PenTest/nmap
1
0
Fork 0
mirror of https://github.com/nmap/nmap.git synced 2025-12-19 14:09:02 +00:00
Code Issues Projects Releases Wiki Activity

fixed bug in authentication encryption function as reported by Sergey

Browse Source 
http://seclists.org/nmap-dev/2010/q4/83

changed the way the library reports "Must change password at next logon"
fixed bug in ms-sql-hasdbaccess that would occur if no rows were returned
[Patrik]
This commit is contained in:
patrik
2010-10-15 19:47:54 +00:00
parent ce075558de
commit 1aed246b69
3 changed files with 4 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files

4
nselib/mssql.lua
View File

@@ -619,7 +619,7 @@ LoginPacket =
local c = bit.bxor( string.byte( password:sub( i, i ) ), xormask ) local c = bit.bxor( string.byte( password:sub( i, i ) ), xormask )
local m1= bit.band( bit.rshift( c, 4 ), 0x0F0F ) local m1= bit.band( bit.rshift( c, 4 ), 0x0F0F )
local m2= bit.band( bit.lshift( c, 4 ), 0xF0F0 ) local m2= bit.band( bit.lshift( c, 4 ), 0xF0F0 )
result = result .. bin.pack("s", bit.bor( m1, m2 ) ) result = result .. bin.pack("S", bit.bor( m1, m2 ) )
end end
return result return result
end, end,
@@ -831,7 +831,7 @@ Helper =
-- Let's check for user must change password, it appears as if this is -- Let's check for user must change password, it appears as if this is
-- reported as ERROR 18488 -- reported as ERROR 18488
if ( token.type == TokenType.ErrorMessage and token.errno == 18488 ) then if ( token.type == TokenType.ErrorMessage and token.errno == 18488 ) then
return true, "Must change password at next logon" return false, "Must change password at next logon"
elseif ( token.type == TokenType.LoginAcknowledgement ) then elseif ( token.type == TokenType.LoginAcknowledgement ) then
return true, "Login Success" return true, "Login Success"
end end

2
scripts/ms-sql-brute.nse
View File

@@ -54,7 +54,7 @@ action = function( host, port )
status, result = helper:Login( username, password, "tempdb", host.ip ) status, result = helper:Login( username, password, "tempdb", host.ip )
helper:Disconnect() helper:Disconnect()
if status then if ( status ) or ( "Must change password at next logon" == result ) then
-- Add credentials for other mysql scripts to use -- Add credentials for other mysql scripts to use
table.insert( valid_accounts, string.format("%s:%s => %s", username, password:len()>0 and password or "<empty>", result ) ) table.insert( valid_accounts, string.format("%s:%s => %s", username, password:len()>0 and password or "<empty>", result ) )
-- don't add accounts that need to change passwords to the registry -- don't add accounts that need to change passwords to the registry

2
scripts/ms-sql-hasdbaccess.nse
View File

@@ -127,7 +127,7 @@ action = function( host, port )
helper:Disconnect() helper:Disconnect()
if ( status ) then if ( status and rs) then
result = mssql.Util.FormatOutputTable( rs, true ) result = mssql.Util.FormatOutputTable( rs, true )
result.name = username result.name = username
if ( RS_LIMIT > 0 ) then if ( RS_LIMIT > 0 ) then