Re: Suggestion for Docs

[Michael Pattrick <mpattrick () rhinovirus org>]

On Fri, Jan 15, 2010 at 6:16 AM, Rob Nicholls <robert () robnicholls co uk> wrote:
> I'm just against
> hardcoded commands, as drive letters and paths can vary (for example, the
> default location for net.exe on a Windows x64 host is SysWOW64 not system32,
> although there is one in system32).

And you are correct! I was trying to avoid conflict with another
hypothetical 'net' command in the path, but seeing as system32 is the
first path entry by default that shouldn't be an issue.

> I've tried David's new code, and although it was strange seeing a Microsoft
> dialog box pop up rather than anything Nmap related (I guess that's just how
> UAC handles it), it did work as described. One thing that was odd, however,
> was the error message when I told Nmap to run an unprivileged scan:

No way to get around that, one of the UAC security features is you
can't brand it.

> C:\nmap-svn\mswin32\Release>nmap www.robnicholls.co.uk -vv --unprivileged
> Unable to start NPF service: ShellExecute returned 5.
> Resorting to unprivileged (non-administrator) mode.
>
> I'm not sure if it's an easy fix, but is it possible to only prompt if the
> user hasn't requested an unprivileged scan?

IMO, line 231 of winfix.cc should be:
o.have_pcap = o.have_pcap && o.isr00t && start_npf();

-M

> -----Original Message-----
> From: nmap-dev-bounces () insecure org [mailto:nmap-dev-bounces () insecure org]
> On Behalf Of David Fifield
> Sent: 15 January 2010 05:32
> To: nmap-dev () insecure org
> Subject: Re: Suggestion for Docs
>
> On Thu, Jan 14, 2010 at 06:49:34AM -0500, Michael Pattrick wrote:
> > On Thu, Jan 14, 2010 at 6:32 AM, Rob Nicholls <robert () robnicholls co uk>
> wrote:
> > > The recommendation to fix the issue, however, might be more complicated
> as
> > > there are several ways of doing it: run Nmap/Zenmap at least once using
> Run
> > > as Administrator, or modify a registry key and reboot, or run the
> command
> > > "net start npf" using an elevated Command Prompt. I wouldn't like to
> > > recommend that people always run Nmap/Zenmap as Administrator.
> >
> > Attached is a small program which will run 'net start npf' from an
> > elevated command.
>
> Michael, that was very helpful. Having Nmap run that ShellExecute
> function makes the UAC dialog appear and load NPF. I found that it works
> even without the full path to net.exe.
>
> > From Wireshark I found the way to check if NPF is already running. I've
> committed code that starts NPF with ShellExecute only when necessary. It
> seems to work well. The UAC dialog appears the first time you run the
> program, and doesn't after that.
>
> David Fifield
> _______________________________________________
> Sent through the nmap-dev mailing list
> http://cgi.insecure.org/mailman/listinfo/nmap-dev
> Archived at http://seclists.org/nmap-dev/
>
>
> _______________________________________________
> Sent through the nmap-dev mailing list
> http://cgi.insecure.org/mailman/listinfo/nmap-dev
> Archived at http://seclists.org/nmap-dev/
_______________________________________________
Sent through the nmap-dev mailing list
http://cgi.insecure.org/mailman/listinfo/nmap-dev
Archived at http://seclists.org/nmap-dev/