Skip to content

Handle error condition when sysDescr cannot be parsed.#38

Open
hardwaterhacker wants to merge 1 commit intotrailofbits:masterfrom
hardwaterhacker:master
Open

Handle error condition when sysDescr cannot be parsed.#38
hardwaterhacker wants to merge 1 commit intotrailofbits:masterfrom
hardwaterhacker:master

Conversation

@hardwaterhacker
Copy link
Copy Markdown

There seems to be an error case in parse_snmp_pdu that's not being handled properly. During testing, I found some hosts where the logr function wasn't printing out the sysDescr and wasn't inserting a newline. As a result, there were multiple results on one line, like the example below. A newline was finally inserted when a host with a parsable response was encountered.

192.168.108.142 [public] 10.3.30.55 [public] 10.3.30.99 [public] 10.3.30.105 [public] 10.3.30.160 [public] 10.3.30.173 [public] 10.3.30.183 [public] 10.3.30.189 [public] 10.3.50.32

Result after testing with one affected host and multiple community strings. Note that these affected hosts respond with SNMP error number 2 (no such name). I do not believe that is relevant to this error condition, but I cannot confirm.

└─$ ./onesixtyone -c community.txt -i target.txt -o confirm.log
Logging to file confirm.log
Scanning 1 hosts, 4 communities
10.3.30.105 [network] Unable to parse sysDesc
10.3.30.105 [netman] Unable to parse sysDesc
10.3.30.105 [monitor] Unable to parse sysDesc
10.3.30.105 [public] Unable to parse sysDesc

Packet capture when error condition is encountered.

0000   bc 24 11 92 21 41 00 09 0f 09 02 08 08 00 45 00   .$..!A........E.
0010   00 48 d3 a7 00 00 fe 11 ab e3 0a 03 1e 69 0a 03   .H...........i..
0020   0a ab 00 a1 b8 8d 00 34 3e 02 30 2a 02 01 00 04   .......4>.0*....
0030   07 6e 65 74 77 6f 72 6b a2 1c 02 04 ff ff ff ff   .network........
0040   02 01 02 02 01 00 30 0e 30 0c 06 08 2b 06 01 02   ......0.0...+...
0050   01 01 01 00 05 00                                 ......

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant