petrus@hive:~$ sudo nmap -p 1-65535 -T4 -A -v -PE -PS22,25,80 -PA21,23,80,3389 192.168.0.254 Starting Nmap 5.61TEST1 ( http://nmap.org ) at 2011-10-11 23:18 CEST NSE: Loaded 71 scripts for scanning. NSE: Script Pre-scanning. Initiating ARP Ping Scan at 23:18 Scanning 192.168.0.254 [1 port] Completed ARP Ping Scan at 23:18, 0.01s elapsed (1 total hosts) Initiating Parallel DNS resolution of 1 host. at 23:18 Completed Parallel DNS resolution of 1 host. at 23:18, 0.04s elapsed Initiating SYN Stealth Scan at 23:18 Scanning 192.168.0.254 [65535 ports] Discovered open port 445/tcp on 192.168.0.254 Discovered open port 21/tcp on 192.168.0.254 Discovered open port 139/tcp on 192.168.0.254 Discovered open port 80/tcp on 192.168.0.254 Discovered open port 554/tcp on 192.168.0.254 SYN Stealth Scan Timing: About 17.14% done; ETC: 23:21 (0:02:30 remaining) Discovered open port 8090/tcp on 192.168.0.254 SYN Stealth Scan Timing: About 36.93% done; ETC: 23:21 (0:01:44 remaining) Discovered open port 9091/tcp on 192.168.0.254 Discovered open port 8095/tcp on 192.168.0.254 SYN Stealth Scan Timing: About 58.44% done; ETC: 23:21 (0:01:05 remaining) Discovered open port 5678/tcp on 192.168.0.254 Discovered open port 54242/tcp on 192.168.0.254 Discovered open port 548/tcp on 192.168.0.254 Discovered open port 8091/tcp on 192.168.0.254 Discovered open port 5000/tcp on 192.168.0.254 Completed SYN Stealth Scan at 23:20, 142.91s elapsed (65535 total ports) Initiating Service scan at 23:20 Scanning 13 services on 192.168.0.254 Completed Service scan at 23:22, 88.95s elapsed (13 services on 1 host) Initiating OS detection (try #1) against 192.168.0.254 Retrying OS detection (try #2) against 192.168.0.254 Retrying OS detection (try #3) against 192.168.0.254 Retrying OS detection (try #4) against 192.168.0.254 Retrying OS detection (try #5) against 192.168.0.254 NSE: Script scanning 192.168.0.254. Initiating NSE at 23:22 Completed NSE at 23:22, 0.98s elapsed Nmap scan report for 192.168.0.254 Host is up (0.00065s latency). Not shown: 65518 filtered ports PORT STATE SERVICE VERSION 21/tcp open ftp Freebox ftpd 80/tcp open http nginx |_http-methods: No Allow or Public header in OPTIONS response (status code 405) |_http-favicon: Unknown favicon MD5: C9AB649457B4E9AFFE91FF0CE488D15F | http-robots.txt: 1 disallowed entry |_/ | http-title: Accueil Freebox Server |_Requested resource was http://192.168.0.254/login.php 137/tcp closed netbios-ns 138/tcp closed netbios-dgm 139/tcp open netbios-ssn Samba smbd 3.X (workgroup: WORKGROUP) 445/tcp open netbios-ssn Samba smbd 3.X (workgroup: WORKGROUP) 548/tcp open afp? | afp-serverinfo: | | Server Flags: 0x8f79 | | Super Client: Yes | | UUIDs: Yes | | UTF8 Server Name: Yes | | Open Directory: Yes | | Reconnect: No | | Server Notifications: Yes | | TCP/IP: Yes | | Server Signature: Yes | | ServerMessages: Yes | | Password Saving Prohibited: No | | Password Changing: No | |_ Copy File: Yes | Server Name: Freebox Server | Machine Type: Netatalk 2.2.0 | AFP Versions: AFP2.2, AFPX03, AFP3.1, AFP3.2, AFP3.3 | UAMs: DHCAST128, DHX2 | Server Signature: f4cae543d1144963616e48617a414650 | Network Address 1: 212.27.38.253 |_ UTF8 Server Name: Freebox Server 554/tcp open rtsp Freebox rtspd 1.2 5000/tcp open upnp? 5001/tcp closed commplex-link 5678/tcp open upnp fbxigdd 1.0 (AliceBox PM203 UPnP; UPnP 1.0) 6600/tcp closed mshvlm 8090/tcp open http nginx |_http-methods: No Allow or Public header in OPTIONS response (status code 302) | http-title: Probl\xC3\xA8me de connexion Internet |_Requested resource was http://192.168.0.254:8090/freebox_conn_problem.html 8091/tcp open http nginx |_http-methods: No Allow or Public header in OPTIONS response (status code 302) | http-title: Contr\xC3\xB4le parental actif |_Requested resource was http://192.168.0.254:8091/freebox_access_filtered.html 8095/tcp open tcpwrapped 9091/tcp open http nginx |_http-title: 403 Forbidden |_http-methods: No Allow or Public header in OPTIONS response (status code 405) 54242/tcp open unknown 3 services unrecognized despite returning data. If you know the service/version, please submit the following fingerprints at http://www.insecure.org/cgi-bin/servicefp-submit.cgi : ==============NEXT SERVICE FINGERPRINT (SUBMIT INDIVIDUALLY)============== SF-Port548-TCP:V=5.61TEST1%I=7%D=10/11%Time=4E94B33B%P=i686-pc-linux-gnu%r SF:(afp,19D,"\x01\x03\0\x01\0\0\0\0\0\0\x01\x8d\0\0\0\0\0\"\x001\0U\0e\x8f SF:y\x0eFreebox\x20Server\0\x01e\x01u\x01\|\x01}\x0eNetatalk\x202\.2\.0\x0 SF:5\x06AFP2\.2\x06AFPX03\x06AFP3\.1\x06AFP3\.2\x06AFP3\.3\x02\tDHCAST128\ SF:x04DHX20\0\x8f\xf8\xcc\x01H\x0c\xb32\(\n\x8c\xcc\|\x0f\x83\x02\xff\x01\ SF:x80\xc3\xc3\x81\x803\xe3\xc1\x80\x0b\xd3\xc1\x80\x0b\xb1a\x80\x0b\xe0\x SF:e1\x80\x0b\xe1\xe1\x80\x0b\xd1\xe1\xc0\n\xc0\xe1p\x0bx\xc1\x1c\x0by\xc1 SF:\x17\x0b3\xff!\xcb\xff\xc4@\x7f\xff\x02\x80\x1e\0\x01\xff\xff\xff\xff\x SF:80\0\0\x01\xff\xff\xff\xff\0\x02\x80\0\0\x02\x80\0\0\x07\xc0\0\0\x04@\0 SF:\0\x04@\0\0\x07\xc0\0\0\x05@\0\x0f\xf9\?\xfc\0\x02\x80\0\x0f\xfc\x7f\xf SF:c0\0\x8f\xf8\xfc\x01\xcf\xfc\xff3\xef\xfe\xff\xff\xff\xff\xff\xff\xff\x SF:ff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\ SF:xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\x7f\xff\xff SF:\xff\x1f\xff\xff\xff\x1f\xff\xff\xff\?\xff\xff\xfc\x7f\xff\xff\xfe\xff\ SF:xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\0\x03\x80\0 SF:\0\x03\x80\0\0\x07\xc0\0\0\x07\xc0\0\0\x07\xc0\0\0\x07\xc0\0\0\x07\xc0\ SF:0\xff\xff\xff\xff\?\xfe\xff\xff\xff\xfc\x7f\xff\xf4\xca\xe5C\xd1\x14Ica SF:nHazAFP\x01\x06\x01\xd4\x1b&\xfd\0\0\x0eFreebox\x20Server"); ==============NEXT SERVICE FINGERPRINT (SUBMIT INDIVIDUALLY)============== SF-Port5000-TCP:V=5.61TEST1%I=7%D=10/11%Time=4E94B33A%P=i686-pc-linux-gnu% SF:r(GenericLines,C0,"RTSP/1\.0\x20400\x20Bad\x20Request\r\nServer:\x20Air SF:Tunes/110\.63\r\nAudio-Jack-Status:\x20connected;\x20type=analog\r\n\r\ SF:nRTSP/1\.0\x20400\x20Bad\x20Request\r\nServer:\x20AirTunes/110\.63\r\nA SF:udio-Jack-Status:\x20connected;\x20type=analog\r\n\r\n")%r(GetRequest,C SF:0,"RTSP/1\.0\x20400\x20Bad\x20Request\r\nServer:\x20AirTunes/110\.63\r\ SF:nAudio-Jack-Status:\x20connected;\x20type=analog\r\n\r\nRTSP/1\.0\x2040 SF:0\x20Bad\x20Request\r\nServer:\x20AirTunes/110\.63\r\nAudio-Jack-Status SF::\x20connected;\x20type=analog\r\n\r\n")%r(RTSPRequest,C2,"RTSP/1\.0\x2 SF:0200\x20OK\r\nServer:\x20AirTunes/110\.63\r\nAudio-Jack-Status:\x20conn SF:ected;\x20type=analog\r\nPublic:\x20ANNOUNCE,\x20SETUP,\x20RECORD,\x20P SF:AUSE,\x20FLUSH,\x20TEARDOWN,\x20OPTIONS,\x20GET_PARAMETER,\x20SET_PARAM SF:ETER,\x20POST,\x20GET\r\n\r\n")%r(HTTPOptions,C0,"RTSP/1\.0\x20400\x20B SF:ad\x20Request\r\nServer:\x20AirTunes/110\.63\r\nAudio-Jack-Status:\x20c SF:onnected;\x20type=analog\r\n\r\nRTSP/1\.0\x20400\x20Bad\x20Request\r\nS SF:erver:\x20AirTunes/110\.63\r\nAudio-Jack-Status:\x20connected;\x20type= SF:analog\r\n\r\n")%r(Help,60,"RTSP/1\.0\x20400\x20Bad\x20Request\r\nServe SF:r:\x20AirTunes/110\.63\r\nAudio-Jack-Status:\x20connected;\x20type=anal SF:og\r\n\r\n")%r(FourOhFourRequest,C0,"RTSP/1\.0\x20400\x20Bad\x20Request SF:\r\nServer:\x20AirTunes/110\.63\r\nAudio-Jack-Status:\x20connected;\x20 SF:type=analog\r\n\r\nRTSP/1\.0\x20400\x20Bad\x20Request\r\nServer:\x20Air SF:Tunes/110\.63\r\nAudio-Jack-Status:\x20connected;\x20type=analog\r\n\r\ SF:n")%r(LPDString,60,"RTSP/1\.0\x20400\x20Bad\x20Request\r\nServer:\x20Ai SF:rTunes/110\.63\r\nAudio-Jack-Status:\x20connected;\x20type=analog\r\n\r SF:\n")%r(SIPOptions,420,"RTSP/1\.0\x20400\x20Bad\x20Request\r\nServer:\x2 SF:0AirTunes/110\.63\r\nAudio-Jack-Status:\x20connected;\x20type=analog\r\ SF:n\r\nRTSP/1\.0\x20400\x20Bad\x20Request\r\nServer:\x20AirTunes/110\.63\ SF:r\nAudio-Jack-Status:\x20connected;\x20type=analog\r\n\r\nRTSP/1\.0\x20 SF:400\x20Bad\x20Request\r\nServer:\x20AirTunes/110\.63\r\nAudio-Jack-Stat SF:us:\x20connected;\x20type=analog\r\n\r\nRTSP/1\.0\x20400\x20Bad\x20Requ SF:est\r\nServer:\x20AirTunes/110\.63\r\nAudio-Jack-Status:\x20connected;\ SF:x20type=analog\r\n\r\nRTSP/1\.0\x20400\x20Bad\x20Request\r\nServer:\x20 SF:AirTunes/110\.63\r\nAudio-Jack-Status:\x20connected;\x20type=analog\r\n SF:\r\nRTSP/1\.0\x20400\x20Bad\x20Request\r\nServer:\x20AirTunes/110\.63\r SF:\nAudio-Jack-Status:\x20connected;\x20type=analog\r\n\r\nRTSP/1\.0\x204 SF:00\x20Bad\x20Request\r\nServer:\x20AirTunes/110\.63\r\nAudio-Jack-Statu SF:s:\x20connected;\x20type=analog\r\n\r\nRTSP/1\.0\x20400\x20Bad\x20Reque SF:st\r\nServer:\x20AirTunes/110\.63\r\nAudio-Jack-Status:\x20connected;\x SF:20type=analog\r\n\r\nRTSP/1\.0\x20400\x20Bad\x20Request\r\nServer:\x20A SF:irTunes/110\.63\r\nAudio-Jack-Status:\x20connected;\x20type=analog\r\n\ SF:r\nRTSP/1\.0\x20400\x20Bad\x20Request\r\nServer:\x20Ai"); ==============NEXT SERVICE FINGERPRINT (SUBMIT INDIVIDUALLY)============== SF-Port54242-TCP:V=5.61TEST1%I=7%D=10/11%Time=4E94B336%P=i686-pc-linux-gnu SF:%r(GetRequest,122,"HTTP/1\.0\x20404\x20Not\x20Found\r\nContent-Type:\x2 SF:0text/html\r\nContent-Length:\x200\r\nAccept-Ranges:\x20bytes\r\nConnec SF:tion:\x20close\r\nDATE:\x20Tue,\x2011\x20Oct\x202011\x2021:20:54\x20GMT SF:\r\ncontentFeatures\.dlna\.org:\x20\r\nEXT:\r\nServer:\x20Linux/2\.6\.3 