Hello I've tried that but I'm stopped about SSL: no problem about private key, I'm stopped before, when SSL try to decode the packets from logo.
My enviroment is win7 64 pro, SSL both 32&64 bit 1.1.1d and nmap 7.80.
This is nmap debug output
[CODE]
C:\Users\User\Desktop\nmap-7.80>nmap -p 10005 --script slig.nse 192.168.1.42 -d
wpcap.dll present, library version: Npcap version 0.9983, based on libpcap versi
on 1.9.1-PRE-GIT
Starting Nmap 7.80 ( https://nmap.org ) at 2019-12-08 15:36 W. Europe Standard T
ime
--------------- Timing report ---------------
hostgroups: min 1, max 100000
rtt-timeouts: init 1000, min 100, max 10000
max-scan-delay: TCP 1000, UDP 1000, SCTP 1000
parallelism: min 0, max 0
max-retries: 10, host-timeout: 0
min-rate: 0, max-rate: 0
NSE: Using Lua 5.3.
NSE: Arguments from CLI:
NSE: DEPRECATION WARNING: bin.lua is deprecated. Please use Lua 5.3 string.pack
NSE: Loaded 1 scripts for scanning.
NSE: Script Pre-scanning.
NSE: Starting runlevel 1 (of 1) scan.
Initiating NSE at 15:36
Completed NSE at 15:36, 0.00s elapsed
Initiating ARP Ping Scan at 15:36
Scanning 192.168.1.42 [1 port]
Packet capture filter (device eth0): arp and arp[18:4] = 0x183DA25F and arp[22:2
] = 0xCA7C
Completed ARP Ping Scan at 15:36, 0.64s elapsed (1 total hosts)
Overall sending rates: 1.57 packets / s, 66.14 bytes / s.
mass_rdns: Using DNS server 192.168.0.1
mass_rdns: Using DNS server 192.168.1.1
mass_rdns: Using DNS server 192.168.0.1
Initiating Parallel DNS resolution of 1 host. at 15:36
mass_rdns: 0.10s 0/1 [#: 3, OK: 0, NX: 0, DR: 0, SF: 0, TR: 1]
Completed Parallel DNS resolution of 1 host. at 15:36, 0.04s elapsed
DNS resolution of 1 IPs took 0.10s. Mode: Async [#: 3, OK: 0, NX: 1, DR: 0, SF:
0, TR: 1, CN: 0]
Initiating SYN Stealth Scan at 15:36
Scanning 192.168.1.42 [1 port]
Packet capture filter (device eth0): dst host 192.168.0.251 and (icmp or icmp6 o
r ((tcp or udp or sctp) and (src host 192.168.1.42)))
Discovered open port 10005/tcp on 192.168.1.42
Completed SYN Stealth Scan at 15:36, 0.01s elapsed (1 total ports)
Overall sending rates: 200.00 packets / s, 8800.00 bytes / s.
NSE: Script scanning 192.168.1.42.
NSE: Starting runlevel 1 (of 1) scan.
Initiating NSE at 15:36
NSE: Starting slig against 192.168.1.42:10005.
00000000 4b 00 09 60 00 00 00 00 00 00 00 00 00 00 00 00 K.............. 00000010 05 60 04 e1 47 fd 91 6a 2e 6f 10 56 f6 1f 16 65 ...G..j.o.V...e
00000020 f4 a6 7d 76 c0 4a c6 76 89 90 d3 52 67 15 41 bb ..}v.J.v...Rg.A.
00000030 01 42 f4 d0 a6 ea 44 96 55 58 4e fd b5 e9 90 8f .B....D.UXN.....
00000040 9d 9c d2 04 fe f3 12 4e 9a 74 ed d0 d2 4e ab b4 .......N.t...N..
00000050 63 2c e7 96 68 c0 b4 e0 6a 13 63 28 6b 98 46 3a c,..h...j.c(k.F:
00000060 64 1b 9b 21 f1 22 27 c0 91 29 8d d3 30 bc 73 4f d..!."'..)..0.sO
00000070 6e 24 80 0c 8d 92 f2 34 55 58 4e fd b5 e9 90 8f n$.....4UXN.....
00000080 4f b8 c7 ce c5 ce 3b c4 57 fe e9 77 d9 1e d0 7c O.....;.W..w...|
Length: 144 [0x90]
NSE: slig against 192.168.1.42:10005 threw an error!
slig.nse:61: Unknown cipher algorithm: DES-EDE3-ECB
stack traceback:
[C]: in function 'openssl.decrypt'
slig.nse:61: in function
(...tail calls...)
Completed NSE at 15:36, 0.07s elapsed
Nmap scan report for 192.168.1.42
Host is up, received arp-response (0.0021s latency).
Scanned at 2019-12-08 15:36:09 W. Europe Standard Time for 0s
PORT STATE SERVICE REASON
10005/tcp open stel syn-ack ttl 255
MAC Address: E0:DC:A0:1F:4D:8D (Siemens Industrial Automation Products Chengdu)
Final times for host: srtt: 2125 rttvar: 4000 to: 100000
NSE: Script Post-scanning.
NSE: Starting runlevel 1 (of 1) scan.
Initiating NSE at 15:36
Completed NSE at 15:36, 0.00s elapsed
Read from C:\Users\User\Desktop\nmap-7.80: nmap-mac-prefixes nmap-payloads nmap-
services.
Nmap done: 1 IP address (1 host up) scanned in 2.71 seconds
Raw packets sent: 2 (72B) | Rcvd: 2 (72B)
[/CODE]
my doubt is about the SSL protocol that seems to be rejected by OpenSSL
Hello I've tried that but I'm stopped about SSL: no problem about private key, I'm stopped before, when SSL try to decode the packets from logo.
