mirror of
https://github.com/nmap/nmap.git
synced 2025-12-06 04:31:29 +00:00
Replace inline tabs with spaces.
Left some in the @output section, since libraries are apparently emitting tab-separated tables (mysql or mssql) https://secwiki.org/w/Nmap/Code_Standards
This commit is contained in:
@@ -32,9 +32,9 @@ For more information about acarsd, see:
|
|||||||
-- |_ Frequency: 131.7250 & 131.45
|
-- |_ Frequency: 131.7250 & 131.45
|
||||||
--
|
--
|
||||||
-- @args acarsd-info.timeout
|
-- @args acarsd-info.timeout
|
||||||
-- Set the timeout in seconds. The default value is 10.
|
-- Set the timeout in seconds. The default value is 10.
|
||||||
-- @args acarsd-info.bytes
|
-- @args acarsd-info.bytes
|
||||||
-- Set the number of bytes to retrieve. The default value is 512.
|
-- Set the number of bytes to retrieve. The default value is 512.
|
||||||
--
|
--
|
||||||
-- @changelog
|
-- @changelog
|
||||||
-- 2012-02-23 - v0.1 - created by Brendan Coles - itsecuritysolutions.org
|
-- 2012-02-23 - v0.1 - created by Brendan Coles - itsecuritysolutions.org
|
||||||
|
|||||||
@@ -39,7 +39,7 @@ categories = {"default", "safe"}
|
|||||||
portrule = shortport.port_or_service(8009, 'ajp13', 'tcp')
|
portrule = shortport.port_or_service(8009, 'ajp13', 'tcp')
|
||||||
|
|
||||||
local arg_url = stdnse.get_script_args(SCRIPT_NAME .. ".path") or "/"
|
local arg_url = stdnse.get_script_args(SCRIPT_NAME .. ".path") or "/"
|
||||||
local UNINTERESTING_METHODS = { "GET", "HEAD", "POST", "OPTIONS" }
|
local UNINTERESTING_METHODS = { "GET", "HEAD", "POST", "OPTIONS" }
|
||||||
|
|
||||||
local function filter_out(t, filter)
|
local function filter_out(t, filter)
|
||||||
local result = {}
|
local result = {}
|
||||||
|
|||||||
@@ -74,7 +74,7 @@ action = function()
|
|||||||
status, _, _, ip, _ = socket:get_info()
|
status, _, _, ip, _ = socket:get_info()
|
||||||
if ( not(status) ) then return end
|
if ( not(status) ) then return end
|
||||||
|
|
||||||
if target.ALLOW_NEW_TARGETS then target.add(ip) end
|
if target.ALLOW_NEW_TARGETS then target.add(ip) end
|
||||||
|
|
||||||
if ( status ) then
|
if ( status ) then
|
||||||
table.insert( result, ("%s - Host: %s; Version: %s"):format(ip, srvname, parseVersion( version ) ) )
|
table.insert( result, ("%s - Host: %s; Version: %s"):format(ip, srvname, parseVersion( version ) ) )
|
||||||
|
|||||||
@@ -41,7 +41,7 @@ action = function()
|
|||||||
local BROADCAST_ADDR = "255.255.255.255"
|
local BROADCAST_ADDR = "255.255.255.255"
|
||||||
|
|
||||||
local status, result = netbios.nbquery( { ip = BROADCAST_ADDR }, NBNAME, { multiple = true })
|
local status, result = netbios.nbquery( { ip = BROADCAST_ADDR }, NBNAME, { multiple = true })
|
||||||
if ( not(status) ) then return end
|
if ( not(status) ) then return end
|
||||||
|
|
||||||
local outtab = tab.new(3)
|
local outtab = tab.new(3)
|
||||||
tab.addrow(outtab, 'ip', 'server', 'domain')
|
tab.addrow(outtab, 'ip', 'server', 'domain')
|
||||||
|
|||||||
@@ -95,9 +95,9 @@ RIPng = {
|
|||||||
-- @return o instance of request
|
-- @return o instance of request
|
||||||
new = function(self, entries)
|
new = function(self, entries)
|
||||||
local o = {
|
local o = {
|
||||||
command = 1,
|
command = 1,
|
||||||
version = 1,
|
version = 1,
|
||||||
entries = entries,
|
entries = entries,
|
||||||
}
|
}
|
||||||
setmetatable(o, self)
|
setmetatable(o, self)
|
||||||
self.__index = self
|
self.__index = self
|
||||||
|
|||||||
@@ -82,12 +82,12 @@ action = function(host, port)
|
|||||||
--
|
--
|
||||||
-- Spec. of response to query[2] that contains a list of published apps
|
-- Spec. of response to query[2] that contains a list of published apps
|
||||||
--
|
--
|
||||||
-- offset size content
|
-- offset size content
|
||||||
-- -------------------------
|
-- -------------------------
|
||||||
-- 0 16-bit Length
|
-- 0 16-bit Length
|
||||||
-- 12 32-bit Server IP (not used here)
|
-- 12 32-bit Server IP (not used here)
|
||||||
-- 30 8-bit Last packet (1), More packets(0)
|
-- 30 8-bit Last packet(1), More packets(0)
|
||||||
-- 40 - null-separated list of applications
|
-- 40 - null-separated list of applications
|
||||||
--
