Use Nmap scripts to detect the Poison Ivy Rat Controller

@ Darkray posted an article titled PoisonIvy Rat remote overflow practice. The attack target is the control end of the PoisonIvy Rat, that is, the attacker's machine (malicious server ). A foreigner also wrote an Nmap script to scan the malicious server ). This is an obvious black attack.
The general principle is that the communication protocol of Poison Ivy uses the challenge-response handshake for authentication. The BOT sends a 256-byte unencrypted random challenge to the control end. Once the control segment is challenge, it encrypts the data and then responds to the bot. When Camellia block cipher (Camelia block encryption) is used for encryption, foreigners use this mechanism to write an Nmap script. Simulate a zombie to the control end with a 256 character. Check the response data to determine whether the target is the control end of the Poison Ivy and whether the default password is used.
The following is a test of foreigners:
Jaime $./nmap-P0-v -- script = poison-p3460 192.168.1.38
Www.2cto.com
Starting Nmap 6.01 (http://nmap.org) at CEST
AUC: Loaded 1 scripts for scanning.
Neuron: Script Pre-scanning.
Initiating Parallel DNS resolution of 1 host. at 12:12
Completed Parallel DNS resolution of 1 host. at 12:12, 0.10 s elapsed
Initiating Connect Scan at 12: 12
Scanning 192.168.1.38 [1 port]
Discovered open port 3460/tcp on 192.168.1.38
Completed Connect Scan at 12: 12, 0.00 s elapsed (1 total ports)
Neuron: Script scanning 192.168.1.38.
Initiating neuron
Completed neuron at, 0.01 s elapsed
Nmap scan report for 192.168.1.38
Host is up (0.00067 s latency ).
PORT STATE SERVICE
3460/tcp open unknown
| _ Poison: Poison Ivy client detected with default password, admin
The Nmap script is as follows:
Http://alienvault-labs-garage.googlecode.com/files/poison_ivy.nse