mirror of
https://github.com/nmap/nmap.git
synced 2025-12-06 04:31:29 +00:00
stdnse.print_debug -> stdnse.debug1
$ sed -i 's/stdnse.print_debug(1, "%s: \([^"]*\)", SCRIPT_NAME/stdnse.debug1("\1"/' *.nse
This commit is contained in:
@@ -60,16 +60,16 @@ action = function(host, port)
|
||||
if not bytes then bytes = 512 else tonumber(bytes) end
|
||||
|
||||
-- Connect and retrieve acarsd info in XML format over TCP
|
||||
stdnse.print_debug(1, "%s: Connecting to %s:%s [Timeout: %ss]", SCRIPT_NAME, host.targetname or host.ip, port.number, timeout)
|
||||
stdnse.debug1("Connecting to %s:%s [Timeout: %ss]", host.targetname or host.ip, port.number, timeout)
|
||||
local status, data = comm.get_banner(host, port, {timeout=timeout*1000,bytes=bytes})
|
||||
if not status or not data then
|
||||
stdnse.print_debug(1, "%s: Retrieving data from %s:%s failed [Timeout expired]", SCRIPT_NAME, host.targetname or host.ip, port.number)
|
||||
stdnse.debug1("Retrieving data from %s:%s failed [Timeout expired]", host.targetname or host.ip, port.number)
|
||||
return
|
||||
end
|
||||
|
||||
-- Check if retrieved data is valid acarsd data
|
||||
if not string.match(data, "acarsd") then
|
||||
stdnse.print_debug(1, "%s: %s:%s is not an acarsd Daemon.", SCRIPT_NAME, host.targetname or host.ip, port.number)
|
||||
stdnse.debug1("%s:%s is not an acarsd Daemon.", host.targetname or host.ip, port.number)
|
||||
return
|
||||
end
|
||||
|
||||
@@ -85,7 +85,7 @@ action = function(host, port)
|
||||
-- Check for unrestricted access -- Parse daemon info
|
||||
else
|
||||
|
||||
stdnse.print_debug(1, "%s: Parsing data from %s:%s", SCRIPT_NAME, host.targetname or host.ip, port.number)
|
||||
stdnse.debug1("Parsing data from %s:%s", host.targetname or host.ip, port.number)
|
||||
local vars = {
|
||||
{"Version","Version"},
|
||||
{"API Version","APIVersion"},
|
||||
|
||||
@@ -203,7 +203,7 @@ action = function(host)
|
||||
end
|
||||
end
|
||||
else
|
||||
stdnse.print_debug(1, "%s: Cannot find hostlist file, quitting", SCRIPT_NAME)
|
||||
stdnse.debug1("Cannot find hostlist file, quitting")
|
||||
return
|
||||
end
|
||||
|
||||
@@ -268,7 +268,7 @@ action = function(host)
|
||||
end
|
||||
end
|
||||
else
|
||||
stdnse.print_debug(1, "%s: Cannot find srvlist file, skipping", SCRIPT_NAME)
|
||||
stdnse.debug1("Cannot find srvlist file, skipping")
|
||||
end
|
||||
end
|
||||
|
||||
|
||||
@@ -95,7 +95,7 @@ end
|
||||
|
||||
function add_target(hostname)
|
||||
if target.ALLOW_NEW_TARGETS then
|
||||
stdnse.print_debug(1, "%s: Added target: %s", SCRIPT_NAME, hostname)
|
||||
stdnse.debug1("Added target: %s", hostname)
|
||||
local status,err = target.add(hostname)
|
||||
end
|
||||
end
|
||||
@@ -185,18 +185,18 @@ action = function( host, port )
|
||||
stdnse.print_debug(2, "%s: Body %s\n", SCRIPT_NAME, body)
|
||||
if body:match("Version:%s*</b>([^][,]+)") then
|
||||
local version = body:match("Version:%s*</b>([^][,]+)")
|
||||
stdnse.print_debug(1, "%s: Version %s", SCRIPT_NAME, version)
|
||||
stdnse.debug1("Version %s", version)
|
||||
result[#result+1] = ("Version: %s"):format(version)
|
||||
port.version.version = version
|
||||
end
|
||||
if body:match("Compiled:%s*</b>([^][<]+)") then
|
||||
local compiled = body:match("Compiled:%s*</b>([^][<]+)")
|
||||
stdnse.print_debug(1, "%s: Compiled %s", SCRIPT_NAME, compiled)
|
||||
stdnse.debug1("Compiled %s", compiled)
|
||||
result[#result+1] = ("Compiled: %s"):format(compiled)
|
||||
end
|
||||
if body:match("ServerID:%s*([^][<]+)") then
|
||||
local upgrades = body:match("ServerID:%s*([^][<]+)")
|
||||
stdnse.print_debug(1, "%s: ServerID %s", SCRIPT_NAME, upgrades)
|
||||
stdnse.debug1("ServerID %s", upgrades)
|
||||
result[#result] = ("ServerID: %s"):format(upgrades)
|
||||
end
|
||||
for logical,physical,hostname in string.gmatch(body,
|
||||
|
||||
@@ -193,7 +193,7 @@ vsFTPd version 2.3.4 backdoor, this was reported on 2011-07-04.]],
|
||||
-- check if vsFTPd was backdoored
|
||||
status, ret = check_backdoor(host, cmd, vsftp_vuln)
|
||||
if not status then
|
||||
stdnse.print_debug(1, "%s: %s", SCRIPT_NAME, ret)
|
||||
stdnse.debug1("%s", ret)
|
||||
return nil
|
||||
end
|
||||
|
||||
|
||||
@@ -196,7 +196,7 @@ execute arbitrary code.]],
|
||||
|
||||
local status, err = check_proftpd(ftp_opts)
|
||||
if not status then
|
||||
stdnse.print_debug(1, "%s: %s", SCRIPT_NAME, err)
|
||||
stdnse.debug1("%s", err)
|
||||
return nil
|
||||
end
|
||||
return report:make_output(ftp_opts.vuln)
|
||||
|
||||
@@ -108,16 +108,16 @@ action = function( host, port )
|
||||
end
|
||||
|
||||
-- Retrieve grid data in XML format over TCP
|
||||
stdnse.print_debug(1, "%s: Connecting to %s:%s", SCRIPT_NAME, host.targetname or host.ip, port.number)
|
||||
stdnse.debug1("Connecting to %s:%s", host.targetname or host.ip, port.number)
|
||||
local status, data = comm.get_banner(host, port, {timeout=timeout*1000,bytes=bytes})
|
||||
if not status then
|
||||
stdnse.print_debug(1, "%s: Timeout exceeded for %s:%s (Timeout: %ss).", SCRIPT_NAME, host.targetname or host.ip, port.number, timeout)
|
||||
stdnse.debug1("Timeout exceeded for %s:%s (Timeout: %ss).", host.targetname or host.ip, port.number, timeout)
|
||||
return
|
||||
end
|
||||
|
||||
-- Parse daemon info
|
||||
if not string.match(data, "<!DOCTYPE GANGLIA_XML") then
|
||||
stdnse.print_debug(1, "%s: %s:%s is not a Ganglia Daemon.", SCRIPT_NAME, host.targetname or host.ip, port.number)
|
||||
stdnse.debug1("%s:%s is not a Ganglia Daemon.", host.targetname or host.ip, port.number)
|
||||
return
|
||||
elseif string.match(data, '<GANGLIA_XML VERSION="([^"]*)" SOURCE="gmond"') then
|
||||
table.insert(result, "Service: Ganglia Monitoring Daemon")
|
||||
@@ -130,7 +130,7 @@ action = function( host, port )
|
||||
local grid = string.match(data, '<GRID NAME="([^"]*)" ')
|
||||
if grid then table.insert(result, string.format("Grid Name: %s", grid)) end
|
||||
else
|
||||
stdnse.print_debug(1, "%s: %s:%s did not supply Ganglia daemon details.", SCRIPT_NAME, host.targetname or host.ip, port.number)
|
||||
stdnse.debug1("%s:%s did not supply Ganglia daemon details.", host.targetname or host.ip, port.number)
|
||||
return
|
||||
end
|
||||
|
||||
|
||||
@@ -46,7 +46,7 @@ action = function( host, port )
|
||||
local uri = "/browseDirectory.jsp"
|
||||
stdnse.print_debug(1, "%s:HTTP GET %s:%s%s", SCRIPT_NAME, host.targetname or host.ip, port.number, uri)
|
||||
local response = http.get( host, port, uri )
|
||||
stdnse.print_debug(1, "%s: Status %s", SCRIPT_NAME,response['status-line'] or "No Response")
|
||||
stdnse.debug1("Status %s",response['status-line'] or "No Response")
|
||||
if response['status-line'] and response['status-line']:match("200%s+OK") and response['body'] then
|
||||
local body = response['body']:gsub("%%","%%%%")
|
||||
stdnse.print_debug(2, "%s: Body %s\n", SCRIPT_NAME,body)
|
||||
@@ -55,7 +55,7 @@ action = function( host, port )
|
||||
port.version.product = "Apache Hadoop"
|
||||
nmap.set_port_version(host, port)
|
||||
local logs = body:match("([^][\"]+)\">Log")
|
||||
stdnse.print_debug(1, "%s: Logs %s", SCRIPT_NAME,logs)
|
||||
stdnse.debug1("Logs %s",logs)
|
||||
table.insert(result, ("Logs: %s"):format(logs))