|
--
|
||||||
query[0] = string.char(
|
query[0] = string.char(
|
||||||
0x1e, 0x00, -- Length: 30
|
0x1e, 0x00, -- Length: 30
|
||||||
|
|||||||
@@ -79,17 +79,17 @@ action = function(host, port)
|
|||||||
--
|
--
|
||||||
-- Spec. of response to query[2] that contains a list of published apps
|
-- Spec. of response to query[2] that contains a list of published apps
|
||||||
--
|
--
|
||||||
-- offset size content
|
-- offset size content
|
||||||
-- -------------------------
|
-- -------------------------
|
||||||
-- 0 16-bit Length
|
-- 0 16-bit Length
|
||||||
-- 12 32-bit Server IP (not used here)
|
-- 12 32-bit Server IP (not used here)
|
||||||
-- 30 8-bit Last packet (1), More packets(0)
|
-- 30 8-bit Last packet(1), More packets(0)
|
||||||
-- 40 - null-separated list of applications
|
-- 40 - null-separated list of applications
|
||||||
--
|
--
|
||||||
query[0] = string.char(
|
query[0] = string.char(
|
||||||
0x1e, 0x00, -- Length: 30
|
0x1e, 0x00, -- Length: 30
|
||||||
0x01, 0x30, 0x02, 0xfd, 0xa8, 0xe3, 0x00, 0x00,
|
0x01, 0x30, 0x02, 0xfd, 0xa8, 0xe3, 0x00, 0x00,
|
||||||
0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
|
0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
|
||||||
0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
|
0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
|
||||||
0x00, 0x00, 0x00, 0x00
|
0x00, 0x00, 0x00, 0x00
|
||||||
)
|
)
|
||||||
@@ -99,7 +99,7 @@ action = function(host, port)
|
|||||||
0x01, 0x32, 0x02, 0xfd, 0xa8, 0xe3, 0x00, 0x00,
|
0x01, 0x32, 0x02, 0xfd, 0xa8, 0xe3, 0x00, 0x00,
|
||||||
0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
|
0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
|
||||||
0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
|
0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
|
||||||
0x00, 0x00, 0x01, 0x00, 0x02, 0x00, 0x00, 0x00,
|
0x00, 0x00, 0x01, 0x00, 0x02, 0x00, 0x00, 0x00,
|
||||||
0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00
|
0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00
|
||||||
)
|
)
|
||||||
|
|
||||||
|
|||||||
@@ -35,7 +35,7 @@ With knowledge of the correct repository name, usernames and passwords can be gu
|
|||||||
-- Version 0.2
|
-- Version 0.2
|
||||||
-- Created 07/13/2010 - v0.1 - created by Patrik Karlsson <patrik@cqure.net>
|
-- Created 07/13/2010 - v0.1 - created by Patrik Karlsson <patrik@cqure.net>
|
||||||
-- Revised 08/07/2012 - v0.2 - revised to suit the changes in brute
|
-- Revised 08/07/2012 - v0.2 - revised to suit the changes in brute
|
||||||
-- library [Aleksandar Nikolic]
|
-- library [Aleksandar Nikolic]
|
||||||
|
|
||||||
author = "Patrik Karlsson"
|
author = "Patrik Karlsson"
|
||||||
license = "Same as Nmap--See http://nmap.org/book/man-legal.html"
|
license = "Same as Nmap--See http://nmap.org/book/man-legal.html"
|
||||||
|
|||||||
@@ -203,7 +203,7 @@ local dns_checks = {
|
|||||||
end
|
end
|
||||||
|
|
||||||
local domain_dns = {}
|
local domain_dns = {}
|
||||||
for _,srv in ipairs(res) do domain_dns[srv] = true end
|
for _,srv in ipairs(res) do domain_dns[srv] = true end
|
||||||
|
|
||||||
local result = {}
|
local result = {}
|
||||||
for srv in pairs(domain_dns) do
|
for srv in pairs(domain_dns) do
|
||||||
|
|||||||
@@ -343,7 +343,7 @@ action = function(host, port)
|
|||||||
end
|
end
|
||||||
|
|
||||||
local addrs = argAddr or areaIPs
|
local addrs = argAddr or areaIPs
|
||||||
if ( "string" == type(addrs) ) then addrs = {{ ip = addrs }} end
|
if ( "string" == type(addrs) ) then addrs = {{ ip = addrs }} end
|
||||||
|
|
||||||
local lookup, result = {}, { name = argDomain }
|
local lookup, result = {}, { name = argDomain }
|
||||||
for _,ip in pairs(addrs) do
|
for _,ip in pairs(addrs) do
|
||||||
|
|||||||
@@ -284,7 +284,7 @@ local function enum(host, port, domain)
|
|||||||
todo[b] = h2
|
todo[b] = h2
|
||||||
break
|
break
|
||||||
end
|
end
|
||||||
if h1 > b then -- a b h1 h2
|
if h1 > b then -- a b h1 h2
|
||||||
todo[b] = nil
|
todo[b] = nil
|
||||||
todo[b] = h1
|
todo[b] = h1
|
||||||
todo[h2] = a
|
todo[h2] = a
|
||||||
|
|||||||
@@ -28,16 +28,16 @@ categories = {"discovery", "safe"}
|
|||||||
