Adds -z option for Ncat #444

tremblerz · 2016-07-01T11:45:14Z

No description provided.

tremblerz · 2016-07-01T11:49:39Z

ncat/ncat_main.c

@@ -723,6 +728,24 @@ int main(int argc, char *argv[])
        }
    }

+    if (o.zerobyte) {


@bonsaiviking Any better way to blacklist most of the incompatible options ?

dmiller-nmap · 2016-07-01T23:26:24Z

This is well on its way. A few points of feedback:

-z also works for SCTP and even Unix sockets, so it's not true that it "only works for TCP."
Traditional netcat has a workaround for UDP that involves sending a single null byte ('\0') and treating a ECONNREFUSED as the false condition and everything else as true. It's ok if you don't implement this right away, but we should open a subsequent issue documenting the deficiency.
We don't need another long option (--zero), just add it as a short option.
We should suppress the "Ncat: Connection refused" message when using -z because it's usually used with scripting and the extra output will probably be objected to by someone. Netcat does not produce any output with -z.
There's not a real better way to blacklist, but some of these probably don't matter. We want to blacklist ones that change the behavior, not the timing. Here's my list:
- Any of the exec options: -c, -e, --lua-exec
- -l, but don't explicitly check for things that only have meaning when -l is given, like -k, --chat, etc.

dmiller-nmap · 2016-07-02T14:26:16Z

ncat/ncat_main.c

@@ -307,7 +307,7 @@ int main(int argc, char *argv[])
        {"nsock-engine",    required_argument,  NULL,         0},
        {"test",            no_argument,        NULL,         0},
        {"ssl",             no_argument,        &o.ssl,       1},
-        {"zero",            no_argument,        NULL,         'z'},
+        {"z",               no_argument,        NULL,         'z'},


To add a short argument, you don't need to add to the long_options array, just make sure it's included in the string argument to getopt_long (which it is below).

tremblerz · 2016-07-02T15:24:06Z

@bonsaiviking Thanks for review, I have pushed correction for this. I am little doubtful over the implementation of UDP scan, here are few reasons why -

Netcat reports all those UDP ports as open which do not reply with ECONNREFUSED. Implication - Link to paste
What should be the time-limit to wait for ECONNREFUSED, I am thinking to implement it by setting up the value of o.idletimeout internally.

I also think that connect_report() shouldn't be called here if o.proto==IPPROTO_UDP.

This is the LINK to capture performed for Netcat. First five frames correspond to command nc -zuv google.com 21 while next four correspond to nc -zuv google.com 80. Payload sent by them is 58(Hex) that is equivalent to "X", any particular reason for it ?

tremblerz · 2016-07-03T11:47:36Z

ncat/ncat_connect.c

@@ -1259,6 +1279,11 @@ static void write_socket_handler(nsock_pool nsp, nsock_event evt, void *data)
        ncat_assert(status == NSE_STATUS_SUCCESS);
    }

+    if (o.zerobyte){
+      ncat_assert(o.proto == IPPROTO_UDP);
+      nsock_read(nsp, cs.sock_nsi, read_socket_handler, 1000 * 2, NULL);


I've kept 2s as time limit here.

We shouldn't hard-code this. We should be able to use either o.conntimeout or o.idletimeout instead. I lean towards conntimeout because we're waiting for a "connection" instead of a "read," though with UDP they're essentially the same thing.

dmiller-nmap · 2016-07-15T14:14:27Z

ncat/test/ncat-test.pl

+        } while ($pid > 0 && $pid != $c_pid);
+        $pid == $c_pid or die;
+        $code = $? >> 8;
+        $code == 2 or die "Exit code was $code, not 2";


Why is exit code 2 for this? ncat/util.c has this comment for the die and bye functions:

/* Exit status 2 indicates a program error other than a network error. */

So I think we should try to have the exit code be 1 in this case.

I am trying but have not been able to catch the reason for getting the error code as 2. Strangely, it prints error code as 1 when tried manually like ./ncat -zv localhost 5000 then echo $?

…ver used

dmiller-nmap · 2016-07-19T02:04:13Z

ncat/test/ncat-test.pl

+        do {
+                $pid = waitpid($c_pid, 0);
+        } while ($pid > 0 && $pid != $c_pid);
+        $pid == $c_pid or "$pid != $c_pid";


Missing die on this line.

dmiller-nmap · 2016-07-19T03:06:18Z

Looks great! @tremblerz commit this as soon as you fix the missing die statement on line 3149.

Adds -z option for Ncat

ab45c63

tremblerz reviewed Jul 1, 2016
View reviewed changes

few minor fixes

4df0d40

dmiller-nmap reviewed Jul 2, 2016
View reviewed changes

removes entry from long_options

0b3d5d3

Adds zero byte option for UDP also by sending single NULL byte

b3a95fc

tremblerz reviewed Jul 3, 2016
View reviewed changes

tremblerz added 7 commits July 6, 2016 05:06

removes hard-coding of timeout in nsock function call

3ab8239

minor changes in usage output

b2985f5

removes comma

50b61c4

minor change to print only in verbose mode

eeb1f5d

minor fix

011a584

Adds tests for zero-byte option

143b146

removes few non-conflicting options in zero-byte option

d4ad7bf

dmiller-nmap reviewed Jul 15, 2016
View reviewed changes

tremblerz added 4 commits July 18, 2016 21:31

corrects UDP test for -z

e5bb26d

Merge branch 'master' into ncat_zero_byte

8d41939

Fix for connection reset error code as 1 and usage of ncat_client/ser…

9053ec7

…ver used

had forgotten to remove comments

f47e84f

dmiller-nmap reviewed Jul 19, 2016
View reviewed changes

adds missing die statement

dd360f0

nmap-bot closed this in d04046a Jul 19, 2016

sergeykhegay pushed a commit to sergeykhegay/nmap that referenced this pull request Jul 27, 2016

Adds test for -z option in ncat, closes nmap#444

18dbade

RainbowHerbicides mentioned this pull request Jun 26, 2019

addr.port().is_reachable do not work in CentOS 7 pytest-dev/pytest-testinfra#458

Open

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Adds -z option for Ncat #444

Adds -z option for Ncat #444

tremblerz commented Jul 1, 2016

tremblerz Jul 1, 2016

dmiller-nmap commented Jul 1, 2016

dmiller-nmap Jul 2, 2016

tremblerz commented Jul 2, 2016 •

edited

tremblerz Jul 3, 2016

dmiller-nmap Jul 5, 2016

dmiller-nmap Jul 15, 2016

tremblerz Jul 15, 2016

dmiller-nmap Jul 19, 2016

dmiller-nmap commented Jul 19, 2016

Adds -z option for Ncat #444

Adds -z option for Ncat #444

Conversation

tremblerz commented Jul 1, 2016

tremblerz Jul 1, 2016

Choose a reason for hiding this comment

dmiller-nmap commented Jul 1, 2016

dmiller-nmap Jul 2, 2016

Choose a reason for hiding this comment

tremblerz commented Jul 2, 2016 • edited

tremblerz Jul 3, 2016

Choose a reason for hiding this comment

dmiller-nmap Jul 5, 2016

Choose a reason for hiding this comment

dmiller-nmap Jul 15, 2016

Choose a reason for hiding this comment

tremblerz Jul 15, 2016

Choose a reason for hiding this comment

dmiller-nmap Jul 19, 2016

Choose a reason for hiding this comment

dmiller-nmap commented Jul 19, 2016

tremblerz commented Jul 2, 2016 •

edited