diff --git a/CHANGELOG b/CHANGELOG index e1187eb9f..92b0f8861 100644 --- a/CHANGELOG +++ b/CHANGELOG @@ -1,5 +1,9 @@ # Nmap Changelog ($Id$); -*-text-*- +o [NSE] Added a new script http-put.nse that allows uploading of local files + to remote web servers using the HTTP PUT method. Added HTTP PUT support to + the http library. [Patrik] + o Made nbase compile with the clang compiler that is a part of Xcode 4.2. [Daniel J. Luke] diff --git a/nselib/http.lua b/nselib/http.lua index e40fc5f43..c44184e14 100644 --- a/nselib/http.lua +++ b/nselib/http.lua @@ -1171,6 +1171,31 @@ function generic_request(host, port, method, path, options) return request(host, port, build_request(host, port, method, path, options), options) end +---Uploads a file using the PUT method and returns a result table. This is a simple wrapper +-- around generic_request +-- +-- @param host The host to connect to. +-- @param port The port to connect to. +-- @param path The path to retrieve. +-- @param options [optional] A table that lets the caller control socket timeouts, HTTP headers, and other parameters. For full documentation, see the module documentation (above). +-- @param putdata The contents of the file to upload +-- @return nil if an error occurs; otherwise, a table as described in the module documentation. +-- @see http.generic_request +function put(host, port, path, options, putdata) + if(not(validate_options(options))) then + return nil + end + if ( not(putdata) ) then + return nil + end + local mod_options = { + content = putdata, + } + table_augment(mod_options, options or {}) + return generic_request(host, port, "PUT", path, mod_options) +end + + ---Fetches a resource with a GET request and returns the result as a table. This is a simple -- wraper around generic_request, with the added benefit of having local caching. -- This caching can be controlled in the options array, see module documentation diff --git a/scripts/http-put.nse b/scripts/http-put.nse new file mode 100644 index 000000000..a6f780939 --- /dev/null +++ b/scripts/http-put.nse @@ -0,0 +1,52 @@ +description = [[ +Uploads a local file to a remote web server using the HTTP PUT method. +]] + +--- +-- @usage +-- nmap -p 80 --script http-put --script-args http-put.url='/uploads/rootme.php',http-put.file='/tmp/rootme.php' +-- +-- @output +-- PORT STATE SERVICE +-- PORT STATE SERVICE +-- 80/tcp open http +-- |_http-put: /uploads/rootme.php was successfully created +-- +-- @args http-put.file - The full path to the local file that should be uploaded to the server +-- @args http-put.url - The remote directory and filename to store the file to e.g. (/uploads/file.txt) +-- + +-- +-- +-- Version 0.1 +-- Created 10/15/2011 - v0.1 - created by Patrik Karlsson +-- + +author = "Patrik Karlsson" +license = "Same as Nmap--See http://nmap.org/book/man-legal.html" +categories = {"auth", "discovery", "safe"} + +require 'shortport' +require 'stdnse' +require 'http' + +portrule = shortport.port_or_service( {80, 443}, {"http", "https"}, "tcp", "open") + +action = function( host, port ) + + local fname, url = stdnse.get_script_args('http-url.file', 'http-put.url') + if ( not(fname) or not(url) ) then return end + + local f = io.open(fname, "r") + if ( not(f) ) then return ("ERROR: Failed to open file: %s"):format(fname) end + local content = f:read("*all") + f:close() + + local response = http.put(host, port, url, nil, content) + + if ( response.status == 200 or response.status == 204 ) then + return ("%s was successfully created"):format(url) + end + + return ("ERROR: %s could not be created"):format(url) +end diff --git a/scripts/script.db b/scripts/script.db index 9ffdfb409..fa2d98e05 100644 --- a/scripts/script.db +++ b/scripts/script.db @@ -96,6 +96,7 @@ Entry { filename = "http-methods.nse", categories = { "default", "safe", } } Entry { filename = "http-open-proxy.nse", categories = { "default", "discovery", "external", "safe", } } Entry { filename = "http-passwd.nse", categories = { "intrusive", "vuln", } } Entry { filename = "http-php-version.nse", categories = { "discovery", "safe", } } +Entry { filename = "http-put.nse", categories = { "auth", "discovery", "safe", } } Entry { filename = "http-robots.txt.nse", categories = { "default", "discovery", "safe", } } Entry { filename = "http-title.nse", categories = { "default", "discovery", "safe", } } Entry { filename = "http-trace.nse", categories = { "discovery", "safe", "vuln", } } @@ -214,6 +215,7 @@ Entry { filename = "smtp-vuln-cve2011-1720.nse", categories = { "intrusive", "vu Entry { filename = "smtp-vuln-cve2011-1764.nse", categories = { "intrusive", "vuln", } } Entry { filename = "sniffer-detect.nse", categories = { "discovery", "intrusive", } } Entry { filename = "snmp-brute.nse", categories = { "brute", "intrusive", } } +Entry { filename = "snmp-brute2.nse", categories = { "auth", "intrusive", } } Entry { filename = "snmp-interfaces.nse", categories = { "default", "discovery", "safe", } } Entry { filename = "snmp-ios-config.nse", categories = { "intrusive", } } Entry { filename = "snmp-netstat.nse", categories = { "default", "discovery", "safe", } }