Skip to content

Commit

Permalink
Ensure TCPWRAPPED services are not emitted.
Browse files Browse the repository at this point in the history
  • Loading branch information
3asm committed Aug 27, 2024
1 parent 5930f83 commit 3670eb0
Show file tree
Hide file tree
Showing 3 changed files with 85 additions and 0 deletions.
8 changes: 8 additions & 0 deletions agent/nmap_agent.py
Original file line number Diff line number Diff line change
Expand Up @@ -46,6 +46,8 @@
# scan up to 65536 host
IPV6_CIDR_LIMIT = 112

BLACKLISTED_SERVICES = ["tcpwrapped"]


class Error(Exception):
"""Base Custom Error Class."""
Expand Down Expand Up @@ -308,6 +310,8 @@ def _emit_services(
if domain_name is not None:
logger.info("Services targeting domain `%s`.", domain_name)
for data in generators.get_services(scan_results):
if data.get("service") in BLACKLISTED_SERVICES:
continue

Check warning on line 314 in agent/nmap_agent.py

View check run for this annotation

Codecov / codecov/patch

agent/nmap_agent.py#L314

Added line #L314 was not covered by tests
domain_name_service = {
"name": domain_name,
"port": data.get("port"),
Expand All @@ -334,6 +338,8 @@ def _emit_services(
raise ValueError(f"Incorrect ip version {version}")

for data in generators.get_services(scan_results):
if data.get("service") in BLACKLISTED_SERVICES:
continue

Check warning on line 342 in agent/nmap_agent.py

View check run for this annotation

Codecov / codecov/patch

agent/nmap_agent.py#L342

Added line #L342 was not covered by tests
logger.debug("Sending results to `%s`", selector)
ip_service = {
"host": data.get("host"),
Expand Down Expand Up @@ -414,6 +420,8 @@ def _emit_fingerprints(
self.emit(selector, fingerprint_data)

for data in generators.get_services(scan_results):
if data.get("service") in BLACKLISTED_SERVICES:
continue

Check warning on line 424 in agent/nmap_agent.py

View check run for this annotation

Codecov / codecov/patch

agent/nmap_agent.py#L424

Added line #L424 was not covered by tests
if data.get("product") is not None:
logger.debug("sending results to selector %s", selector)
fingerprint_data = {
Expand Down
35 changes: 35 additions & 0 deletions tests/nmap_agent_test.py
Original file line number Diff line number Diff line change
Expand Up @@ -1041,3 +1041,38 @@ def testAgentNmap_withOSFingerprintCrash2_noException(
nmap_test_agent.process(ipv4_msg2)

assert len(agent_mock) > 0


def testAgentLifecycle_whenTCPWrappedService_emitsNoService(
nmap_test_agent: nmap_agent.NmapAgent,
agent_mock: List[message.Message],
agent_persist_mock: Dict[Union[str, bytes], Union[str, bytes]],
ipv4_msg: message.Message,
mocker: plugin.MockerFixture,
) -> None:
"""Check `tcpwrapped` services are not emitted."""
json_output = {
"nmaprun": {
"host": {
"address": {"@addr": "127.0.0.1", "@addrtype": "ipv4"},
"ports": {
"port": {
"@portid": "222",
"@protocol": "tcp",
"state": {"@state": "open"},
"service": {"@name": "ssh"},
}
},
}
}
}

mocker.patch(
"agent.nmap_wrapper.NmapWrapper.scan_hosts",
return_value=(json_output, HUMAN_OUTPUT),
)

nmap_test_agent.process(ipv4_msg)

