mirror of
https://github.com/nmap/nmap.git
synced 2025-12-28 18:39:03 +00:00
Importing changes from my branch. There are two major updates:
1) I wrote a function that formats output from scripts in a consistent way. Although we haven't really come to a concensus on how it should look yet, it's easy to change when we do. 2) New script: smb-enum-groups.nse. Enumerate the local groups on a system and their membership.
This commit is contained in:
ron
@@ -29,36 +29,28 @@ for shares that require a user account.
|
||||
--
|
||||
--@output
|
||||
-- Host script results:
|
||||
-- | smb-enum-shares:
|
||||
-- | ADMIN$
|
||||
-- | |_ Type: STYPE_DISKTREE_HIDDEN
|
||||
-- | |_ Comment: Remote Admin
|
||||
-- | |_ Users: 0, Max: <unlimited>
|
||||
-- | |_ Path: C:\WINNT
|
||||
-- | |_ Anonymous access: <none>
|
||||
-- | |_ Current user ('test') access: READ/WRITE
|
||||
-- | C$
|
||||
-- | |_ Type: STYPE_DISKTREE_HIDDEN
|
||||
-- | |_ Comment: Default share
|
||||
-- | |_ Users: 0, Max: <unlimited>
|
||||
-- | |_ Path: C:\
|
||||
-- | |_ Anonymous access: <none>
|
||||
-- | |_ Current user ('test') access: READ
|
||||
-- | IPC$
|
||||
-- | |_ Type: STYPE_IPC_HIDDEN
|
||||
-- | |_ Comment: Remote IPC
|
||||
-- | |_ Users: 1, Max: <unlimited>
|
||||
-- | |_ Path:
|
||||
-- | |_ Anonymous access: READ <not a file share>
|
||||
-- | |_ Current user ('test') access: READ <not a file share>
|
||||
-- | test
|
||||
-- | |_ Type: STYPE_DISKTREE
|
||||
-- | |_ Comment: This is a test share, with a maximum of 7 users
|
||||
-- | |_ Users: 0, Max: 7
|
||||
-- | |_ Path: C:\Documents and Settings\Ron\Desktop\test
|
||||
-- | |_ Anonymous access: <none>
|
||||
-- |_ |_ Current user ('test') access: READ/WRITE
|
||||
|
||||
-- | smb-enum-shares:
|
||||
-- | | ADMIN$
|
||||
-- | | | Type: STYPE_DISKTREE_HIDDEN
|
||||
-- | | | Comment: Remote Admin
|
||||
-- | | | Users: 0, Max: <unlimited>
|
||||
-- | | | Path: C:\WINNT
|
||||
-- | | | Anonymous access: <none>
|
||||
-- | | |_ Current user ('administrator') access: READ/WRITE
|
||||
-- | | C$
|
||||
-- | | | Type: STYPE_DISKTREE_HIDDEN
|
||||
-- | | | Comment: Default share
|
||||
-- | | | Users: 0, Max: <unlimited>
|
||||
-- | | | Path: C:\
|
||||
-- | | | Anonymous access: <none>
|
||||
-- | | |_ Current user ('administrator') access: READ
|
||||
-- | | IPC$
|
||||
-- | | | Type: STYPE_IPC_HIDDEN
|
||||
-- | | | Comment: Remote IPC
|
||||
-- | | | Users: 1, Max: <unlimited>
|
||||
-- | | | Path:
|
||||
-- | | | Anonymous access: READ <not a file share>
|
||||
-- |_ |_ |_ Current user ('administrator') access: READ <not a file share>
|
||||
-----------------------------------------------------------------------
|
||||
|
||||
author = "Ron Bowes"
|
||||
@@ -74,14 +66,14 @@ hostrule = function(host)
|
||||
return smb.get_port(host) ~= nil
|
||||
end
|
||||
|
||||
local function go(host)
|
||||
action = function(host)
|
||||
local status, shares, extra
|
||||
local response = " \n"
|
||||
local response = {}
|
||||
|
||||
-- Get the list of shares
|
||||
status, shares, extra = smb.share_get_list(host)
|
||||
if(status == false) then
|
||||
return false, string.format("Couldn't enumerate shares: %s", shares)
|
||||
return stdnse.format_output(false, string.format("Couldn't enumerate shares: %s", shares))
|
||||
end
|
||||
|
||||
-- Find out who the current user is
|
||||
@@ -91,25 +83,24 @@ local function go(host)
|
||||
domain = ""
|
||||
end
|
||||
|
||||
if(extra ~= nil) then
|
||||
response = response .. extra .. "\n"
|
||||
if(extra ~= nil and extra ~= '') then
|
||||
table.insert(response, extra)
|
||||
end
|
||||
|
||||
for i = 1, #shares, 1 do
|
||||
local share = shares[i]
|
||||
local share_output = {}
|
||||
share_output['name'] = share['name']
|
||||
|
||||
-- Start generating a human-readable string
|
||||
response = response .. share['name'] .. "\n"
|
||||
|
||||
if(type(share['details']) ~= 'table') then
|
||||
response = response .. string.format("|_ Couldn't get details for share: %s\n", share['details'])
|
||||
share_output['warning'] = string.format("Couldn't get details for share: %s", share['details'])
|
||||
else
|
||||
local details = share['details']
|
||||
|
||||
response = response .. string.format("|_ Type: %s\n", details['sharetype'])
