CERBERUS/nmap
1
0
Fork 0
mirror of https://github.com/nmap/nmap.git synced 2026-10-20 19:01:56 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions

Update some time-based signatures so they cover times further in the future (and ignore times which are now well into the past)

Browse source
This commit is contained in:
fyodor 2013-10-29 07:30:09 +00:00
parent 00798ff53b
commit 24461539b9
1 changed files with 10 additions and 9 deletions
Download patch file Download diff file Expand all files Collapse all files

19
nmap-service-probes
View file

@ -1812,9 +1812,10 @@ match mysql m|^.\0\0\0\n(0[\w._-]+)\0| p/MySQL instance manager/ v/$1/
# TIME
# This is a random 128-byte IV followed by a four-byte timestamp.
# 0x46000000 = Tue Mar 20 09:38:40 2007
# 0x53FFFFFF = Thu Aug 28 22:22:23 2014
match nagios-nsca m|^.{128}[\x46-\x53]...$|s p/Nagios NSCA/
# 0x52000000 = Mon Aug 5 12:41:52 2013
# 0x5FFFFFFF = Thu Jan 14 00:25:35 2021
# Calculating: perl -MPOSIX -le 'print ctime(0x5FFFFFFF)'
match nagios-nsca m|^.{128}[\x52-\x5F]...$|s p/Nagios NSCA/
match nbd m|^NBDMAGIC\0\0B| p/Network Block Device/
@ -4034,15 +4035,15 @@ match tinc m|^0 \w+ 17\n| p/tinc vpn daemon/
# TIME
# This will match systems with clocks set between the
# following 2 dates:
# 0xCA000000 = Thu May 24 14:13:52 2007
# 0xD7FFFFFF = Sat Nov 1 18:57:35 2014
# 0xD5000000 = Fri Mar 29 04:56:48 2013
# 0xE2FFFFFF = Sun Sep 6 17:40:31 2020
# Calculate this with the Python program:
# python -c 'import datetime; print datetime.datetime.fromtimestamp(0xca000000 - 2208988800).ctime()'
# Also needs updating (search for TIME):
# UDP Help
# TCP NULL
match time m|^[\xca-\xd7]...$|s i/32 bits/
match time m|^[\xca-\xd7]....\0\0\0$|s i/64 bits/
match time m|^[\xd5-\xe2]...$|s i/32 bits/
match time m|^[\xd5-\xe2]....\0\0\0$|s i/64 bits/
# Need more examples... -Doug
match timeedit m|^\0\0\0H\0\0\0\x02\x0fTimeEdit131\.| p/Evolvera TimeEdit/ v/1.3.1/
@ -9916,8 +9917,8 @@ match daytime m|^\d\d:\d\d:\d\d \d\d.\d\d.20\d\d\n$| p/Microsoft Windows Interna
match daytime m|^\w\w\w \w\w\w \d\d \d\d:\d\d:\d\d \d\d\d\d\r\n$| p/AIX daytime/ o/AIX/ cpe:/o:ibm:aix/a
match daytime m|^(\w\w\w \w\w\w \d\d \d\d:\d\d:\d\d \w+ \d\d\d\d)\r\n\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0 \0\0\0\x7f\xff\xec0\0\0\0\0\0\0\0\0\0\0\0\0\x04\x01Q\xa0\0\0\0\0\0\x01\0\x15\x90-d\0\0\0\0\0\0\0\0\x1c\0\0\xff\xfe\xff\xff\xff\xff\xc5:H\0\0\x16\xc3\xd8\0\0\0\0\0\0\0\0\0\0\0\0\0\0\xff\xff\xac\x10\x0b\x05\0\xff\0\x06T\xa3\0\0 !\"#\$%&'\(\)\*\+,-\./0123456789:;<=>\?@ABCDEFGHIJKLMNO\xd3\$\x12\xccTUVWOy\x94L\0\r\xd1z\0\0\0\0\x04\x02\x1b`\0\0\0\0\x04\x02\x1b`| i/time: $1/
# TIME
match time m|^[\xca-\xd7]...$|s i/32 bits/
match time m|^[\xca-\xd7]....\0\0\0$|s i/64 bits/
match time m|^[\xd5-\xe2]...$|s i/32 bits/
match time m|^[\xd5-\xe2]....\0\0\0$|s i/64 bits/
# Solaris Internet Name Server (42/udp), see ien116.txt
match nameserver m|^help\r\n\r\n\0\0\0\0\x20CKAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\0\0!\0\x01| p/Solaris Internet Name Server/ i/IEN 116/ o/Solaris/ cpe:/o:sun:sunos/a
match nameserver m|^\x03\x03\x02$| p/Solaris Internet Name Server/ i/IEN 116/ o/Solaris/ cpe:/o:sun:sunos/a