search

nmap / ncrack

Ncrack network authentication tool
Other
1.08k stars 237 forks source link

Properly parse IPv6 services in the cli #98

Closed schischi closed 3 years ago

schischi commented 3 years ago

Summary:

This commit fixes #31.

Eventhough ncrack supports IPv6, the cli interface does not accept IPv6 services because of a parsing issue. The -6 flag works fine if a hostname is provided:

$ ncrack -v -6 ftp://facebook.com
ftp://2a03:2880:f106:83:face:b00c:0:25de:21 finished.

But the cli rejects the input if we use an IPv6 directly:

$ ncrack -v -6 [2a03:2880:f106:83:face:b00c:0:25de]:21
Invalid port number: 2880:f106:83:face:b00c:0:25de]:21
$ ncrack -v -6 ftp://2a03:2880:f106:83:face:b00c:0:25de
Invalid port number: 2880:f106:83:face:b00c:0:25de

This diff refactors and changes the way we are parsing services from the cli to properly handle IPv6 addresses.

Test Plan:

The 2 examples aboves that weren't working are now working:

$ ./ncrack -v -6 [2a03:2880:f106:83:face:b00c:0:25de]:21
ftp://2a03:2880:f106:83:face:b00c:0:25de:21 finished.
$ ./ncrack -v -6 ftp://2a03:2880:f106:83:face:b00c:0:25de
ftp://2a03:2880:f106:83:face:b00c:0:25de:21 finished.

A small shell script to compare the behavior of the old and new code:

$ cat test.sh
cases=(
    '127.0.0.1'
    '127.0.0.1,'
    '127.0.0.1 -p ftp'
    '127.0.0.1,path=/ -p ftp'
    '127.0.0.1:21'
    'ftp://127.0.0.1'
    '203.0.113.0/24'
    '203.0.113.10-20'
    'localhost'
    'ftp://localhost:21'
    '-6 ::1'
    '-6 2001:db8::1'
    '-6 ftp://2001:db8::1'
    '-6 ftp://[2001:db8::1]'
    '-6 [2001:db8::1]:21'
    '-6 ftp://[2001:db8::1]:21'
    '-6 ftp://2001:db8::192.168.0.1'
    '-6 2001:db8::1,path=/ -p ftp'
    '-6 ftp://[2001:db8::1]:21,path=/ -p ftp'
)
for args in "${cases[@]}"; do
    printf '%-50s' "$args"
    ncrack $args >/dev/null 2>/dev/null
    echo -en "\t$?"
    ./ncrack $args >/dev/null 2>/dev/null
    echo -e "\t$?"
done

$ make && bash test.sh
ncrack 127.0.0.1                                        1   1
ncrack 127.0.0.1,                                       1   1
ncrack 127.0.0.1 -p ftp                                 0   0
ncrack 127.0.0.1,path=/ -p ftp                          1   1
ncrack 127.0.0.1:21                                     0   0
ncrack ftp://127.0.0.1                                  0   0
ncrack 203.0.113.0/24                                   1   1
ncrack 203.0.113.10-20                                  1   1
ncrack localhost                                        1   1
ncrack ftp://localhost:21                               0   0
ncrack -6 ::1                                           1   1
ncrack -6 2001:db8::1                                   1   1
ncrack -6 ftp://2001:db8::1                             1   0
ncrack -6 ftp://[2001:db8::1]                           1   0
ncrack -6 [2001:db8::1]:21                              1   0
ncrack -6 ftp://[2001:db8::1]:21                        1   0
ncrack -6 ftp://2001:db8::192.168.0.1                   1   0
ncrack -6 2001:db8::1,path=/ -p ftp                     1   1
ncrack -6 ftp://[2001:db8::1]:21,path=/ -p ftp          1   0

As we can see the new code behave like the old one for IPv4/hostname, but is also working with valid IPv6 services.