From a8f57064fdefe940eb2bb8ae30fa2bbafa04bfc9 Mon Sep 17 00:00:00 2001
From: patrik <patrik@e0a8ed71-7df4-0310-8962-fdc924857419>
Date: Fri, 11 Nov 2011 06:42:01 +0000
Subject: [PATCH] o Added a probe for the Metasploit XMLRPC service [Vlatko
 Kosturjak]

---
 CHANGELOG           | 2 ++
 nmap-service-probes | 7 +++++++
 2 files changed, 9 insertions(+)

diff --git a/CHANGELOG b/CHANGELOG
index 1cdb2e3a8..914074e20 100644
--- a/CHANGELOG
+++ b/CHANGELOG
@@ -1,5 +1,7 @@
 # Nmap Changelog ($Id$); -*-text-*-
 
+o Added a probe for the Metasploit XMLRPC service [Vlatko Kosturjak]
+
 o [NSE] Re-enabled support for guessing the username in addition to password
   that was incorrectly removed from the metasploit-xmlrpc-brute in previous
   commit. [Patrik]
diff --git a/nmap-service-probes b/nmap-service-probes
index 06562f818..94379f677 100644
--- a/nmap-service-probes
+++ b/nmap-service-probes
@@ -10095,3 +10095,10 @@ match gkrellm m|^<gkrellmd_setup>\n<version>\ngkrellmd ([\w._-]+)\n| p/GKrellM S
 Probe TCP vmware-esx q|<soap:Envelope xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/"><soap:Header><operationID>00000001-00000001</operationID></soap:Header><soap:Body><RetrieveServiceContent xmlns="urn:internalvim25"><_this xsi:type="ManagedObjectReference" type="ServiceInstance">ServiceInstance</_this></RetrieveServiceContent></soap:Body></soap:Envelope>|
 ports 443
 rarity 9
+
+##############################NEXT PROBE##############################
+Probe TCP metasploit-xmlrpc q|<?xml version="1.0" ?><methodCall><methodName>nmap.probe</methodName></methodCall>\n\0|
+ports 55553
+sslports 55553
+rarity 9
+match metasploit-xmlrpc m|<\?xml\x20version=\"1\.0\"\x20\?><methodResponse><fault><value><struct><member><name>faultCode</name><value><i4>-99</i4></value></member><member><name>faultString</name><value><string>Method\x20nmap\.probe\x20missing\x20or\x20wrong\x20number\x20of\x20parameters!</string></value></member></struct></value></fault></methodResponse>\n\0|