assert len(agent_mock) > 0
assert "tcpwrapped" not in [m.data.get("service") for m in agent_mock]
42 changes: 42 additions & 0 deletions tests/tcpwrapped_output.xml
Original file line number Diff line number Diff line change
@@ -0,0 +1,42 @@
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE nmaprun>
<?xml-stylesheet href="file:///usr/bin/../share/nmap/nmap.xsl" type="text/xsl"?>
<!-- Nmap 7.94SVN scan initiated Mon Aug 26 19:46:11 2024 as: nmap -O -sV -n -p 0-65535 -T3 -sT -&#45;script banner -sC -oX /tmp/xmloutput -oN /tmp/normal 1.1.1.1/32 -->
<nmaprun scanner="nmap" args="nmap -O -sV -n -p 0-65535 -T3 -sT -&#45;script banner -sC -oX /tmp/xmloutput -oN /tmp/normal 1.1.1.1/32" start="1724697971" startstr="Mon Aug 26 19:46:11 2024" version="7.94SVN" xmloutputversion="1.05">
<scaninfo type="connect" protocol="tcp" numservices="65536" services="0-65535"/>
<verbose level="0"/>
<debugging level="0"/>
<hosthint><status state="up" reason="unknown-response" reason_ttl="0"/>
<address addr="1.1.1.1" addrtype="ipv4"/>
<hostnames>
</hostnames>
</hosthint>
<host starttime="1724697971" endtime="1724698130"><status state="up" reason="reset" reason_ttl="64"/>
<address addr="1.1.1.1" addrtype="ipv4"/>
<hostnames>
</hostnames>
<ports><extraports state="filtered" count="65533">
<extrareasons reason="no-response" count="65533" proto="tcp" ports="0-112,114-178,180-8442,8444-65535"/>
</extraports>
<port protocol="tcp" portid="113"><state state="closed" reason="conn-refused" reason_ttl="0"/><service name="ident" method="table" conf="3"/></port>
<port protocol="tcp" portid="179"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="tcpwrapped" method="probed" conf="8"/></port>
<port protocol="tcp" portid="8443"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="https-alt" servicefp="SF-Port8443-TCP:V=7.94SVN%T=SSL%I=7%D=8/26%Time=66CCCDEA%P=x86_64-pc-linux-gnu%r(GetRequest,263,&quot;HTTP/1\.0\x20400\x20Bad\x20Request\r\nDate:\x20Mon,\x2026\x20Aug\x202024\x2018:48:10\x20GMT\r\nConnection:\x20close\r\nContent-Type:\x20text/html;\x20charset=utf-8\r\nX-Frame-Options:\x20SAMEORIGIN\r\nContent-Security-Policy:\x20frame-ancestors\x20&apos;self&apos;;\x20object-src\x20&apos;self&apos;;\x20script-src\x20&apos;self&apos;\x20https:\x20\x20&apos;unsafe-eval&apos;\x20&apos;unsafe-inline&apos;\x20blob:;\r\nX-XSS-Protection:\x201;\x20mode=block\r\nX-Content-Type-Options:\x20nosniff\r\nStrict-Transport-Security:\x20max-age=31536000\r\n\r\n&lt;!DOCTYPE\x20HTML\x20PUBLIC\x20\&quot;-//IETF//DTD\x20HTML\x202\.0//EN\&quot;&gt;\n&lt;HTML&gt;&lt;HEAD&gt;\n&lt;TITLE&gt;400\x20Bad\x20Request&lt;/TITLE&gt;\n&lt;/HEAD&gt;&lt;BODY&gt;\n&lt;H1&gt;Bad\x20Request&lt;/H1&gt;\nYour\x20browser\x20sent\x20a\x20request\x20that\x20this\x20server\x20could\x20not\x20understand\.