openvas_to_report
openvas_to_report copied to clipboard
cr0hn
Does not work with GVM11?
Due to the fact that openvas had its life cycle at the end, I needed to install GVM11, however the XML is different from openvas 9 and the script you provided does not work with it. Did you have any plans to make the new version available to us? Note: You did a great job, helped a lot with scripting. an example of xml generated by gvm11
-
Microsoft Windows Server 2012 Edition
-
Microsoft Windows Server 2016
-
Microsoft Windows 8.1 x32/x64 Edition
-
Microsoft Windows Server 2012 R2 Edition
-
Microsoft Windows 7 x32/x64 Edition Service Pack 1
-
Microsoft Windows Vista x32/x64 Edition Service Pack 2
-
Microsoft Windows Server 2008 R2 x64 Edition Service Pack 1
-
Microsoft Windows Server 2008 x32/x64 Edition Service Pack 2|impact=Successful exploitation will allow remote attackers to gain the ability to execute code on the target server, also could lead to information disclosure from the server.|solution=The vendor has released updates. Please see the references for more information.|vuldetect=Send the crafted SMB transaction request with fid = 0 and check the response to confirm the vulnerability.|solution_type=VendorFix
<scan_nvt_version></scan_nvt_version> High 9.3 95 <original_threat>High</original_threat><original_severity>9.3</original_severity> DCE/RPC and MSRPC Services Enumeration Reporting admin <creation_time>2020-05-29T00:31:05-03:00</creation_time> 172.16.0.171 135/tcp nvt DCE/RPC and MSRPC Services Enumeration Reporting Windows <cvss_base>5.0</cvss_base>cvss_base_vector=AV:N/AC:L/Au:N/C:P/I:N/A:N|summary=Distributed Computing Environment / Remote Procedure Calls (DCE/RPC) or MSRPC services running on the remote host can be enumerated by connecting on port 135 and doing the appropriate queries.|insight=|affected=|impact=An attacker may use this fact to gain more knowledge about the remote host.|solution=Filter incoming traffic to this ports.|vuldetect=|solution_type=Mitigation Medium 5.0 80 Here is the list of DCE/RPC or MSRPC services running on this host via the TCP protocol:
Port: 49152/tcp
UUID: d95afe70-a6d5-4259-822e-2c84da1ddb0d, version 1
Endpoint: ncacn_ip_tcp:172.16.0.171[49152]
Port: 49153/tcp
UUID: 06bba54a-be05-49f9-b0a0-30f790261023, version 1
Endpoint: ncacn_ip_tcp:172.16.0.171[49153]
Annotation: Security Center
UUID: 30adc50c-5cbc-46ce-9a0e-91914789e23c, version 1
Endpoint: ncacn_ip_tcp:172.16.0.171[49153]
Annotation: NRP server endpoint
UUID: 3c4728c5-f0ab-448b-bda1-6ce01eb0a6d5, version 1
Endpoint: ncacn_ip_tcp:172.16.0.171[49153]
Annotation: DHCP Client LRPC Endpoint
UUID: 3c4728c5-f0ab-448b-bda1-6ce01eb0a6d6, version 1
Endpoint: ncacn_ip_tcp:172.16.0.171[49153]
Annotation: DHCPv6 Client LRPC Endpoint
UUID: f6beaff7-1e19-4fbb-9f8f-b89e2018337c, version 1
Endpoint: ncacn_ip_tcp:172.16.0.171[49153]
Annotation: Event log TCPIP
Port: 49154/tcp
UUID: 552d076a-cb29-4e44-8b6a-d15e59e2c0af, version 1
Endpoint: ncacn_ip_tcp:172.16.0.171[49154]
Annotation: IP Transition Configuration endpoint
UUID: 86d35949-83c9-4044-b424-db363231fd0c, version 1
Endpoint: ncacn_ip_tcp:172.16.0.171[49154]
UUID: 98716d03-89ac-44c7-bb8c-285824e51c4a, version 1
Endpoint: ncacn_ip_tcp:172.16.0.171[49154]
Annotation: XactSrv service
UUID: a398e520-d59a-4bdd-aa7a-3c1e0303a511, version 1
Endpoint: ncacn_ip_tcp:172.16.0.171[49154]
Annotation: IKE/Authip API
Port: 49155/tcp
UUID: 12345778-1234-abcd-ef00-0123456789ac, version 1
Endpoint: ncacn_ip_tcp:172.16.0.171[49155]
Named pipe : lsass
Win32 service or process : lsass.exe
Description : SAM access
Port: 49184/tcp
UUID: 367abb81-9844-35f1-ad32-98f038001003, version 2
Endpoint: ncacn_ip_tcp:172.16.0.171[49184]
Port: 49186/tcp
UUID: 12345678-1234-abcd-ef00-0123456789ab, version 1
Endpoint: ncacn_ip_tcp:172.16.0.171[49186]
Annotation: IPSec Policy agent endpoint
Named pipe : spoolss
Win32 service or process : spoolsv.exe
Description : Spooler service
UUID: 6b5bdd1e-528c-422c-af8c-a4079be4fe48, version 1
Endpoint: ncacn_ip_tcp:172.16.0.171[49186]
Annotation: Remote Fw APIs
Note: DCE/RPC or MSRPC services running on this host locally were identified. Reporting this list is not enabled by default due to the possible large size of this list. See the script preferences to enable this reporting.
<original_threat>Medium</original_threat><original_severity>5</original_severity>
To disable TCP timestamps on Windows execute 'netsh int tcp set global timestamps=disabled'
Starting with Windows Server 2008 and Vista, the timestamp can not be completely disabled.
The default behavior of the TCP/IP stack on this Systems is to not use the Timestamp options when initiating TCP connections, but use them if the TCP peer that is initiating communication includes them in their synchronize (SYN) segment.
See the references for more information.|vuldetect=Special IP packets are forged and sent with a little delay in between to the
target IP. The responses are searched for a timestamps. If found, the timestamps are reported.|solution_type=Mitigation
The following timestamps were retrieved with a delay of 1 seconds in-between:
Packet 1: 101882
Packet 2: 101991
<original_threat>Low</original_threat><original_severity>2.6</original_severity><result_count>14
Hi! I'm sorry to say that currently I only have time to maintain a few quantity of projects and I'm priorizing these projects with sponsorship. This project doesn't have any sponsors (currently) so, I don't have plans to add new features.
I should analyse the work for this feature but, at least, a tier 2 for my sponsor tiers:
https://github.com/sponsors/cr0hn