-- Examples
|
-- Examples
|
||||||
--
|
--
|
||||||
-- Adding different types of records to a server
|
-- Adding different types of records to a server
|
||||||
-- * dns.update( "www.cqure.net", { host=host, port=port, dtype="A", data="10.10.10.10" } )
|
-- * dns.update( "www.cqure.net", { host=host, port=port, dtype="A", data="10.10.10.10" } )
|
||||||
-- * dns.update( "alias.cqure.net", { host=host, port=port, dtype="CNAME", data="www.cqure.net" } )
|
-- * dns.update( "alias.cqure.net", { host=host, port=port, dtype="CNAME", data="www.cqure.net" } )
|
||||||
-- * dns.update( "cqure.net", { host=host, port=port, dtype="MX", data={ pref=10, mx="mail.cqure.net"} })
|
-- * dns.update( "cqure.net", { host=host, port=port, dtype="MX", data={ pref=10, mx="mail.cqure.net"} })
|
||||||
-- * dns.update( "_ldap._tcp.cqure.net", { host=host, port=port, dtype="SRV", data={ prio=0, weight=100, port=389, target="ldap.cqure.net" } } )
|
-- * dns.update( "_ldap._tcp.cqure.net", { host=host, port=port, dtype="SRV", data={ prio=0, weight=100, port=389, target="ldap.cqure.net" } } )
|
||||||
--
|
--
|
||||||
-- Removing the above records by setting an empty data and a ttl of zero
|
-- Removing the above records by setting an empty data and a ttl of zero
|
||||||
-- * dns.update( "www.cqure.net", { host=host, port=port, dtype="A", data="", ttl=0 } )
|
-- * dns.update( "www.cqure.net", { host=host, port=port, dtype="A", data="", ttl=0 } )
|
||||||
-- * dns.update( "alias.cqure.net", { host=host, port=port, dtype="CNAME", data="", ttl=0 } )
|
-- * dns.update( "alias.cqure.net", { host=host, port=port, dtype="CNAME", data="", ttl=0 } )
|
||||||
-- * dns.update( "cqure.net", { host=host, port=port, dtype="MX", data="", ttl=0 } )
|
-- * dns.update( "cqure.net", { host=host, port=port, dtype="MX", data="", ttl=0 } )
|
||||||
-- * dns.update( "_ldap._tcp.cqure.net", { host=host, port=port, dtype="SRV", data="", ttl=0 } )
|
-- * dns.update( "_ldap._tcp.cqure.net", { host=host, port=port, dtype="SRV", data="", ttl=0 } )
|
||||||
--
|
--
|
||||||
|
|
||||||
-- Version 0.2
|
-- Version 0.2
|
||||||
|
|||||||
@@ -74,7 +74,7 @@ local function readAPIBlock( socket )
|
|||||||
local result = {}
|
local result = {}
|
||||||
local status, line = socket:receive_lines(1)
|
local status, line = socket:receive_lines(1)
|
||||||
|
|
||||||
if ( not(status) ) then return false, "Failed to read line" end
|
if ( not(status) ) then return false, "Failed to read line" end
|
||||||
lines = stdnse.strsplit( "\n", line )
|
lines = stdnse.strsplit( "\n", line )
|
||||||
|
|
||||||
for _, line in ipairs( lines ) do
|
for _, line in ipairs( lines ) do
|
||||||
@@ -104,7 +104,7 @@ action = function(host, port)
|
|||||||
local pass = stdnse.get_script_args('domcon-cmd.pass')
|
local pass = stdnse.get_script_args('domcon-cmd.pass')
|
||||||
local cmd = stdnse.get_script_args('domcon-cmd.cmd')
|
local cmd = stdnse.get_script_args('domcon-cmd.cmd')
|
||||||
|
|
||||||
if( not(cmd) ) then return " \n ERROR: No command supplied (see domcon-cmd.cmd)" end
|
if( not(cmd) ) then return " \n ERROR: No command supplied (see domcon-cmd.cmd)" end
|
||||||
if( not(user)) then return " \n ERROR: No username supplied (see domcon-cmd.user)" end
|
if( not(user)) then return " \n ERROR: No username supplied (see domcon-cmd.user)" end
|
||||||
if( not(pass)) then return " \n ERROR: No password supplied (see domcon-cmd.pass)" end
|
if( not(pass)) then return " \n ERROR: No password supplied (see domcon-cmd.pass)" end
|
||||||
|
|
||||||
|
|||||||
@@ -24,8 +24,8 @@ Attempts to discover valid IBM Lotus Domino users and download their ID files by
|
|||||||
--
|
--
|
||||||
-- @args domino-id.path the location to which any retrieved ID files are stored
|
-- @args domino-id.path the location to which any retrieved ID files are stored
|
||||||
-- @args domino-id.username the name of the user from which to retrieve the ID.
|
-- @args domino-id.username the name of the user from which to retrieve the ID.
|
||||||
-- If this parameter is not specified, the unpwdb library will be used to
|
-- If this parameter is not specified, the unpwdb
|
||||||
-- brute force names of users.
