00 00 00 09 5f 73 65 72 76 69 63 65 73   ......._services
0040  07 5f 64 6e 73 2d 73 64 04 5f 75 64 70 05 6c 6f   ._dns-sd._udp.lo
0050  63 61 6c 00 00 0c 00 01                           cal.....

_______________________________________________
Sent through the nmap-dev mailing list
http://cgi.insecure.org/mailman/listinfo/nmap-dev
Archived at http://SecLists.Org
Previous By Date Next
Previous By Thread Next

Current thread: