how scan for os detect ?

[blackout314]

PHP Fatal error: Uncaught exception 'RuntimeException' with message 'Failed to execute "nmap -O -oX '/tmp/output.xml' 'xxx.xxx.eu'" TCP/IP fingerprinting (for OS scan) requires root privileges.

how to for do this scan?

[openWebX]

OS detection is only possible as root-user in recent nmap versions, also getting the macaddress... Workaround would be to prefix the nmap call with sudo and allow the php-user to use nmap without password (but that would be really dangerous...)

[openWebX]

This should work, but not perfectly:

in file /etc/sudoers:

nginx ALL=NOPASSWD: /usr/bin/nmap
or
apache ALL=NOPASSWD: /usr/bin/nmap

and then there should be a "sudo" prefix in this lib. But i really don't think this is a good solution...

[openWebX]

Something like this:

openWebX@e2bd06b#diff-f70198ad3caedc74e273ab01a7e1179e

But as said: wirks for me, but may be bad practice. Be aware that these deep scans (OS detection and MacAddresses) require a bigger timeout. Scanning my homenetwork needs about 5 mins...

[repat]

Have a look here:
https://secwiki.org/w/Running_nmap_as_an_unprivileged_user

Just giving apache/nginx/www-data the ability to run nmap with root rights seems sloppy and, as the article points out, via NSE scripts it should be possible to use this to get root access.

[openWebX]

I never said this is good practise in terms of security... but in my case (home automation...) i really needed a possibility to scan the local network for devices and to identify them as e.g. nuki lock, sonoff switch... So there had to be a possibility to get as many infos as possible, just to skip the need to telnet or sonething like that in every found ip to guess what kind of device this is.
Never use this on devices exposed to the internet or something like that. But i think if someone controls your webserver user, he also can try to get priviliedged access via nginx, apache, php, ... and he has to escape the webserver environment to push his own command to nmap. something that should be made impossible by xss-prevention...

[repat]

I guess for home automation it's sort of ok still. But with more smart devices coming into peoples homes the exploits will get larger in numbers and more automated. While a targeted Mr. Robot scenario is technically possible I guess it's still unlikely to get targeted unless you are, you know, an evil corp executive ;-) Also, Noki has an internet bridge.

As we have a SaaS we need nmap for, we're trying to find a better solution. I'll post it when/if we find it. So far I'm thinking of building a microservice on a separate instance that only does nmap scans . Then we purge and rebuild it every night or so. Or we'll run nmap as a cronjob.

What were other options you looked at @openWebX ?

[openWebX]

The idea with the microservice sounds interesting...Sure i am aware of all the possibilities to connect to the nuki but i rather like the idea to talk to the local bridge than via internet. And this works really great AFTER having located the bridge ;-)

i cureently have a little problem with too many devices on my fritzbox and therefor not really wirking dhcp, so i currently can't relly on the once found ips... :-( And running a complete network scan all 30 minutes or so is an overkill...

First i will fix the network, than i will find a better solution for the rooted nmap (or you share your ideas / solutions) @repat ;-)

[kimhaafi]

Failed to execute "nmap -p 80 -oX 'FOLDER' 'IP'"
Failed to open XML output file 'FOLDER' for writing
QUITTING!

Have you found any way to run the nmap with nginx or apache on windows. I'm developing on laragon and laravel 5.6 to 5.8 seem to not work. It is weird since 5.5 works fine, so i don't understand how it can be a privilege issue.

[kimhaafi]

I found a way around my problem by using homestead with vagrant for developing my project. While i still don't know why windows does not give right permissions this was not a problem on linux system.