Re: [Openvas-discuss] OpenVAS 7 in Kali can't SSH into target server for local tests
On the target, it's OpenSSH_5.9p1 Debian-5ubuntu1.4, OpenSSL 1.0.1 14 Mar 2012 The version on my Kali VM is OpenSSH_6.0p1 Debian-4+deb7u2, OpenSSL 1.0.1e 11 Feb 2013 Thanks, Wesley On 12/17/2014 12:25 AM, Michael Meyer wrote: *** Wesley Botham wrote: I asked on Server Fault if you want to read there: http://serverfault.com/questions/652693/openvas-7-failing-to-ssh-into-a-test-server OpenSSH version on the target? Micha ___ Openvas-discuss mailing list Openvas-discuss@wald.intevation.org https://lists.wald.intevation.org/cgi-bin/mailman/listinfo/openvas-discuss
Re: [Openvas-discuss] OpenVAS OMP CLI Examples :Comprehensive Configuration Guide/Tutorial?
Am Montag, 13. Oktober 2014, 18:37:05 schrieb Traiano Welcome: Is there a through guide or tutorial on how to configure and use OMP via the cli ? The scattered examples on the net are mostly outdated and incomplete, and the documentation on this is pretty thin on actual working examples. Apart from the API document there are some examples in the Learning Center of the Greenbone website which should be uptodate and working. We are lacking a real programmers guide for OMP indeed. -- Dr. Jan-Oliver Wagner | ++49-541-335084-0 | http://www.greenbone.net/ Greenbone Networks GmbH, Neuer Graben 17, 49074 Osnabrück | AG Osnabrück, HR B 202460 Geschäftsführer: Lukas Grunwald, Dr. Jan-Oliver Wagner ___ Openvas-discuss mailing list Openvas-discuss@wald.intevation.org https://lists.wald.intevation.org/cgi-bin/mailman/listinfo/openvas-discuss
Re: [Openvas-discuss] OpenVas 7 PDF-generation on CentOS 7
Am Dienstag, 14. Oktober 2014, 14:37:38 schrieb Dustin Demuth: I'd like to open an discussion for PDF-Generation on CentOS 7. Currently this is failing, as the dependency texlive-collection-latexextra is missing in the CentOS repositories. So my Idea is the solution^W circumvention below, which could also be posted to the Wiki, if you agree with it. thanks for posting the work around which should help the CentOS users for sure. Please feel free to add such guides to the Wiki. -- Dr. Jan-Oliver Wagner | ++49-541-335084-0 | http://www.greenbone.net/ Greenbone Networks GmbH, Neuer Graben 17, 49074 Osnabrück | AG Osnabrück, HR B 202460 Geschäftsführer: Lukas Grunwald, Dr. Jan-Oliver Wagner ___ Openvas-discuss mailing list Openvas-discuss@wald.intevation.org https://lists.wald.intevation.org/cgi-bin/mailman/listinfo/openvas-discuss
Re: [Openvas-discuss] Known vulnerabilities not discovered.
