diff --git a/scripts/smb-os-discovery.nse b/scripts/smb-os-discovery.nse
index 11be42802..cf784c77d 100644
--- a/scripts/smb-os-discovery.nse
+++ b/scripts/smb-os-discovery.nse
@@ -52,22 +52,22 @@ will speed up the script on targets that do not allow guest access.
-- | smb-os-discovery:
-- | OS: Windows Server (R) 2008 Standard 6001 Service Pack 1 (Windows Server (R) 2008 Standard 6.0)
-- | Computer name: Sql2008
+-- | NetBIOS computer name: SQL2008
-- | Domain name: lab.test.local
-- | Forest name: test.local
-- | FQDN: Sql2008.lab.test.local
--- | NetBIOS computer name: SQL2008
-- | NetBIOS domain name: LAB
-- |_ System time: 2011-04-20T13:34:06-05:00
--
--@xmloutput
--- Windows Server (R) 2008 Standard 6001 Service Pack 1 (Windows Server (R) 2008 Standard 6.0)
--- Sql2008
--- lab.test.local
--- test.local
--- Sql2008.lab.test.local
--- SQL2008
--- LAB
--- 2011-04-20T13:34:06-05:00
+-- Windows Server (R) 2008 Standard 6001 Service Pack 1
+-- Windows Server (R) 2008 Standard 6.0
+-- LAB
+-- SQL2008
+-- 2011-04-20T13:34:06-05:00
+-- Sql2008.lab.test.local
+-- lab.test.local
+-- test.local
author = "Ron Bowes"
license = "Same as Nmap--See http://nmap.org/book/man-legal.html"
@@ -95,12 +95,10 @@ function get_windows_version(os)
end
-function add_to_output(output_table, label, value, value_if_nil)
- if (value == nil and value_if_nil ~= nil) then
- value = value_if_nil
+function add_to_output(output_table, label, value)
+ if value then
+ table.insert(output_table, string.format("%s: %s", label, value))
end
-
- output_table[label] = value
end
action = function(host)
@@ -111,45 +109,43 @@ action = function(host)
return stdnse.format_output(false, result)
end
- local hostname_dns, is_domain_member, os_string, time_string
- if (result[ "fqdn" ]) then
- -- Pull the first part of the FQDN as the computer name
- hostname_dns = string.match( result[ "fqdn" ], "^([^.]+)%.?" )
-
- if (result[ "domain_dns" ]) then
- -- If the computer name doesn't match the domain name, the target is a domain member
- is_domain_member = ( result[ "fqdn" ] ~= result[ "domain_dns" ] )
- end
+ -- Collect results.
+ response.os = result.os
+ response.lanmanager = result.lanmanager
+ response.domain = result.domain
+ response.server = result.server
+ if result.time and result.timezone then
+ response.date = stdnse.format_timestamp(result.time, result.timezone * 60 * 60)
end
+ response.fqdn = result.fqdn
+ response.domain_dns = result.domain_dns
+ response.forest_dns = result.forest_dns
+ response.workgroup = result.workgroup
- if (result['os'] and result['lanmanager']) then
- os_string = string.format( "%s (%s)", get_windows_version( result['os'] ), result['lanmanager'] )
- end
- if (result['time'] and result['timezone']) then
- time_string = stdnse.format_timestamp(result.time, result.timezone * 60 * 60)
- end
-
-
- add_to_output( response, "OS", os_string, "Unknown" )
- add_to_output( response, "Computer name", hostname_dns )
-
- if ( is_domain_member ) then
- add_to_output( response, "Domain name", result[ "domain_dns" ] )
- add_to_output( response, "Forest name", result[ "forest_dns" ] )
- add_to_output( response, "FQDN", result[ "fqdn" ] )
- end
-
- add_to_output( response, "NetBIOS computer name", result[ "server" ] )
-
- if ( is_domain_member ) then
- add_to_output( response, "NetBIOS domain name", result[ "domain" ] )
+ -- Build normal output.
+ local output_lines = {}
+ if response.os and response.lanmanager then
+ add_to_output(output_lines, "OS", string.format("%s (%s)", get_windows_version(response.os), response.lanmanager))
else
- add_to_output( response, "Workgroup", result[ "workgroup" ], result[ "domain" ] )
+ add_to_output(output_lines, "OS", "Unknown")
end
-
- add_to_output( response, "System time", time_string, "Unknown" )
+ if response.fqdn then
+ -- Pull the first part of the FQDN as the computer name.
+ add_to_output(output_lines, "Computer name", string.match(response.fqdn, "^([^.]+)%.?"))
+ end
+ add_to_output(output_lines, "NetBIOS computer name", result.server)
+ if response.fqdn and response.domain_dns and response.fqdn ~= response.domain_dns then
+ -- If the FQDN doesn't match the domain name, the target is a domain member.
+ add_to_output(output_lines, "Domain name", response.domain_dns)
+ add_to_output(output_lines, "Forest name", response.forest_dns)
+ add_to_output(output_lines, "FQDN", response.fqdn)
+ add_to_output(output_lines, "NetBIOS domain name", response.domain)
+ else
+ add_to_output(output_lines, "Workgroup", response.workgroup or response.domain)
+ end
+ add_to_output(output_lines, "System time", response.date or "Unknown")
- return response
+ return response, stdnse.format_output(true, output_lines)
end