|
||||
end
|
||||
return stdnse.format_output(true, result)
|
||||
|
||||
@@ -64,7 +64,7 @@ get_userhistory = function( host, port )
|
||||
local uri = "/jobhistory.jsp?pageno=-1&search="
|
||||
stdnse.print_debug(1, "%s:HTTP GET %s:%s%s", SCRIPT_NAME, host.targetname or host.ip, port.number, uri)
|
||||
local response = http.get( host, port, uri )
|
||||
stdnse.print_debug(1, "%s: Status %s", SCRIPT_NAME,response['status-line'] or "No Response")
|
||||
stdnse.debug1("Status %s",response['status-line'] or "No Response")
|
||||
if response['status-line'] and response['status-line']:match("200%s+OK") and response['body'] then
|
||||
local body = response['body']:gsub("%%","%%%%")
|
||||
stdnse.print_debug(2, "%s: Body %s\n", SCRIPT_NAME,body)
|
||||
@@ -73,7 +73,7 @@ get_userhistory = function( host, port )
|
||||
if line:match("job_[%d_]+") then
|
||||
local user = line:match("<td>([^][<>]+)</td></tr>")
|
||||
local job_time = line:match("</td><td>([^][<]+)")
|
||||
stdnse.print_debug(1, "%s: User: %s (%s)", SCRIPT_NAME,user,job_time)
|
||||
stdnse.debug1("User: %s (%s)",user,job_time)
|
||||
table.insert( results, ("User: %s (%s)"):format(user,job_time))
|
||||
end
|
||||
end
|
||||
@@ -85,19 +85,19 @@ get_tasktrackers = function( host, port )
|
||||
local uri = "/machines.jsp?type=active"
|
||||
stdnse.print_debug(1, "%s:HTTP GET %s:%s%s", SCRIPT_NAME, host.targetname or host.ip, port.number, uri)
|
||||
local response = http.get( host, port, uri )
|
||||
stdnse.print_debug(1, "%s: Status %s", SCRIPT_NAME,response['status-line'] or "No Response")
|
||||
stdnse.debug1("Status %s",response['status-line'] or "No Response")
|
||||
if response['status-line'] and response['status-line']:match("200%s+OK") and response['body'] then
|
||||
stdnse.print_debug(2, "%s: Body %s\n", SCRIPT_NAME,response['body'])
|
||||
for line in string.gmatch(response['body'], "[^\n]+") do
|
||||
stdnse.print_debug(3, "%s: Line %s\n", SCRIPT_NAME,line)
|
||||
if line:match("href=\"[%w]+://([%w%.:]+)/\">tracker") then
|
||||
local tasktracker = line:match("href=\".*//([%w%.:]+)/\">tracker")
|
||||
stdnse.print_debug(1, "%s: taskstracker %s", SCRIPT_NAME,tasktracker)
|
||||
stdnse.debug1("taskstracker %s",tasktracker)
|
||||
table.insert( results, tasktracker)
|
||||
if target.ALLOW_NEW_TARGETS then
|
||||
if tasktracker:match("([%w%.]+)") then
|
||||
local newtarget = tasktracker:match("([%w%.]+)")
|
||||
stdnse.print_debug(1, "%s: Added target: %s", SCRIPT_NAME, newtarget)
|
||||
stdnse.debug1("Added target: %s", newtarget)
|
||||
local status,err = target.add(newtarget)
|
||||
end
|
||||
end
|
||||
@@ -112,40 +112,40 @@ action = function( host, port )
|
||||
local uri = "/jobtracker.jsp"
|
||||
stdnse.print_debug(1, "%s:HTTP GET %s:%s%s", SCRIPT_NAME, host.targetname or host.ip, port.number, uri)
|
||||
local response = http.get( host, port, uri )
|
||||
stdnse.print_debug(1, "%s: Status %s", SCRIPT_NAME,response['status-line'] or "No Response")
|
||||
stdnse.debug1("Status %s",response['status-line'] or "No Response")
|
||||
if response['status-line'] and response['status-line']:match("200%s+OK") and response['body'] then
|
||||
stdnse.print_debug(2, "%s: Body %s\n", SCRIPT_NAME,response['body'])
|
||||
if response['body']:match("State:</b>%s*([^][<]+)") then
|
||||
local state = response['body']:match("State:</b>%s*([^][<]+)")
|
||||
stdnse.print_debug(1, "%s: State %s", SCRIPT_NAME,state)
|
||||
stdnse.debug1("State %s",state)
|
||||
table.insert(result, ("State: %s"):format(state))
|
||||
end
|
||||
if response['body']:match("Started:</b>%s*([^][<]+)") then
|
||||
local started = response['body']:match("Started:</b>%s*([^][<]+)")
|
||||
stdnse.print_debug(1, "%s: Started %s", SCRIPT_NAME,started)
|
||||
stdnse.debug1("Started %s",started)
|
||||
table.insert(result, ("Started: %s"):format(started))
|
||||
end
|
||||
if response['body']:match("Version:</b>%s*([^][<]+)") then
|
||||
local version = response['body']:match("Version:</b>%s*([^][<]+)")
|
||||
local versionNo = version:match("([^][,]+)")
|
||||
local versionHash = version:match("[^][,]+%s+(%w+)")
|
||||
stdnse.print_debug(1, "%s: Version %s (%s)", SCRIPT_NAME,versionNo,versionHash)
|
||||
stdnse.debug1("Version %s (%s)",versionNo,versionHash)
|
||||
table.insert(result, ("Version: %s (%s)"):format(versionNo,versionHash))
|
||||
port.version.version = versionNo
|
||||
end
|
||||
if response['body']:match("Compiled:</b>%s*([^][<]+)") then
|
||||
local compiled = response['body']:match("Compiled:</b>%s*([^][<]+)"):gsub("%s+", " ")
|
||||
stdnse.print_debug(1, "%s: Compiled %s", SCRIPT_NAME,compiled)
|
||||
stdnse.debug1("Compiled %s",compiled)
|
||||
table.insert(result, ("Compiled: %s"):format(compiled))
|
||||
end
|
||||
if response['body']:match("Identifier:</b>%s*([^][<]+)") then
|
||||
local identifier = response['body']:match("Identifier:</b>%s*([^][<]+)")
|
||||
stdnse.print_debug(1, "%s: Identifier %s", SCRIPT_NAME,identifier)
|
||||
stdnse.debug1("Identifier %s",identifier)
|
||||
table.insert(result, ("Identifier: %s"):format(identifier))
|
||||
end
|
||||
if response['body']:match("([%w/]+)\">Log<") then
|
||||
local logfiles = response['body']:match("([%w/-_:%%]+)\">Log<")
|
||||
stdnse.print_debug(1, "%s: Log Files %s", SCRIPT_NAME,logfiles)
|
||||
stdnse.debug1("Log Files %s",logfiles)
|
||||
table.insert(result, ("Log Files: %s"):format(logfiles))
|
||||
end
|
||||
local tasktrackers = get_tasktrackers (host, port)
|
||||
|
||||
@@ -64,18 +64,18 @@ get_datanodes = function( host, port, Status )
|
||||
local uri = "/dfsnodelist.jsp?whatNodes=" .. Status
|
||||
stdnse.print_debug(1, "%s:HTTP GET %s:%s%s", SCRIPT_NAME, host.targetname or host.ip, port.number, uri)
|
||||
local response = http.get( host, port, uri )
|
||||
stdnse.print_debug(1, "%s: Status %s", SCRIPT_NAME,response['status-line'] or "No Response" )
|
||||
stdnse.debug1("Status %s",response['status-line'] or "No Response" )
|
||||
if response['status-line'] and response['status-line']:match("200%s+OK") and response['body'] then
|
||||
local body = response['body']:gsub("%%","%%%%")
|
||||
stdnse.print_debug(2, "%s: Body %s\n", SCRIPT_NAME,body)
|
||||
for datanodetmp in string.gmatch(body, "[%w%.:-_]+/browseDirectory.jsp") do
|
||||
local datanode = datanodetmp:gsub("/browseDirectory.jsp","")
|
||||
stdnse.print_debug(1, "%s: Datanode %s", SCRIPT_NAME,datanode)
|
||||
stdnse.debug1("Datanode %s",datanode)
|
||||
table.insert(result, ("Datanode: %s"):format(datanode))
|
||||
if target.ALLOW_NEW_TARGETS then
|
||||
if datanode:match("([%w%.]+)") then
|
||||
local newtarget = datanode:match("([%w%.]+)")
|
||||
stdnse.print_debug(1, "%s: Added target: %s", SCRIPT_NAME, newtarget)
|
||||
stdnse.debug1("Added target: %s", newtarget)
|
||||
local status,err = target.add(newtarget)
|
||||
end
|
||||
end
|
||||
@@ -90,49 +90,49 @@ action = function( host, port )
|
||||
local uri = "/dfshealth.jsp"
|
||||
stdnse.print_debug(1, "%s:HTTP GET %s:%s%s", SCRIPT_NAME, host.targetname or host.ip, port.number, uri)
|
||||
local response = http.get( host, port, uri )
|
||||
stdnse.print_debug(1, "%s: Status %s", SCRIPT_NAME,response['status-line'] or "No Response")
|
||||
