[Ncrack] nsock WRITE unexpected status problem

[ithilgore <ithilgore.ryu.l () gmail com>]

> Hello,
>
> I have been trying to test Intrusion Detection running on IBM z/OS machine. I found out that NCRACK was available.
>
> I downloaded the most current version and ran it as seen below:
>
>
> C:\WINDOWS\system32>ncrack mvsz:21 mvsz:22
>
> Starting Ncrack 0.2ALPHA ( http://ncrack.org ) at 2010-06-14 10:40 Eastern Daylight Time
> ftp://10.190.0.3:21 WARNING: nsock WRITE unexpected status 3
>
>
> It took a long time for the message to show up, at least 1 hour. I saw no evidence of any attempts except for syslogd 
> recording of the entry.
>
>
> Jim Lou
> CITY of NEW YORK   NETWORK SYSTEMS
> 15 MTC 18th Floor
> Brooklyn, NY   11201
>
> jimlou () doitt nyc gov<mailto:jimlou () doitt nyc gov>
>
> WORK - 718-403-8115
> CELL  - 3475380825
>
> 718-403-8140 (Network Systems Hotline)


This is a response to: http://seclists.org/nmap-dev/2010/q2/879 which for
some reason (perhaps lack of 'Subject' ?) didn't reach my inbox. Luckily, I
saw it by chance through twitter.

I tried running the latest version of Ncrack from a Windows machine against
an FTP and an SSH server at the same time and couldn't reproduce the
problem. The cracking goes on for more than 3 hours without any such fatal
message appearing. I specifically ran it against proftpd (1.3.3) and
opensshd (5.5).

Could you please paste some of the debugging output (rerun by using the
switch -d10) and also specify what kind of server software the target was
running?

Thanks,
ithilgore


-- 
http://sock-raw.org
http://twitter.com/ithilgore
_______________________________________________
Sent through the nmap-dev mailing list
http://cgi.insecure.org/mailman/listinfo/nmap-dev
Archived at http://seclists.org/nmap-dev/