1

The Nmap script for HeartBleed (using Nmap v7.40) seems to work only over known ports. Whenever a non-standard port is used, the script does not report anything.

nmap -p 46000 --script ssl-heartbleed -script-args vulns.showall -sV x.x.x.x 

Starting Nmap 7.40 ( https://nmap.org ) at 2018-06-26 03:23 EDT
Nmap scan report for x.x.x.x.in-addr.arpa (x.x.x.x)
Host is up (0.0048s latency).
PORT      STATE SERVICE VERSION
46000/tcp open  http    nginx 1.5.12
|_http-server-header: nginx/1.5.12

Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 12.08 seconds

Using debugging -d does not help much but to see that the script is not doing anything apparently.


As requested in comments:

nmap -p 46000 -n -Pn -sV --version-trace x.x.x.x 
Starting Nmap 7.40 ( https://nmap.org ) at 2018-06-26 15:38 EDT
--------------- Timing report ---------------
  hostgroups: min 1, max 100000
  rtt-timeouts: init 1000, min 100, max 10000
  max-scan-delay: TCP 1000, UDP 1000, SCTP 1000
  parallelism: min 0, max 0
  max-retries: 10, host-timeout: 0
  min-rate: 0, max-rate: 0
---------------------------------------------
NSE: Using Lua 5.3.
NSE: Arguments from CLI: 
NSE: Loaded 40 scripts for scanning.
Packet capture filter (device eth0): dst host 192.168.80.131 and (icmp or icmp6 or ((tcp or udp or sctp) and (src host x.x.x.x)))
Overall sending rates: 10.78 packets / s, 474.44 bytes / s.
NSOCK INFO [0.8860s] nsock_iod_new2(): nsock_iod_new (IOD #1)
NSOCK INFO [0.8860s] nsock_connect_tcp(): TCP connection requested to x.x.x.x:46000 (IOD #1) EID 8
NSOCK INFO [0.9240s] nsock_trace_handler_callback(): Callback: CONNECT SUCCESS for EID 8 [x.x.x.x:46000]
Service scan sending probe NULL to x.x.x.x:46000 (tcp)
NSOCK INFO [0.9240s] nsock_read(): Read request from IOD #1 [x.x.x.x:46000] (timeout: 6000ms) EID 18
NSOCK INFO [6.9250s] nsock_trace_handler_callback(): Callback: READ TIMEOUT for EID 18 [x.x.x.x:46000]
Service scan sending probe GenericLines to x.x.x.x:46000 (tcp)
NSOCK INFO [6.9250s] nsock_write(): Write request for 4 bytes to IOD #1 EID 27 [x.x.x.x:46000]
NSOCK INFO [6.9250s] nsock_read(): Read request from IOD #1 [x.x.x.x:46000] (timeout: 5000ms) EID 34
NSOCK INFO [6.9250s] nsock_trace_handler_callback(): Callback: WRITE SUCCESS for EID 27 [x.x.x.x:46000]
NSOCK INFO [11.9320s] nsock_trace_handler_callback(): Callback: READ TIMEOUT for EID 34 [x.x.x.x:46000]
NSOCK INFO [11.9320s] nsock_iod_delete(): nsock_iod_delete (IOD #1)
NSOCK INFO [11.9320s] nsock_iod_new2(): nsock_iod_new (IOD #2)
NSOCK INFO [11.9330s] nsock_connect_tcp(): TCP connection requested to x.x.x.x:46000 (IOD #2) EID 40
NSOCK INFO [11.9690s] nsock_trace_handler_callback(): Callback: CONNECT SUCCESS for EID 40 [x.x.x.x:46000]
Service scan sending probe GetRequest to x.x.x.x:46000 (tcp)
NSOCK INFO [11.9690s] nsock_write(): Write request for 18 bytes to IOD #2 EID 51 [x.x.x.x:46000]
NSOCK INFO [11.9690s] nsock_read(): Read request from IOD #2 [x.x.x.x:46000] (timeout: 5000ms) EID 58
NSOCK INFO [11.9690s] nsock_trace_handler_callback(): Callback: WRITE SUCCESS for EID 51 [x.x.x.x:46000]
NSOCK INFO [12.0520s] nsock_trace_handler_callback(): Callback: READ SUCCESS for EID 58 [x.x.x.x:46000] (346 bytes)
Service scan match (Probe GetRequest matched with GetRequest line 6609): x.x.x.x:46000 is http.  Version: |nginx|1.5.12||
NSOCK INFO [12.0520s] nsock_iod_delete(): nsock_iod_delete (IOD #2)
NSE: Script scanning x.x.x.x.
NSE: Starting runlevel 1 (of 2) scan.
NSE: Starting http-server-header against x.x.x.x:46000.
NSOCK INFO [12.0530s] nsock_iod_new2(): nsock_iod_new (IOD #1)
NSOCK INFO [12.0550s] nsock_connect_tcp(): TCP connection requested to x.x.x.x:46000 (IOD #1) EID 8
NSE: Finished http-server-header against x.x.x.x:46000.
NSE: Starting runlevel 2 (of 2) scan.
Nmap scan report for x.x.x.x
Host is up (0.036s latency).
Scanned at 2018-06-26 15:38:40 EDT for 11s
PORT      STATE SERVICE VERSION
46000/tcp open  http    nginx 1.5.12
Final times for host: srtt: 36338 rttvar: 36338  to: 181690

