PenTest/nmap
1
0
Fork 0
mirror of https://github.com/nmap/nmap.git synced 2025-12-17 13:09:02 +00:00
Code Issues Projects Releases Wiki Activity

Use decoding instead of pattern match for protocol checking

Browse Source
This commit is contained in:
dmiller
2014-12-18 03:23:46 +00:00
parent 711f6d97c9
commit 425e407eb3
1 changed files with 11 additions and 7 deletions
Download Patch File Download Diff File Expand all files Collapse all files

18
scripts/snmp-info.nse
View File

@@ -106,26 +106,30 @@ action = function (host, port)
end end
end end
local pos, decoded = snmp.decode(response)
-- Check for SNMP version 3 and msgid 0x4a69 (from the probe) -- Check for SNMP version 3 and msgid 0x4a69 (from the probe)
if not response:match("^..\x02\x01\x03\x30.\x02\x02Ji") then if ((not decoded) or
(decoded[1] or false) ~= 3 or
(not decoded[2]) or
(decoded[2][1] or false) ~= 0x4a69) then
stdnse.debug1("Service is not SNMPv3, or packet structure not recognized") stdnse.debug1("Service is not SNMPv3, or packet structure not recognized")
return nil return nil
end end
local decoded = {snmp.decode(response)}
-- This really only works for User-based Security Model (USM) -- This really only works for User-based Security Model (USM)
if decoded[2][2][4] ~= 3 then if decoded[2][4] ~= 3 then
-- TODO: at least report the security model in use -- TODO: at least report the security model in use
stdnse.debug1("SNMP service not using User-based Security Model") stdnse.debug1("SNMP service not using User-based Security Model")
return nil return nil
end end
-- Decode the msgSecurityParameters octet-string -- Decode the msgSecurityParameters octet-string
decoded = {snmp.decode(decoded[2][3])} pos, decoded = snmp.decode(decoded[3])
local output = stdnse.output_table() local output = stdnse.output_table()
-- Decode the msgAuthoritativeEngineID octet-string -- Decode the msgAuthoritativeEngineID octet-string
local engineID = decoded[2][1] local engineID = decoded[1]
local pos, enterprise = bin.unpack(">I", engineID) local pos, enterprise = bin.unpack(">I", engineID)
if enterprise > 0x80000000 then if enterprise > 0x80000000 then
enterprise = enterprise - 0x80000000 enterprise = enterprise - 0x80000000
@@ -156,8 +160,8 @@ action = function (host, port)
output.engineIDFormat = "unknown" output.engineIDFormat = "unknown"
output.engineIDData = stdnse.tohex(engineID:sub(5)) output.engineIDData = stdnse.tohex(engineID:sub(5))
end end
output.snmpEngineBoots = decoded[2][2] output.snmpEngineBoots = decoded[2]
output.snmpEngineTime = stdnse.format_time(decoded[2][3]) output.snmpEngineTime = stdnse.format_time(decoded[3])
port.version = port.version or {} port.version = port.version or {}
port.version.service = "snmp" port.version.service = "snmp"