Am Montag, 13. Oktober 2014, 19:24:43 schrieb Barkley, Joey: PROBLEM: I cannot get OpenVAS v7 to scan a Windows 7 system properly and detect an insecure version of Firefox. it is hard to guess what might be going wrong. I would simplify the scenario you are running. A standard FF should be sufficient in combination with a credential. I only can offer some general notes, perhaps you already checked these. Check whether the scanner uses the newest feed. There should be a log message that tells you whether the authentication with the credential worked properly or not. Have you checked the Error section of the Report View for any error messages? DETAILS: I have installed OpenVAS 7 on a CentOS 7 system. I have updated to the latest definitions. I have copied the “Full and very deep” Scan Configuration and made the following changes: 1. Added General Test Family 2. Enabled Aggressive OS detection AND Identify the remote OS under “Launch Nmap for Network Scanning” 3. Enabled Identify the remote OS under “Nmap (NASL wrapper)” I have a Windows 7 Ultimate VM that is not connected to a domain. I have installed Firefox v25 on this system. It has a local admin account enabled. I have added SMB credentials to my OpenVAS server. I did not preface this account with a \, but I have tried this also and it does not correct the issue. I have added the IP of the VM as a target, and then create a new task to scan with my modified config for that target with the appropriate credentials. When I run the scan, the host is found, but is identified by the default mechanism as an HP Jet Direct OS. After the scan has completed, there are 6 entries in the report: CPE Inventory, Host Summary, OS fingerprinting, arachnid (NASL wrapper), Traceroute, and Microsoft SMB Signing Disabled. All are considered (Log) severity. SPECULATION: I am assuming that since the OS fingerprinting process is not completing correctly, the Windows checks (and possibly the authentication) are not even being executed. Is there something that I can do to force the task to use the nmap checks instead of the incorrect one? Or perhaps something is not working properly with authentication? Should I change something there? If I execute this same scan against a target that is on the domain (Win2008 and Win2012) it appears to correctly identify the OS and scan the system properly, but I cannot install the outdated Firefox on these systems to check. Any help is greatly appreciated. -- Dr. Jan-Oliver Wagner | ++49-541-335084-0 | http://www.greenbone.net/ Greenbone Networks GmbH, Neuer Graben 17, 49074 Osnabrück | AG Osnabrück, HR B 202460 Geschäftsführer: Lukas Grunwald, Dr. Jan-Oliver Wagner ___ Openvas-discuss mailing list Openvas-discuss@wald.intevation.org https://lists.wald.intevation.org/cgi-bin/mailman/listinfo/openvas-discuss
Re: [Openvas-discuss] Openvas-discuss Openvas 7 Installation error on CentOS 6.5
Am Dienstag, 14. Oktober 2014, 15:25:37 schrieb Shwetank Sharma: I am trying to compile openvas 7 from source. All packages are compiled successfully. But when I tried to sync NVT every time I got the error mentioned below. openvas-nvt-sync openvassd: error while loading shared libraries: libopenvas_misc.so.7: cannot open shared object file: No such file or directory I think this should be addressed first. Maybe you need a LD_LIBRARY_PATH to where you installed the libs. The path needs to be known by the environment that calls openvassd. -- Dr. Jan-Oliver Wagner | ++49-541-335084-0 | http://www.greenbone.net/ Greenbone Networks GmbH, Neuer Graben 17, 49074 Osnabrück | AG Osnabrück, HR B 202460 Geschäftsführer: Lukas Grunwald, Dr. Jan-Oliver Wagner ___ Openvas-discuss mailing list Openvas-discuss@wald.intevation.org https://lists.wald.intevation.org/cgi-bin/mailman/listinfo/openvas-discuss
Re: [Openvas-discuss] share sockets
