search

robertdavidgraham / masscan

TCP port scanner, spews SYN packets asynchronously, scanning entire Internet in under 5 minutes.
GNU Affero General Public License v3.0
23.28k stars 3.05k forks source link

ERROR: bad packet template with openvpn #540

Open SecuProject opened 3 years ago

SecuProject commented 3 years ago

masscan return ERROR: bad packet template on the tun0 interface. 

# sudo masscan -p 0-65535 10.10.10.0/24 -vv -e tun0

pcap: found library: libpcap.so
pfring: error: dlopen('libpfring.so'): No such file or directory
if: initializing adapter interface
if: interface=tun0
if:tun0: adapter-ip=10.10.10.1
if:tun0: type=0xfffe
tun0: creating fake address
if:tun0: adapter-mac=00-00-00-00-00-01
if:tun0: pcap=libpcap version 1.9.1 (with TPACKET_V3)
if:tun0: opening...
if:tun0: successfully opened
if:tun0: not receiving transmits
if:tun0: looking for default gateway
if:tun0: router-ip=0.0.0.0
if:tun0:arp: resolving IPv4 address
if:tun0: router-mac=00-00-00-00-00-02
if:tun0: initialization done.
ERROR: bad packet template
# ifconfig tun0

tun0: flags=4305<UP,POINTOPOINT,RUNNING,NOARP,MULTICAST>  mtu 1500
        inet 10.10.10.1  netmask 255.255.254.0  destination 10.10.10.1
        inet6 dead:beef:2::1008  prefixlen 64  scopeid 0x0<global>
        inet6 fe81::fd26:e8fc:9f82:2b9  prefixlen 64  scopeid 0x20<link>
        unspec 00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00  txqueuelen 500  (UNSPEC)
        RX packets 1752  bytes 111108 (108.5 KiB)
        RX errors 0  dropped 0  overruns 0  frame 0
        TX packets 26197  bytes 6558930 (6.2 MiB)
        TX errors 0  dropped 0 overruns 0  carrier 0  collisions 0

Note:

Version info:

0xdacafe commented 3 years ago

I am getting the same error.

OS info:

Version info:

Masscan version 1.3.0 ( https://github.com/robertdavidgraham/masscan )
Compiled on: Jan  9 2021 12:12:25
Compiler: gcc 10.2.0
OS: Linux
CPU: unknown (64 bits)
GIT version: unknown

Error:

pcap: found library: libpcap.so
pfring: error: dlopen('libpfring.so'): No such file or directory
if: initializing adapter interface
if: interface=tun0
if:tun0: adapter-ip=10.8.8.10
if:tun0: type=0xfffe
tun0: creating fake address
if:tun0: adapter-mac=00-00-00-00-00-01
if:tun0: pcap=libpcap version 1.10.0 (with TPACKET_V3)
if:tun0: opening...
if:tun0: successfully opened
if:tun0: not receiving transmits
if:tun0: looking for default gateway
if:tun0: router-ip=10.8.8.1
if:tun0:arp: resolving IPv4 address
if:tun0: router-mac=00-00-00-00-00-02
if:tun0: initialization done.
ERROR: bad packet template

Maybe something related to this error?

pfring: error: dlopen('libpfring.so'): No such file or directory

When using physical interface, the error still shows up but the tool works fine, so not sure if it is related.

scriptzteam commented 3 years ago

A quick try :-D and works for me - ip is hidden via openVPN server

https://github.com/scriptzteam/masscan-openVPN

rolandx commented 3 years ago

I had the same issue after I upgraded my kali os. sudo masscan -vv -p1-65535 10.129.80.158 --rate=1000 -e tun0 > ports

