Cross-compiled nmap 7.70 + NSE crash when running "telnet-brute" #1233
Description
I'm sorry I couldn't narrow the issue...
Running the telnet-brute script with cross-compiled nmap 7.60 with GCC 6.x for ARM little endian systems worked fine:
$ nmap --version
Nmap version 7.60 ( https://nmap.org )
Platform: arm-buildroot-linux-gnueabi
Compiled with: liblua-5.3.3 openssl-1.0.2o libpcre-8.41 libpcap-1.8.1 nmap-libdnet-1.12 ipv6
Compiled without: libssh2 libz
Available nsock engines: epoll poll select
$ nmap -p 23 --script telnet-brute --script-args userdb=<path/to/users>,passdb=<path/to/pass>,telnet-brute.timeout=8s <target>
Starting Nmap 7.60 ( https://nmap.org ) at <...>
Nmap scan report for <target>
Host is up (0.0011s latency).
PORT STATE SERVICE
23/tcp open telnet
| telnet-brute:
| Accounts:
| admin:admin - Valid credentials
|_ Statistics: Performed 1 guesses in 3 seconds, average tps: 0.3
Running the same script and command, with nmap 7.70 return the following error (with --script-trace output). Related assertion nse_nsock.cc:672 :
nmap -p 23 --script telnet-brute --script-args userdb=<path/to/user>,passdb=<path/to/pass>,telnet-brute.timeout=8s --script-trace <target>
Starting Nmap 7.70 ( https://nmap.org ) at <...>
NSOCK INFO [2.6910s] nsock_trace_handler_callback(): Callback: CONNECT SUCCESS for EID 8 [<target>:23]
NSE: TCP <nmap_host>:52350 > <target>:23 | CONNECT
NSE: TCP <nmap_host>:52350 > <target>:23 | 00000000: 0a
NSOCK INFO [2.6920s] nsock_write(): Write request for 1 bytes to IOD #1 EID 19 [<target>:23]
NSOCK INFO [2.6920s] nsock_trace_handler_callback(): Callback: WRITE SUCCESS for EID 19 [<target>:23]
NSE: TCP <nmap_host>:52350 > <target>:23 | SEND
NSOCK INFO [2.6930s] nsock_read(): Read request from IOD #1 [<target>:23] (timeout: 16000ms) EID 26
NSOCK INFO [2.7040s] nsock_trace_handler_callback(): Callback: READ SUCCESS for EID 26 [<target>:23] (12 bytes): ............
NSE: TCP <nmap_host>:52350 < <target>:23 | 00000000: ff fd 01 ff fd 1f ff fb 01 ff fb 03
NSE: TCP <nmap_host>:52350 > <target>:23 | CLOSE
NSOCK INFO [2.7060s] nsock_iod_delete(): nsock_iod_delete (IOD #1)
NSOCK INFO [2.7130s] nsock_iod_new2(): nsock_iod_new (IOD #2)
NSOCK INFO [2.7140s] nsock_connect_tcp(): TCP connection requested to <target>:23 (IOD #2) EID 32
NSOCK INFO [2.7140s] nsock_iod_new2(): nsock_iod_new (IOD #3)
NSOCK INFO [2.7160s] nsock_connect_tcp(): TCP connection requested to <target>:23 (IOD #3) EID 40
NSOCK INFO [2.7160s] nsock_iod_new2(): nsock_iod_new (IOD #4)
NSOCK INFO [2.7180s] nsock_connect_tcp(): TCP connection requested to <target>:23 (IOD #4) EID 48
NSOCK INFO [2.7180s] nsock_iod_new2(): nsock_iod_new (IOD #5)
NSOCK INFO [2.7200s] nsock_connect_tcp(): TCP connection requested to <target>:23 (IOD #5) EID 56
NSOCK INFO [2.7200s] nsock_iod_new2(): nsock_iod_new (IOD #6)
NSOCK INFO [2.7230s] nsock_connect_tcp(): TCP connection requested to <target>:23 (IOD #6) EID 64
NSOCK INFO [2.7240s] nsock_trace_handler_callback(): Callback: CONNECT SUCCESS for EID 32 [<target>:23]
NSE: TCP <nmap_host>:52352 > <target>:23 | CONNECT
NSOCK INFO [2.7240s] nsock_trace_handler_callback(): Callback: CONNECT SUCCESS for EID 40 [<target>:23]
NSE: TCP <nmap_host>:52354 > <target>:23 | CONNECT
NSOCK INFO [2.7240s] nsock_trace_handler_callback(): Callback: CONNECT SUCCESS for EID 48 [<target>:23]
NSE: TCP <nmap_host>:52356 > <target>:23 | CONNECT
NSOCK INFO [2.7240s] nsock_trace_handler_callback(): Callback: CONNECT SUCCESS for EID 56 [<target>:23]
NSE: TCP <nmap_host>:52358 > <target>:23 | CONNECT
NSOCK INFO [2.7730s] nsock_read(): Read request from IOD #6 [<target>:23] (timeout: 8000ms) EID 74
NSOCK INFO [2.7740s] nsock_read(): Read request from IOD #6 [<target>:23] (timeout: 8000ms) EID 82
NSOCK INFO [2.7740s] nsock_read(): Read request from IOD #6 [<target>:23] (timeout: 8000ms) EID 90
NSOCK INFO [2.7740s] nsock_read(): Read request from IOD #6 [<target>:23] (timeout: 8000ms) EID 98
NSOCK INFO [3.7900s] nsock_trace_handler_callback(): Callback: CONNECT SUCCESS for EID 64 [<target>:23]
NSE: TCP <nmap_host>:52360 < <target>:23 | RECEIVE BUF
NSOCK INFO [3.7950s] nsock_trace_handler_callback(): Callback: READ SUCCESS for EID 98 [<target>:23] (12 bytes): ............
NSE: TCP <nmap_host>:52360 < <target>:23 | 00000000: ff fd 01 ff fd 1f ff fb 01 ff fb 03
NSOCK INFO [3.7990s] nsock_trace_handler_callback(): Callback: READ SUCCESS for EID 90 [<target>:23] (3 bytes): ...
NSE: TCP <nmap_host>:52360 < <target>:23 | 00000000: 0d 0d 0a
NSOCK INFO [3.8080s] nsock_trace_handler_callback(): Callback: READ SUCCESS for EID 82 [<target>:23] (14 bytes): (none) login:
NSE: TCP <nmap_host>:52360 < <target>:23 | (none) login:
nmap: nse_nsock.cc:672: int receive_buf(lua_State*, int, lua_KContext): Assertion `lua_gettop(L) == 7' failed.
Aborted