Am Donnerstag, 16. Oktober 2014, 05:08:24 schrieb flymolon: I've been told that everytime a script's about to exit, the socket(s) it opened should be closed. Now I want to know how the scripts share sockets, and how the openvassd processes share sockets. Anybody knows? A NVT that opens a socket does not share it with other NVTs. -- Dr. Jan-Oliver Wagner | ++49-541-335084-0 | http://www.greenbone.net/ Greenbone Networks GmbH, Neuer Graben 17, 49074 Osnabrück | AG Osnabrück, HR B 202460 Geschäftsführer: Lukas Grunwald, Dr. Jan-Oliver Wagner ___ Openvas-discuss mailing list Openvas-discuss@wald.intevation.org https://lists.wald.intevation.org/cgi-bin/mailman/listinfo/openvas-discuss
Re: [Openvas-discuss] 回复: install openvas has some problem
Am Samstag, 18. Oktober 2014, 09:09:09 schrieb r...@cnmoker.org: anybody konw what is problem? how fix it? usually the beta tar balls compile. I have never observed the problem, not even in SVN trunk. Have you the same problem still with the newest beta tar balls? -- Dr. Jan-Oliver Wagner | ++49-541-335084-0 | http://www.greenbone.net/ Greenbone Networks GmbH, Neuer Graben 17, 49074 Osnabrück | AG Osnabrück, HR B 202460 Geschäftsführer: Lukas Grunwald, Dr. Jan-Oliver Wagner ___ Openvas-discuss mailing list Openvas-discuss@wald.intevation.org https://lists.wald.intevation.org/cgi-bin/mailman/listinfo/openvas-discuss
Re: [Openvas-discuss] GSA and POODLE
Am Freitag, 17. Oktober 2014, 21:35:46 schrieb Daniel Malament: Is there a way to turn off SSLv3 on the Greenbone Security Assistant? there is a command line option for gsad --gnutls-priorities with which you control the ciphers. The abilities depend on the gnutls version you are using. -- Dr. Jan-Oliver Wagner | ++49-541-335084-0 | http://www.greenbone.net/ Greenbone Networks GmbH, Neuer Graben 17, 49074 Osnabrück | AG Osnabrück, HR B 202460 Geschäftsführer: Lukas Grunwald, Dr. Jan-Oliver Wagner ___ Openvas-discuss mailing list Openvas-discuss@wald.intevation.org https://lists.wald.intevation.org/cgi-bin/mailman/listinfo/openvas-discuss
Re: [Openvas-discuss] Scan on Slave dies at 3% consistently on Master, but Still continues on Slave
Am Samstag, 18. Oktober 2014, 17:13:33 schrieb Traiano Welcome: [Using openVAS 6, installed from the atomic repos. On CentOS 6.5] I'm running a scan initiated from a master node to a slave node. From the masters perspective the scan seems to die at 3% consistently, with the following messages in the master's logs. However, the scan continues on the slave! And there appear to be regular SIGSEGV errors in the openvassd logs on the slave during the scan process: --- [Sat Oct 18 14:35:19 2014][20293] SIGSEGV occured ! [Sat Oct 18 14:35:19 2014][20293] closing logfile [Sat Oct 18 14:35:19 2014][22681] Process 20293 seems to have died too early --- Is there a known cause for this kind of behavior, and how would I go about troubleshooting this further? sigsegv is bad and should not happen indeed. First thing to do is to check whether you are running the latest releases of the OpenVAS version you are running. These are available on the download source page and are send to openvas-announce. Once you ensured you are using the newest version and still observe the sigsegv the next thing to do is to increase the log level of openvasmd and see if the log offers a clue. Be aware that the verbosity can be very very extensive. -- Dr. Jan-Oliver Wagner | ++49-541-335084-0 | http://www.greenbone.net/ Greenbone Networks GmbH, Neuer Graben 17, 49074 Osnabrück | AG Osnabrück, HR B 202460 Geschäftsführer: Lukas Grunwald, Dr. Jan-Oliver Wagner ___ Openvas-discuss mailing list Openvas-discuss@wald.intevation.org https://lists.wald.intevation.org/cgi-bin/mailman/listinfo/openvas-discuss
Re: [Openvas-discuss] Task started via the CLI silently refuses to run