stdnse.debug1("Status %s",response['status-line'] or "No Response")
|
||||
if response['status-line'] and response['status-line']:match("200%s+OK") and response['body'] then
|
||||
local body = response['body']:gsub("%%","%%%%")
|
||||
local capacity = {}
|
||||
stdnse.print_debug(2, "%s: Body %s\n", SCRIPT_NAME,body)
|
||||
if body:match("Started:%s*<td>([^][<]+)") then
|
||||
local start = body:match("Started:%s*<td>([^][<]+)")
|
||||
stdnse.print_debug(1, "%s: Started %s", SCRIPT_NAME,start)
|
||||
stdnse.debug1("Started %s",start)
|
||||
table.insert(result, ("Started: %s"):format(start))
|
||||
end
|
||||
if body:match("Version:%s*<td>([^][<]+)") then
|
||||
local version = body:match("Version:%s*<td>([^][<]+)")
|
||||
stdnse.print_debug(1, "%s: Version %s", SCRIPT_NAME,version)
|
||||
stdnse.debug1("Version %s",version)
|
||||
table.insert(result, ("Version: %s"):format(version))
|
||||
port.version.version = version
|
||||
end
|
||||
if body:match("Compiled:%s*<td>([^][<]+)") then
|
||||
local compiled = body:match("Compiled:%s*<td>([^][<]+)")
|
||||
stdnse.print_debug(1, "%s: Compiled %s", SCRIPT_NAME,compiled)
|
||||
stdnse.debug1("Compiled %s",compiled)
|
||||
table.insert(result, ("Compiled: %s"):format(compiled))
|
||||
end
|
||||
if body:match("Upgrades:%s*<td>([^][<]+)") then
|
||||
local upgrades = body:match("Upgrades:%s*<td>([^][<]+)")
|
||||
stdnse.print_debug(1, "%s: Upgrades %s", SCRIPT_NAME,upgrades)
|
||||
stdnse.debug1("Upgrades %s",upgrades)
|
||||
table.insert(result, ("Upgrades: %s"):format(upgrades))
|
||||
end
|
||||
if body:match("([^][\"]+)\">Browse") then
|
||||
local filesystem = body:match("([^][\"]+)\">Browse")
|
||||
stdnse.print_debug(1, "%s: Filesystem %s", SCRIPT_NAME,filesystem)
|
||||
stdnse.debug1("Filesystem %s",filesystem)
|
||||
table.insert(result, ("Filesystem: %s"):format(filesystem))
|
||||
end
|
||||
if body:match("([^][\"]+)\">Namenode") then
|
||||
local logs = body:match("([^][\"]+)\">Namenode")
|
||||
stdnse.print_debug(1, "%s: Logs %s", SCRIPT_NAME,logs)
|
||||
stdnse.debug1("Logs %s",logs)
|
||||
table.insert(result, ("Logs: %s"):format(logs))
|
||||
end
|
||||
for i in string.gmatch(body, "[%d%.]+%s[KMGTP]B") do
|
||||
table.insert(capacity,i)
|
||||
end
|
||||
if #capacity >= 6 then
|
||||
stdnse.print_debug(1, "%s: Total %s", SCRIPT_NAME,capacity[3])
|
||||
stdnse.print_debug(1, "%s: Used DFS (NonDFS) %s (%s)", SCRIPT_NAME,capacity[4],capacity[5])
|
||||
stdnse.print_debug(1, "%s: Remaining %s", SCRIPT_NAME,capacity[6])
|
||||
stdnse.debug1("Total %s",capacity[3])
|
||||
stdnse.debug1("Used DFS (NonDFS) %s (%s)",capacity[4],capacity[5])
|
||||
stdnse.debug1("Remaining %s",capacity[6])
|
||||
table.insert(result,"Storage:")
|
||||
table.insert(result,"Total\tUsed (DFS)\tUsed (Non DFS)\tRemaining")
|
||||
table.insert(result, ("%s\t%s\t%s\t%s"):format(capacity[3],capacity[4],capacity[5],capacity[6]))
|
||||
|
||||
@@ -61,7 +61,7 @@ action = function( host, port )
|
||||
local uri = "/status.jsp"
|
||||
stdnse.print_debug(1, "%s:HTTP GET %s:%s%s", SCRIPT_NAME, host.targetname or host.ip, port.number, uri)
|
||||
local response = http.get( host, port, uri )
|
||||
stdnse.print_debug(1, "%s: Status %s", SCRIPT_NAME,response['status-line'] or "No Resposne")
|
||||
stdnse.debug1("Status %s",response['status-line'] or "No Resposne")
|
||||
if response['status-line'] and response['status-line']:match("200%s+OK") and response['body'] then
|
||||
local body = response['body']:gsub("%%","%%%%")
|
||||
local stats = {}
|
||||
@@ -71,27 +71,27 @@ action = function( host, port )
|
||||
table.insert(stats,i:match(":%s+([^][\n]+)"))
|
||||
end
|
||||
if #stats == 5 then
|
||||
stdnse.print_debug(1, "%s: namenode %s", SCRIPT_NAME,stats[1])
|
||||
stdnse.print_debug(1, "%s: Start %s", SCRIPT_NAME,stats[2])
|
||||
stdnse.print_debug(1, "%s: Last Checkpoint %s", SCRIPT_NAME,stats[3])
|
||||
stdnse.print_debug(1, "%s: Checkpoint Period %s", SCRIPT_NAME,stats[4])
|
||||
stdnse.print_debug(1, "%s: Checkpoint Size %s", SCRIPT_NAME,stats[5])
|
||||
stdnse.debug1("namenode %s",stats[1])
|
||||
stdnse.debug1("Start %s",stats[2])
|
||||
stdnse.debug1("Last Checkpoint %s",stats[3])
|
||||
stdnse.debug1("Checkpoint Period %s",stats[4])
|
||||
stdnse.debug1("Checkpoint Size %s",stats[5])
|
||||
table.insert(result, ("Start: %s"):format(stats[2]))
|
||||
end
|
||||
if body:match("Version:%s*</td><td>([^][\n]+)") then
|
||||
local version = body:match("Version:%s*</td><td>([^][\n]+)")
|
||||
stdnse.print_debug(1, "%s: Version %s", SCRIPT_NAME,version)
|
||||
stdnse.debug1("Version %s",version)
|
||||
table.insert(result, ("Version: %s"):format(version))
|
||||
port.version.version = version
|
||||
end
|
||||
if body:match("Compiled:%s*</td><td>([^][\n]+)") then
|
||||
local compiled = body:match("Compiled:%s*</td><td>([^][\n]+)")
|
||||
stdnse.print_debug(1, "%s: Compiled %s", SCRIPT_NAME,compiled)
|
||||
stdnse.debug1("Compiled %s",compiled)
|
||||
table.insert(result, ("Compiled: %s"):format(compiled))
|
||||
end
|
||||
if body:match("([^][\"]+)\">Logs") then
|
||||
local logs = body:match("([^][\"]+)\">Logs")
|
||||
stdnse.print_debug(1, "%s: Logs %s", SCRIPT_NAME,logs)
|
||||
stdnse.debug1("Logs %s",logs)
|
||||
table.insert(result, ("Logs: %s"):format(logs))
|
||||
end
|
||||
if #stats == 5 then
|
||||
@@ -108,7 +108,7 @@ action = function( host, port )
|
||||
if target.ALLOW_NEW_TARGETS then
|
||||
if stats[1]:match("([^][/]+)") then
|
||||
local newtarget = stats[1]:match("([^][/]+)")
|
||||
stdnse.print_debug(1, "%s: Added target: %s", SCRIPT_NAME, newtarget)
|
||||
stdnse.debug1("Added target: %s", newtarget)
|
||||
local status,err = target.add(newtarget)
|
||||
end
|
||||
end
|
||||
|
||||
@@ -50,7 +50,7 @@ action = function( host, port )
|
||||
local uri = "/tasktracker.jsp"
|
||||
stdnse.print_debug(1, "%s:HTTP GET %s:%s%s", SCRIPT_NAME, host.targetname or host.ip, port.number, uri)
|
||||
local response = http.get( host, port, uri )
|
||||
stdnse.print_debug(1, "%s: Status %s", SCRIPT_NAME,response['status-line'] or "No Response")
|
||||
stdnse.debug1("Status %s",response['status-line'] or "No Response")
|
||||
if response['status-line'] and response['status-line']:match("200%s+OK") and response['body'] then
|
||||
local body = response['body']:gsub("%%","%%%%")
|
||||
stdnse.print_debug(2, "%s: Body %s\n", SCRIPT_NAME,body)
|
||||
@@ -58,18 +58,18 @@ action = function( host, port )
|
||||
local version = response['body']:match("Version:</b>%s*([^][<]+)")
|
||||
local versionNo = version:match("([^][,]+)")
|
||||
local versionHash = version:match("[^][,]+%s+(%w+)")
|
||||
stdnse.print_debug(1, "%s: Version %s (%s)", SCRIPT_NAME,versionNo,versionHash)
|
||||
stdnse.debug1("Version %s (%s)",versionNo,versionHash)
|
||||
table.insert(result, ("Version: %s (%s)"):format(versionNo,versionHash))
|
||||
port.version.version = version
|
||||
end
|
||||
if response['body']:match("Compiled:</b>%s*([^][<]+)") then
|
||||
local compiled = response['body']:match("Compiled:</b>%s*([^][<]+)"):gsub("%s+", " ")
|
||||
stdnse.print_debug(1, "%s: Compiled %s", SCRIPT_NAME,compiled)
|
||||
stdnse.debug1("Compiled %s",compiled)
|
||||
table.insert(result, ("Compiled: %s"):format(compiled))
