{"id":699,"date":"2012-05-25T16:36:27","date_gmt":"2012-05-25T15:36:27","guid":{"rendered":"http:\/\/www.phillips321.co.uk\/?p=699"},"modified":"2012-05-25T16:41:53","modified_gmt":"2012-05-25T15:41:53","slug":"onesixtyone-version-8-now-with-port-option","status":"publish","type":"post","link":"https:\/\/www.phillips321.co.uk\/2012\/05\/25\/onesixtyone-version-8-now-with-port-option\/","title":{"rendered":"onesixtyone version 8 – now with port option"},"content":{"rendered":"

Writeup by scriptmonkey:
\nOnesixtyone’s origional developer (phreedom.org – 404)<\/a> produced the great piece of code that was modified by Portcullis here<\/a>. Unfortunately onesixtyone has never supported obscure ports and insteads is fixed using UDP port 161.<\/p>\n

We’ll modify the code the allow a custom port using the -p flag<\/p>\n

Wanted to add it as a custom flag so added it to the structure which stores the command line options right at the top of the file.<\/p>\n

1
2
3
4
5
6
7
8
9
<\/div><\/td>
  73<\/span> struct<\/span> {<\/span>
\n  74<\/span>     int<\/span>             debug;<\/span>
\n  75<\/span>     int<\/span>             log<\/span><\/a>;<\/span>
\n  76<\/span>     int<\/span>             quiet;<\/span>
\n  77<\/span>     int<\/span>             port;<\/span>
\n  78<\/span>     long<\/span>            wait;<\/span>
\n  79<\/span>
\n  80<\/span>     FILE           *<\/span>log_fd;<\/span>
\n  81<\/span> }<\/span> o;<\/span><\/div><\/td><\/tr><\/tbody><\/table><\/div>\n

I don’t want to affect it if people don’t want to use the -p flag so I set the default to 161<\/p>\n

1
2
3
4
5
6
7
8
9
<\/div><\/td>
 175<\/span>     o.debug<\/span> =<\/span> 0<\/span>;<\/span>
\n 176<\/span>     o.log<\/span><\/a> =<\/span> 0<\/span>;<\/span>
\n 177<\/span>     o.quiet<\/span> =<\/span> 0<\/span>;<\/span>
\n 178<\/span>     o.wait<\/span> =<\/span> 10<\/span>;<\/span>
\n 179<\/span>     o.port<\/span> =<\/span> 161<\/span>;<\/span>
\n 180<\/span>     input_file =<\/span> 0<\/span>;<\/span>
\n 181<\/span>     community_file =<\/span> 0<\/span>;<\/span>
\n 182<\/span>
\n 183<\/span>     o.log_fd<\/span> =<\/span> NULL;<\/span><\/div><\/td><\/tr><\/tbody><\/table><\/div>\n

Now with it added to the structure if I want to customise it, I can access it using o.port so I look at the switch case statement which handles command line input.<\/p>\n

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
<\/div><\/td>
 185<\/span>     while<\/span> (<\/span>(<\/span>arg =<\/span> getopt(<\/span>argc,<\/span> argv,<\/span> "c:di:o:p:w:q"<\/span>)<\/span>)<\/span> !=<\/span> EOF)<\/span> {<\/span>
\n 186<\/span>         switch<\/span> (<\/span>arg)<\/span> {<\/span>
\n 187<\/span>         case<\/span> 'c'<\/span>:<\/span>
\n 188<\/span>             community_file =<\/span> 1<\/span>;<\/span>
\n 189<\/span>             strncpy<\/span><\/a>(<\/span>community_filename,<\/span> optarg,<\/span>
\n 190<\/span>                     sizeof<\/span>(<\/span>community_filename)<\/span>)<\/span>;<\/span>
\n 191<\/span>             break<\/span>;<\/span>
\n 192<\/span>         case<\/span> 'd'<\/span>:<\/span>
\n 193<\/span>             o.debug<\/span>++;<\/span>
\n 194<\/span>             break<\/span>;<\/span>
\n 195<\/span>         case<\/span> 'i'<\/span>:<\/span>
\n 196<\/span>             input_file =<\/span> 1<\/span>;<\/span>
\n 197<\/span>             strncpy<\/span><\/a>(<\/span>input_filename,<\/span> optarg,<\/span> sizeof<\/span>(<\/span>input_filename)<\/span>)<\/span>;<\/span>
\n 198<\/span>             break<\/span>;<\/span>
\n 199<\/span>         case<\/span> 'o'<\/span>:<\/span>
\n 200<\/span>             o.log<\/span><\/a> =<\/span> 1<\/span>;<\/span>
\n 201<\/span>             strncpy<\/span><\/a>(<\/span>log_filename,<\/span> optarg,<\/span> sizeof<\/span>(<\/span>log_filename)<\/span>)<\/span>;<\/span>
\n 202<\/span>             break<\/span>;<\/span>
\n 203<\/span>         case<\/span> 'w'<\/span>:<\/span>
\n 204<\/span>             o.wait<\/span> =<\/span> atol<\/span><\/a>(<\/span>optarg)<\/span>;<\/span>      \/* convert to nanoseconds *\/<\/span>
\n 205<\/span>             break<\/span>;<\/span>
\n 206<\/span>         case<\/span> 'q'<\/span>:<\/span>
\n 207<\/span>             o.quiet<\/span> =<\/span> 1<\/span>;<\/span>
\n 208<\/span>             break<\/span>;<\/span>
\n 209<\/span>         case<\/span> 'p'<\/span>:<\/span>
\n 210<\/span>                 o.port<\/span> =<\/span> atoi<\/span><\/a>(<\/span>optarg)<\/span>;<\/span> \/*added ability to specify a port *\/<\/span>
\n 211<\/span>                 break<\/span>;<\/span>
\n 212<\/span>         case<\/span> '?'<\/span>:<\/span>
\n 213<\/span>             usage(<\/span>argv[<\/span>0<\/span>]<\/span>)<\/span>;<\/span>
\n 214<\/span>             exit<\/span><\/a>(<\/span>1<\/span>)<\/span>;<\/span><\/div><\/td><\/tr><\/tbody><\/table><\/div>\n