My enviroment is win7 64 pro, SSL both 32&64 bit 1.1.1d and nmap 7.80.
This is nmap debug output
[CODE] C:\Users\User\Desktop\nmap-7.80>nmap -p 10005 --script slig.nse 192.168.1.42 -d wpcap.dll present, library version: Npcap version 0.9983, based on libpcap versi on 1.9.1-PRE-GIT Starting Nmap 7.80 ( https://nmap.org ) at 2019-12-08 15:36 W. Europe Standard T ime --------------- Timing report --------------- hostgroups: min 1, max 100000 rtt-timeouts: init 1000, min 100, max 10000 max-scan-delay: TCP 1000, UDP 1000, SCTP 1000 parallelism: min 0, max 0 max-retries: 10, host-timeout: 0 min-rate: 0, max-rate: 0
NSE: Using Lua 5.3. NSE: Arguments from CLI: NSE: DEPRECATION WARNING: bin.lua is deprecated. Please use Lua 5.3 string.pack NSE: Loaded 1 scripts for scanning. NSE: Script Pre-scanning. NSE: Starting runlevel 1 (of 1) scan. Initiating NSE at 15:36 Completed NSE at 15:36, 0.00s elapsed Initiating ARP Ping Scan at 15:36 Scanning 192.168.1.42 [1 port] Packet capture filter (device eth0): arp and arp[18:4] = 0x183DA25F and arp[22:2 ] = 0xCA7C Completed ARP Ping Scan at 15:36, 0.64s elapsed (1 total hosts) Overall sending rates: 1.57 packets / s, 66.14 bytes / s. mass_rdns: Using DNS server 192.168.0.1 mass_rdns: Using DNS server 192.168.1.1 mass_rdns: Using DNS server 192.168.0.1 Initiating Parallel DNS resolution of 1 host. at 15:36 mass_rdns: 0.10s 0/1 [#: 3, OK: 0, NX: 0, DR: 0, SF: 0, TR: 1] Completed Parallel DNS resolution of 1 host. at 15:36, 0.04s elapsed DNS resolution of 1 IPs took 0.10s. Mode: Async [#: 3, OK: 0, NX: 1, DR: 0, SF: 0, TR: 1, CN: 0] Initiating SYN Stealth Scan at 15:36 Scanning 192.168.1.42 [1 port] Packet capture filter (device eth0): dst host 192.168.0.251 and (icmp or icmp6 o r ((tcp or udp or sctp) and (src host 192.168.1.42))) Discovered open port 10005/tcp on 192.168.1.42 Completed SYN Stealth Scan at 15:36, 0.01s elapsed (1 total ports) Overall sending rates: 200.00 packets / s, 8800.00 bytes / s. NSE: Script scanning 192.168.1.42. NSE: Starting runlevel 1 (of 1) scan. Initiating NSE at 15:36 NSE: Starting slig against 192.168.1.42:10005. 00000000 4b 00 09 60 00 00 00 00 00 00 00 00 00 00 00 00 K..
(...tail calls...)
............ 00000010 05 60 04 e1 47 fd 91 6a 2e 6f 10 56 f6 1f 16 65 .
..G..j.o.V...e 00000020 f4 a6 7d 76 c0 4a c6 76 89 90 d3 52 67 15 41 bb ..}v.J.v...Rg.A. 00000030 01 42 f4 d0 a6 ea 44 96 55 58 4e fd b5 e9 90 8f .B....D.UXN..... 00000040 9d 9c d2 04 fe f3 12 4e 9a 74 ed d0 d2 4e ab b4 .......N.t...N.. 00000050 63 2c e7 96 68 c0 b4 e0 6a 13 63 28 6b 98 46 3a c,..h...j.c(k.F: 00000060 64 1b 9b 21 f1 22 27 c0 91 29 8d d3 30 bc 73 4f d..!."'..)..0.sO 00000070 6e 24 80 0c 8d 92 f2 34 55 58 4e fd b5 e9 90 8f n$.....4UXN..... 00000080 4f b8 c7 ce c5 ce 3b c4 57 fe e9 77 d9 1e d0 7c O.....;.W..w...| Length: 144 [0x90] NSE: slig against 192.168.1.42:10005 threw an error! slig.nse:61: Unknown cipher algorithm: DES-EDE3-ECB stack traceback: [C]: in function 'openssl.decrypt' slig.nse:61: in functionCompleted NSE at 15:36, 0.07s elapsed Nmap scan report for 192.168.1.42 Host is up, received arp-response (0.0021s latency). Scanned at 2019-12-08 15:36:09 W. Europe Standard Time for 0s
PORT STATE SERVICE REASON 10005/tcp open stel syn-ack ttl 255 MAC Address: E0:DC:A0:1F:4D:8D (Siemens Industrial Automation Products Chengdu) Final times for host: srtt: 2125 rttvar: 4000 to: 100000
NSE: Script Post-scanning. NSE: Starting runlevel 1 (of 1) scan. Initiating NSE at 15:36 Completed NSE at 15:36, 0.00s elapsed Read from C:\Users\User\Desktop\nmap-7.80: nmap-mac-prefixes nmap-payloads nmap- services. Nmap done: 1 IP address (1 host up) scanned in 2.71 seconds Raw packets sent: 2 (72B) | Rcvd: 2 (72B)
[/CODE]
my doubt is about the SSL protocol that seems to be rejected by OpenSSL
thanks in advance to all