|
||||
end
|
||||
if body:match("([^][\"]+)\">Log") then
|
||||
local logs = body:match("([^][\"]+)\">Log")
|
||||
stdnse.print_debug(1, "%s: Logs %s", SCRIPT_NAME,logs)
|
||||
stdnse.debug1("Logs %s",logs)
|
||||
table.insert(result, ("Logs: %s"):format(logs))
|
||||
end
|
||||
if #result > 0 then
|
||||
|
||||
@@ -63,7 +63,7 @@ action = function( host, port )
|
||||
local uri = "/master.jsp"
|
||||
stdnse.print_debug(1, "%s:HTTP GET %s:%s%s", SCRIPT_NAME, host.targetname or host.ip, port.number, uri)
|
||||
local response = http.get( host, port, uri )
|
||||
stdnse.print_debug(1, "%s: Status %s", SCRIPT_NAME,response['status-line'] or "No Response")
|
||||
stdnse.debug1("Status %s",response['status-line'] or "No Response")
|
||||
if response['status-line'] and response['status-line']:match("200%s+OK") and response['body'] then
|
||||
local body = response['body']:gsub("%%","%%%%")
|
||||
stdnse.print_debug(2, "%s: Body %s\n", SCRIPT_NAME,body)
|
||||
@@ -75,37 +75,37 @@ action = function( host, port )
|
||||
end
|
||||
if body:match("HBase%s+Compiled</td><td>([^][<]+)") then
|
||||
local compiled = body:match("HBase%s+Compiled</td><td>([^][<]+)"):gsub("%s+", " ")
|
||||
stdnse.print_debug(1, "%s: Hbase Compiled %s", SCRIPT_NAME,compiled)
|
||||
stdnse.debug1("Hbase Compiled %s",compiled)
|
||||
table.insert(result, ("Hbase Compiled: %s"):format(compiled))
|
||||
end
|
||||
if body:match("Directory</td><td>([^][<]+)") then
|
||||
local compiled = body:match("Directory</td><td>([^][<]+)"):gsub("%s+", " ")
|
||||
stdnse.print_debug(1, "%s: HBase RootDirectory %s", SCRIPT_NAME,compiled)
|
||||
stdnse.debug1("HBase RootDirectory %s",compiled)
|
||||
table.insert(result, ("HBase Root Directory: %s"):format(compiled))
|
||||
end
|
||||
if body:match("Hadoop%s+Version</td><td>([^][<]+)") then
|
||||
local version = body:match("Hadoop%s+Version</td><td>([^][<]+)"):gsub("%s+", " ")
|
||||
stdnse.print_debug(1, "%s: Hadoop Version %s", SCRIPT_NAME,version)
|
||||
stdnse.debug1("Hadoop Version %s",version)
|
||||
table.insert(result, ("Hadoop Version: %s"):format(version))
|
||||
end
|
||||
if body:match("Hadoop%s+Compiled</td><td>([^][<]+)") then
|
||||
local compiled = body:match("Hadoop%s+Compiled</td><td>([^][<]+)"):gsub("%s+", " ")
|
||||
stdnse.print_debug(1, "%s: Hadoop Compiled %s", SCRIPT_NAME,compiled)
|
||||
stdnse.debug1("Hadoop Compiled %s",compiled)
|
||||
table.insert(result, ("Hadoop Compiled: %s"):format(compiled))
|
||||
end
|
||||
if body:match("average</td><td>([^][<]+)") then
|
||||
local average = body:match("average</td><td>([^][<]+)"):gsub("%s+", " ")
|
||||
stdnse.print_debug(1, "%s: Average Load %s", SCRIPT_NAME,average)
|
||||
stdnse.debug1("Average Load %s",average)
|
||||
table.insert(result, ("Average Load: %s"):format(average))
|
||||
end
|
||||
if body:match("Quorum</td><td>([^][<]+)") then
|
||||
local quorum = body:match("Quorum</td><td>([^][<]+)"):gsub("%s+", " ")
|
||||
stdnse.print_debug(1, "%s: Zookeeper Quorum %s", SCRIPT_NAME,quorum)
|
||||
stdnse.debug1("Zookeeper Quorum %s",quorum)
|
||||
table.insert(result, ("Zookeeper Quorum: %s"):format(quorum))
|
||||
if target.ALLOW_NEW_TARGETS then
|
||||
if quorum:match("([%w%.]+)") then
|
||||
local newtarget = quorum:match("([%w%.]+)")
|
||||
stdnse.print_debug(1, "%s: Added target: %s", SCRIPT_NAME, newtarget)
|
||||
stdnse.debug1("Added target: %s", newtarget)
|
||||
local status,err = target.add(newtarget)
|
||||
end
|
||||
end
|
||||
@@ -114,12 +114,12 @@ action = function( host, port )
|
||||
stdnse.print_debug(3, "%s: Line %s\n", SCRIPT_NAME,line)
|
||||
if line:match("maxHeap") then
|
||||
local region_server= line:match("\">([^][<]+)</a>")
|
||||
stdnse.print_debug(1, "%s: Region Server %s", SCRIPT_NAME,region_server)
|
||||
stdnse.debug1("Region Server %s",region_server)
|
||||
table.insert(region_servers, region_server)
|
||||
if target.ALLOW_NEW_TARGETS then
|
||||
if region_server:match("([%w%.]+)") then
|
||||
local newtarget = region_server:match("([%w%.]+)")
|
||||
stdnse.print_debug(1, "%s: Added target: %s", SCRIPT_NAME, newtarget)
|
||||
stdnse.debug1("Added target: %s", newtarget)
|
||||
local status,err = target.add(newtarget)
|
||||
end
|
||||
end
|
||||
|
||||
@@ -58,7 +58,7 @@ action = function( host, port )
|
||||
local uri = "/rs-status"
|
||||
stdnse.print_debug(1, "%s:HTTP GET %s:%s%s", SCRIPT_NAME, host.targetname or host.ip, port.number, uri)
|
||||
local response = http.get( host, port, uri )
|
||||
stdnse.print_debug(1, "%s: Status %s", SCRIPT_NAME,response['status-line'] or "No Response")
|
||||
stdnse.debug1("Status %s",response['status-line'] or "No Response")
|
||||
if response['status-line'] and response['status-line']:match("200%s+OK") and response['body'] then
|
||||
local body = response['body']:gsub("%%","%%%%")
|
||||
stdnse.print_debug(2, "%s: Body %s\n", SCRIPT_NAME,body)
|
||||
@@ -70,22 +70,22 @@ action = function( host, port )
|
||||
end
|
||||
if body:match("HBase%s+Compiled</td><td>([^][<]+)") then
|
||||
local compiled = body:match("HBase%s+Compiled</td><td>([^][<]+)"):gsub("%s+", " ")
|
||||
stdnse.print_debug(1, "%s: Hbase Compiled %s", SCRIPT_NAME,compiled)
|
||||
stdnse.debug1("Hbase Compiled %s",compiled)
|
||||
table.insert(result, ("Hbase Compiled: %s"):format(compiled))
|
||||
end
|
||||
if body:match("Metrics</td><td>([^][<]+)") then
|
||||
local metrics = body:match("Metrics</td><td>([^][<]+)"):gsub("%s+", " ")
|
||||
stdnse.print_debug(1, "%s: Metrics %s", SCRIPT_NAME,metrics)
|
||||
stdnse.debug1("Metrics %s",metrics)
|
||||
table.insert(result, ("Metrics %s"):format(metrics))
|
||||
end
|
||||
if body:match("Quorum</td><td>([^][<]+)") then
|
||||
local quorum = body:match("Quorum</td><td>([^][<]+)"):gsub("%s+", " ")
|
||||
stdnse.print_debug(1, "%s: Zookeeper Quorum %s", SCRIPT_NAME,quorum)
|
||||
stdnse.debug1("Zookeeper Quorum %s",quorum)
|
||||
table.insert(result, ("Zookeeper Quorum: %s"):format(quorum))
|
||||
if target.ALLOW_NEW_TARGETS then
|
||||
if quorum:match("([%w%.]+)") then
|
||||
local newtarget = quorum:match("([%w%.]+)")
|
||||
stdnse.print_debug(1, "%s: Added target: %s", SCRIPT_NAME, newtarget)
|
||||
stdnse.debug1("Added target: %s", newtarget)
|
||||
local status,err = target.add(newtarget)
|
||||
end
|
||||
end
|
||||
|
||||
@@ -37,7 +37,7 @@ local function get_admin_cookie(host, port, basepath)
|
||||
stdnse.print_debug(1, "%s:Header 'set-cookie' detected in response.", SCRIPT_NAME)
|
||||
local _, _, admin_cookie = string.find(req.header['set-cookie'], ";path=/, CFAUTHORIZATION_cfadmin=(.*);path=/")
|
||||
if admin_cookie:len() > 79 then
|
||||
stdnse.print_debug(1, "%s: Extracted cookie:%s", SCRIPT_NAME, admin_cookie)
|
||||
stdnse.debug1("Extracted cookie:%s", admin_cookie)
|
||||
return admin_cookie
|
||||
end
|
||||
end
|
||||
|
||||
@@ -120,7 +120,7 @@ action = function(host, port)
|
||||
|
||||
--check this is an axis2 installation
|
||||
if not(check_installation(host, port, basepath.."listServices")) then
|
||||
stdnse.print_debug(1, "%s: This does not look like an Apache Axis2 installation.", SCRIPT_NAME)
|
||||
stdnse.debug1("This does not look like an Apache Axis2 installation.")