Am Samstag, 18. Oktober 2014, 18:29:05 schrieb Traiano Welcome: I've preconfigured targets and tasks for openvas using the gsad, and tested scanning via the gsad. Now I'd like to kick off a scan using the openvas-cli tool with something like: --- openvas-cli -v -u admin_user -w password -S task uuid --- ... Am I going about launching the task from the CLI the right way? If so, how would I debug this further? I am not sure I got the problem right. Howeverm the command line tool is called omp, not openvas-cli. You may try the -X option for omp to directly apply OMP commands and see the OMP responses. -- Dr. Jan-Oliver Wagner | ++49-541-335084-0 | http://www.greenbone.net/ Greenbone Networks GmbH, Neuer Graben 17, 49074 Osnabrück | AG Osnabrück, HR B 202460 Geschäftsführer: Lukas Grunwald, Dr. Jan-Oliver Wagner ___ Openvas-discuss mailing list Openvas-discuss@wald.intevation.org https://lists.wald.intevation.org/cgi-bin/mailman/listinfo/openvas-discuss
Re: [Openvas-discuss] No Scan results in OpenVAS-7
Am Mittwoch, 22. Oktober 2014, 16:06:05 schrieb Helmut Koers: I did setup OpenVAS-7 including Trusted NVTs according to the OpenVAS guidance like I did for OpenVAS-6 a couple of times already without issues. Unfortunately I do not see any results in any report, knowing there are some. The logfile openvas.dump shows (openvassd:15412): base gpgme-WARNING **: Setting GnuPG homedir failed: No such file or directory /var/lib/openvas/plugins/radius_detect.nasl: bad or missing signature. Will not execute this script for all scripts. As soon as I disable Trusted NVTs in /etc/openvas/openvassd.conf, I see the expected results in the reports. Has anything changed in these regards in OpenVAS-7? you correctly identified that the failing signatre check was the reason for no results :-) Bascially there was no change regarding the location of the gnupg signing key. It seems your v7 setup does not find it... -- Dr. Jan-Oliver Wagner | ++49-541-335084-0 | http://www.greenbone.net/ Greenbone Networks GmbH, Neuer Graben 17, 49074 Osnabrück | AG Osnabrück, HR B 202460 Geschäftsführer: Lukas Grunwald, Dr. Jan-Oliver Wagner ___ Openvas-discuss mailing list Openvas-discuss@wald.intevation.org https://lists.wald.intevation.org/cgi-bin/mailman/listinfo/openvas-discuss
Re: [Openvas-discuss] OpenVAS 7 installation
Am Freitag, 24. Oktober 2014, 19:58:11 schrieb Dominguez, Roland: Thanks everyone for the advice. Here's what I did. I exported one of the included scans as an XML file. Created a new scan and imported the XML file. Them I modified the ping host section to TCP based pings. Is this the proper method of solving the ICMP problem, where ICMP is blocked on a network? hm, very complicated method. If you simply change the Aive Test for the target in GSA, it is easier. Also, if there is some other than using the scan config default, the Value you enter manually to the scan config (like with your method above) gets overwritten. -- Dr. Jan-Oliver Wagner | ++49-541-335084-0 | http://www.greenbone.net/ Greenbone Networks GmbH, Neuer Graben 17, 49074 Osnabrück | AG Osnabrück, HR B 202460 Geschäftsführer: Lukas Grunwald, Dr. Jan-Oliver Wagner ___ Openvas-discuss mailing list Openvas-discuss@wald.intevation.org https://lists.wald.intevation.org/cgi-bin/mailman/listinfo/openvas-discuss
Re: [Openvas-discuss] CVE-2009-3095 in windows
Hello, reports about possible false positives or other bugs in the NVTs are best send to the openvas-plugins mailing list to ensure the NVT developers get aware of it. Am Montag, 27. Oktober 2014, 08:55:11 schrieb flymolon: The NVT secpod_apache_mod_proxy_ftp_cmd_inj_vuln.nasl detects CVE-2009-3095 for linux, but it filters windows out. There's an apache HTTP server in my windows server, here's its banner: HTTP/1.1 200 OK Date: Mon, 27 Oct 2014 07:28:40 GMT Server: Apache/2.2.13 (Win32) Last-Modified: Sat, 20 Nov 2004 07:16:26 GMT ETag: 1d0bb-2c-3e94b66c2e680 Accept-Ranges: bytes Content-Length: 44 Connection: close Content-Type: text/html X-Pad: avoid browser bug Does the vulnerability exist in it? or is there a tool I can use to test the attack? -- Dr. Jan-Oliver Wagner | ++49-541-335084-0 | http://www.greenbone.net/ Greenbone Networks GmbH, Neuer Graben 17, 49074 Osnabrück | AG Osnabrück, HR B 202460 Geschäftsführer: Lukas Grunwald, Dr. Jan-Oliver Wagner ___ Openvas-discuss mailing list Openvas-discuss@wald.intevation.org https://lists.wald.intevation.org/cgi-bin/mailman/listinfo/openvas-discuss