|
-- library will be used to brute force names of users.
|
||||||
--
|
--
|
||||||
-- For more information see:
|
-- For more information see:
|
||||||
-- http://www-01.ibm.com/support/docview.wss?rs=463&uid=swg21248026
|
-- http://www-01.ibm.com/support/docview.wss?rs=463&uid=swg21248026
|
||||||
|
|||||||
@@ -93,7 +93,7 @@ action = function( host, port )
|
|||||||
end
|
end
|
||||||
|
|
||||||
local uid, pid = data:match("uid=(%d+)&pid=(%d+)")
|
local uid, pid = data:match("uid=(%d+)&pid=(%d+)")
|
||||||
if ( uid and pid ) then tab.addrow( results, app, uid, pid ) end
|
if ( uid and pid ) then tab.addrow( results, app, uid, pid ) end
|
||||||
|
|
||||||
try( socket:close() )
|
try( socket:close() )
|
||||||
end
|
end
|
||||||
|
|||||||
@@ -119,7 +119,7 @@ local function postaction()
|
|||||||
if #siteids[id] > 1 then
|
if #siteids[id] > 1 then
|
||||||
local str = id .. ' used by:'
|
local str = id .. ' used by:'
|
||||||
for _, site in ipairs(siteids[id]) do
|
for _, site in ipairs(siteids[id]) do
|
||||||
str = str .. '\n ' .. site
|
str = str .. '\n ' .. site
|
||||||
end
|
end
|
||||||
table.insert(output, str)
|
table.insert(output, str)
|
||||||
end
|
end
|
||||||
|
|||||||
@@ -60,7 +60,7 @@ end
|
|||||||
action = function(host, port)
|
action = function(host, port)
|
||||||
|
|
||||||
-- create a new crawler instance
|
-- create a new crawler instance
|
||||||
local crawler = httpspider.Crawler:new( host, port, nil, { scriptname = SCRIPT_NAME } )
|
local crawler = httpspider.Crawler:new( host, port, nil, { scriptname = SCRIPT_NAME } )
|
||||||
|
|
||||||
if ( not(crawler) ) then
|
if ( not(crawler) ) then
|
||||||
return
|
return
|
||||||
|
|||||||
@@ -75,7 +75,7 @@ function action(host, port)
|
|||||||
end
|
end
|
||||||
|
|
||||||
-- if no email addresses were collected abort
|
-- if no email addresses were collected abort
|
||||||
if ( not(emails) ) then return end
|
if ( not(emails) ) then return end
|
||||||
|
|
||||||
local results = {}
|
local results = {}
|
||||||
for email, _ in pairs(emails) do
|
for email, _ in pairs(emails) do
|
||||||
|
|||||||
@@ -313,7 +313,7 @@ local function get_fingerprints(fingerprint_file, category)
|
|||||||
end
|
end
|
||||||
|
|
||||||
|
|
||||||
-- -- If the user wants to try variations, add them
|
-- -- If the user wants to try variations, add them
|
||||||
-- if(try_variations) then
|
-- if(try_variations) then
|
||||||
-- -- Get a list of all variations for this directory
|
-- -- Get a list of all variations for this directory
|
||||||
-- local variations = get_variations(entry['checkdir'])
|
-- local variations = get_variations(entry['checkdir'])
|
||||||
|
|||||||
@@ -62,8 +62,8 @@ end
|
|||||||
action = function(host, port)
|
action = function(host, port)
|
||||||
|
|
||||||
-- read script specific arguments
|
-- read script specific arguments
|
||||||
local match = stdnse.get_script_args("http-grep.match")
|
local match = stdnse.get_script_args("http-grep.match")
|
||||||
local break_on_match = stdnse.get_script_args("http-grep.breakonmatch")
|
local break_on_match = stdnse.get_script_args("http-grep.breakonmatch")
|
||||||
|
|
||||||
if ( not(match) ) then
|
if ( not(match) ) then
|
||||||
return stdnse.format_output(true, "ERROR: Argument http-grep.match was not set")
|
return stdnse.format_output(true, "ERROR: Argument http-grep.match was not set")
|
||||||
|
|||||||
@@ -37,8 +37,8 @@ categories = {"brute", "intrusive", "external"}
|
|||||||
|
|
||||||
portrule = shortport.port_or_service({8123,3128,8000,8080},{'polipo','squid-http','http-proxy'})
|
portrule = shortport.port_or_service({8123,3128,8000,8080},{'polipo','squid-http','http-proxy'})
|
||||||
|
|
||||||
local arg_url = stdnse.get_script_args(SCRIPT_NAME .. '.url') or 'http://scanme.nmap.org/'
|
local arg_url = stdnse.get_script_args(SCRIPT_NAME .. '.url') or 'http://scanme.nmap.org/'
|
||||||
local arg_method = stdnse.get_script_args(SCRIPT_NAME .. '.method') or "HEAD"
|
local arg_method = stdnse.get_script_args(SCRIPT_NAME .. '.method') or "HEAD"
|
||||||
|
|
||||||
Driver = {
|
Driver = {
|
||||||
|
|
||||||
|
|||||||
@@ -151,7 +151,7 @@ so, it starves the http server's resources causing Denial Of Service.