pcap: failed to load: libpcap.so
pcap: failed to load: libpcap.A.dylib
pcap: failed to load: libpcap.dylib
pcap: failed to load: libpcap.so.0.9.5
pcap: failed to load: libpcap.so.0.9.4
pcap: found library: libpcap.so.0.8
pfring: error: dlopen('libpfring.so'): No such file or directory
if: initializing adapter interface
if: interface=tun0
if:tun0: adapter-ip=10.10.14.11
if:tun0: type=0xfffe
tun0: creating fake address
if:tun0: adapter-mac=00-00-00-00-00-01
if:tun0: pcap=libpcap version 1.10.0 (with TPACKET_V3)
if:tun0: opening...
if:tun0: successfully opened
if:tun0: not receiving transmits
if:tun0: looking for default gateway
if:tun0: router-ip=0.0.0.0
if:tun0:arp: resolving IPv4 address
if:tun0: router-mac=00-00-00-00-00-02
if:tun0: initialization done.
ERROR: bad packet template

Version info：

Masscan version 1.3.0 ( https://github.com/robertdavidgraham/masscan )
Compiled on: Jan 11 2021 14:53:47
Compiler: gcc 10.2.1 20210108
OS: Linux
CPU: unknown (64 bits)
GIT version: unknown

OS info: 5.9.0-kali5-amd64

ghost commented 3 years ago

Same here after upgrading Kali-Linux... pf_ring.ko and libpfring.so seem not to be installed nor part of the distro.

scriptzteam commented:

A quick try :-D and works for me - ip is hidden via openVPN server

https://github.com/scriptzteam/masscan-openVPN

However, I'm going to give yours templ-pkt.c a try.

Masscan version 1.3.0 ( https://github.com/robertdavidgraham/masscan )
Compiled on: Jan 18 2021 13:14:36
Compiler: gcc 10.2.1 20210110
OS: Linux
CPU: unknown (64 bits)
GIT version: unknown
5.9.0-kali5-amd64
ghost commented 3 years ago

@scriptzteam

//LOG(0, "ERROR: bad packet template\n");
//exit(1);

so you just commented out error message and exiting the process?

Can we deduce that pf_ring.ko and libpfring.so are not needed and masscan nevertheless uses tun0 or any other virtual interface? Or is it using eth0 and only spoofing the IP address?

scriptzteam commented 3 years ago

@mkfifos i search simple solutions :D yeah i get what i needed -> openVPN IP on scanned server ;) tcpdump show openVPN IP too!

ahonjo commented 3 years ago

I encountered the same error. After some studying I was able to make the use of pf_ring and libpfring.so on Kali. You can find the solution from here: https://kalilinuxtutorials.com/pf_ring/.

OS info:

$ uname -srvmo
Linux 5.3.0-kali2-amd64 #1 SMP Debian 5.3.9-3kali1 (2019-11-20) x86_64 GNU/Linux

Version info:

$ masscan --version

Masscan version 1.3.1 ( https://github.com/robertdavidgraham/masscan )
Compiled on: Jan 28 2021 22:53:01
Compiler: gcc 4.2.1 Compatible Clang 8.0.1 (tags/RELEASE_801/final)
OS: Linux
CPU: unknown (64 bits)
GIT version: 1.3.1-2-g4407812

Now my masscan output is much more healthier:

$ masscan -vv
[-] pcap: failed to load: libpcap.so
[-] pcap: failed to load: libpcap.A.dylib
[-] pcap: failed to load: libpcap.dylib
[-] pcap: failed to load: libpcap.so.0.9.5
[-] pcap: failed to load: libpcap.so.0.9.4
[+] pcap: found library: libpcap.so.0.8
pfring: found 'libpfring.so'!
pfring: successfully loaded PF_RING API
pfring: found 'pf_ring' driver
pfring: found 'pf_ring' driver module
usage:
masscan -p80,8000-8100 10.0.0.0/8 --rate=10000
 scan some web ports on 10.x.x.x at 10kpps
masscan --nmap
 list those options that are compatible with nmap
masscan -p80 10.0.0.0/8 --banners -oB <filename>
 save results of scan in binary format to <filename>
masscan --open --banners --readscan <filename> -oX <savefile>
 read binary scan results in <filename> and save them as xml in <savefile>

However, the ERROR: bad packet template error still exist when using -e tun0 / --adapter tun0.