SHARE
TWEET

Finfisher-Nmap

a guest Jul 27th, 2012 497 Never
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
  1. Considering the network pattern described on http://pastebin.com/emK1Vt5g it is possible to enable nmap to detect Finfisher C&C machines:
  2.  
  3. vim /usr/share/nmap/nmap-service-probes
  4.  
  5. It basically add-up to the ports for HTTP probing:
  6. - 22
  7. - 53
  8. - 4111
  9.  
  10. And add that signature:
  11. match http m|^HTTP/1\.1 200 OK.*Hallo Steffi$|s p/FinFisher Governmental
  12. Monitoring Trojan C&C Server/
  13.  
  14. The result is as follow:
  15. Starting Nmap 5.00 ( http://nmap.org ) at 2012-07-27 11:29 MSK
  16. Interesting ports on static.ip.77.69.140.194.batelco.com.bh (77.69.140.194):
  17. PORT     STATE SERVICE VERSION
  18. 4111/tcp open  http    FinFisher Governmental Monitoring Trojan C&C Server
  19.  
  20. The nmap-service-probes format is at http://nmap.org/book/vscan-fileformat.html
RAW Paste Data
We use cookies for various purposes including analytics. By continuing to use Pastebin, you agree to our use of cookies as described in the Cookies Policy. OK, I Understand
Not a member of Pastebin yet?
Sign Up, it unlocks many cool features!
 
Top