Re: [Openvas-discuss] Problem running OpenVAS
Am Montag, 27. Oktober 2014, 12:33:20 schrieb Andreas Walz: I'm trying to get OpenVAS running on my Linux machine since a few days...unfortunately without success :-(. I have built OpenVAS from sources using greenbone-security-assistant-5.0.3/openvas-cli-1.3.0/openvas-libraries-7.0. 4/openvas-manager-5.0.4/openvas-scanner-4.0.3/ So far, compiling does work without any problems. However, while following step 3 (from http://www.openvas.org/install-packages-v6.html#openvas_debian_obs) I get stuck over and over again: While openvas-check-setup reports (please also see attached openvas-check-setup.log) [...] Step 7: Checking if OpenVAS services are up and running ... OK: netstat found, extended checks of the OpenVAS services enabled. ERROR: OpenVAS Scanner is NOT running! FIX: Start OpenVAS Scanner (openvassd). ERROR: OpenVAS Manager is NOT running! FIX: Start OpenVAS Manager (openvasmd). [...] I perform /etc/init.d/openvas-scanner start and what I get is OpenVAS # /etc/init.d/openvas-scanner start Starting OpenVAS Scanner: WARN: The (expected) certificate file /var/lib/openvas/CA//cakey.pem is not available.The OpenVAS daemon might not start up.WARN: The (expected) certificate file /var/lib/openvas/CA//serverkey.pem is not available.The OpenVAS daemon might not start up.log_init():open : No such file or directory Could not open the logfile, using stderr dup2 : Bad file descriptor fdopen : Bad file descriptor rules_new():open : No such file or directory /usr/share/openvas/openvas-services could not be found. Install it and try again ERROR. In fact, the files are there: OpenVAS # ll /var/lib/openvas/CA total 28 -rw-r--r-- 1 root root 1513 Oct 27 09:33 cacert.pem -rw--- 1 root root 887 Oct 27 09:34 cakey.pem -rw--- 1 root root 3950 Oct 27 09:33 clientcert.pem -rw--- 1 root root 887 Oct 27 09:34 clientkey.pem -rw-r--r-- 1 root root 4312 Oct 27 09:33 servercert.pem -rw--- 1 root root 891 Oct 27 09:34 serverkey.pem Do you have any idea what I'm missing? Maybe the init script openvas-scanner behaves wrongly? You might try to start openvassd directly, for example # openvassd --listen=127.0.0.1 --foreground -- Dr. Jan-Oliver Wagner | ++49-541-335084-0 | http://www.greenbone.net/ Greenbone Networks GmbH, Neuer Graben 17, 49074 Osnabrück | AG Osnabrück, HR B 202460 Geschäftsführer: Lukas Grunwald, Dr. Jan-Oliver Wagner ___ Openvas-discuss mailing list Openvas-discuss@wald.intevation.org https://lists.wald.intevation.org/cgi-bin/mailman/listinfo/openvas-discuss
Re: [Openvas-discuss] os icmp echo no answer
Am Dienstag, 28. Oktober 2014, 03:43:53 schrieb flymolon: Why does the function ModuleA() in os_fingerprint.nasl receive nothing while executing 'ping' command in bash is ok? such questions are best addressed to the openvas-plugins mailing list where the NVT developers hang around. -- Dr. Jan-Oliver Wagner | ++49-541-335084-0 | http://www.greenbone.net/ Greenbone Networks GmbH, Neuer Graben 17, 49074 Osnabrück | AG Osnabrück, HR B 202460 Geschäftsführer: Lukas Grunwald, Dr. Jan-Oliver Wagner ___ Openvas-discuss mailing list Openvas-discuss@wald.intevation.org https://lists.wald.intevation.org/cgi-bin/mailman/listinfo/openvas-discuss
Re: [Openvas-discuss] IRC #openvas archive stopped working
Am Donnerstag, 30. Oktober 2014, 10:32:36 schrieb Dustin Demuth: Who is in charge of archiving the #openvas irc channel? It seems like the archive [1] does not work anymore since 21.10.2014 http://www.linux.hr/openvas/archive/ oops, true. Kost (Vlatko) set it up and maintained it. Not sure what happened. I send Kost a reminder about it. -- Dr. Jan-Oliver Wagner | ++49-541-335084-0 | http://www.greenbone.net/ Greenbone Networks GmbH, Neuer Graben 17, 49074 Osnabrück | AG Osnabrück, HR B 202460 Geschäftsführer: Lukas Grunwald, Dr. Jan-Oliver Wagner ___ Openvas-discuss mailing list Openvas-discuss@wald.intevation.org https://lists.wald.intevation.org/cgi-bin/mailman/listinfo/openvas-discuss