|
||||
return
|
||||
end
|
||||
|
||||
@@ -132,18 +132,18 @@ action = function(host, port)
|
||||
--generate debug info for services and select first one to be used in the request
|
||||
if #services > 0 then
|
||||
for _, servname in pairs(services) do
|
||||
stdnse.print_debug(1, "%s: Service found: %s", SCRIPT_NAME, servname)
|
||||
stdnse.debug1("Service found: %s", servname)
|
||||
end
|
||||
selected_service = services[1]
|
||||
else
|
||||
if nmap.verbosity() >= 2 then
|
||||
stdnse.print_debug(1, "%s: There are no services available. We can't exploit this", SCRIPT_NAME)
|
||||
stdnse.debug1("There are no services available. We can't exploit this")
|
||||
end
|
||||
return
|
||||
end
|
||||
|
||||
--Use selected service and exploit
|
||||
stdnse.print_debug(1, "%s: Querying service: %s", SCRIPT_NAME, selected_service)
|
||||
stdnse.debug1("Querying service: %s", selected_service)
|
||||
req = http.get(host, port, basepath..selected_service.."?xsd="..rfile)
|
||||
stdnse.print_debug(2, "%s: Query -> %s", SCRIPT_NAME, basepath..selected_service.."?xsd="..rfile)
|
||||
|
||||
@@ -168,7 +168,7 @@ action = function(host, port)
|
||||
if extract_st then
|
||||
output[#output+1] = extract_msg
|
||||
else
|
||||
stdnse.print_debug(1, "%s: Credentials not found in configuration file", SCRIPT_NAME)
|
||||
stdnse.debug1("Credentials not found in configuration file")
|
||||
end
|
||||
end
|
||||
|
||||
@@ -182,7 +182,7 @@ action = function(host, port)
|
||||
end
|
||||
end
|
||||
else
|
||||
stdnse.print_debug(1, "%s: Request did not return status 200. File might not be found or unreadable", SCRIPT_NAME)
|
||||
stdnse.debug1("Request did not return status 200. File might not be found or unreadable")
|
||||
return
|
||||
end
|
||||
|
||||
|
||||
@@ -92,7 +92,7 @@ action = function(host, port)
|
||||
local config_file = ""
|
||||
|
||||
-- Loop through vulnerable files
|
||||
stdnse.print_debug(1, "%s: Connecting to %s:%s", SCRIPT_NAME, host.targetname or host.ip, port.number)
|
||||
stdnse.debug1("Connecting to %s:%s", host.targetname or host.ip, port.number)
|
||||
for _, path in ipairs(paths) do
|
||||
|
||||
-- Retrieve file
|
||||
@@ -100,11 +100,11 @@ action = function(host, port)
|
||||
if data and data.status then
|
||||
|
||||
-- Check if file exists
|
||||
stdnse.print_debug(1, "%s: HTTP %s: %s", SCRIPT_NAME, data.status, tostring(path))
|
||||
stdnse.debug1("HTTP %s: %s", data.status, tostring(path))
|
||||
if tostring(data.status):match("200") then
|
||||
|
||||
-- Attempt config file retrieval with LFI exploit
|
||||
stdnse.print_debug(1, "%s: Exploiting: %s", SCRIPT_NAME, tostring(path .. payload))
|
||||
stdnse.debug1("Exploiting: %s", tostring(path .. payload))
|
||||
data = http.get(host, port, tostring(path .. payload))
|
||||
if data and data.status and tostring(data.status):match("200") and data.body and data.body ~= "" then
|
||||
|
||||
@@ -115,25 +115,25 @@ action = function(host, port)
|
||||
end
|
||||
|
||||
else
|
||||
stdnse.print_debug(1, "%s: Failed to retrieve file: %s", SCRIPT_NAME, tostring(path .. payload))
|
||||
stdnse.debug1("Failed to retrieve file: %s", tostring(path .. payload))
|
||||
end
|
||||
|
||||
end
|
||||
|
||||
else
|
||||
stdnse.print_debug(1, "%s: Failed to retrieve file: %s", SCRIPT_NAME, tostring(path))
|
||||
stdnse.debug1("Failed to retrieve file: %s", tostring(path))
|
||||
end
|
||||
|
||||
end
|
||||
|
||||
-- No config file found
|
||||
if config_file == "" then
|
||||
stdnse.print_debug(1, "%s: %s:%s is not vulnerable or connection timed out.", SCRIPT_NAME, host.targetname or host.ip, port.number)
|
||||
stdnse.debug1("%s:%s is not vulnerable or connection timed out.", host.targetname or host.ip, port.number)
|
||||
return
|
||||
end
|
||||
|
||||
-- Extract system info from config file in MySQL dump format
|
||||
stdnse.print_debug(1, "%s: Exploit success! Extracting system info from MySQL database dump", SCRIPT_NAME)
|
||||
stdnse.debug1("Exploit success! Extracting system info from MySQL database dump")
|
||||
|
||||
-- Count users
|
||||
if string.match(config_file, "'user_default_email_address',") then
|
||||
|
||||
@@ -62,7 +62,7 @@ action = function(host, port)
|
||||
-- Identify servers that answer 200 to invalid HTTP requests and exit as these would invalidate the tests
|
||||
local _, http_status, _ = http.identify_404(host,port)
|
||||
if ( http_status == 200 ) then
|
||||
stdnse.print_debug(1, "%s: Exiting due to ambiguous response from web server on %s:%s. All URIs return status 200.", SCRIPT_NAME, host.ip, port.number)
|
||||
stdnse.debug1("Exiting due to ambiguous response from web server on %s:%s. All URIs return status 200.", host.ip, port.number)
|
||||
return false
|
||||
end
|
||||
|
||||
|
||||
@@ -75,7 +75,7 @@ local function get_installation_path(host, port, basepath)
|
||||
local _, _, path = string.find(req.header['set-cookie'],
|
||||
"path=/, ANALYZER_DIRECTORY=(.-);path=/")
|
||||
if path then
|
||||
stdnse.print_debug(1, "%s: Extracted path:%s", SCRIPT_NAME, path)
|
||||
stdnse.debug1("Extracted path:%s", path)
|
||||
return path
|
||||
end
|
||||
end
|
||||
|
||||
@@ -59,12 +59,12 @@ local function loadFingerprints(filename, cat)
|
||||
filename = nmap.fetchfile('nselib/data/' .. filename) or filename
|
||||
|
||||
-- Load the file
|
||||
stdnse.print_debug(1, "%s: Loading fingerprints: %s", SCRIPT_NAME, filename)
|
||||
stdnse.debug1("Loading fingerprints: %s", filename)
|
||||
local env = setmetatable({fingerprints = {}}, {__index = _G});
|
||||
file = loadfile(filename, "t", env)
|
||||
|
||||
if( not(file) ) then
|
||||
stdnse.print_debug(1, "%s: Couldn't load the file: %s", SCRIPT_NAME, filename)
|
||||
stdnse.debug1("Couldn't load the file: %s", filename)
|
||||
return
|
||||
end
|
||||
|
||||
|
||||
@@ -60,7 +60,7 @@ action = function(host, port)
|
||||
-- send requests
|
||||
local pipeline_responses = http.pipeline_go(host, port, allrequests)
|
||||
if not pipeline_responses then
|
||||
stdnse.print_debug(1, "%s: No answers from pipelined requests", SCRIPT_NAME)
|
||||
stdnse.debug1("No answers from pipelined requests")
|
||||
return nil
|
||||
end
|
||||
|
||||
|
||||
@@ -72,7 +72,7 @@ action = function(host, port)
|
||||
SCRIPT_NAME, SCRIPT_NAME)
|
||||
end
|
||||
|
||||
stdnse.print_debug(1, "%s: Checking host %s", SCRIPT_NAME, target_url)
|
||||
stdnse.debug1("Checking host %s", target_url)
|
||||
local qry = build_qry(apikey, target_url)
|
||||
local req = http.get_url(qry)
|
||||
stdnse.print_debug(2, "%s", qry)
|
||||
|
||||
@@ -83,7 +83,7 @@ including PPPoE credentials, firmware version, model, gateway, dns servers and a
|
||||
