Script `backorifice-info`

Script types: portrule
Categories: default, discovery, safe
Download: https://svn.nmap.org/nmap/scripts/backorifice-info.nse

Script Summary

Connects to a BackOrifice service and gathers information about the host and the BackOrifice service itself.

The extracted host information includes basic system setup, list of running processes, network resources and shares.

Information about the service includes enabled port redirections, listening console applications and a list of BackOrifice plugins installed with the service.

Script Arguments

backorifice-info.seed: Encryption seed (default derived from password, or 31337 for no password).
backorifice-info.password: Encryption password (defaults to no password).

Example Usage

nmap --script backorifice-info <target> --script-args backorifice-info.password=<password>

Script Output

31337/udp open|filtered BackOrifice
| backorifice-info:
|   PING REPLY
|     !PONG!1.20!HAL9000!
|   SYSTEM INFO
|     System info for machine 'HAL9000'
|     Current user: 'Dave'
|     Processor: I586
|     Win32 on Windows 95 v4.10 build 2222 -  A
|     Memory: 63M in use: 30%  Page file: 1984M free: 1970M
|     C:\ - Fixed Sec/Clust: 64 Byts/Sec: 512,  Bytes free: 2147155968/21471
|       ...155968
|     D:\ - CD-ROM
|   PROCESS LIST
|       PID  -    Executable
|     4293872589 C:\WINDOWS\SYSTEM\KERNEL32.DLL
|     4294937581 C:\WINDOWS\SYSTEM\MSGSRV32.EXE
|     4294935933 C:\WINDOWS\SYSTEM\MPREXE.EXE
|     4294843869 C:\WINDOWS\SYSTEM\MSTASK.EXE
|     4294838549 C:\WINDOWS\SYSTEM\ .EXE
|     4294864917 C:\WINDOWS\EXPLORER.EXE
|     4294880413 C:\WINDOWS\TASKMON.EXE
|     4294878445 C:\WINDOWS\SYSTEM\SYSTRAY.EXE
|     4294771309 C:\WINDOWS\WINIPCFG.EXE
|     4294772081 C:\WINDOWS\SYSTEM\WINOA386.MOD
|   NETWORK RESOURCES - NET VIEW
|     (null) '(null)' - Microsoft Network - UNKNOWN!  (Network root?):CONTAINER
|     (null) 'WORKGROUP' - (null) - DOMAIN:CONTAINER
|     (null) '\\HAL9000' -  - SERVER:CONTAINER
|     (null) '\\HAL9000\DOCUMENTS' - sample comment 2 - SHARE:DISK
|     (null) '\\WIN982' -  - SERVER:CONTAINER
|     (null) '\\WIN982\BO' - tee hee hee comment - SHARE:DISK
|   SHARELIST
|     'DOCUMENTS'-C:\WINDOWS\DESKTOP\DOCUMENTS 'sample comment 2' RO:'' RW:'
|       ...'' Disk PERSISTANT READONLY
|     'IPC$'-  'Remote Inter Process Communication' RO:'' RW:'' IPC FULL
|   REDIRECTED PORTS
|     0 redirs displayed
|   LISTENING CONSOLE APPLICATIONS
|     0 apps listed
|   PLUGIN LIST
|_    End of plugins

Requires

Author:

Gorjan Petrovski