Skip to content

UDP port scanner is missing SNMP ports #933

Description

@WouterHadrian

Describe the bug

Rustscan cannot find an open SNMP port, while it can be found using NMAP and snmpget.

To Reproduce

  1. Confirm that the public SNMP test service responds using SNMPv1 and community public:

    snmpget -v1 -c public -t 3 -r 1 \
      demo.pysnmp.com 1.3.6.1.2.1.1.1.0

    Observed:

    SNMPv2-MIB::sysDescr.0 = STRING: #SNMP Agent on .NET Standard
    
  2. Scan UDP port 161 using Nmap:

    sudo nmap -sU -Pn -n -p 161 --reason \
      --max-retries 1 --host-timeout 20s demo.pysnmp.com

    Observed with Nmap 7.95:

    PORT    STATE SERVICE REASON
    161/udp open  snmp    udp-response ttl 63
    
  3. Scan the same port using an affected RustScan build:

    rustscan --no-config --udp -a demo.pysnmp.com -p 161 \
      --timeout 3000 --tries 2 --scripts none --accessible

    Observed with the affected RustScan 2.4.1 lab build:

    Looks like I didn't find any open ports for 128.203.82.143.
    

Expected behavior

RustScan should generate a valid SNMP payload containing the community string public and detect UDP port 161 when the agent responds.

More generally, payload decoding should preserve literal text, decode escape sequences, and concatenate quoted strings without adding separator whitespace.

Screenshots

Not applicable;

Desktop (please complete the following information):

  • OS: Linux/aarch64 for the containerized comparison; macOS/Apple Silicon for an additional host check.
  • Browser: Not applicable.
  • Version: RustScan 2.4.1 in downstream lab builds; installed host RustScan 2.3.0 also missed the port.
  • Nmap: 7.95 for the comparison.

Smartphone (please complete the following information):

  • Device: Not applicable.
  • OS: Not applicable.
  • Browser: Not applicable.
  • Version: Not applicable.

Additional context

According to our friend 🤖

The missing detection appears to be caused by a malformed SNMP payload. The server does not respond to that payload, so RustScan reports no open ports.
The parser in build.rs keeps only ASCII hexadecimal digits:
if char == '\' && payload.chars().nth(idx + 1) == Some('x') {
continue;
} else if char.is_ascii_hexdigit() {
tmp_str.push(char);
// Converts each pair of retained hex digits into a byte.
}
However, the bundled SNMP probe contains the literal community string public. The parser retains only b and c, converting the six-character string into the single byte 0xbc.
This produces a 28-byte probe instead of the expected 33 bytes, while its BER header still declares 31 bytes after the two-byte header.
A local build with corrected payload decoding detected port 161 on the same server. The faulty parser is also present in upstream master at the time of reporting.
Other probes containing literal text, including NetBIOS, LDAP, SSDP, memcached, and service location, may be affected as well.

Activity

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Projects

    No projects

      Milestone

      No milestone

      Relationships

      None yet

      Development

      No branches or pull requests

      Issue actions