id: famatech-radmin-detect

info:
  name: Famatech Radmin - Detect
  author: matejsmycka
  severity: info
  description: |
    Detected the Famatech Radmin service running on TCP port 4899. It was used as zero-configuration remote control software.
  reference:
    - https://www.famatech.com/
    - https://seclists.org/nmap-dev/2008/q1/89
  metadata:
    verified: true
    max-request: 1
    shodan-query: port:4899 product:"Famatech Radmin"
  tags: network,detect,tcp,famatech,radmin,discovery

tcp:
  - inputs:
      - data: "\x01\x00\x00\x00\x01\x00\x00\x00\x08\x08"

    host:
      - "{{Hostname}}"
    port: 4899
    read-size: 1024

    matchers:
      - type: binary
        binary:
          - "0100000009"
# digest: 4a0a00473045022100ac32271e5db704577247fc1ee3e35ff5121ba231e6f129efe1927ab509459d2f02203c77f98826d5a1e2b70890b2b5595833d2b084198a9c822d2fee6533fead7066:922c64590222798bb761d5b6d8e72950