Trend Micro OfficeScan service fingerprint

[Tom Sellers <nmap () fadedcode net>]

While working on some problems with Trend Micro's OfficeScan
antivirus I realized that I had never seen the associated
client network port identified by Nmap.  I saw that there are
two entries in nmap-service-probes but these did not seem
to work in my environment.  After some testing I found the
following:

1.  Random data and commands submitted to the port would eventually
     time out between 3 and 5 seconds after the last data.

2.  When it does time out it generates a HTTP 400 error.

It turns out that the problems that caused me to start looking
at the service originally are related to the fact that it
takes so long to timeout in response to invalid data.  I am
guessing that this is also the reason that nmap has not been
identifying the service.  I would imagine that 3 seconds
for each fingerprint probe adds up and the fingerprinting
process hits a timeout.

To address this I performed some packet captures and testing
and came up with the following.

1.  GET /?CAVIT HTTP/1.1 is a valid request and **returns
     immediately**.

2.  The result is a HTTP 200 response.

        HTTP/1.0 200 OK
        Server: OfficeScan Client
        Date: Fri, 28 Dec 2007 13:36:56 GMT
        Content-Type: text/html
        Accept-Ranges: bytes
        Content-Length: 410

        <snip data>

3.  OfficeScan client version 7 and below are on port 12345.
     Version 8 is on a random port.


The following nmap-service-probes entries successfully detected
Officescan 7.3 and 8 on every host I tested it against:

Probe TCP OfficeScan q|GET /?CAVIT HTTP/1.1\r\n\r\n|
match http m|^HTTP/1.0 200 OK\r\nServer: OfficeScan Client| p/Trend Micro OfficeScan Antivirus http config/

They should work against OfficeScan 6.x as well.

the p/ / strings were taken from the existing nmap-service-probes
file entries.

I think these should be added and the two existing lines (685 and
2984)should be removed.  The entries above should be added as early
as posible in the fingerprinting process in order to save time.


What do you folks think?

Tom

_______________________________________________
Sent through the nmap-dev mailing list
http://cgi.insecure.org/mailman/listinfo/nmap-dev
Archived at http://SecLists.Org