goncalor

[package]
name = "sequoia-test"
version = "0.1.0"
edition = "2021"

[[bin]]
name = "sequoia-test"
path = "main.rs"

[dependencies]

goncalor

MSMQ Nmap service probe

⚠️ Disclaimer: testing of this probe is limited and the MSMQ protocol is proprietary and undocumented. Use this probe at your own risk. ⚠️

Nmap currently has no way to detect whether the service running on TCP port 1801 is [Microsoft Message Queuing (MSMQ)][wikipedia_msmq]. The file msmq-service-probe here has been developed to give Nmap the capability to detect MSMQ. The objective is to help identify assets with MSMQ exposed, that may be vulnerable to [CVE-2023-21554][nist_cve_2023_21554], aka QueueJumper.

This works by sending a MSMQ packet to port 1801 and checking if the response matches an expected fingerprint.

You can run this probe as follows:

goncalor

#!/usr/bin/env python3
# Collapses subnets and/or IPs into the smallest possible set of subnets
import sys
import ipaddress

if len(sys.argv) != 2:
    print("Usage: {} <file>".format(sys.argv[0]))
    sys.exit(-1)

with open(sys.argv[1]) as f:

goncalor

just a test
wivykwfs6@nullmbx.net
don't send mail

goncalor

FROM alpine

RUN apk --no-cache add go chromium
RUN go get github.com/shelld3v/aquatone

#RUN useradd -m -d /app user
WORKDIR /app

#USER user

goncalor

FROM kalilinux/kali-rolling

RUN apt update
RUN apt -y install git build-essential libssh-dev #libsmbclient-dev #freerdp2-dev

WORKDIR /app
RUN git clone --depth=1 https://github.com/vanhauser-thc/thc-hydra .
RUN ./configure
RUN make

goncalor

/NXDOMAIN/ {print $2, "?"; next}
/SERVFAIL/ {print $2, "?"; next}
/mail is handled by/ {next}

/is an alias for/ {doms[$6]=$1; next}

{
    if ($1"." in doms)
        print doms[$1"."], $4
    else if (match($0, "has IPv6 address"))

goncalor

FROM alpine:3.13

RUN apk add --no-cache bash procps drill git coreutils curl

RUN addgroup testssl
RUN adduser -G testssl -g "testssl user"  -s /bin/bash -D testssl

RUN ln -s /home/testssl/testssl.sh /usr/local/bin/

USER testssl

goncalor

Masscan notes

NTP

For NTP, masscan (1.3.1) sends by default "monlist" packets. We only get responses from IPs that have this feature enabled (which is great for NTP amplification DDoS attacks). Since we get no response we miss open NTPs that don't have this feature.

$ masscan -pU:123 <ip>

goncalor

#!/usr/bin/env python3
import sys
import ipaddress

if len(sys.argv) != 2:
    print("Usage: {} <file>".format(sys.argv[0]))
    sys.exit(-1)

with open(sys.argv[1]) as f:
    for line in f.readlines():