Erlang Port Mapper Daemon

ID: erlang-daemon

Severity: low

Author: pussycat0x,daffainfo

Tags: demon,enum,erlang,epmd,network,misconfig,tcp

Description

The erlang port mapper daemon is used to coordinate distributed erlang instances. His job is to keep track of which node name listens on which address. Hence, epmd map symbolic node names to machine addresses.

YAML Source

id: erlang-daemon

info:
  name: Erlang Port Mapper Daemon
  author: pussycat0x,daffainfo
  severity: low
  description: |
    The erlang port mapper daemon is used to coordinate distributed erlang instances. His job is to keep track of which node name listens on which address. Hence, epmd map symbolic node names to machine addresses.
  reference:
    - https://nmap.org/nsedoc/scripts/epmd-info.html
    - https://book.hacktricks.xyz/network-services-pentesting/4369-pentesting-erlang-port-mapper-daemon-epmd
    - https://medium.com/@_sadshade/couchdb-erlang-and-cookies-rce-on-default-settings-b1e9173a4bcd
  metadata:
    verified: true
    max-request: 1
    shodan-query: product:"Erlang Port Mapper Daemon"
  tags: demon,enum,erlang,epmd,network,misconfig,tcp
tcp:
  - inputs:
      - data: "\x00\x01\x6e"

    host:
      - "{{Hostname}}"
    port: 4369

    matchers-condition: and
    matchers:
      - type: word
        words:
          - "HTTP/1.1"
        negative: true

      - type: word
        words:
          - "name"
          - "at port"
        condition: and

    extractors:
      - type: regex
        regex:
          - 'name (.*?) at port ([0-9]+)'
# digest: 490a0046304402203a15bfaeb83663694a1263e073b7a8d842d7a397f69761897081d839d5bed11c02207a75e7a2b272b5aac31feab63bbeec6d7fd8564d275c5285bde99adcd88fdfe3:922c64590222798bb761d5b6d8e72950

Guide to check the vulnerabilities

This template is used to detect vulnerabilities in web applications. It can be used with the Nuclei tool to scan for specific patterns or behaviors.

$ nuclei -u "URL" -t "network/misconfig/erlang-daemon.yaml"

View on Github