Read from /usr/bin/../share/nmap: nmap-payloads nmap-service-probes nmap-services.
Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 12.22 seconds

(echo -en 'GET / HTTP/1.0\r\n\r\n'; sleep 2) | nc x.x.x.x 46000 | (hd || xxd || hexdump)
00000000  48 54 54 50 2f 31 2e 31  20 33 30 32 20 4d 6f 76  |HTTP/1.1 302 Mov|
00000010  65 64 20 54 65 6d 70 6f  72 61 72 69 6c 79 0d 0a  |ed Temporarily..|
00000020  53 65 72 76 65 72 3a 20  6e 67 69 6e 78 2f 31 2e  |Server: nginx/1.|
00000030  35 2e 31 32 0d 0a 44 61  74 65 3a 20 57 65 64 2c  |5.12..Date: Wed,|
00000040  20 32 37 20 4a 75 6e 20  32 30 31 38 20 31 36 3a  | 27 Jun 2018 16:|
00000050  33 32 3a 30 39 20 47 4d  54 0d 0a 43 6f 6e 74 65  |32:09 GMT..Conte|
00000060  6e 74 2d 54 79 70 65 3a  20 74 65 78 74 2f 68 74  |nt-Type: text/ht|
00000070  6d 6c 0d 0a 43 6f 6e 74  65 6e 74 2d 4c 65 6e 67  |ml..Content-Leng|
00000080  74 68 3a 20 31 36 31 0d  0a 43 6f 6e 6e 65 63 74  |th: 161..Connect|
00000090  69 6f 6e 3a 20 63 6c 6f  73 65 0d 0a 4c 6f 63 61  |ion: close..Loca|
000000a0  74 69 6f 6e 3a 20 68 74  74 70 73 3a 2f 2f 3a 34  |tion: https://:4|
000000b0  36 30 30 30 2f 0d 0a 0d  0a 3c 68 74 6d 6c 3e 0d  |6000/....<html>.|
000000c0  0a 3c 68 65 61 64 3e 3c  74 69 74 6c 65 3e 33 30  |.<head><title>30|
000000d0  32 20 46 6f 75 6e 64 3c  2f 74 69 74 6c 65 3e 3c  |2 Found</title><|
000000e0  2f 68 65 61 64 3e 0d 0a  3c 62 6f 64 79 20 62 67  |/head>..<body bg|
000000f0  63 6f 6c 6f 72 3d 22 77  68 69 74 65 22 3e 0d 0a  |color="white">..|
00000100  3c 63 65 6e 74 65 72 3e  3c 68 31 3e 33 30 32 20  |<center><h1>302 |
00000110  46 6f 75 6e 64 3c 2f 68  31 3e 3c 2f 63 65 6e 74  |Found</h1></cent|
00000120  65 72 3e 0d 0a 3c 68 72  3e 3c 63 65 6e 74 65 72  |er>..<hr><center|
00000130  3e 6e 67 69 6e 78 2f 31  2e 35 2e 31 32 3c 2f 63  |>nginx/1.5.12</c|
00000140  65 6e 74 65 72 3e 0d 0a  3c 2f 62 6f 64 79 3e 0d  |enter>..</body>.|
00000150  0a 3c 2f 68 74 6d 6c 3e  0d 0a                    |.</html>..|
7
  • Nmap has a match line that is supposed to catch nginx with SSL enabled, but it didn't match the service you scanned. Can you run this command and provide output so we can write a better match? (echo -en 'GET / HTTP/1.0\r\n\r\n'; sleep 2) | nc x.x.x.x 46000 | (hd || xxd || hexdump) Jun 27, 2018 at 16:17
  • Done, not sure if it will help since it seems there is a redirection... Jun 27, 2018 at 16:35
  • Ok, I see. This isn't something ordinary -sV can deal with, since the clue is a redirection to https on the same port, but I think I can add a NSE script to check for it. Jun 27, 2018 at 17:23
  • Great. Let me know if you need more info, please Jun 27, 2018 at 17:26
  • New script is here: nmap.org/nsedoc/scripts/https-redirect.html - the change also adds dependencies on it to several other scripts so that it is ensured to run first. Otherwise you're likely to end up with the same problem. Wish I had a better solution. Jun 28, 2018 at 3:52

