search

Abacus-Group-RTO / legion

Legion is an open source, easy-to-use, super-extensible and semi-automated network penetration testing tool that aids in discovery, reconnaissance and exploitation of information systems.
GNU General Public License v3.0
1.03k stars 170 forks source link

Operating System Returning as a Printer #219

Closed cherrigasoline closed 1 year ago

cherrigasoline commented 2 years ago

DESCRIPTION Sorry if I miss anything, very very new to linux. Legion is returning my website host as a Afga DryStar 5500 printer. That is very much not what I have, and my website is very rudimentary with little/no protections. I have no idea how this happened. Running most recent Kali Linux update as of 3/29/22 on the most recent version of Virtualbox. Pasted the logs from the error. From my knowledge this brand of printer is only used in clinical settings to print XRays so it is very strange for it to even be a registered operating system.

runStagedNmap called for stage 3 Queuing: nmap -sV --script=./scripts/nmap/vulners.nse -vvvv micronations.wiki -oA /root/.local/share/legion/tmp/legion-u2i3x175-running/nmap/20220329060141555240-nmapstage3 runCommand called for stage 3 runCommand connected for stage 3 Parsing nmap xml file: /root/.local/share/legion/tmp/legion-3i0qmvub-tool-output/nmap/20220329055946856555-nmapstage2.xml nmap xml report read successfully! Found db_host already in db Processing h 78.141.223.154 Found db_host during os/ports/service processing 'os_nodes' to process: 21 Processing os obj Processing os obj Processing os obj Processing os obj Processing os obj Processing os obj Processing os obj Processing os obj Processing os obj Processing os obj Processing os obj Processing os obj Agfa DryStar 5500 printer Processing os obj D-Link DP-300U, DP-G310, or Hamlet HPS01UU print server Processing os obj Tahoe 8216 power management system Processing os obj TRENDnet TV-IP100 webcam Processing os obj Linux 1.0.9 Processing os obj D-Link DIR-655 Processing os obj OUYA game console Processing os obj SiliconDust HDHomeRun 3 set top box Processing os obj Silicondust HDHomeRun set top box Processing os obj SiliconDust HDHomeRun set top box 'ports' to process: 12 Processing port obj 25 Processing port obj 135 Processing port obj 137 Processing port obj 139 Processing port obj 445 Processing port obj 1433 Processing port obj 3306 Processing port obj 5432 Processing port obj 137 Processing port obj 161 Processing port obj 162 Processing port obj 1434 Finished in 0.27230024337768555 seconds. Scheduler started!

Scheduler ended! Process 5 is done!

sscottgvit commented 2 years ago

@cherrigasoline Unfortunately this is what nmap is fingerprinting your system as. There's a lot of items that nmap thinks it might be- the printer is just the first in the list. It must run a very peculiar version of openssh or have the same banner as that printer. To confirm can you try running nmap -sV --script=./scripts/nmap/vulners.nse -vvvv micronations.wiki -A and seeing if the same data is being returned?