From 1accb103d13e16dcd48cef12d93041756b1bcd29 Mon Sep 17 00:00:00 2001 From: dmiller Date: Fri, 8 Jan 2016 16:17:12 +0000 Subject: [PATCH] New script: nntp-ntlm-info --- CHANGELOG | 3 + scripts/nntp-ntlm-info.nse | 153 +++++++++++++++++++++++++++++++++++++ scripts/script.db | 1 + 3 files changed, 157 insertions(+) create mode 100644 scripts/nntp-ntlm-info.nse diff --git a/CHANGELOG b/CHANGELOG index b27329657..4c6d2d7f3 100644 --- a/CHANGELOG +++ b/CHANGELOG @@ -1,5 +1,8 @@ # Nmap Changelog ($Id$); -*-text-*- +o [NSE] Added nntp-ntlm-info for extracting hostname and sometimes OS version + from NTLM-auth-enabled NNTP services. [Justin Cacak] + o [NSE] Added pop3-ntlm-info for extracting hostname and sometimes OS version from NTLM-auth-enabled POP3 services. [Justin Cacak] diff --git a/scripts/nntp-ntlm-info.nse b/scripts/nntp-ntlm-info.nse new file mode 100644 index 000000000..23bbfaacd --- /dev/null +++ b/scripts/nntp-ntlm-info.nse @@ -0,0 +1,153 @@ +local comm = require "comm" +local shortport = require "shortport" +local stdnse = require "stdnse" +local base64 = require "base64" +local smbauth = require "smbauth" +local string = require "string" + + +description = [[ +This script enumerates information from remote NNTP services with NTLM +authentication enabled. + +Sending an MS-NNTP NTLM authentication request with null credentials will +cause the remote service to respond with a NTLMSSP message disclosing +information to include NetBIOS, DNS, and OS build version. +]] + + +--- +-- @usage +-- nmap -p 119,433,563 --script nntp-ntlm-info +-- +-- @output +-- 119/tcp open nntp +-- | nntp-ntlm-info: +-- | Target_Name: ACTIVENNTP +-- | NetBIOS_Domain_Name: ACTIVENNTP +-- | NetBIOS_Computer_Name: NNTP-TEST2 +-- | DNS_Domain_Name: somedomain.com +-- | DNS_Computer_Name: nntp-test2.somedomain.com +-- | DNS_Tree_Name: somedomain.com +-- |_ Product_Version: 6.1 (Build 7601) +-- +--@xmloutput +-- ACTIVENNTP +-- ACTIVENNTP +-- NNTP-TEST2 +-- somedomain.com +-- nntp-test2.somedomain.com +-- somedomain.com +-- 6.1 (Build 7601) + + +author = "Justin Cacak" +license = "Same as Nmap--See https://nmap.org/book/man-legal.html" +categories = {"default", "discovery", "safe"} + + +local ntlm_auth_blob = base64.enc( select(2, + smbauth.get_security_blob(nil, nil, nil, nil, nil, nil, nil, + 0x00000001 + -- Negotiate Unicode + 0x00000002 + -- Negotiate OEM strings + 0x00000004 + -- Request Target + 0x00000200 + -- Negotiate NTLM + 0x00008000 + -- Negotiate Always Sign + 0x00080000 + -- Negotiate NTLM2 Key + 0x20000000 + -- Negotiate 128 + 0x80000000 -- Negotiate 56 + )) + ) + + +portrule = shortport.port_or_service({ 119, 433, 563 }, { "nntp", "snews" }) + +action = function(host, port) + + local output = stdnse.output_table() + + -- Negotiate connection protocol + local socket, line, bopt, first_line = comm.tryssl(host, port, "" , {timeout=10000, recv_before=true}) + if not socket then + return + end + + -- Do not attempt to upgrade to a TLS connection if already over TLS + if not shortport.ssl(host,port) then + -- Attempt to upgrade to a TLS connection if supported (may not be advertised) + -- Various implementations *require* this before accepting authentication requests + socket:send("STARTTLS\r\n") + local status, response = socket:receive() + if not status then + return + end + -- Upgrade the connection if STARTTLS permitted, else continue without + if string.match(response, "382 .*") then + status, response = socket:reconnect_ssl() + if not status then + return + end + end + end + + socket:send("AUTHINFO GENERIC NTLM\r\n") + local status, response = socket:receive() + -- If server supports NTLM authentication then continue + if string.match(response, "381 .*") then + socket:send("AUTHINFO GENERIC " .. ntlm_auth_blob .."\r\n") + status, response = socket:receive() + if not response then + return + end + end + + socket:close() + + -- Continue only if a 381 response is returned + local response_decoded = string.match(response, "381 (.*)") + if not response_decoded then + return nil + end + + local response_decoded = base64.dec(response_decoded) + + -- Continue only if NTLMSSP response is returned + if not string.match(response_decoded, "^NTLMSSP") then + return nil + end + + -- Leverage smbauth.get_host_info_from_security_blob() for decoding + local ntlm_decoded = smbauth.get_host_info_from_security_blob(response_decoded) + + -- Target Name will always be returned under any implementation + output.Target_Name = ntlm_decoded.target_realm + + -- Display information returned & ignore responses with null values + if ntlm_decoded.netbios_domain_name and #ntlm_decoded.netbios_domain_name > 0 then + output.NetBIOS_Domain_Name = ntlm_decoded.netbios_domain_name + end + + if ntlm_decoded.netbios_computer_name and #ntlm_decoded.netbios_computer_name > 0 then + output.NetBIOS_Computer_Name = ntlm_decoded.netbios_computer_name + end + + if ntlm_decoded.dns_domain_name and #ntlm_decoded.dns_domain_name > 0 then + output.DNS_Domain_Name = ntlm_decoded.dns_domain_name + end + + if ntlm_decoded.fqdn and #ntlm_decoded.fqdn > 0 then + output.DNS_Computer_Name = ntlm_decoded.fqdn + end + + if ntlm_decoded.dns_forest_name and #ntlm_decoded.dns_forest_name > 0 then + output.DNS_Tree_Name = ntlm_decoded.dns_forest_name + end + + if ntlm_decoded.os_major_version then + output.Product_Version = string.format("%d.%d.%d", + ntlm_decoded.os_major_version, ntlm_decoded.os_minor_version, ntlm_decoded.os_build) + end + + return output + +end diff --git a/scripts/script.db b/scripts/script.db index fdfd42b8f..0fb85e56e 100644 --- a/scripts/script.db +++ b/scripts/script.db @@ -355,6 +355,7 @@ Entry { filename = "nfs-ls.nse", categories = { "discovery", "safe", } } Entry { filename = "nfs-showmount.nse", categories = { "discovery", "safe", } } Entry { filename = "nfs-statfs.nse", categories = { "discovery", "safe", } } Entry { filename = "nje-node-brute.nse", categories = { "brute", "intrusive", } } +Entry { filename = "nntp-ntlm-info.nse", categories = { "default", "discovery", "safe", } } Entry { filename = "nping-brute.nse", categories = { "brute", "intrusive", } } Entry { filename = "nrpe-enum.nse", categories = { "discovery", "intrusive", } } Entry { filename = "ntp-info.nse", categories = { "default", "discovery", "safe", } }