9.8 High
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
10 High
CVSS2
Access Vector
NETWORK
Access Complexity
LOW
Authentication
NONE
Confidentiality Impact
COMPLETE
Integrity Impact
COMPLETE
Availability Impact
COMPLETE
AV:N/AC:L/Au:N/C:C/I:C/A:C
0.973 High
EPSS
Percentile
99.8%
Connects to the rpcap service (provides remote sniffing capabilities through WinPcap) and retrieves interface information. The service can either be setup to require authentication or not and also supports IP restrictions.
username:password to use for authentication
See the documentation for the creds library.
nmap -p 2002 <ip> --script rpcap-info
nmap -p 2002 <ip> --script rpcap-info --script-args="creds.rpcap='administrator:foobar'"
PORT STATE SERVICE REASON
2002/tcp open rpcap syn-ack
| rpcap-info:
| \Device\NPF_{0D5D1364-1F1F-4892-8AC3-B838258F9BB8}
| Intel(R) PRO/1000 MT Desktop Adapter
| Addresses
| fe80:0:0:0:aabb:ccdd:eeff:0011
| 192.168.1.127/24
| \Device\NPF_{D5EAD105-B0BA-4D38-ACB4-6E95512BC228}
| Hamachi Virtual Network Interface Driver
| Addresses
|_ fe80:0:0:0:aabb:ccdd:eeff:0022
local creds = require "creds"
local nmap = require "nmap"
local rpcap = require "rpcap"
local shortport = require "shortport"
local stdnse = require "stdnse"
description = [[
Connects to the rpcap service (provides remote sniffing capabilities
through WinPcap) and retrieves interface information. The service can either be
setup to require authentication or not and also supports IP restrictions.
]]
---
-- @usage
-- nmap -p 2002 <ip> --script rpcap-info
-- nmap -p 2002 <ip> --script rpcap-info --script-args="creds.rpcap='administrator:foobar'"
--
-- @output
-- PORT STATE SERVICE REASON
-- 2002/tcp open rpcap syn-ack
-- | rpcap-info:
-- | \Device\NPF_{0D5D1364-1F1F-4892-8AC3-B838258F9BB8}
-- | Intel(R) PRO/1000 MT Desktop Adapter
-- | Addresses
-- | fe80:0:0:0:aabb:ccdd:eeff:0011
-- | 192.168.1.127/24
-- | \Device\NPF_{D5EAD105-B0BA-4D38-ACB4-6E95512BC228}
-- | Hamachi Virtual Network Interface Driver
-- | Addresses
-- |_ fe80:0:0:0:aabb:ccdd:eeff:0022
--
-- @args creds.rpcap username:password to use for authentication
--
-- @see rpcap-brute.nse
author = "Patrik Karlsson"
license = "Same as Nmap--See https://nmap.org/book/man-legal.html"
categories = {"discovery", "safe"}
dependencies = {"rpcap-brute"}
portrule = shortport.port_or_service(2002, "rpcap", "tcp")
local function fail(err) return stdnse.format_output(false, err) end
local function getInfo(host, port, username, password)
local helper = rpcap.Helper:new(host, port)
local status, resp = helper:connect()
if ( not(status) ) then
return false, "Failed to connect to server"
end
status, resp = helper:login(username, password)
if ( not(status) ) then
return false, resp
end
status, resp = helper:findAllInterfaces()
helper:close()
if ( not(status) ) then
return false, resp
end
port.version.name = "rpcap"
port.version.product = "WinPcap remote packet capture daemon"
nmap.set_port_version(host, port)
return true, resp
end
action = function(host, port)
-- patch-up the service name, so creds.rpcap will work, ugly but needed as
-- tcp 2002 is registered to the globe service in nmap-services ...
port.service = "rpcap"
local c = creds.Credentials:new(creds.ALL_DATA, host, port)
local states = creds.State.VALID + creds.State.PARAM
local status, resp = getInfo(host, port)
if ( status ) then
return stdnse.format_output(true, resp)
end
for cred in c:getCredentials(states) do
status, resp = getInfo(host, port, cred.user, cred.pass)
if ( status ) then
return stdnse.format_output(true, resp)
end
end
return fail(resp)
end
9.8 High
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
10 High
CVSS2
Access Vector
NETWORK
Access Complexity
LOW
Authentication
NONE
Confidentiality Impact
COMPLETE
Integrity Impact
COMPLETE
Availability Impact
COMPLETE
AV:N/AC:L/Au:N/C:C/I:C/A:C
0.973 High
EPSS
Percentile
99.8%