&lt;P&gt;\n&lt;/BODY&gt;&lt;/HTML&gt;\n&quot;)%r(HTTPOptions,279,&quot;HTTP/1\.0\x20405\x20Method\x20Not\x20Allowed\r\nDate:\x20Mon,\x2026\x20Aug\x202024\x2018:48:10\x20GMT\r\nAllow:\x20\r\nConnection:\x20close\r\nContent-Type:\x20text/html;\x20charset=utf-8\r\nX-Frame-Options:\x20SAMEORIGIN\r\nContent-Security-Policy:\x20frame-ancestors\x20&apos;self&apos;;\x20object-src\x20&apos;self&apos;;\x20script-src\x20&apos;self&apos;\x20https:\x20\x20&apos;unsafe-eval&apos;\x20&apos;unsafe-inline&apos;\x20blob:;\r\nX-XSS-Protection:\x201;\x20mode=block\r\nX-Content-Type-Options:\x20nosniff\r\nStrict-Transport-Security:\x20max-age=31536000\r\n\r\n&lt;!DOCTYPE\x20HTML\x20PUBLIC\x20\&quot;-//IETF//DTD\x20HTML\x202\.0//EN\&quot;&gt;\n&lt;HTML&gt;&lt;HEAD&gt;\n&lt;TITLE&gt;405\x20Method\x20Not\x20Allowed&lt;/TITLE&gt;\n&lt;/HEAD&gt;&lt;BODY&gt;\n&lt;H1&gt;Method\x20Not\x20Allowed&lt;/H1&gt;\nThe\x20requested\x20method\x20OPTIONS\x20is\x20not\x20allowed\x20for\x20the\x20URL\x20/\.&lt;P&gt;\n&lt;/BODY&gt;&lt;/HTML&gt;\n&quot;)%r(FourOhFourRequest,263,&quot;HTTP/1\.0\x20400\x20Bad\x20Request\r\nDate:\x20Mon,\x2026\x20Aug\x202024\x2018:48:10\x20GMT\r\nConnection:\x20close\r\nContent-Type:\x20text/html;\x20charset=utf-8\r\nX-Frame-Options:\x20SAMEORIGIN\r\nContent-Security-Policy:\x20frame-ancestors\x20&apos;self&apos;;\x20object-src\x20&apos;self&apos;;\x20script-src\x20&apos;self&apos;\x20https:\x20\x20&apos;unsafe-eval&apos;\x20&apos;unsafe-inline&apos;\x20blob:;\r\nX-XSS-Protection:\x201;\x20mode=block\r\nX-Content-Type-Options:\x20nosniff\r\nStrict-Transport-Security:\x20max-age=31536000\r\n\r\n&lt;!DOCTYPE\x20HTML\x20PUBLIC\x20\&quot;-//IETF//DTD\x20HTML\x202\.0//EN\&quot;&gt;\n&lt;HTML&gt;&lt;HEAD&gt;\n&lt;TITLE&gt;400\x20Bad\x20Request&lt;/TITLE&gt;\n&lt;/HEAD&gt;&lt;BODY&gt;\n&lt;H1&gt;Bad\x20Request&lt;/H1&gt;\nYour\x20browser\x20sent\x20a\x20request\x20that\x20this\x20server\x20could\x20not\x20understand\.&lt;P&gt;\n&lt;/BODY&gt;&lt;/HTML&gt;\n&quot;);" tunnel="ssl" method="probed" conf="10"/><script id="fingerprint-strings" output="&#xa; FourOhFourRequest, GetRequest: &#xa; HTTP/1.0 400 Bad Request&#xa; Date: Mon, 26 Aug 2024 18:48:10 GMT&#xa; Connection: close&#xa; Content-Type: text/html; charset=utf-8&#xa; X-Frame-Options: SAMEORIGIN&#xa; Content-Security-Policy: frame-ancestors &apos;self&apos;; object-src &apos;self&apos;; script-src &apos;self&apos; https: &apos;unsafe-eval&apos; &apos;unsafe-inline&apos; blob:;&#xa; X-XSS-Protection: 1; mode=block&#xa; X-Content-Type-Options: nosniff&#xa; Strict-Transport-Security: max-age=31536000&#xa; &lt;!DOCTYPE HTML PUBLIC &quot;-//IETF//DTD HTML 2.0//EN&quot;&gt;&#xa; &lt;HTML&gt;&lt;HEAD&gt;&#xa; &lt;TITLE&gt;400 Bad Request&lt;/TITLE&gt;&#xa; &lt;/HEAD&gt;&lt;BODY&gt;&#xa; &lt;H1&gt;Bad Request&lt;/H1&gt;&#xa; Your browser sent a request that this server could not understand.&lt;P&gt;&#xa; &lt;/BODY&gt;&lt;/HTML&gt;&#xa; HTTPOptions: &#xa; HTTP/1.0 405 Method Not Allowed&#xa; Date: Mon, 26 Aug 2024 18:48:10 GMT&#xa; Allow: &#xa; Connection: close&#xa; Content-Type: text/html; charset=utf-8&#xa; X-Frame-Options: SAMEORIGIN&#xa; Content-Security-Policy: frame-ancestors &apos;self&apos;; object-src &apos;self&apos;; script-src &apos;self&apos; https: &apos;unsafe-eval&apos; &apos;unsafe-inline&apos; blob:;&#xa; X-XSS-Protection: 1; mode=block&#xa; X-Content-Type-Options: nosniff&#xa; Strict-Transport-Security: max-age=31536000&#xa; &lt;!DOCTYPE HTML PUBLIC &quot;-//IETF//DTD HTML 2.0//EN&quot;&gt;&#xa; &lt;HTML&gt;&lt;HEAD&gt;&#xa; &lt;TITLE&gt;405 Method Not Allowed&lt;/TITLE&gt;&#xa; &lt;/HEAD&gt;&lt;BODY&gt;&#xa; &lt;H1&gt;Method Not Allowed&lt;/H1&gt;&#xa; requested method OPTIONS is not allowed for the URL /.