NSE LIB

Back to library
Official safe Discovery

rpcap-info

Connects to the rpcap service (provides remote sniffing capabilities through WinPcap) and retrieves interface information. The service can either be setup to require authentication or not and also supports IP restrictions.

Ports

Any

Protocols

n/a

Attribution

Nmap Project

Usage

Copy the command and adjust the target or script arguments as needed. 

nmap -p 2002 <ip> --script rpcap-info
nmap -p 2002 <ip> --script rpcap-info --script-args="creds.rpcap='administrator:foobar'"
Script Source Toggle

The full script source is stored with this entry and is hidden by default to keep the page easier to scan. 

local creds = require "creds"
local nmap = require "nmap"
local rpcap = require "rpcap"
local shortport = require "shortport"
local stdnse = require "stdnse"

description = [[
Connects to the rpcap service (provides remote sniffing capabilities
through WinPcap) and retrieves interface information. The service can either be
setup to require authentication or not and also supports IP restrictions.
]]

---
-- @usage
-- nmap -p 2002 <ip> --script rpcap-info
-- nmap -p 2002 <ip> --script rpcap-info --script-args="creds.rpcap='administrator:foobar'"
--
-- @output
-- PORT     STATE SERVICE REASON
-- 2002/tcp open  rpcap   syn-ack
-- | rpcap-info:
-- |   \Device\NPF_{0D5D1364-1F1F-4892-8AC3-B838258F9BB8}
-- |     Intel(R) PRO/1000 MT Desktop Adapter
-- |     Addresses
-- |         fe80:0:0:0:aabb:ccdd:eeff:0011
-- |         192.168.1.127/24
-- |   \Device\NPF_{D5EAD105-B0BA-4D38-ACB4-6E95512BC228}
-- |     Hamachi Virtual Network Interface Driver
-- |     Addresses
-- |_        fe80:0:0:0:aabb:ccdd:eeff:0022
--
-- @args creds.rpcap username:password to use for authentication
--
-- @see rpcap-brute.nse

author = "Patrik Karlsson"
license = "Same as Nmap--See https://nmap.org/book/man-legal.html"
categories = {"discovery", "safe"}
dependencies = {"rpcap-brute"}


portrule = shortport.port_or_service(2002, "rpcap", "tcp")

local function fail(err) return stdnse.format_output(false, err) end

local function getInfo(host, port, username, password)

  local helper = rpcap.Helper:new(host, port)
  local status, resp = helper:connect()
  if ( not(status) ) then
    return false, "Failed to connect to server"
  end
  status, resp = helper:login(username, password)

  if ( not(status) ) then
    return false, resp
  end

  status, resp = helper:findAllInterfaces()
  helper:close()
  if ( not(status) ) then
    return false, resp
  end

  port.version.name = "rpcap"
  port.version.product = "WinPcap remote packet capture daemon"
  nmap.set_port_version(host, port)

  return true, resp
end

action = function(host, port)

  -- patch-up the service name, so creds.rpcap will work, ugly but needed as
  -- tcp 2002 is registered to the globe service in nmap-services ...
  port.service = "rpcap"

  local c = creds.Credentials:new(creds.ALL_DATA, host, port)
  local states = creds.State.VALID + creds.State.PARAM
  local status, resp = getInfo(host, port)

  if ( status ) then
    return stdnse.format_output(true, resp)
  end

  for cred in c:getCredentials(states) do
    status, resp = getInfo(host, port, cred.user, cred.pass)
    if ( status ) then
      return stdnse.format_output(true, resp)
    end
  end

  return fail(resp)
end

Overview

Connects to the rpcap service (provides remote sniffing capabilities through WinPcap) and retrieves interface information. The service can either be setup to require authentication or not and also supports IP restrictions.