From 60baf397e12a417277aedbed07ffcdd6bc4c0a46 Mon Sep 17 00:00:00 2001
From: dmiller <dmiller@e0a8ed71-7df4-0310-8962-fdc924857419>
Date: Fri, 6 Nov 2015 19:40:07 +0000
Subject: [PATCH] Let mcafee-epo-agent match newer agent replies with looser
 pattern

---
 scripts/mcafee-epo-agent.nse | 6 +-----
 1 file changed, 1 insertion(+), 5 deletions(-)

diff --git a/scripts/mcafee-epo-agent.nse b/scripts/mcafee-epo-agent.nse
index 0527dc977..7a4a836cb 100644
--- a/scripts/mcafee-epo-agent.nse
+++ b/scripts/mcafee-epo-agent.nse
@@ -40,10 +40,6 @@ portrule = function(host, port)
   end
 end
 
-function string.StartsWith(stringToSearch, stringToFind)
-  return stringToFind == stringToSearch:sub(1, #stringToFind)
-end
-
 function ExtractXMLElement(xmlContent, elementName)
   return xmlContent:match("<" .. elementName .. ">([^<]*)</" .. elementName .. ">")
 end
@@ -59,7 +55,7 @@ action = function(host, port)
   if data.body then
     stdnse.debug2("data.body:sub = %s", data.body:sub(1, 80))
 
-    if data.body:StartsWith('<?xml version="1.0" encoding="UTF-8"?><?xml-stylesheet type="text/xsl" href="FrameworkLog.xsl"?><naLog>') then
+    if data.body:match('^<%?xml .*%?>%s*<naLog>') then
       port.version.hostname = ExtractXMLElement(data.body, "ComputerName")
       epoServerName = ExtractXMLElement(data.body, "ePOServerName") or ""
       port.version.version =  ExtractXMLElement(data.body, "version") or ""