having a colon after an argument in the getopt function means that it has a value associated with it, the difference between -p and -p 8161<\/p>\n

Then just handle it like a normal case statement (Dont forget the break!) only we have to convert a string (the default type of argument you get with a getopt call) into an integer, atoi does the job and so we can set o.port to be the new value.<\/p>\n

Now we have to find where onesixtyone has hardcoded a value of 161 in the code. \/161 in vim gets us the single hit so we change it.<\/p>\n

1
<\/div><\/td>
897<\/span>      remote_addr.sin_port<\/span> =<\/span> htons(<\/span>o.port<\/span>)<\/span>;<\/span><\/div><\/td><\/tr><\/tbody><\/table><\/div>\n

Finally, changing the port is fine, but unless you’ve specified an easy to remember filename when you review the scans post test you’ll be like me and facedesking as to why you didn’t record the port number.<\/p>\n

So lets get rid of that issue. When we’re using a non-standard port, lets include it in the output file.<\/p>\n

A quick search through the code below the above snippet reveals lots of writes for when it finds a successful string. So lets use the same method of recording the port we’re scanning.<\/p>\n

1
2
3
4
<\/div><\/td>
 265<\/span>         printf<\/span><\/a>(<\/span>"Logging to file %s\\n<\/span>"<\/span>,<\/span> log_filename)<\/span>;<\/span>
\n 266<\/span>                 if<\/span>(<\/span>o.port<\/span> !=<\/span> 161<\/span>)<\/span>{<\/span>
\n 267<\/span>                         logfx(<\/span>"Non-standard port selected - scanning port: %d\\n<\/span>"<\/span>,<\/span> o.port<\/span>)<\/span>;<\/span>
\n 268<\/span>                 }<\/span><\/div><\/td><\/tr><\/tbody><\/table><\/div>\n

and bobs your mothers brother. You’ve now got an updated onesixtyone that does custom ports. \ud83d\ude42<\/p>\n

Download the source and the binary from here:
\nphillips321.co.uk\/downloads\/onesixtyone-0.8.tar.gz<\/a><\/p>\n","protected":false},"excerpt":{"rendered":"

Writeup by scriptmonkey: Onesixtyone’s origional developer (phreedom.org – 404) produced the great piece of code that was modified by Portcullis here. Unfortunately onesixtyone has never supported obscure ports and insteads is fixed using UDP port 161. We’ll modify the code the allow a custom port using the -p flag Wanted to add it as a […]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":[],"categories":[1],"tags":[265,264,267,269,266,268],"_links":{"self":[{"href":"https:\/\/www.phillips321.co.uk\/wp-json\/wp\/v2\/posts\/699"}],"collection":[{"href":"https:\/\/www.phillips321.co.uk\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.phillips321.co.uk\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.phillips321.co.uk\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.phillips321.co.uk\/wp-json\/wp\/v2\/comments?post=699"}],"version-history":[{"count":7,"href":"https:\/\/www.phillips321.co.uk\/wp-json\/wp\/v2\/posts\/699\/revisions"}],"predecessor-version":[{"id":707,"href":"https:\/\/www.phillips321.co.uk\/wp-json\/wp\/v2\/posts\/699\/revisions\/707"}],"wp:attachment":[{"href":"https:\/\/www.phillips321.co.uk\/wp-json\/wp\/v2\/media?parent=699"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.phillips321.co.uk\/wp-json\/wp\/v2\/categories?post=699"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.phillips321.co.uk\/wp-json\/wp\/v2\/tags?post=699"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}