Issue with fprobe

[JaseNZC]

Thanks for the hard work into this its amazing. I am getting an error every run with fprobe. Any idea how I might be able to resolve this. If there is any more info you need please let me know so I can provide every thing you need to see what is going on.

RUNNING HTTP PROBE ====================================================================================•x[2020-05-07](07:06)x• Error in collector #1 parameters Wrong parameters fprobe: a NetFlow probe. Version 1.1 Usage: fprobe [options] remote:port[/[local][/type]] ...

[1N3]

Hi, It looks like you may have a different 'fprobe' executable installed. Can you send the output of the following command?

ls -lh /usr/bin/fprobe                                                                                                                                          ✔  ⚡  1518  08:26:35 
lrwxrwxrwx 1 root root 19 Apr  5 15:48 /usr/bin/fprobe -> /root/go/bin/fprobe

[JaseNZC]

you mean this ??

ls -lh /usr/bin/fprobe lrwxrwxrwx 1 root root 19 May 5 22:46 /usr/bin/fprobe -> /root/go/bin/fprobe

Net probe is as follows. probe: a NetFlow probe. Version 1.1

[1N3]

Hi, Please run the following to resolve:

mv ~/go/bin/fprobe ~/go/bin/fprobe.bak
GO111MODULE=on go get -u github.com/theblackturtle/fprobe; ln -s ~/go/bin/fprobe /usr/bin/fprobe

This will create a backup of the existing and download the latest fprobe executable. To confirm if this worked, just run a test scan after to see if fprobe runs properly.

[Jase-NZ]

Sorry no dice, Not really a major issue as setup a docker.

Following is full output so you can see what is happening. This is running on a fresh install of Kali.

I removed fprob from /usr/bin as it was sitting in there then installed go.

root@kali:/home/kali# mv ~/go/bin/fprobe ~/go/bin/fprobe.bak root@kali:/home/kali# cd /usr/bin root@kali:/usr/bin# rm fprobe root@kali:/usr/bin# GO111MODULE=on go get -u github.com/theblackturtle/fprobe; ln -s ~/go/bin/fprobe /usr/bin/fprobe go: finding github.com/theblackturtle/fprobe latest go: finding github.com/3th1nk/cidr latest go: finding github.com/valyala/tcplisten latest go: finding golang.org/x/net latest go: finding golang.org/x/sys latest go: finding github.com/modern-go/concurrent latest go: finding golang.org/x/crypto latest go: finding golang.org/x/tools latest go: finding gopkg.in/check.v1 latest go: finding golang.org/x/xerrors latest go: finding golang.org/x/sync latest

====================================================================================•x2020-05-11x• RUNNING HTTP PROBE ====================================================================================•x2020-05-11x• Error in collector #1 parameters Wrong parameters fprobe: a NetFlow probe. Version 1.1 Usage: fprobe [options] remote:port[/[local][/type]] ...

-h Display this help -p Don't put the interface into promiscuous mode -i Network interface name -f Filter expression (see tcpdump manual for details) -s How often scan for expired flows [5] -g Fragmented flow lifetime [30] -d Idle flow lifetime (inactive timer) [60] -e Active flow lifetime (active timer) [300] -n NetFlow version for use (1, 5 or 7) [5] -a

Use

as source for NetFlow flow -x [:] Workaround for SNMP interfaces indexes [0] -b Memory bulk size (1..4294967295) [10000] -m Memory limit (0=no limit) [0] -q Pending queue length [100] -B Kernel capture buffer size [0] -r Real-time priority (0=disabled, 1..99) [0] -t Produce nanosecond delay after each bytes sent [0:0] -S Snaplen [256] -K Link layer header size -k Don't exclude link layer header from packet size -c Directory to chroot to -u User to run as -v Maximum log level (0=EMERG, ..., 6=INFO, 7=DEBUG) [6] -l <[dst][:id]> Log destination and log/pidfile idetifier [1] remote:port Address of the NetFlow collector

====================================================================================•x2020-05-11x• RUNNING INTRUSIVE SCANS ====================================================================================•x2020-05-11x•

• -- --=[Port 21 opened... running tests..

[1N3]

It seems that there's a different program being referenced and used under the same name somewhere in your path statement. I found this project which seems to line up with the output you have above: https://sourceforge.net/projects/fprobe/, but this is not the intended fprobe program used by Sn1per.

Can you please send the output of the following command?

which fprobe

[JaseNZC]

As requested :-)

kali@kali:~$ which fprobe /usr/sbin/fprobe

[1N3]

ah! Thanks. Okay.. so potential fix is mv /usr/sbin/fprobe /usr/sbin/fprobe2 && bash && which fprobe

This should now point to /usr/bin/fprobe which is linked to the correct go binary which should hopefully do the trick.