forescout/project-memoria-detectorActive fingerprinting tool that identifies 16 embedded TCP/IP stacks on network devices using ICMP, TCP, HTTP, SSH, and FTP probing techniques for vulnerability assessment.
The project-memoria-detector tool aims to determine whether a target network device runs a specific embedded TCP/IP stack.
Currently, the tool supports fingerprints for 16 embedded TCP/IP stacks (and their variations):
Several of the above stacks were found vulnerable during the Project Memoria research.
The script identifies the use of the 16 TCP/IP stacks on a target device via the following active fingerprinting methods:
Although the script has been tested in a lab environment, we cannot guarantee its use to be safe against every possible device. Malformed ICMP packets, for instance, could crash a device that is running a different stack. THEREFORE, WE DO NOT RECOMMEND ITS USE DIRECTLY ON LIVE ENVIRONMENTS WITH MISSION-CRITICAL DEVICES (SUCH AS HOSPITALS WITH PATIENT-CONNECTED DEVICES OR SAFETY-CRITICAL INDUSTRIAL CONTROL SYSTEMS). An ideal approach is to test devices in a lab setting or during a maintenance window.
Please note that the tool has been tested only in a Linux test environment (any modern Linux distribution should work). It is assumed that the test environment is using iptables (https://linux.die.net/man/8/iptables) as a basic firewall.
The tool requires a recent version of Python 3.x (see https://www.python.org/, version >= 3.7.7 is preferable), as well as Scapy (see https://scapy.net/, version >= 2.4.3 is preferable).
To install Scapy together with Python and for general troubleshooting, please follow the documentation here: https://scapy.readthedocs.io/en/latest/installation.html
If python is already installed on your machine, to install the required dependencies you can use pip and the provided requirements.txt file:
$ pip install -r requirements.txt
As Scapy requires root privileges to run, the tool must be run with sudo, e.g.:
$ sudo python project-memoria-detector.py [options]
To see the available options for running the script, run it with the -h option:
$ python project-memoria-detector.py -h
In general, the script requires at least a single the IP address of the target device (this parameter can be explicitly specified with -ip_dst)
$ sudo python project-memoria-detector.py 192.168.3.1
The script supports scanning ranges of IP addresses. You can either specify a subnet to scan using the CIDR notation, or provide a .txt file with a set of IP addresses to scan.
The CIDR notation can be used as follows (for this example, the IP addresses from 192.168.3.1 to 192.168.3.254 will be scanned:
$ sudo python project-memoria-detector.py 192.168.3.0/24
You can also use a .txt file in order to specify the IP addresses of interest: each IP address in this file must start with a new line. For example, we can create a file called input.txt with the following contents:
$ cat input.txt
192.168.1.8
192.168.1.9
192.168.3.1
192.168.2.14
We can then run the script as follows:
$ sudo python project-memoria-detector.py --in-file input.txt
The script uses default values for ports to fingerprint different protocols such as SSH (22), FTP (21) and HTTP (80). In order to overwrite these default values, you are able to do so by setting the flags like:
$ sudo python project-memoria-detector.py -ip_dst 192.168.212.42 --tcp-port 80 --http-port 80 --ssh-port 22 --ftp-port 21 -i eth1
The script will output matches to individual fingerprints as well as degree of certainty in round brackets:
$ sudo python project-memoria-detector.py 192.168.6.42
192.168.6.42 is alive
ICMP => uIP/Contiki (High)
TCP => uIP/Contiki (Medium)
HTTP => uIP/Contiki (High)
SSH => Unknown (No match)
FTP => Unknown (No reply)
The degree of certainty of a particular fingerprint can be High, Medium, or Low. No match means that there was no match with any known fingerprints, and No reply means that a specific port/service is unavailable.
Copyright (C) 2020 Forescout Technologies, Inc.
Program License
"The Program" refers to any copyrightable work licensed under this License. Each licensee is addressed as "you."
All rights granted under this License are granted for the term of copyright on the Program, and are irrevocable provided the stated conditions are met. This License explicitly affirms your unlimited permission to run the unmodified Program for personal, governmental, business or non-profit use. You are prohibited from using the Program in derivative works for commercial purposes. You are prohibited from modifying the Program to be used in a commercial product or service, either alone or in conjunction with other code, either downloadable or accessed as a service. "Derivative works" shall mean any work, whether in source or object form, that is based on (or derived from) the Program and for which the editorial revisions, annotations, elaborations, or other modifications represent, as a whole, an original work of authorship.