From 15b8331f72265913a3737bf5578f52a6172763cb Mon Sep 17 00:00:00 2001
From: patrik <patrik@e0a8ed71-7df4-0310-8962-fdc924857419>
Date: Sun, 8 Apr 2012 23:04:18 +0000
Subject: [PATCH] o [NSE] Added the script http-vlcstreamer-ls which queries
 the VLC Streamer   helper service for a list of files in a given directory.
 [Patrik Karlsson]

---
 CHANGELOG                       |  7 ++-
 scripts/http-vlcstreamer-ls.nse | 83 +++++++++++++++++++++++++++++++++
 scripts/script.db               |  1 +
 3 files changed, 89 insertions(+), 2 deletions(-)
 create mode 100644 scripts/http-vlcstreamer-ls.nse

diff --git a/CHANGELOG b/CHANGELOG
index e637f0270..0ecec811c 100644
--- a/CHANGELOG
+++ b/CHANGELOG
@@ -1,7 +1,10 @@
 # Nmap Changelog ($Id$); -*-text-*-
 
-o [NSE] Added script targets-ipv6-mld that sends a malformed ICMP6 MLD Query
-  to discover IPv6 enabled hosts on the LAN. [Niteesh Kumar]
+o [NSE] Added the script http-vlcstreamer-ls which queries the VLC Streamer
+  helper service for a list of files in a given directory. [Patrik Karlsson]
+
+o [NSE] Added the script targets-ipv6-mld that sends a malformed ICMP6 MLD
+  Query to discover IPv6 enabled hosts on the LAN. [Niteesh Kumar]
 
 o [NSE] Added script http-virustotal that allows checking files, or hashes
   of previously scanned files, against the major antivirus engines. [Patrik
diff --git a/scripts/http-vlcstreamer-ls.nse b/scripts/http-vlcstreamer-ls.nse
new file mode 100644
index 000000000..7c383463b
--- /dev/null
+++ b/scripts/http-vlcstreamer-ls.nse
@@ -0,0 +1,83 @@
+description = [[
+Connects to the VLC Streamer helper service and lists directory contents. The
+VLC Streamer helper service is used by the iOS VLC Streamer application to
+enable streaming of multimedia content from the remote server to the device.
+]]
+
+---
+-- @usage
+-- nmap -p 54340 --script http-vlcstreamer-ls <ip>
+--
+-- @output
+-- PORT      STATE SERVICE
+-- 54340/tcp open  unknown
+-- | http-vlcstreamer-ls: 
+-- |   /Applications
+-- |   /Developer
+-- |   /Library
+-- |   /Network
+-- |   /Pictures
+-- |   /System
+-- |   /User Guides And Information
+-- |   /Users
+-- |   /Volumes
+-- |   /bin
+-- |   /bundles
+-- |   /cores
+-- |   /dev
+-- |   /etc
+-- |   /home
+-- |   /mach_kernel
+-- |   /net
+-- |   /opt
+-- |   /private
+-- |   /sbin
+-- |   /tmp
+-- |   /usr
+-- |_  /var
+--
+-- @args http-vlcstreamer-ls.dir directory to list (default: /)
+--
+
+author = "Patrik Karlsson"
+license = "Same as Nmap--See http://nmap.org/book/man-legal.html"
+categories = {"discovery", "safe"}
+
+local http		= require('http')
+local json		= require('json')
+local shortport = require('shortport')
+
+portrule = shortport.port_or_service(54340, "vlcstreamer", "tcp")
+
+local arg_dir = stdnse.get_script_args(SCRIPT_NAME .. ".dir") or "/"
+
+local function fail(err) return ("\n  ERROR: %s"):format(err or "") end
+
+action = function(host, port)
+	
+	local response = http.get(host, port, ("/secure?command=browse&dir=%s"):format(arg_dir))
+
+	if ( response.status ~= 200 or not(response.body) or 0 == #response.body ) then
+		if ( response.status == 401 ) then
+			return fail("Server requires authentication")
+		else
+			return
+		end
+	end
+
+	local status, parsed = json.parse(response.body)
+	if ( not(status) ) then
+		return fail("Failed to parse response")
+	end
+	
+	if ( parsed.errorMessage ) then
+		return fail(parsed.errorMessage)
+	end
+	
+	local output = {}
+	for _, entry in pairs(parsed.files or {}) do
+		table.insert(output,entry.path)
+	end
+	table.sort(output, function(a,b) return a<b end)
+	return stdnse.format_output(true, output)
+end
\ No newline at end of file
diff --git a/scripts/script.db b/scripts/script.db
index 233048772..840cdeefe 100644
--- a/scripts/script.db
+++ b/scripts/script.db
@@ -150,6 +150,7 @@ Entry { filename = "http-unsafe-output-escaping.nse", categories = { "discovery"
 Entry { filename = "http-userdir-enum.nse", categories = { "auth", "intrusive", } }
 Entry { filename = "http-vhosts.nse", categories = { "discovery", "intrusive", } }
 Entry { filename = "http-virustotal.nse", categories = { "external", "malware", "safe", } }
+Entry { filename = "http-vlcstreamer-ls.nse", categories = { "discovery", "safe", } }
 Entry { filename = "http-vmware-path-vuln.nse", categories = { "safe", "vuln", } }
 Entry { filename = "http-vuln-cve2009-3960.nse", categories = { "exploit", "intrusive", } }
 Entry { filename = "http-vuln-cve2010-2861.nse", categories = { "intrusive", "vuln", } }