Conficker scans with nmap

brgsousa · 04-06-2009, 09:35 AM

Hi, i am trying to scan my network for conficker. But I don't know much about nmap scans. I downloaded smb-check-vulns script from here http://nmap.org/nsedoc/scripts/smb-check-vulns.html

But some dependencies were not satisfied. How can I do that?

Code:

# nmap -sC --script=smb-check-vulns --script-args=safe=1 -p445 -d -PN -n -T4 --min-hostgroup 256 --min-parallelism 64 -oA conficker_scan 10.101.6.8
Warning: You specified a highly aggressive --min-hostgroup.

Starting Nmap 4.62 ( http://nmap.org ) at 2009-04-06 10:56 BRT
--------------- Timing report ---------------
  hostgroups: min 256, max 100000
  rtt-timeouts: init 500, min 100, max 1250
  max-scan-delay: TCP 10, UDP 1000
  parallelism: min 64, max 64
  max-retries: 6, host-timeout: 0
  min-rate: 0
---------------------------------------------
Initiating SYN Stealth Scan at 10:56
Scanning 10.101.6.8 [1 port]
Packet capture filter (device eth0): dst host 10.1.100.45 and (icmp or (tcp and (src host 10.101.6.8)))
Completed SYN Stealth Scan at 10:56, 1.02s elapsed (1 total ports)
Overall sending rates: 1.96 packets / s, 86.03 bytes / s.
SCRIPT ENGINE: Initiating script scanning.
SCRIPT ENGINE: Script scanning 10.101.6.8.
SCRIPT ENGINE: Using /usr/lib/nmap/nselib-bin/?.so;./?.so;/usr/local/lib/lua/5.1/?.so;/usr/local/lib/lua/5.1/loadall.so to search for C-modules and /usr/share/nmap/nselib/?.lua;./?.lua;/usr/local/share/lua/5.1/?.lua;/usr/local/share/lua/5.1/?/init.lua;/usr/local/lib/lua/5.1/?.lua;/usr/local/lib/lua/5.1/?/init.lua for Lua-modules
LUA INTERPRETER in nse_init.cc:763: ./smb-check-vulns.nse:78: module 'msrpc' not found:
        no field package.preload['msrpc']
        no file '/usr/share/nmap/nselib/msrpc.lua'
        no file './msrpc.lua'
        no file '/usr/local/share/lua/5.1/msrpc.lua'
        no file '/usr/local/share/lua/5.1/msrpc/init.lua'
        no file '/usr/local/lib/lua/5.1/msrpc.lua'
        no file '/usr/local/lib/lua/5.1/msrpc/init.lua'
        no file '/usr/lib/nmap/nselib-bin/msrpc.so'
        no file './msrpc.so'
        no file '/usr/local/lib/lua/5.1/msrpc.so'
        no file '/usr/local/lib/lua/5.1/loadall.so'
SCRIPT ENGINE: Script scanning completed.
SCRIPT ENGINE: Aborting script scan.
Host 10.101.6.8 appears to be up ... good.
Interesting ports on 10.101.6.8:
PORT    STATE    SERVICE      REASON
445/tcp filtered microsoft-ds no-response
Final times for host: srtt: -1 rttvar: -1  to: 500000

Read from /usr/share/nmap: nmap-services.
Nmap done: 1 IP address (1 host up) scanned in 1.070 seconds
           Raw packets sent: 2 (88B) | Rcvd: 0 (0B)

brianL · 04-06-2009, 10:01 AM

You just need to install lua (it's an interpreted programming language). It's available for Debian and Ubuntu, look in Synaptic.

brianL · 04-06-2009, 03:42 PM

And you're using the wrong version of NMap, see here:
http://insecure.org/#conficker

brgsousa · 04-08-2009, 07:12 AM

I installed Lua5.1 (debian package) and it still was not working.
But when I used the new version of nmap it worked.

thanks