-- Identify servers that answer 200 to invalid HTTP requests and exit as these would invalidate the tests
|
||||
local _, http_status, _ = http.identify_404(host,port)
|
||||
if ( http_status == 200 ) then
|
||||
stdnse.print_debug(1, "%s: Exiting due to ambiguous response from web server on %s:%s. All URIs return status 200.", SCRIPT_NAME, host.ip, port.number)
|
||||
stdnse.debug1("Exiting due to ambiguous response from web server on %s:%s. All URIs return status 200.", host.ip, port.number)
|
||||
return false
|
||||
end
|
||||
|
||||
|
||||
@@ -44,7 +44,7 @@ action = function(host, port)
|
||||
local output = {}
|
||||
local rfile = stdnse.get_script_args("http-litespeed-sourcecode-download.uri") or "/index.php"
|
||||
|
||||
stdnse.print_debug(1, "%s: Trying to download the source code of %s", SCRIPT_NAME, rfile)
|
||||
stdnse.debug1("Trying to download the source code of %s", rfile)
|
||||
--we append a null byte followed by ".txt" to retrieve the source code
|
||||
local req = http.get(host, port, rfile.."\00.txt")
|
||||
|
||||
|
||||
@@ -51,7 +51,7 @@ action = function(host, port)
|
||||
|
||||
-- Identify servers that answer 200 to invalid HTTP requests and exit as these would invalidate the test
|
||||
if ( result_404 == 200 ) then
|
||||
stdnse.print_debug(1, "%s: Exiting due to ambiguous response from web server on %s:%s. All URIs return status 200.", SCRIPT_NAME, host.ip, port.number)
|
||||
stdnse.debug1("Exiting due to ambiguous response from web server on %s:%s. All URIs return status 200.", host.ip, port.number)
|
||||
return false
|
||||
end
|
||||
|
||||
|
||||
@@ -179,7 +179,7 @@ action = function(host, port)
|
||||
local page_var = response.body:match ("[%?%&](%a-)=%a-%.%a")
|
||||
if page_var then
|
||||
local query_base = root .. "?" .. page_var .. "="
|
||||
stdnse.print_debug(1, "%s: testing with query %s.", SCRIPT_NAME, query_base .. "...")
|
||||
stdnse.debug1("testing with query %s.", query_base .. "...")
|
||||
|
||||
for _, dir in ipairs(dirs) do
|
||||
-- Add an encoded null byte at the end to bypass some checks; see
|
||||
|
||||
@@ -99,8 +99,8 @@ action = function(host, port)
|
||||
local rfile = stdnse.get_script_args("http-phpmyadmin-dir-traversal.file") or DEFAULT_FILE
|
||||
local evil_postdata = EXPLOIT_QUERY:format(rfile)
|
||||
local filewrite = stdnse.get_script_args(SCRIPT_NAME..".outfile")
|
||||
stdnse.print_debug(1, "%s: HTTP POST %s%s", SCRIPT_NAME, stdnse.get_hostname(host), evil_uri)
|
||||
stdnse.print_debug(1, "%s: POST DATA %s", SCRIPT_NAME, evil_postdata)
|
||||
stdnse.debug1("HTTP POST %s%s", stdnse.get_hostname(host), evil_uri)
|
||||
stdnse.debug1("POST DATA %s", evil_postdata)
|
||||
|
||||
local vuln = {
|
||||
title = 'phpMyAdmin grab_globals.lib.php subform Parameter Traversal Local File Inclusion',
|
||||
@@ -121,7 +121,7 @@ action = function(host, port)
|
||||
local response = http.post(host, port, evil_uri,
|
||||
{header = {["Content-Type"] = "application/x-www-form-urlencoded"}}, nil, evil_postdata)
|
||||
if response.body and response.status==200 then
|
||||
stdnse.print_debug(1, "%s: response : %s", SCRIPT_NAME, response.body)
|
||||
stdnse.debug1("response : %s", response.body)
|
||||
vuln.state = vulns.STATE.EXPLOIT
|
||||
vuln.extra_info = rfile.." :\n"..response.body
|
||||
if filewrite then
|
||||
@@ -135,7 +135,7 @@ action = function(host, port)
|
||||
elseif response.status==500 then
|
||||
vuln.state = vulns.STATE.LIKELY_VULN
|
||||
stdnse.print_debug(1, "%s:[Error] File not found:%s", SCRIPT_NAME, rfile)
|
||||
stdnse.print_debug(1, "%s: response : %s", SCRIPT_NAME, response.body)
|
||||
stdnse.debug1("response : %s", response.body)
|
||||
vuln.extra_info = string.format("%s not found.\n", rfile)
|
||||
end
|
||||
return vuln_report:make_output(vuln)
|
||||
|
||||
@@ -52,28 +52,28 @@ action = function(host, port)
|
||||
local config_file = ""
|
||||
|
||||
-- Retrieve file
|
||||
stdnse.print_debug(1, "%s: Connecting to %s:%s", SCRIPT_NAME, host.targetname or host.ip, port.number)
|
||||
stdnse.debug1("Connecting to %s:%s", host.targetname or host.ip, port.number)
|
||||
local data = http.get(host, port, path)
|
||||
|
||||
-- Check if file exists
|
||||
if data and data.status and data.status == 200 and data.body and data.body ~= "" then
|
||||
|
||||
-- Check if the config file is valid
|
||||
stdnse.print_debug(1, "%s: HTTP %s: %s", SCRIPT_NAME, data.status, path)
|
||||
stdnse.debug1("HTTP %s: %s", data.status, path)
|
||||
if string.match(data.body, '<QDocRoot version="[^"]+">') then
|
||||
config_file = data.body
|
||||
else
|
||||
stdnse.print_debug(1, "%s: %s:%s uses an invalid config file.", SCRIPT_NAME, host.targetname or host.ip, port.number)
|
||||
stdnse.debug1("%s:%s uses an invalid config file.", host.targetname or host.ip, port.number)
|
||||
return
|
||||
end
|
||||
|
||||
else
|
||||
stdnse.print_debug(1, "%s: Failed to retrieve file: %s", SCRIPT_NAME, path)
|
||||
stdnse.debug1("Failed to retrieve file: %s", path)
|
||||
return
|
||||
end
|
||||
|
||||
-- Extract system info from config file
|
||||
stdnse.print_debug(1, "%s: Extracting system info from %s", SCRIPT_NAME, path)
|
||||
stdnse.debug1("Extracting system info from %s", path)
|
||||
local vars = {
|
||||
|
||||
-- System details --
|
||||
|
||||
@@ -270,7 +270,7 @@ action = function(host, port)
|
||||
-- try to inject
|
||||
local results_queries = {}
|
||||
if #injectable > 0 then
|
||||
stdnse.print_debug(1, "%s: Testing %d suspicious URLs", SCRIPT_NAME, #injectable)
|
||||
stdnse.debug1("Testing %d suspicious URLs", #injectable)
|
||||
local injectableQs = build_injection_vector(injectable)
|
||||
local responses = inject(host, port, injectableQs)
|
||||
results_queries = check_responses(injectableQs, responses)
|
||||
|
||||
@@ -48,7 +48,7 @@ action = function(host, port)
|
||||
-- Identify servers that answer 200 to invalid HTTP requests and exit as these would invalidate the tests
|
||||
local _, http_status, _ = http.identify_404(host,port)
|
||||
if ( http_status == 200 ) then
|
||||
stdnse.print_debug(1, "%s: Exiting due to ambiguous response from web server on %s:%s. All URIs return status 200.", SCRIPT_NAME, host.ip, port.number)
|
||||
stdnse.debug1("Exiting due to ambiguous response from web server on %s:%s. All URIs return status 200.", host.ip, port.number)
|
||||
return false
|
||||
end
|
||||
|
||||
|
||||
@@ -71,7 +71,7 @@ action = function(host, port)
|
||||
local id_netgear = string.match(escape(detection_session.body), ('(id=%d+)'))
|
||||
|
||||
if id_netgear == nil then
|
||||
stdnse.print_debug(1, "%s: Unable to obtain the id", SCRIPT_NAME)
|
||||
stdnse.debug1("Unable to obtain the id")
|
||||
return
|
||||
else
|
||||