|
|||||||
-- if second connection died 10 or more seconds after the first
|
-- if second connection died 10 or more seconds after the first
|
||||||
-- it means that sending additional data prolonged the connection's time
|
-- it means that sending additional data prolonged the connection's time
|
||||||
-- and the server is vulnerable to slowloris attack
|
-- and the server is vulnerable to slowloris attack
|
||||||
if diff >= 10 then
|
if diff >= 10 then
|
||||||
stdnse.print_debug("Difference is greater or equal to 10 seconds.")
|
stdnse.print_debug("Difference is greater or equal to 10 seconds.")
|
||||||
slowloris.state = vulns.STATE.VULN
|
slowloris.state = vulns.STATE.VULN
|
||||||
end
|
end
|
||||||
|
|||||||
@@ -101,7 +101,7 @@ local function set_parameters()
|
|||||||
end
|
end
|
||||||
|
|
||||||
local function do_half_http(host, port, obj)
|
local function do_half_http(host, port, obj)
|
||||||
local condvar = nmap.condvar(obj)
|
local condvar = nmap.condvar(obj)
|
||||||
|
|
||||||
if StopAll then
|
if StopAll then
|
||||||
condvar("signal")
|
condvar("signal")
|
||||||
|
|||||||
@@ -77,17 +77,17 @@ local function fake_xml_parse(str, tag)
|
|||||||
end
|
end
|
||||||
|
|
||||||
--local function parse_vmware_conf(str, field)
|
--local function parse_vmware_conf(str, field)
|
||||||
-- local index, value_start = string.find(str, field .. "[^\"]*")
|
-- local index, value_start = string.find(str, field .. "[^\"]*")
|
||||||
-- if(not(index) or not(value_start)) then
|
-- if(not(index) or not(value_start)) then
|
||||||
-- return nil
|
-- return nil
|
||||||
-- end
|
-- end
|
||||||
--
|
--
|
||||||
-- local value_end = string.find(str, "\"", value_start + 1)
|
-- local value_end = string.find(str, "\"", value_start + 1)
|
||||||
-- if(not(value_end)) then
|
-- if(not(value_end)) then
|
||||||
-- return nil
|
-- return nil
|
||||||
-- end
|
-- end
|
||||||
--
|
--
|
||||||
-- return string.sub(str, value_start + 1, value_end - 1)
|
-- return string.sub(str, value_start + 1, value_end - 1)
|
||||||
--end
|
--end
|
||||||
|
|
||||||
local function go(host, port)
|
local function go(host, port)
|
||||||
|
|||||||
@@ -36,9 +36,9 @@ Wordpress default uri and form names:
|
|||||||
-- @args http-wordpress-brute.hostname sets the host header in case of virtual
|
-- @args http-wordpress-brute.hostname sets the host header in case of virtual
|
||||||
-- hosting
|
-- hosting
|
||||||
-- @args http-wordpress-brute.uservar sets the http-variable name that holds the
|
-- @args http-wordpress-brute.uservar sets the http-variable name that holds the
|
||||||
-- username used to authenticate. Default: log
|
-- username used to authenticate. Default: log
|
||||||
-- @args http-wordpress-brute.passvar sets the http-variable name that holds the
|
-- @args http-wordpress-brute.passvar sets the http-variable name that holds the
|
||||||
-- password used to authenticate. Default: pwd
|
-- password used to authenticate. Default: pwd
|
||||||
-- @args http-wordpress-brute.threads sets the number of threads. Default: 3
|
-- @args http-wordpress-brute.threads sets the number of threads. Default: 3
|
||||||
--
|
--
|
||||||
-- Other useful arguments when using this script are:
|
-- Other useful arguments when using this script are:
|
||||||
|
|||||||
@@ -31,10 +31,10 @@ portrule = shortport.port_or_service(500, "isakmp", "udp")
|
|||||||
--
|
--
|
||||||
local function get_version(host, port)
|
local function get_version(host, port)
|
||||||
local packet, version, t
|
local packet, version, t
|
||||||
local auth = {"psk", "rsa", "Hybrid", "XAUTH"}
|
local auth = {"psk", "rsa", "Hybrid", "XAUTH"}
|
||||||
local encryption = {"des", "3des", "aes/128", "aes/192", "aes/256"}
|
local encryption = {"des", "3des", "aes/128", "aes/192", "aes/256"}
|
||||||
local hash = {"md5", "sha1"}
|
local hash = {"md5", "sha1"}
|
||||||
local group = {"768", "1024", "1536"}
|
local group = {"768", "1024", "1536"}
|
||||||
|
|
||||||
|
|
||||||
-- generate transforms
|
-- generate transforms
|
||||||
|
|||||||
@@ -25,7 +25,7 @@ Performs brute force password auditing against IMAP servers using either LOGIN,
|
|||||||
-- |_ Performed 62 guesses in 10 seconds, average tps: 6
|
-- |_ Performed 62 guesses in 10 seconds, average tps: 6