Re: [Openvas-discuss] CVE-2009-3095 in windows
Hello, On Monday 27 October 2014 01:25 PM, flymolon wrote: Hi there, The NVT secpod_apache_mod_proxy_ftp_cmd_inj_vuln.nasl detects CVE-2009-3095 for linux, but it filters windows out. There's an apache HTTP server in my windows server, here's its banner: HTTP/1.1 200 OK Date: Mon, 27 Oct 2014 07:28:40 GMT Server: Apache/2.2.13 (Win32) Last-Modified: Sat, 20 Nov 2004 07:16:26 GMT ETag: 1d0bb-2c-3e94b66c2e680 Accept-Ranges: bytes Content-Length: 44 Connection: close Content-Type: text/html X-Pad: avoid browser bug Does the vulnerability exist in it? or is there a tool I can use to test the attack? This vulnerability does not exists on Windows platform. Thanks, Antu Sanadi Thanks! flymolon ___ Openvas-discuss mailing list Openvas-discuss@wald.intevation.org https://lists.wald.intevation.org/cgi-bin/mailman/listinfo/openvas-discuss -- Saner Personal A free vulnerability mitigation software. Build strong defense. http://www.secpod.com/saner-personal.html ___ Openvas-discuss mailing list Openvas-discuss@wald.intevation.org https://lists.wald.intevation.org/cgi-bin/mailman/listinfo/openvas-discuss
[Openvas-discuss] redis connection refused
Hi: Trying to scan and getting WARNING: Cannot connect to KB at '/tmp/redis.sock': Connection refused' Any ideas? Thanks Alex ___ Openvas-discuss mailing list Openvas-discuss@wald.intevation.org https://lists.wald.intevation.org/cgi-bin/mailman/listinfo/openvas-discuss
Re: [Openvas-discuss] redis connection refused
Hello Alex, Start the redis-server as root user. Thanks, Antu Sanadi On Thursday 18 December 2014 11:20 AM, Alexander Rau wrote: Hi: Trying to scan and getting WARNING: Cannot connect to KB at '/tmp/redis.sock': Connection refused' Any ideas? Thanks Alex ___ Openvas-discuss mailing list Openvas-discuss@wald.intevation.org https://lists.wald.intevation.org/cgi-bin/mailman/listinfo/openvas-discuss -- Saner Personal A free vulnerability mitigation software. Build strong defense. http://www.secpod.com/saner-personal.html ___ Openvas-discuss mailing list Openvas-discuss@wald.intevation.org https://lists.wald.intevation.org/cgi-bin/mailman/listinfo/openvas-discuss
Re: [Openvas-discuss] share sockets
Hi, Sorry to discuss here about NVT again, I haven't subscribed to that mailing list yet, just reply the last mail. I found some NVTs that calls a function named ssh_login_or_reuse_connection, such as gb_openssl_detect_lin.nasl, gb_tcptrack_detect.nasl, gb_google_chrome_detect_lin.nasl. I guessed the function reuse connection means somewhere else may probably shared a ssh connection with it. And now I know that function is just open a connection, rather than reuse. I were wrong. Thanks for the answer! flymo...@qq.com From: Jan-Oliver Wagner Date: 2014-12-18 02:52 To: openvas-discuss Subject: Re: [Openvas-discuss] share sockets Am Donnerstag, 16. Oktober 2014, 05:08:24 schrieb flymolon: I've been told that everytime a script's about to exit, the socket(s) it opened should be closed. Now I want to know how the scripts share sockets, and how the openvassd processes share sockets. Anybody knows? A NVT that opens a socket does not share it with other NVTs. -- Dr. Jan-Oliver Wagner | ++49-541-335084-0 | http://www.greenbone.net/ Greenbone Networks GmbH, Neuer Graben 17, 49074 Osnabrück | AG Osnabrück, HR B 202460 Geschäftsführer: Lukas Grunwald, Dr. Jan-Oliver Wagner ___ Openvas-discuss mailing list Openvas-discuss@wald.intevation.org https://lists.wald.intevation.org/cgi-bin/mailman/listinfo/openvas-discuss ___ Openvas-discuss mailing list Openvas-discuss@wald.intevation.org https://lists.wald.intevation.org/cgi-bin/mailman/listinfo/openvas-discuss