-- send the payload to get username and password
|
||||
@@ -83,7 +83,7 @@ action = function(host, port)
|
||||
stdnse.print_debug(1, "%s: username : " .. escape(netgear_username), SCRIPT_NAME)
|
||||
stdnse.print_debug(1, "%s: password : " .. escape(netgear_password), SCRIPT_NAME)
|
||||
else
|
||||
stdnse.print_debug(1, "%s: We haven't been able to get username/password", SCRIPT_NAME)
|
||||
stdnse.debug1("We haven't been able to get username/password")
|
||||
end
|
||||
end
|
||||
end
|
||||
|
||||
@@ -54,7 +54,7 @@ local function get_wp_user(host, port, path, id)
|
||||
stdnse.print_debug(2, "%s: Trying to get username with id %s", SCRIPT_NAME, id)
|
||||
local req = http.get(host, port, path.."?author="..id, { no_cache = true})
|
||||
if req.status then
|
||||
stdnse.print_debug(1, "%s: User id #%s returned status %s", SCRIPT_NAME, id, req.status)
|
||||
stdnse.debug1("User id #%s returned status %s", id, req.status)
|
||||
if req.status == 301 then
|
||||
local _, _, user = string.find(req.header.location, 'https?://.*/.*/(.*)/')
|
||||
return user
|
||||
@@ -124,7 +124,7 @@ action = function(host, port)
|
||||
for i=1, tonumber(limit) do
|
||||
local user = get_wp_user(host, port, basepath, i)
|
||||
if user then
|
||||
stdnse.print_debug(1, "%s: Username found -> %s", SCRIPT_NAME, user)
|
||||
stdnse.debug1("Username found -> %s", user)
|
||||
output[#output+1] = string.format("Username found: %s", user)
|
||||
users[#users+1] = user
|
||||
end
|
||||
|
||||
@@ -43,7 +43,7 @@ action = function(host, port)
|
||||
end
|
||||
return stdnse.strjoin(" ", capstrings)
|
||||
elseif type(capa) == "string" then
|
||||
stdnse.print_debug(1, "%s: '%s' for %s", SCRIPT_NAME, capa, host.ip)
|
||||
stdnse.debug1("'%s' for %s", capa, host.ip)
|
||||
return
|
||||
else
|
||||
return "server doesn't support CAPABILITIES"
|
||||
|
||||
@@ -60,14 +60,14 @@ action = function(host, port)
|
||||
local injectedClass
|
||||
status,injectedClass = jdwp.injectClass(socket,class_bytes)
|
||||
if not status then
|
||||
stdnse.print_debug(1, "%s: Failed to inject class", SCRIPT_NAME)
|
||||
stdnse.debug1("Failed to inject class")
|
||||
return stdnse.format_output(false, "Failed to inject class")
|
||||
end
|
||||
-- find injected class method
|
||||
local runMethodID = jdwp.findMethod(socket,injectedClass.id,"run",false)
|
||||
|
||||
if runMethodID == nil then
|
||||
stdnse.print_debug(1, "%s: Couldn't find run method", SCRIPT_NAME)
|
||||
stdnse.debug1("Couldn't find run method")
|
||||
return stdnse.format_output(false, "Couldn't find run method.")
|
||||
end
|
||||
-- set run() method argument
|
||||
@@ -78,7 +78,7 @@ action = function(host, port)
|
||||
local cmdID
|
||||
status,cmdID = jdwp.createString(socket,0,cmd)
|
||||
if not status then
|
||||
stdnse.print_debug(1, "%s: Couldn't create string", SCRIPT_NAME)
|
||||
stdnse.debug1("Couldn't create string")
|
||||
return stdnse.format_output(false, cmdID)
|
||||
end
|
||||
local runArgs = bin.pack(">CL",0x4c,cmdID) -- 0x4c is object type tag
|
||||
@@ -86,7 +86,7 @@ action = function(host, port)
|
||||
local result
|
||||
status, result = jdwp.invokeObjectMethod(socket,0,injectedClass.instance,injectedClass.thread,injectedClass.id,runMethodID,1,runArgs)
|
||||
if not status then
|
||||
stdnse.print_debug(1, "%s: Couldn't invoke run method", SCRIPT_NAME)
|
||||
stdnse.debug1("Couldn't invoke run method")
|
||||
return stdnse.format_output(false, result)
|
||||
end
|
||||
-- get the result string
|
||||
|
||||
@@ -67,14 +67,14 @@ action = function(host, port)
|
||||
local injectedClass
|
||||
status,injectedClass = jdwp.injectClass(socket,class_bytes)
|
||||
if not status then
|
||||
stdnse.print_debug(1, "%s: Failed to inject class", SCRIPT_NAME)
|
||||
stdnse.debug1("Failed to inject class")
|
||||
return stdnse.format_output(false, "Failed to inject class")
|
||||
end
|
||||
-- find injected class method
|
||||
local runMethodID = jdwp.findMethod(socket,injectedClass.id,"run",false)
|
||||
|
||||
if runMethodID == nil then
|
||||
stdnse.print_debug(1, "%s: Couldn't find run method", SCRIPT_NAME)
|
||||
stdnse.debug1("Couldn't find run method")
|
||||
return stdnse.format_output(false, "Couldn't find run method.")
|
||||
end
|
||||
|
||||
@@ -82,7 +82,7 @@ action = function(host, port)
|
||||
local result
|
||||
status, result = jdwp.invokeObjectMethod(socket,0,injectedClass.instance,injectedClass.thread,injectedClass.id,runMethodID,0,nil)
|
||||
if not status then
|
||||
stdnse.print_debug(1, "%s: Couldn't invoke run method", SCRIPT_NAME)
|
||||
stdnse.debug1("Couldn't invoke run method")
|
||||
return stdnse.format_output(false, result)
|
||||
end
|
||||
-- get the result string
|
||||
|
||||
@@ -58,14 +58,14 @@ action = function(host, port)
|
||||
local injectedClass
|
||||
status,injectedClass = jdwp.injectClass(socket,class_bytes)
|
||||
if not status then
|
||||
stdnse.print_debug(1, "%s: Failed to inject class", SCRIPT_NAME)
|
||||
stdnse.debug1("Failed to inject class")
|
||||
return stdnse.format_output(false, "Failed to inject class")
|
||||
end
|
||||
-- find injected class method
|
||||
local runMethodID = jdwp.findMethod(socket,injectedClass.id,"run",false)
|
||||
|
||||
if runMethodID == nil then
|
||||
stdnse.print_debug(1, "%s: Couldn't find run method", SCRIPT_NAME)
|
||||
stdnse.debug1("Couldn't find run method")
|
||||
return stdnse.format_output(false, "Couldn't find run method.")
|
||||
end
|
||||
|
||||
@@ -73,7 +73,7 @@ action = function(host, port)
|
||||
local result
|
||||
status, result = jdwp.invokeObjectMethod(socket,0,injectedClass.instance,injectedClass.thread,injectedClass.id,runMethodID,0,nil)
|
||||
if not status then
|
||||
stdnse.print_debug(1, "%s: Couldn't invoke run method", SCRIPT_NAME)
|
||||
stdnse.debug1("Couldn't invoke run method")
|
||||
return stdnse.format_output(false, result)
|
||||
end
|
||||
-- get the result string
|
||||
|
||||
@@ -124,7 +124,7 @@ action = function(host, port)
|
||||
-- Identify servers that answer 200 to invalid HTTP requests and exit as these would invalidate the tests
|
||||
local _, http_status, _ = http.identify_404(host,port)
|
||||
if ( http_status == 200 ) then
|
||||
stdnse.print_debug(1, "%s: Exiting due to ambiguous response from web server on %s:%s. All URIs return status 200.", SCRIPT_NAME, host.ip, port.number)
|
||||
stdnse.debug1("Exiting due to ambiguous response from web server on %s:%s. All URIs return status 200.", host.ip, port.number)
|
||||
return false
|
||||
end
|
||||
|
||||
|
||||
@@ -130,7 +130,7 @@ basically account password protection is as good as nonexistent.
|
||||
-- Chance of succeeding is 1/256. Let's try 1,500 to be safe.
