I discovered that on a 1900 node scan, the only 6 computers that showed
possitive for upnp were win2k systems!
I started to look at it and decided to add checking for tcp port 5000 in the
plugin.
This is an easy plugin to run, doesn't require any dependencies. Can be run
from nasl command line or GUI.
I would like ot get feedback on these changes and see if they eliminate
false positives and detect ALL RUNNING PNP devices?
Thanks.
(yeh, I guess I could do udp 1900 stuff, but this is faster)
--- src/nessus-plugins/scripts/upnp_xp.nasl Sat Dec 29 09:32:22 2001
+++ lib/nessus/plugins/upnp_xp.nasl Fri Jan 4 18:13:16 2002
@@ -30,11 +30,17 @@
script_copyright(english:"This script is Copyright (C) 2001 by John
Lampe",);
family["english"] = "General";
script_family(english:family["english"]);
+ script_require_ports(5000);
exit(0);
}
#script based on eeye advisory Multiple Remote Windows XP/ME/98
Vulnerabilities
-
+if (get_port_state(5000))
+ {
+ soctcp = open_sock_tcp(5000);
+ if(!soctcp)exit(0);
+ close(soctcp);
+ }
myaddr = this_host();
dstaddr = get_host_ip();
returnport = 80;
@@ -101,6 +107,6 @@
flags = get_tcp_element(tcp:rpkt2, element:"th_flags");
if (flags & TH_SYN) {
- security_hole(1900);
+ security_hole(port:1900,protocol:"udp");
}
--
Michael Scheidell
Secnap Network Security, LLC
[EMAIL PROTECTED] 1+(561) 368-9561
See updated IT Security News at http://www.fdma.com/
