1

I'm running nmap 6.47 on Windows 7 and am trying to run the ssl-ccs-injection.nse script. After getting an error, I ran it with the -d (debug) option and the error in the subject is what showed up. I haven't ever tried to run this script before, and I'm wondering what I've missed.

Here's a sanitized copy of the session along with the errors, I've replaced the hostname with example.com and used 10.10.10.10 for its IP.

nmap -p 443 -d --script ssl-ccs-injection.nse --script-args vulns.showall example.com

Starting Nmap 6.47 ( http://nmap.org ) at 2015-02-24 10:17 Eastern Standard Time
Winpcap present, dynamic linked to: WinPcap version 4.1.3 (packet.dll version 4.1.0.2980), based on libpcap version 1.0 branch 1_0_rel0b (20091008)
--------------- Timing report ---------------
  hostgroups: min 1, max 100000
  rtt-timeouts: init 1000, min 100, max 10000
  max-scan-delay: TCP 1000, UDP 1000, SCTP 1000
  parallelism: min 0, max 0
  max-retries: 10, host-timeout: 0
  min-rate: 0, max-rate: 0
---------------------------------------------
NSE: Using Lua 5.2.
NSE: Script Arguments seen from CLI: vulns.showall
NSE: Loaded 1 scripts for scanning.
NSE: Script Pre-scanning.
NSE: Starting runlevel 1 (of 1) scan.
Initiating Ping Scan at 10:17
Scanning example.com (10.10.10.10) [4 ports]
Packet capture filter (device eth2): dst host 10.10.10.11 and (icmp or icmp6 or ((tcp or udp or sctp) and (src host 10.10.10.10)))
We got a TCP ping packet back from 10.10.10.10 port 443 (trynum = 0)
Completed Ping Scan at 10:17, 0.42s elapsed (1 total hosts)
Overall sending rates: 9.43 packets / s, 358.49 bytes / s.
mass_rdns: Using DNS server 209.244.0.3
mass_rdns: Using DNS server 4.2.2.1
mass_rdns: Using DNS server 156.154.70.1
mass_rdns: Using DNS server 209.244.0.3
mass_rdns: Using DNS server 4.2.2.1
mass_rdns: Using DNS server 156.154.70.1
Initiating Parallel DNS resolution of 1 host. at 10:17
mass_rdns: 1.93s 0/1 [#: 6, OK: 0, NX: 0, DR: 0, SF: 0, TR: 1]
Completed Parallel DNS resolution of 1 host. at 10:17, 0.02s elapsed
DNS resolution of 1 IPs took 1.93s. Mode: Async [#: 6, OK: 0, NX: 1, DR: 0, SF: 0, TR: 1, CN: 0]
Initiating SYN Stealth Scan at 10:17
Scanning example.com (10.10.10.10) [1 port]
Packet capture filter (device eth2): dst host 10.10.10.11 and (icmp or icmp6 or ((tcp or udp or sctp) and (src host 10.10.10.10)))
Discovered open port 443/tcp on 10.10.10.10
Completed SYN Stealth Scan at 10:17, 0.36s elapsed (1 total ports)
Overall sending rates: 2.77 packets / s, 121.88 bytes / s.
NSE: Script scanning 10.10.10.10.
NSE: Starting runlevel 1 (of 1) scan.
NSE: Starting ssl-ccs-injection against example.com (10.10.10.10:443).
Initiating NSE at 10:17
NSE: ssl-ccs-injection against example.com (10.10.10.10:443) threw an error!
C:\Program Files (x86)\Nmap/scripts\ssl-ccs-injection.nse:123: variable 'keys' is not declared
stack traceback:
    [C]: in function 'error'
    C:\Program Files (x86)\Nmap/nselib/strict.lua:80: in function '__index'
    C:\Program Files (x86)\Nmap/scripts\ssl-ccs-injection.nse:123: in function 'test_ccs_injection'
    C:\Program Files (x86)\Nmap/scripts\ssl-ccs-injection.nse:269: in function <C:\Program Files (x86)\Nmap/scripts\ssl-ccs-injection.nse:245>
    (...tail calls...)
Completed NSE at 10:17, 0.00s elapsed
Nmap scan report for example.com (10.10.10.10)
Host is up, received syn-ack (0.28s latency).
Scanned at 2015-02-24 10:17:12 Eastern Standard Time for 3s
PORT    STATE SERVICE REASON
443/tcp open  https   syn-ack
Final times for host: srtt: 284875 rttvar: 227250  to: 1193875
NSE: Script Post-scanning.
NSE: Starting runlevel 1 (of 1) scan.
Read from C:\Program Files (x86)\Nmap: nmap-payloads nmap-services.
Nmap done: 1 IP address (1 host up) scanned in 3.92 seconds
           Raw packets sent: 5 (196B) | Rcvd: 2 (88B)

What's going on?

  • Looks like an error with the script. Contact the maintainer, because that's a syntax error. – Ohnana Feb 24 '15 at 16:33
  • What's on line 123 of ssl-ccs-injection.nse ? – kalina Feb 24 '15 at 18:21
  • Have you tried running that script without the "script-args" directive? – schroeder Feb 24 '15 at 19:09
  • @Flyk line 123 calls stdnse.keys(), which is supposed to be part of the standard NSE library, but it's seeing it as a variable, and not a function. It looks like an internal nmap problem. Tho, I'd try not using the "script-args" directive. – schroeder Feb 24 '15 at 19:22
  • @Flyk: Here's the line: ["ciphers"] = stdnse.keys(tls.CIPHERS), schroeder: Yep, tried without that directive. – David Kozinn Feb 24 '15 at 19:31
3

The script is written for the current development version of Nmap, not the released version. In r33651, I moved several different implementations of the same function into the stdnse library. You should be able to copy that library into your nselib/ directory just like you did to copy the ssl-ccs-injection script into the scripts/ directory. This will also solve the further problems of the same sort you may run into involving the debug function.

EDIT: The ssl-ccs-injection script was released with Nmap 6.49BETA1, and is available in stable releases after that (such as Nmap 7.01).

  • 1
    Thanks, I can confirm that using the updated stdnse library allowed the script to work properly. – David Kozinn Feb 24 '15 at 20:58
  • This worked for me as well. One thing to note, the example usage says nmap --script ssh2-enum-algos target, but I had to include service scanning to meet the dependencies for the check by adding -sV. – freb Jun 11 '15 at 1:36
0

Looking at the ssl-ccs-injection.nse Lua code:

local stdnse = require('stdnse')
... (snip) ...
local function test_ccs_injection(host, port, version)
  local hello = tls.client_hello({
    ["protocol"] = version,
    -- Claim to support every cipher
    -- Doesn't work with IIS, but IIS isn't vulnerable
    ["ciphers"] = stdnse.keys(tls.CIPHERS),              --< LINE 123
    ["compressors"] = {"NULL"},

It appears there is an internal problem with the Lua script interpreter. It's not seeing the stdnse.keys() function properly.

I would try updating or re-installing nmap and/or this one script.

  • I've re-installed nmap already and have tried re-downloading the script. I even built a Kali Linux Live ISO and downloaded the script (I'm not sure why it's not included) and I get the same error. I'm assuming that it's a script issue and I am attempting to get help via the dev@nmap.org, but the mailing list seems to be taking a long time to allow me to subscribe. I'm wondering if anyone else has this and if so, if it runs? I'm thinking that I need to configure something somewhere perhaps. – David Kozinn Feb 24 '15 at 19:42
  • Then it looks like an internal nmap coding issue. – schroeder Feb 24 '15 at 19:48

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.