|
||||
--
|
||||
for i=1,iterations do
|
||||
stdnse.print_debug(1, "%s: Connection attempt #%d", SCRIPT_NAME, i)
|
||||
stdnse.debug1("Connection attempt #%d", i)
|
||||
try( socket:connect(host, port) )
|
||||
response = try( mysql.receiveGreeting(socket) )
|
||||
status, response = mysql.loginRequest(socket, {authversion = "post41", charset = response.charset}, mysql_user, mysql_pwd, response.salt)
|
||||
|
||||
@@ -95,7 +95,7 @@ Driver = {
|
||||
end
|
||||
if not status or string.find(response,"Please press <Enter>") == nil then
|
||||
--probably not pcanywhere
|
||||
stdnse.print_debug(1, "%s: not pcAnywhere", SCRIPT_NAME)
|
||||
stdnse.debug1("not pcAnywhere")
|
||||
return false, brute.Error:new( "Probably not pcAnywhere." )
|
||||
end
|
||||
retry = false
|
||||
@@ -108,7 +108,7 @@ Driver = {
|
||||
status, err = self.socket:send(bin.pack("H","6f620102000000")) -- auth capabilities II
|
||||
status, response = self.socket:receive_bytes(0)
|
||||
if not status or (string.find(response,"Enter user name") == nil and string.find(response,"Enter login name") == nil) then
|
||||
stdnse.print_debug(1, "%s: handshake failed", SCRIPT_NAME)
|
||||
stdnse.debug1("handshake failed")
|
||||
return false, brute.Error:new( "Handshake failed." )
|
||||
end
|
||||
return true
|
||||
@@ -124,14 +124,14 @@ Driver = {
|
||||
status, err = self.socket:send(bin.pack("C",0x06) .. bin.pack("C",string.len(user)) .. encrypt(user) ) -- send username
|
||||
status, response = self.socket:receive_bytes(0)
|
||||
if not status or string.find(response,"Enter password") == nil then
|
||||
stdnse.print_debug(1, "%s: Sending username failed", SCRIPT_NAME)
|
||||
stdnse.debug1("Sending username failed")
|
||||
return false, brute.Error:new( "Sending username failed." )
|
||||
end
|
||||
-- send password
|
||||
status, err = self.socket:send(bin.pack("C",0x06) .. bin.pack("C",string.len(pass)) .. encrypt(pass) ) -- send password
|
||||
status, response = self.socket:receive_bytes(0)
|
||||
if not status or string.find(response,"Login unsuccessful") or string.find(response,"Invalid login.")then
|
||||
stdnse.print_debug(1, "%s: Incorrect username or password", SCRIPT_NAME)
|
||||
stdnse.debug1("Incorrect username or password")
|
||||
return false, brute.Error:new( "Incorrect username or password." )
|
||||
end
|
||||
|
||||
|
||||
@@ -40,7 +40,7 @@ action = function(host, port)
|
||||
end
|
||||
return stdnse.strjoin(" ", capstrings)
|
||||
elseif type(err) == "string" then
|
||||
stdnse.print_debug(1, "%s: '%s' for %s", SCRIPT_NAME, err, host.ip)
|
||||
stdnse.debug1("'%s' for %s", err, host.ip)
|
||||
return
|
||||
else
|
||||
return "server doesn't support CAPA"
|
||||
|
||||
@@ -87,17 +87,17 @@ system commands as the 'root' user.
|
||||
|
||||
-- Send command as service launcher request
|
||||
local req = string.format("service launcher\nstart/flags run /bin/sh /bin/sh -c \"%s\"\n", cmd)
|
||||
stdnse.print_debug(1, "%s: Connecting to %s:%s", SCRIPT_NAME, host.targetname or host.ip, port.number)
|
||||
stdnse.debug1("Connecting to %s:%s", host.targetname or host.ip, port.number)
|
||||
local status, data = comm.exchange(host, port, req, {timeout=timeout*1000,bytes=bytes})
|
||||
if not status then
|
||||
stdnse.print_debug(1, "%s: Timeout exceeded for %s:%s (Timeout: %ss).", SCRIPT_NAME, host.targetname or host.ip, port.number, timeout)
|
||||
stdnse.debug1("Timeout exceeded for %s:%s (Timeout: %ss).", host.targetname or host.ip, port.number, timeout)
|
||||
return
|
||||
end
|
||||
|
||||
-- Parse response
|
||||
stdnse.print_debug(2, "%s: Received reply:\n%s", SCRIPT_NAME, data)
|
||||
if not string.match(data, "QCONN") then
|
||||
stdnse.print_debug(1, "%s: %s:%s is not a QNX QCONN daemon.", SCRIPT_NAME, host.targetname or host.ip, port.number)
|
||||
stdnse.debug1("%s:%s is not a QNX QCONN daemon.", host.targetname or host.ip, port.number)
|
||||
return
|
||||
end
|
||||
|
||||
@@ -107,7 +107,7 @@ system commands as the 'root' user.
|
||||
local report = vulns.Report:new(SCRIPT_NAME, host, port)
|
||||
return report:make_output(vuln_table)
|
||||
else
|
||||
stdnse.print_debug(1, "%s: %s:%s QNX QCONN daemon is not vulnerable.", SCRIPT_NAME, host.targetname or host.ip, port.number)
|
||||
stdnse.debug1("%s:%s QNX QCONN daemon is not vulnerable.", host.targetname or host.ip, port.number)
|
||||
return
|
||||
end
|
||||
|
||||
|
||||
@@ -186,7 +186,7 @@ action = function(host, port)
|
||||
status, response = socket:receive_bytes(0)
|
||||
if response ~= bin.pack("H","0300000b06d00000123400") then
|
||||
--probably not rdp at all
|
||||
stdnse.print_debug(1, "%s: not RDP", SCRIPT_NAME)
|
||||
stdnse.debug1("not RDP")
|
||||
return nil
|
||||
end
|
||||
status, err = socket:send(connectInitial)
|
||||
|
||||
@@ -116,7 +116,7 @@ action = function(host, port)
|
||||
-- Identify servers that answer 200 to invalid HTTP requests and exit as these would invalidate the tests
|
||||
local _, http_status, _ = http.identify_404(host,port)
|
||||
if ( http_status == 200 ) then
|
||||
stdnse.print_debug(1, "%s: Exiting due to ambiguous response from web server on %s:%s. All URIs return status 200.", SCRIPT_NAME, host.ip, port.number)
|
||||
stdnse.debug1("Exiting due to ambiguous response from web server on %s:%s. All URIs return status 200.", host.ip, port.number)
|
||||
return false
|
||||
end
|
||||
|
||||
|
||||
@@ -650,10 +650,10 @@ local function locate_file(filename, extension)
|
||||
if(filename_full == nil) then
|
||||
local f, err = io.open(filename, "rb")
|
||||
if f == nil then
|
||||
stdnse.print_debug(1, "%s: Error opening %s: %s", SCRIPT_NAME, filename, err)
|
||||
stdnse.debug1("Error opening %s: %s", filename, err)
|
||||
f, err = io.open(filename .. "." .. extension, "rb")
|
||||
if f == nil then
|
||||
stdnse.print_debug(1, "%s: Error opening %s.%s: %s", SCRIPT_NAME, filename, extension, err)
|
||||
stdnse.debug1("Error opening %s.%s: %s", filename, extension, err)
|
||||
return nil -- unnecessary, but explicit
|
||||
else
|
||||
f:close()
|
||||
|
||||
@@ -461,7 +461,7 @@ action = function(host, port)
|
||||
end
|
||||
local status, output = check_exim(smtp_opts)
|
||||
if not status then
|
||||
stdnse.print_debug(1, "%s: %s", SCRIPT_NAME, output)
|
||||
stdnse.debug1("%s", output)
|
||||
return nil
|
||||
end
|
||||
return stdnse.format_output(status, output)
|
||||
|
||||
@@ -280,7 +280,7 @@ than PLAIN and LOGIN.]],
|
||||
local report = vulns.Report:new(SCRIPT_NAME, host, port)
|
||||
local status, err = check_smtpd(smtp_opts)
|
||||
if not status then
|
||||
stdnse.print_debug(1, "%s: %s", SCRIPT_NAME, err)
|
||||
stdnse.debug1("%s", err)
|
||||
return nil
|
||||
end
|
||||
return report:make_output(smtp_opts.vuln)
|
||||
|
||||
@@ -232,7 +232,7 @@ arbitrary code with the privileges of the Exim daemon.]],
|
||||
local report = vulns.Report:new(SCRIPT_NAME, host, port)
|
||||
local status, err = check_exim(smtp_opts)
|
||||
if not status then
|
||||
stdnse.print_debug(1, "%s: %s", SCRIPT_NAME, err)
|
||||
stdnse.debug1("%s", err)
|
||||
return nil
|
||||
end
|
||||
return report:make_output(smtp_opts.vuln)
|
||||
|
||||
Reference in New Issue
Block a user