Re: [Plugins-writers] Identification of the ManHunt service

Previous message: Renaud Deraison: "Re: [Plugins-writers] Correction needed for ssh timing attack"
In reply to: Renaud Deraison: "Re: [Plugins-writers] Identification of the ManHunt service"
Messages sorted by: [ date ] [ thread ] [ subject ] [ author ] [ attachment ]

evilpacket@private

Thanks for pointing me towards find_service2.nasl as the proper place
to locate this. Attached / below is an addition to find_service2.nasl
to identify the Symantec ManHunt / SNS console service; qsp-proxy.
Default port is 2600/TCP but is configurable.

740a741,752
> # Submitted by Adam Baldwin - (http://evilpacket.net)
> # Identifies Symantec ManHunt or SNS console (qsp proxy)
> # 32 bytes of data sent when a connection is made
> # 01 01 00 08 1C EE 01 00 00 00 00 00 00 00 00 00
> # 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
> if (r == '\x01\x01\x00\x08\x1c\xee\x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00')
> {
>   register_service(port: port, proto: 'qsp-proxy');
>   security_note(port: port, data: "A Symantec ManHunt / SNS console (QSP Proxy) seems to be running on this port");
>   exit(0);
> }
> 

--
Adam Baldwin