Script rpcap-info

Script types: portrule
Categories: discovery, safe
Download: https://svn.nmap.org/nmap/scripts/rpcap-info.nse

Script Summary

Connects to the rpcap service (provides remote sniffing capabilities through WinPcap) and retrieves interface information. The service can either be setup to require authentication or not and also supports IP restrictions.

See also:

• rpcap-brute.nse

Script Arguments

creds.rpcap

username:password to use for authentication

creds.[service], creds.global

See the documentation for the creds library.

Example Usage

nmap -p 2002 <ip> --script rpcap-info
nmap -p 2002 <ip> --script rpcap-info --script-args="creds.rpcap='administrator:foobar'"

Script Output

PORT     STATE SERVICE REASON
2002/tcp open  rpcap   syn-ack
| rpcap-info:
|   \Device\NPF_{0D5D1364-1F1F-4892-8AC3-B838258F9BB8}
|     Intel(R) PRO/1000 MT Desktop Adapter
|     Addresses
|         fe80:0:0:0:aabb:ccdd:eeff:0011
|         192.168.1.127/24
|   \Device\NPF_{D5EAD105-B0BA-4D38-ACB4-6E95512BC228}
|     Hamachi Virtual Network Interface Driver
|     Addresses
|_        fe80:0:0:0:aabb:ccdd:eeff:0022

Requires

• creds
• nmap
• rpcap
• shortport
• stdnse

---

Author:

• Patrik Karlsson

License: Same as Nmap--See https://nmap.org/book/man-legal.html