|
||||
response = response .. string.format("|_ Comment: %s\n", details['comment'])
|
||||
response = response .. string.format("|_ Users: %s, Max: %s\n", details['current_users'], details['max_users'])
|
||||
response = response .. string.format("|_ Path: %s\n", details['path'])
|
||||
table.insert(share_output, string.format("Type: %s", details['sharetype']))
|
||||
table.insert(share_output, string.format("Comment: %s", details['comment']))
|
||||
table.insert(share_output, string.format("Users: %s, Max: %s", details['current_users'], details['max_users']))
|
||||
table.insert(share_output, string.format("Path: %s", details['path']))
|
||||
end
|
||||
|
||||
|
||||
@@ -117,64 +108,47 @@ local function go(host)
|
||||
if(share['user_can_write'] == "NT_STATUS_OBJECT_NAME_NOT_FOUND") then
|
||||
-- Print details for a non-file share
|
||||
if(share['anonymous_can_read']) then
|
||||
response = response .. "|_ Anonymous access: READ <not a file share>\n"
|
||||
table.insert(share_output, "Anonymous access: READ <not a file share>")
|
||||
else
|
||||
response = response .. "|_ Anonymous access: <none> <not a file share>\n"
|
||||
table.insert(share_output, "Anonymous access: <none> <not a file share>")
|
||||
end
|
||||
|
||||
-- Don't bother printing this if we're already anonymous
|
||||
if(username ~= '') then
|
||||
if(share['user_can_read']) then
|
||||
response = response .. "|_ Current user ('" .. username .. "') access: READ <not a file share>\n"
|
||||
table.insert(share_output, "Current user ('" .. username .. "') access: READ <not a file share>")
|
||||
else
|
||||
response = response .. "|_ Current user ('" .. username .. "') access: <none> <not a file share>\n"
|
||||
table.insert(share_output, "Current user ('" .. username .. "') access: <none> <not a file share>")
|
||||
end
|
||||
end
|
||||
else
|
||||
-- Print details for a file share
|
||||
if(share['anonymous_can_read'] and share['anonymous_can_write']) then
|
||||
response = response .. "|_ Anonymous access: READ/WRITE\n"
|
||||
table.insert(share_output, "Anonymous access: READ/WRITE")
|
||||
elseif(share['anonymous_can_read'] and not(share['anonymous_can_write'])) then
|
||||
response = response .. "|_ Anonymous access: READ\n"
|
||||
table.insert(share_output, "Anonymous access: READ")
|
||||
elseif(not(share['anonymous_can_read']) and share['anonymous_can_write']) then
|
||||
response = response .. "|_ Anonymous access: WRITE\n"
|
||||
table.insert(share_output, "Anonymous access: WRITE")
|
||||
else
|
||||
response = response .. "|_ Anonymous access: <none>\n"
|
||||
table.insert(share_output, "Anonymous access: <none>")
|
||||
end
|
||||
|
||||
|
||||
|
||||
if(username ~= '') then
|
||||
if(share['user_can_read'] and share['user_can_write']) then
|
||||
response = response .. "|_ Current user ('" .. username .. "') access: READ/WRITE\n"
|
||||
table.insert(share_output, "Current user ('" .. username .. "') access: READ/WRITE")
|
||||
elseif(share['user_can_read'] and not(share['user_can_write'])) then
|
||||
response = response .. "|_ Current user ('" .. username .. "') access: READ\n"
|
||||
table.insert(share_output, "Current user ('" .. username .. "') access: READ")
|
||||
elseif(not(share['user_can_read']) and share['user_can_write']) then
|
||||
response = response .. "|_ Current user ('" .. username .. "') access: WRITE\n"
|
||||
table.insert(share_output, "Current user ('" .. username .. "') access: WRITE")
|
||||
else
|
||||
response = response .. "|_ Current user ('" .. username .. "') access: <none>\n"
|
||||
table.insert(share_output, "Current user ('" .. username .. "') access: <none>")
|
||||
end
|
||||
end
|
||||
end
|
||||
|
||||
table.insert(response, share_output)
|
||||
end
|
||||
|
||||
return true, response
|
||||
return stdnse.format_output(true, response)
|
||||
end
|
||||
|
||||
|
||||
action = function(host)
|
||||
local status, result
|
||||
|
||||
status, result = go(host)
|
||||
|
||||
if(status == false) then
|
||||
if(nmap.debugging() > 0) then
|
||||
return "ERROR: " .. result
|
||||
end
|
||||
else
|
||||
return result
|
||||
end
|
||||
end
|
||||
|
||||
|
||||
|
||||
|
||||
Reference in New Issue
Block a user