|
||||||
--
|
--
|
||||||
-- @args imap-brute.auth authentication mechanism to use LOGIN, PLAIN,
|
-- @args imap-brute.auth authentication mechanism to use LOGIN, PLAIN,
|
||||||
-- CRAM-MD5, DIGEST-MD5 or NTLM
|
-- CRAM-MD5, DIGEST-MD5 or NTLM
|
||||||
|
|
||||||
-- Version 0.1
|
-- Version 0.1
|
||||||
-- Created 07/15/2011 - v0.1 - created by Patrik Karlsson <patrik@cqure.net>
|
-- Created 07/15/2011 - v0.1 - created by Patrik Karlsson <patrik@cqure.net>
|
||||||
|
|||||||
@@ -77,10 +77,10 @@ action = function( host, port )
|
|||||||
end
|
end
|
||||||
|
|
||||||
status, data = helper:Login(user, pass, nil, db)
|
status, data = helper:Login(user, pass, nil, db)
|
||||||
if ( not(status) ) then return stdnse.format_output(status, data) end
|
if ( not(status) ) then return stdnse.format_output(status, data) end
|
||||||
|
|
||||||
status, data = helper:Query(query)
|
status, data = helper:Query(query)
|
||||||
if ( not(status) ) then return stdnse.format_output(status, data) end
|
if ( not(status) ) then return stdnse.format_output(status, data) end
|
||||||
|
|
||||||
for _, rs in ipairs(data) do
|
for _, rs in ipairs(data) do
|
||||||
table.insert( result, { "User: " .. user, "Database: " .. db, ( "Query: \"%s\"" ):format( rs.query ), name="Information" } )
|
table.insert( result, { "User: " .. user, "Database: " .. db, ( "Query: \"%s\"" ):format( rs.query ), name="Information" } )
|
||||||
|
|||||||
@@ -89,7 +89,7 @@ action = function( host, port )
|
|||||||
end
|
end
|
||||||
|
|
||||||
status, data = helper:Login(user, pass)
|
status, data = helper:Login(user, pass)
|
||||||
if ( not(status) ) then return stdnse.format_output(status, data) end
|
if ( not(status) ) then return stdnse.format_output(status, data) end
|
||||||
|
|
||||||
local databases
|
local databases
|
||||||
status, databases = helper:GetDatabases()
|
status, databases = helper:GetDatabases()
|
||||||
@@ -100,9 +100,9 @@ action = function( host, port )
|
|||||||
for _, db in ipairs(databases) do
|
for _, db in ipairs(databases) do
|
||||||
if ( not( excluded_dbs[db] ) ) then
|
if ( not( excluded_dbs[db] ) ) then
|
||||||
status, data = helper:OpenDatabase(db)
|
status, data = helper:OpenDatabase(db)
|
||||||
if ( not(status) ) then return stdnse.format_output(status, data) end
|
if ( not(status) ) then return stdnse.format_output(status, data) end
|
||||||
status, data = helper:Query( query )
|
status, data = helper:Query( query )
|
||||||
if ( not(status) ) then return stdnse.format_output(status, data) end
|
if ( not(status) ) then return stdnse.format_output(status, data) end
|
||||||
|
|
||||||
if ( status ) then
|
if ( status ) then
|
||||||
data = informix.Util.formatTable( data[1] )
|
data = informix.Util.formatTable( data[1] )
|
||||||
|
|||||||
@@ -22,7 +22,7 @@ accepts a shell command as its argument.
|
|||||||
---
|
---
|
||||||
-- @usage nmap -sT <target> -p <port> --script=+jdwp-exec --script-args cmd="date"
|
-- @usage nmap -sT <target> -p <port> --script=+jdwp-exec --script-args cmd="date"
|
||||||
--
|
--
|
||||||
-- @args jdwp-exec.cmd Command to execute on the remote system.
|
-- @args jdwp-exec.cmd Command to execute on the remote system.
|
||||||
--
|
--
|
||||||
-- @output
|
-- @output
|
||||||
-- PORT STATE SERVICE REASON
|
-- PORT STATE SERVICE REASON
|
||||||
@@ -81,7 +81,7 @@ action = function(host, port)
|
|||||||
stdnse.print_debug(1, "%s: Couldn't create string", SCRIPT_NAME)
|
stdnse.print_debug(1, "%s: Couldn't create string", SCRIPT_NAME)
|
||||||
return stdnse.format_output(false, cmdID)
|
return stdnse.format_output(false, cmdID)
|
||||||
end
|
end
|
||||||
local runArgs = bin.pack(">CL",0x4c,cmdID) -- 0x4c is object type tag
|
local runArgs = bin.pack(">CL",0x4c,cmdID) -- 0x4c is object type tag
|
||||||
-- invoke run method
|
-- invoke run method
|
||||||
local result
|
local result
|
||||||
status, result = jdwp.invokeObjectMethod(socket,0,injectedClass.instance,injectedClass.thread,injectedClass.id,runMethodID,1,runArgs)
|
status, result = jdwp.invokeObjectMethod(socket,0,injectedClass.instance,injectedClass.thread,injectedClass.id,runMethodID,1,runArgs)
|
||||||
|
|||||||
@@ -19,7 +19,7 @@ See nselib/data/jdwp-class/README for more.
