diff options
Diffstat (limited to 'src/usr.bin/nc/scripts/probe')
-rw-r--r-- | src/usr.bin/nc/scripts/probe | 52 |
1 files changed, 0 insertions, 52 deletions
diff --git a/src/usr.bin/nc/scripts/probe b/src/usr.bin/nc/scripts/probe deleted file mode 100644 index 0b647672ea..0000000000 --- a/src/usr.bin/nc/scripts/probe +++ /dev/null | |||
@@ -1,52 +0,0 @@ | |||
1 | #! /bin/sh | ||
2 | # $OpenBSD: probe,v 1.2 2001/01/29 01:58:13 niklas Exp $ | ||
3 | |||
4 | ## launch a whole buncha shit at yon victim in no particular order; capture | ||
5 | ## stderr+stdout in one place. Run as root for rservice and low -p to work. | ||
6 | ## Fairly thorough example of using netcat to collect a lot of host info. | ||
7 | ## Will set off every intrusion alarm in existence on a paranoid machine! | ||
8 | |||
9 | # where .d files are kept; "." if nothing else | ||
10 | DDIR=../data | ||
11 | # address of some well-connected router that groks LSRR | ||
12 | GATE=192.157.69.11 | ||
13 | |||
14 | # might conceivably wanna change this for different run styles | ||
15 | UCMD='nc -v -w 8' | ||
16 | |||
17 | test ! "$1" && echo Needs victim arg && exit 1 | ||
18 | |||
19 | echo '' | $UCMD -w 9 -r "$1" 13 79 6667 2>&1 | ||
20 | echo '0' | $UCMD "$1" 79 2>&1 | ||
21 | # if LSRR was passed thru, should get refusal here: | ||
22 | $UCMD -z -r -g $GATE "$1" 6473 2>&1 | ||
23 | $UCMD -r -z "$1" 6000 4000-4004 111 53 2105 137-140 1-20 540-550 95 87 2>&1 | ||
24 | # -s `hostname` may be wrong for some multihomed machines | ||
25 | echo 'UDP echoecho!' | nc -u -p 7 -s `hostname` -w 3 "$1" 7 19 2>&1 | ||
26 | echo '113,10158' | $UCMD -p 10158 "$1" 113 2>&1 | ||
27 | rservice bin bin | $UCMD -p 1019 "$1" shell 2>&1 | ||
28 | echo QUIT | $UCMD -w 8 -r "$1" 25 158 159 119 110 109 1109 142-144 220 23 2>&1 | ||
29 | # newline after any telnet trash | ||
30 | echo '' | ||
31 | echo PASV | $UCMD -r "$1" 21 2>&1 | ||
32 | echo 'GET /' | $UCMD -w 10 "$1" 80 81 210 70 2>&1 | ||
33 | # sometimes contains useful directory info: | ||
34 | echo 'GET /robots.txt' | $UCMD -w 10 "$1" 80 2>&1 | ||
35 | # now the big red lights go on | ||
36 | rservice bin bin 9600/9600 | $UCMD -p 1020 "$1" login 2>&1 | ||
37 | rservice root root | $UCMD -r "$1" exec 2>&1 | ||
38 | echo 'BEGIN big udp -- everything may look "open" if packet-filtered' | ||
39 | data -g < ${DDIR}/nfs-0.d | $UCMD -i 1 -u "$1" 2049 | od -x 2>&1 | ||
40 | # no wait-time, uses RTT hack | ||
41 | nc -v -z -u -r "$1" 111 66-70 88 53 87 161-164 121-123 213 49 2>&1 | ||
42 | nc -v -z -u -r "$1" 137-140 694-712 747-770 175-180 2103 510-530 2>&1 | ||
43 | echo 'END big udp' | ||
44 | $UCMD -r -z "$1" 175-180 2000-2003 530-533 1524 1525 666 213 8000 6250 2>&1 | ||
45 | # Use our identd-sniffer! | ||
46 | iscan "$1" 21 25 79 80 111 53 6667 6000 2049 119 2>&1 | ||
47 | # this gets pretty intrusive, but what the fuck. Probe for portmap first | ||
48 | if nc -w 5 -z -u "$1" 111 ; then | ||
49 | showmount -e "$1" 2>&1 | ||
50 | rpcinfo -p "$1" 2>&1 | ||
51 | fi | ||
52 | exit 0 | ||