SF:9\.4-fbxgw1r_bank1_1\.1\.3-00786-g2d64716,\x20UPnP/1\.0,\x20Free\x20UPn SF:P\x20Entertainment\x20Service/0\.655\r\n\r\n")%r(HTTPOptions,92,"HTTP/1 SF:\.0\x20200\x20OK\r\nContent-Length:\x200\r\nServer:\x20Linux/2\.6\.39\. SF:4-fbxgw1r_bank1_1\.1\.3-00786-g2d64716,\x20UPnP/1\.0,\x20Free\x20UPnP\x SF:20Entertainment\x20Service/0\.655\r\n\r\n")%r(FourOhFourRequest,122,"HT SF:TP/1\.0\x20404\x20Not\x20Found\r\nContent-Type:\x20text/html\r\nContent SF:-Length:\x200\r\nAccept-Ranges:\x20bytes\r\nConnection:\x20close\r\nDAT SF:E:\x20Tue,\x2011\x20Oct\x202011\x2021:21:31\x20GMT\r\ncontentFeatures\. SF:dlna\.org:\x20\r\nEXT:\r\nServer:\x20Linux/2\.6\.39\.4-fbxgw1r_bank1_1\ SF:.1\.3-00786-g2d64716,\x20UPnP/1\.0,\x20Free\x20UPnP\x20Entertainment\x2 SF:0Service/0\.655\r\n\r\n"); MAC Address: F4:CA:E5:43:D1:14 (Freebox SA) No exact OS matches for host (If you know what OS is running on it, see http://nmap.org/submit/ ). TCP/IP fingerprint: OS:SCAN(V=5.61TEST1%E=4%D=10/11%OT=21%CT=137%CU=40680%PV=Y%DS=1%DC=D%G=Y%M= OS:F4CAE5%TM=4E94B398%P=i686-pc-linux-gnu)SEQ(SP=CA%GCD=1%ISR=C9%TI=Z%CI=Z% OS:II=I%TS=7)OPS(O1=M5B4ST11NW5%O2=M5B4ST11NW5%O3=M5B4NNT11NW5%O4=M5B4ST11N OS:W5%O5=M5B4ST11NW5%O6=M5B4ST11)WIN(W1=3890%W2=3890%W3=3890%W4=3890%W5=389 OS:0%W6=3890)ECN(R=Y%DF=Y%T=40%W=3908%O=M5B4NNSNW5%CC=Y%Q=)T1(R=Y%DF=Y%T=40 OS:%S=O%A=S+%F=AS%RD=0%Q=)T2(R=N)T3(R=Y%DF=Y%T=40%W=3890%S=O%A=S+%F=AS%O=M5 OS:B4ST11NW5%RD=0%Q=)T4(R=Y%DF=Y%T=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)T5(R=Y%DF= OS:Y%T=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)T6(R=Y%DF=Y%T=40%W=0%S=A%A=Z%F=R%O=% OS:RD=0%Q=)T7(R=Y%DF=Y%T=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)U1(R=Y%DF=N%T=40%I OS:PL=164%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=G%RUD=G)IE(R=Y%DFI=N%T=40%CD=S) Uptime guess: 1.087 days (since Mon Oct 10 21:16:37 2011) Network Distance: 1 hop TCP Sequence Prediction: Difficulty=202 (Good luck!) IP ID Sequence Generation: All zeros Service Info: OS: Linux 2.6; Devices: media device, WAP; CPE: cpe:/o:linux:kernel:2.6 Host script results: | nbstat: | NetBIOS name: FREEBOX, NetBIOS user: , NetBIOS MAC: | Names | FREEBOX<00> Flags: | FREEBOX<03> Flags: | FREEBOX<20> Flags: | \x01\x02__MSBROWSE__\x02<01> Flags: | WORKGROUP<1d> Flags: | WORKGROUP<1e> Flags: |_ WORKGROUP<00> Flags: |_smbv2-enabled: Server doesn't support SMBv2 protocol | smb-security-mode: | Account that was used for smb scripts: guest | User-level authentication | SMB Security: Challenge/response passwords supported |_ Message signing disabled (dangerous, but default) | smb-os-discovery: | OS: Unix (Samba 3.0.37) | NetBIOS computer name: | Workgroup: WORKGROUP |_ System time: 2011-10-11 23:22:32 UTC+0 TRACEROUTE HOP RTT ADDRESS 1 0.65 ms 192.168.0.254 NSE: Script Post-scanning. Read data files from: /usr/local/bin/../share/nmap OS and Service detection performed. Please report any incorrect results at http://nmap.org/submit/ . Nmap done: 1 IP address (1 host up) scanned in 250.83 seconds Raw packets sent: 131085 (5.772MB) | Rcvd: 285 (22.289KB)