|
|||||||
---
|
---
|
||||||
-- @usage nmap -sT <target> -p <port> --script=+jdwp-inject --script-args filename=HelloWorld.class
|
-- @usage nmap -sT <target> -p <port> --script=+jdwp-inject --script-args filename=HelloWorld.class
|
||||||
--
|
--
|
||||||
-- @args jdwp-inject.filename Java <code>.class</code> file to inject.
|
-- @args jdwp-inject.filename Java <code>.class</code> file to inject.
|
||||||
-- @output
|
-- @output
|
||||||
-- PORT STATE SERVICE REASON
|
-- PORT STATE SERVICE REASON
|
||||||
-- 2010/tcp open search syn-ack
|
-- 2010/tcp open search syn-ack
|
||||||
|
|||||||
@@ -76,9 +76,9 @@ KRB5 = {
|
|||||||
{ ['aes128-cts-hmac-sha1-96'] = 17 },
|
{ ['aes128-cts-hmac-sha1-96'] = 17 },
|
||||||
{ ['des3-cbc-sha1'] = 16 },
|
{ ['des3-cbc-sha1'] = 16 },
|
||||||
{ ['rc4-hmac'] = 23 },
|
{ ['rc4-hmac'] = 23 },
|
||||||
-- { ['des-cbc-crc'] = 1 },
|
-- { ['des-cbc-crc'] = 1 },
|
||||||
-- { ['des-cbc-md5'] = 3 },
|
-- { ['des-cbc-md5'] = 3 },
|
||||||
-- { ['des-cbc-md4'] = 2 }
|
-- { ['des-cbc-md4'] = 2 }
|
||||||
},
|
},
|
||||||
|
|
||||||
-- A list of principal name types
|
-- A list of principal name types
|
||||||
|
|||||||
@@ -29,9 +29,9 @@ administrative account.
|
|||||||
--
|
--
|
||||||
-- @usage
|
-- @usage
|
||||||
-- nmap -p 636 --script ldap-novell-getpass --script-args \
|
-- nmap -p 636 --script ldap-novell-getpass --script-args \
|
||||||
-- 'ldap-novell-getpass.username="CN=admin,O=cqure", \
|
-- 'ldap-novell-getpass.username="CN=admin,O=cqure", \
|
||||||
-- ldap-novell-getpass.password=pass1234, \
|
-- ldap-novell-getpass.password=pass1234, \
|
||||||
-- ldap-novell-getpass.account="CN=paka,OU=hr,O=cqure"'
|
-- ldap-novell-getpass.account="CN=paka,OU=hr,O=cqure"'
|
||||||
--
|
--
|
||||||
-- @output
|
-- @output
|
||||||
-- PORT STATE SERVICE REASON
|
-- PORT STATE SERVICE REASON
|
||||||
@@ -67,7 +67,7 @@ function action(host,port)
|
|||||||
-- do some basic account validation
|
-- do some basic account validation
|
||||||
if ( not(account:match("^[Cc][Nn]=.*,") ) ) then
|
if ( not(account:match("^[Cc][Nn]=.*,") ) ) then
|
||||||
return "\n ERROR: The account argument should be specified as:\n" ..
|
return "\n ERROR: The account argument should be specified as:\n" ..
|
||||||
" \"CN=name,OU=orgunit,O=org\""
|
" \"CN=name,OU=orgunit,O=org\""
|
||||||
end
|
end
|
||||||
end
|
end
|
||||||
|
|
||||||
@@ -106,7 +106,7 @@ function action(host,port)
|
|||||||
data = ldap.encode( { _ldaptype = '30', bin.pack("H", "020102") .. data } )
|
data = ldap.encode( { _ldaptype = '30', bin.pack("H", "020102") .. data } )
|
||||||
|
|
||||||
status = socket:send(data)
|
status = socket:send(data)
|
||||||
if ( not(status) ) then return "ERROR: Failed to send request" end
|
if ( not(status) ) then return "ERROR: Failed to send request" end
|
||||||
|
|
||||||
status, data = socket:receive()
|
status, data = socket:receive()
|
||||||
if ( not(status) ) then return data end
|
if ( not(status) ) then return data end
|
||||||
|
|||||||
@@ -53,7 +53,7 @@ be disabled using the <code>mssql.scanned-ports-only</code> script argument.
