UPNP is lots of fun ;-)
A quick way to find all upnp on your network is to send out UDP UPNP
advertisement to port 1900 and have the vulnerable hosts connect back to one
of your webservers. Then, just cull your web logs for all vulnerable
machines. Assuming you have all pingable IP's in a text file (foo.txt) you
could do
$ for i in `cat foo.txt`; do nasl -t $i findpnp.nasl; done
then do a
$grep "foo.xms" <weblogs> on your web server
and the findpnp.nasl would be:
myaddr = this_host();
dstaddr = get_host_ip();
returnport = 80;
websrv = "10.10.10.55"; #change this to your web server IP
mystring = string("NOTIFY * HTTP/1.1\r\n");
mystring = mystring + string("HOST: ", "239.255.255.250" , ":1900\r\n");
mystring = mystring + string("CACHE-CONTROL: max-age=10\r\n");
mystring = mystring + string("LOCATION: http://"; , websrv, ":" ,
returnport , "/foo.xms\r\n");
mystring = mystring + string("NT:
urn:schemas-upnp-org:device:InternetGatewayDevice:1\r\n");
mystring = mystring + string("NTS: ssdp:alive\r\n");
mystring = mystring + string("SERVER: EEYE/2001 UPnP/1.0
product/1.1\r\n");
mystring = mystring + string("USN: uuid:EEYE\r\n\r\n");
len = strlen(mystring);
ippkt = forge_ip_packet(
ip_hl :5,
ip_v :4,
ip_tos :0, vice
ip_len :20,
ip_id :31337,
ip_off :0,
ip_ttl :64,
ip_p :IPPROTO_UDP,
ip_src :myaddr
);
udppacket = forge_udp_packet(
ip :ippkt,
uh_sport:1900,
uh_dport:1900,
uh_ulen :8 + len,
data :mystring
);
rpkt = send_packet(udppacket, pcap_active:FALSE);
John Lampe
https://f00dikator.hn.org/
"In Germany, they first came for the communists, and I didn't speak up
because I wasn't a communist. Then they came for the
Jews, and I didn't speak up because I wasn't a Jew. Then they came for
the trade unionists, and I didn't speak up because I
wasn't a trade unionist. Then they came for the Catholics and I didn't
speak up because I wasn't a Catholic. Then they came for me - and by
that time there was nobody left to speak up."
--Martin Niemvller
----- Original Message -----
From: "Michael Scheidell" <[EMAIL PROTECTED]>
To: <[EMAIL PROTECTED]>
Sent: Thursday, December 27, 2001 9:04 PM
Subject: Re: anyone working on a UpnP detector plugin?
> Besides... along with finding the open ports, could so the smb_nt* stuff
to
> check the registry
>
> Anyone had the smb_nt_* registry stuff work on win2k workstations? or XP
> workstations?
> I only have access to XP 'home' right now and it won't let remote access
> (does show some strange accounts that XP account/user manager doesn't see)
> also, XP seems to want to 'phone home' (doing ntp on
> windowstime.microsoft.com)
> --
> Michael Scheidell
> Secnap Network Security, LLC
> [EMAIL PROTECTED] 1+(561) 368-9561
> See updated IT Security News at http://www.fdma.com/
>
> ----- Original Message -----
> From: "John Lampe" <[EMAIL PROTECTED]>
> To: "Michael Scheidell" <[EMAIL PROTECTED]>; <[EMAIL PROTECTED]>
> Sent: Thursday, December 27, 2001 10:51 AM
> Subject: Re: anyone working on a UpnP detector plugin?
>
>
> > I can find UpnP via NASL script...It gets thorny if you want to serve
up
> > the overflow from port 1900...plus, the details of the overflow have not
> yet
> > been released.
> >