1 Answer 1

1

The trick is to make the port to pass the "portrule" specified. One of the ways to force the script to operate in the port is to specify the port with -p while the script is run with the + preffix:

nmap -p 46000 --script +ssl-heartbleed -script-args vulns.showall -sV x.x.x.x 

Starting Nmap 7.40 ( https://nmap.org ) at 2018-06-26 03:27 EDT
Nmap scan report for x.x.x.x.in-addr.arpa (x.x.x.x)
Host is up (0.0051s latency).
PORT      STATE SERVICE VERSION
46000/tcp open  http    nginx 1.5.12
|_http-server-header: nginx/1.5.12
| ssl-heartbleed: 
|   VULNERABLE:
|   The Heartbleed Bug is a serious vulnerability in the popular OpenSSL cryptographic software library. It allows for stealing information intended to be protected by SSL/TLS encryption.
|     State: VULNERABLE
|     Risk factor: High
|       OpenSSL versions 1.0.1 and 1.0.2-beta releases (including 1.0.1f and 1.0.2-beta1) of OpenSSL are affected by the Heartbleed bug. The bug allows for reading memory of systems protected by the vulnerable OpenSSL versions and could allow for disclosure of otherwise encrypted confidential information as well as the encryption keys themselves.
|           
|     References:
|       http://www.openssl.org/news/secadv_20140407.txt 
|       https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0160
|_      http://cvedetails.com/cve/2014-0160/

Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 11.78 seconds

This time the script detected the vulnerability.

4
  • You can also add -sV to let service fingerprinting detect the presence of SSL/TLS. All the ssl-* scripts will work against most standard ports and services, but since they shouldn't be run against every port ever they need help to know when to run otherwise. Jun 26, 2018 at 20:56
  • Sure, but -sV does not help with port 46000. Otherwise there was no need for this question, since it would've been worked straight away from the manual instructions Jun 26, 2018 at 21:30
  • Ah, I see, I had missed the -sV in your example. This works fine for me with Nmap 7.40 and 7.70 against a couple nginx SSL systems on port 46000 I found with Shodan. Can you provide the output of nmap -p46000 -n -Pn -sV --version-trace x.x.x.x? If you don't want to paste here, dmiller@nmap.org will reach me. We should be able to fix this. Jun 27, 2018 at 3:26
  • Of course, thanks. Updated in the question. Let me know if anything else is needed Jun 27, 2018 at 11:21

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.