1

my concern is the finger print at the end could someone please explain what it is, thanks (looks like a nop sled and buffer overflow )

bash >> nmap -sS -sU -T4 -A -v 192.168.50.1

Nmap scan report for router.asus.com (192.168.50.1)
Host is up (0.0032s latency).
Not shown: 950 filtered ports, 911 open|filtered ports, 136 closed ports
PORT     STATE SERVICE VERSION
53/tcp   open  domain  ISC BIND
53/udp   open  domain  (generic dns response: NOTIMP)
|_dns-recursion: Recursion appears to be enabled
| fingerprint-strings:
|   NBTStat:
|     CKAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
|_    root-servers
5353/udp open  mdns    DNS-based service discovery
| dns-service-discovery:
|   9/tcp workstation
|_    Address=192.168.50.1
1 service unrecognized despite returning data. If you know the         service/version, please submit the following fingerprint at https://nmap.org/cgi-bin/submit.cgi?new-service :
SF-Port53-UDP:V=7.70%I=7%D=6/12%Time=5B204969%P=x86_64-pc-linux-gnu%r(DNSS
SF:tatusRequest,C,"\0\0\x90\x84\0\0\0\0\0\0\0\0")%r(NBTStat,1D5,"\x80\xf0\
SF:x80\x90\0\x01\0\0\0\r\0\r\x20CKAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\0\0!\0\x0
SF:1\0\0\x02\0\x01\0\x03\xabM\0\x14\x01e\x0croot-servers\x03net\0\0\0\x02\
SF:0\x01\0\x03\xabM\0\x04\x01f\xc0\?\0\0\x02\0\x01\0\x03\xabM\0\x04\x01g\x
SF:c0\?\0\0\x02\0\x01\0\x03\xabM\0\x04\x01l\xc0\?\0\0\x02\0\x01\0\x03\xabM
SF:\0\x04\x01k\xc0\?\0\0\x02\0\x01\0\x03\xabM\0\x04\x01i\xc0\?\0\0\x02\0\x
SF:01\0\x03\xabM\0\x04\x01j\xc0\?\0\0\x02\0\x01\0\x03\xabM\0\x04\x01c\xc0\
SF:?\0\0\x02\0\x01\0\x03\xabM\0\x04\x01d\xc0\?\0\0\x02\0\x01\0\x03\xabM\0\
SF:x04\x01m\xc0\?\0\0\x02\0\x01\0\x03\xabM\0\x04\x01a\xc0\?\0\0\x02\0\x01\
SF:0\x03\xabM\0\x04\x01h\xc0\?\0\0\x02\0\x01\0\x03\xabM\0\x04\x01b\xc0\?\x
SF:c0\xe3\0\x01\0\x01\0\x04\xb2\xd1\0\x04\xc6\)\0\x04\xc1\x01\0\x01\0\x01\
SF:0\0Mg\0\x04\xc7\t\x0e\xc9\xc0\xb6\0\x01\0\x01\0\x004\xa2\0\x04\xc0!\x04
SF:\x0c\xc0\xc5\0\x01\0\x01\0\x01\xc1\xf9\0\x04\xc7\x07\[\r\xc0=\0\x01\0\x
SF:01\0\x004\x93\0\x04\xc0\xcb\xe6\n\xc0\\\0\x01\0\x01\0\x01\xc1\xeb\0\x04
SF:\xc0\x05\x05\xf1\xc0k\0\x01\0\x01\0\x05\x91a\0\x04\xc0p\$\x04\xc0\xf2\0
SF:\x01\0\x01\0\x05\x91\x92\0\x04\xc6a\xbe5\xc0\x98\0\x01\0\x01\0\x05r\x8d
SF:\0\x04\xc0\$\x94\x11\xc0\xa7\0\x01\0\x01\0\x004\xaf\0\x04\xc0:\x80\x1e\
SF:xc0\x89\0\x01\0\x01\0\x05\x91\xa2\0\x04\xc1\0\x0e\x81\xc0z\0\x01\0\x01\
SF:0\x05\x91Q\0\x04\xc7\x07S\*\xc0\xd4\0\x01\0\x01\0\x02\xba\x11\0\x04\xca
SF:\x0c\x1b!");

2 Answers 2

1

In some cases, nmap will get data back in response to port probes and be unable to match it to anything in its fingerprint database. When that happens, it will print the data for you to examine in case that helps you. Since for many ports and protocols the data received by nmap is binary (e.g., not just ascii), it gets hex encoded as you see above. Otherwise it would be unreadable and probably make a mess printing to the screen.

The fact that binary data is reduced to \x hex encoding for both binary malicious payloads and binary service response data is due to the fact that they're both binary... nmap's output is not an indication that it's malicious.

0

This is nothing more than fingerprint signature created by Nmap for unknown service from the data that was returned from the scanned port.

2
  • it compiled is that just a fluke? Jun 13, 2018 at 12:45
  • It’s possible it scanned a port that served an exploit, what you’re seeing is different binary data received in response to different data sent by nmap
    – wireghoul
    Aug 1, 2018 at 12:38

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .