Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Service Detection: Add Ubiquiti Discovery Service on 10001/udp #1454

Closed
wants to merge 6 commits into from
Closed

Service Detection: Add Ubiquiti Discovery Service on 10001/udp #1454

wants to merge 6 commits into from

Conversation

TomSellers
Copy link

@TomSellers TomSellers commented Feb 1, 2019 •
edited

This PR adds UDP service probe and match lines for Ubiquiti Discovery Service on 10001/udp.

NOTE : The PR has been updated to include coverage of v2 of the protocol.

The Discovery Service is used by various Ubiquiti networking gear. The Ubiquiti Discovery Tool sends a 4 byte payload of \x01\0\0\0 and devices with the service will respond with hostname, model, firmware, MAC addresses, IP Addresses, etc.

v1 output

PORT      STATE SERVICE            REASON       VERSION
10001/udp open  ubiquiti-discovery udp-response Ubiquiti Discovery Service (v1 protocol)

v2 output

PORT      STATE SERVICE            REASON       VERSION
10001/udp open  ubiquiti-discovery udp-response Ubiquiti Discovery Service (v2 protocol)

This is related to PR #1457

Context: https://blog.rapid7.com/2019/02/01/ubiquiti-discovery-service-exposures/

If there aren't any objections or changes requested I will commit this code and the corresponding Changelog entry this weekend.

@TomSellers TomSellers mentioned this pull request Feb 4, 2019
Closed
@TomSellers
Copy link
Author

@dmiller-nmap - I added an entry to nmap-payloads for the v1 protocol. I'd add one for v2 but it appears you can only have one entry in nmap-payloads per port. I think this is because the port is used as the key.

nmap/payload.cc

Lines 352 to 358 in a0418c0

for (p = 0; p < count; p++) {
struct proto_dport key(IPPROTO_UDP, ports[p]);
struct payload payload;
payload.data = payload_data;
payloads[key] = payload;
}

@TomSellers
Copy link
Author

Additional examples that show short model name. This output aligns with output from the script.

Version 1

PORT      STATE SERVICE            REASON              VERSION
10001/udp open  ubiquiti-discovery udp-response ttl xx Ubiquiti Discovery Service (v1 protocol, ERPro-8)
10001/udp open  ubiquiti-discovery udp-response ttl xx Ubiquiti Discovery Service (v1 protocol, ER-X)
10001/udp open  ubiquiti-discovery udp-response ttl xx Ubiquiti Discovery Service (v1 protocol, WOM5AMiMo)
10001/udp open  ubiquiti-discovery udp-response ttl xx Ubiquiti Discovery Service (v1 protocol, P5B-300)
10001/udp open  ubiquiti-discovery udp-response ttl xx Ubiquiti Discovery Service (v1 protocol, AirCam)
10001/udp open  ubiquiti-discovery udp-response ttl xx Ubiquiti Discovery Service (v1 protocol, NBE-5AC-19)

PORT      STATE SERVICE            REASON              VERSION
10001/udp open  ubiquiti-discovery udp-response ttl xx Ubiquiti Discovery Service (v1 protocol, AirCamDome)
Service Info: CPE: cpe:/h:ubnt:aircam_dome:

Version 2, some with software version

PORT      STATE SERVICE            REASON       VERSION
10001/udp open  ubiquiti-discovery udp-response Ubiquiti Discovery Service (v2 protocol, UCK software ver. 5.9.29)
10001/udp open  ubiquiti-discovery udp-response Ubiquiti Discovery Service (v2 protocol, UCK-v2 software ver. 5.9.29)
10001/udp open  ubiquiti-discovery udp-response Ubiquiti Discovery Service (v2 protocol, UCK-v3 software ver. 5.9.29)

@nmap-bot nmap-bot closed this in 5d5e11d Feb 9, 2019
@TomSellers TomSellers deleted the ubiquiti_discovery branch February 9, 2019 20:01
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@jhart-r7 jhart-r7 jhart-r7 left review comments

@dmiller-nmap dmiller-nmap dmiller-nmap left review comments

Assignees
No one assigned
Labels
None yet
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.

None yet
3 participants
@TomSellers @jhart-r7 @dmiller-nmap