&lt;P&gt;&#xa; &lt;/BODY&gt;&lt;/HTML&gt;"><elem key="FourOhFourRequest, GetRequest">&#xa; HTTP/1.0 400 Bad Request&#xa; Date: Mon, 26 Aug 2024 18:48:10 GMT&#xa; Connection: close&#xa; Content-Type: text/html; charset=utf-8&#xa; X-Frame-Options: SAMEORIGIN&#xa; Content-Security-Policy: frame-ancestors &apos;self&apos;; object-src &apos;self&apos;; script-src &apos;self&apos; https: &apos;unsafe-eval&apos; &apos;unsafe-inline&apos; blob:;&#xa; X-XSS-Protection: 1; mode=block&#xa; X-Content-Type-Options: nosniff&#xa; Strict-Transport-Security: max-age=31536000&#xa; &lt;!DOCTYPE HTML PUBLIC &quot;-//IETF//DTD HTML 2.0//EN&quot;&gt;&#xa; &lt;HTML&gt;&lt;HEAD&gt;&#xa; &lt;TITLE&gt;400 Bad Request&lt;/TITLE&gt;&#xa; &lt;/HEAD&gt;&lt;BODY&gt;&#xa; &lt;H1&gt;Bad Request&lt;/H1&gt;&#xa; Your browser sent a request that this server could not understand.&lt;P&gt;&#xa; &lt;/BODY&gt;&lt;/HTML&gt;</elem>
<elem key="HTTPOptions">&#xa; HTTP/1.0 405 Method Not Allowed&#xa; Date: Mon, 26 Aug 2024 18:48:10 GMT&#xa; Allow: &#xa; Connection: close&#xa; Content-Type: text/html; charset=utf-8&#xa; X-Frame-Options: SAMEORIGIN&#xa; Content-Security-Policy: frame-ancestors &apos;self&apos;; object-src &apos;self&apos;; script-src &apos;self&apos; https: &apos;unsafe-eval&apos; &apos;unsafe-inline&apos; blob:;&#xa; X-XSS-Protection: 1; mode=block&#xa; X-Content-Type-Options: nosniff&#xa; Strict-Transport-Security: max-age=31536000&#xa; &lt;!DOCTYPE HTML PUBLIC &quot;-//IETF//DTD HTML 2.0//EN&quot;&gt;&#xa; &lt;HTML&gt;&lt;HEAD&gt;&#xa; &lt;TITLE&gt;405 Method Not Allowed&lt;/TITLE&gt;&#xa; &lt;/HEAD&gt;&lt;BODY&gt;&#xa; &lt;H1&gt;Method Not Allowed&lt;/H1&gt;&#xa; requested method OPTIONS is not allowed for the URL /.&lt;P&gt;&#xa; &lt;/BODY&gt;&lt;/HTML&gt;</elem>
</script></port>
</ports>
<os><portused state="open" proto="tcp" portid="8443"/>
<portused state="closed" proto="tcp" portid="113"/>
<osmatch name="Sun Solaris 9 or 10 (SPARC)" accuracy="85" line="101279">
<osclass type="general purpose" vendor="Sun" osfamily="Solaris" osgen="9" accuracy="85"><cpe>cpe:/o:sun:sunos:5.9</cpe></osclass>
<osclass type="general purpose" vendor="Sun" osfamily="Solaris" osgen="10" accuracy="85"><cpe>cpe:/o:sun:sunos:5.10</cpe></osclass>
</osmatch>
</os>
<uptime seconds="7697531" lastboot="Wed May 29 17:36:39 2024"/>
<tcpsequence index="254" difficulty="Good luck!" values="8EA02712,EB10867A,3C803010,9097977E,A7F35C,CBEF6498"/>
<ipidsequence class="Incremental" values="9120,9121,9122,9123,9124,9125"/>
<tcptssequence class="100HZ" values="2DE177C1,2DE177CB,2DE177D5,2DE177DF,2DE177E9,2DE177F3"/>
<times srtt="38619" rttvar="20786" to="121763"/>
</host>
<runstats><finished time="1724698130" timestr="Mon Aug 26 19:48:50 2024" summary="Nmap done at Mon Aug 26 19:48:50 2024; 1 IP address (1 host up) scanned in 159.23 seconds" elapsed="159.23" exit="success"/><hosts up="1" down="0" total="1"/>
</runstats>
</nmaprun>

0 comments on commit 3670eb0

Please sign in to comment.