|
|||||||
|
|
||||||
-- Created 01/17/2010 - v0.1 - created by Patrik Karlsson <patrik@cqure.net>
|
-- Created 01/17/2010 - v0.1 - created by Patrik Karlsson <patrik@cqure.net>
|
||||||
-- Revised 02/01/2011 - v0.2 - Added ability to run against all instances on a host;
|
-- Revised 02/01/2011 - v0.2 - Added ability to run against all instances on a host;
|
||||||
-- added compatibility with changes in mssql.lua (Chris Woodbury)
|
-- added compatibility with changes in mssql.lua (Chris Woodbury)
|
||||||
|
|
||||||
author = "Patrik Karlsson"
|
author = "Patrik Karlsson"
|
||||||
license = "Same as Nmap--See http://nmap.org/book/man-legal.html"
|
license = "Same as Nmap--See http://nmap.org/book/man-legal.html"
|
||||||
|
|||||||
@@ -42,7 +42,7 @@ portrule = shortport.port_or_service(3306, "mysql")
|
|||||||
action = function( host, port )
|
action = function( host, port )
|
||||||
|
|
||||||
local socket = nmap.new_socket()
|
local socket = nmap.new_socket()
|
||||||
local catch = function() socket:close() end
|
local catch = function() socket:close() end
|
||||||
local try = nmap.new_try(catch)
|
local try = nmap.new_try(catch)
|
||||||
local result, response, dbs = {}, nil, {}
|
local result, response, dbs = {}, nil, {}
|
||||||
local users = {}
|
local users = {}
|
||||||
|
|||||||
@@ -45,7 +45,7 @@ portrule = shortport.port_or_service(3306, "mysql")
|
|||||||
action = function( host, port )
|
action = function( host, port )
|
||||||
|
|
||||||
local socket = nmap.new_socket()
|
local socket = nmap.new_socket()
|
||||||
local catch = function() socket:close() end
|
local catch = function() socket:close() end
|
||||||
local try = nmap.new_try(catch)
|
local try = nmap.new_try(catch)
|
||||||
local result, response = {}, nil
|
local result, response = {}, nil
|
||||||
local users = {}
|
local users = {}
|
||||||
|
|||||||
@@ -54,7 +54,7 @@ portrule = shortport.port_or_service(3306, "mysql")
|
|||||||
action = function( host, port )
|
action = function( host, port )
|
||||||
|
|
||||||
local socket = nmap.new_socket()
|
local socket = nmap.new_socket()
|
||||||
local catch = function() socket:close() end
|
local catch = function() socket:close() end
|
||||||
local try = nmap.new_try(catch)
|
local try = nmap.new_try(catch)
|
||||||
local result, response = {}, nil
|
local result, response = {}, nil
|
||||||
local users = {}
|
local users = {}
|
||||||
|
|||||||
@@ -38,10 +38,10 @@ action = function(host, port)
|
|||||||
local helper = ncp.Helper:new(host,port)
|
local helper = ncp.Helper:new(host,port)
|
||||||
|
|
||||||
local status, resp = helper:connect()
|
local status, resp = helper:connect()
|
||||||
if ( not(status) ) then return stdnse.format_output(false, resp) end
|
if ( not(status) ) then return stdnse.format_output(false, resp) end
|
||||||
|
|
||||||
status, resp = helper:search("[Root]", "User", "*")
|
status, resp = helper:search("[Root]", "User", "*")
|
||||||
if ( not(status) ) then return stdnse.format_output(false, resp) end
|
if ( not(status) ) then return stdnse.format_output(false, resp) end
|
||||||
|
|
||||||
local output = {}
|
local output = {}
|
||||||
|
|
||||||
|
|||||||
@@ -40,10 +40,10 @@ action = function(host, port)
|
|||||||
local helper = ncp.Helper:new(host,port)
|
local helper = ncp.Helper:new(host,port)
|
||||||
|
|
||||||
local status, resp = helper:connect()
|
local status, resp = helper:connect()
|
||||||
if ( not(status) ) then return stdnse.format_output(false, resp) end
|
if ( not(status) ) then return stdnse.format_output(false, resp) end
|
||||||
|
|
||||||
status, resp = helper:getServerInfo()
|
status, resp = helper:getServerInfo()
|
||||||
if ( not(status) ) then return stdnse.format_output(false, resp) end
|
if ( not(status) ) then return stdnse.format_output(false, resp) end
|
||||||
|
|
||||||
helper:close()
|
helper:close()
|
||||||
|
|
||||||
|
|||||||
@@ -49,7 +49,7 @@ action = function(host, port)
|
|||||||
|
|
||||||
local helper = ndmp.Helper:new(host, port)
|
local helper = ndmp.Helper:new(host, port)
|
||||||
local status, msg = helper:connect()
|
local status, msg = helper:connect()
|
||||||
if ( not(status) ) then return fail("Failed to connect to server") end
|
if ( not(status) ) then return fail("Failed to connect to server") end
|
||||||
|
|
||||||
status, msg = helper:getFsInfo()
|
status, msg = helper:getFsInfo()
|
||||||
if ( not(status) ) then return fail("Failed to get filesystem information from server") end
|
if ( not(status) ) then return fail("Failed to get filesystem information from server") end
|
||||||
|
|||||||
@@ -39,7 +39,7 @@ end
|
|||||||
action = function(host, port)
|
action = function(host, port)
|
||||||
local helper = ndmp.Helper:new(host, port)
|
local helper = ndmp.Helper:new(host, port)
|
||||||
local status, err = helper:connect()
|
local status, err = helper:connect()
|
||||||
if ( not(status) ) then return fail("Failed to connect to server") end
|
if ( not(status) ) then return fail("Failed to connect to server") end
|
||||||
|
|
||||||
local hi, si
|
local hi, si
|
||||||
status, hi = helper:getHostInfo()
|
status, hi = helper:getHostInfo()
|
||||||
|
|||||||
@@ -76,7 +76,7 @@ Driver =
|
|||||||
return o
|
return o
|
||||||
end,
|
end,
|
||||||
|
|
||||||
connect = function ( self ) return true end,
|
connect = function ( self ) return true end,
|
||||||
|
|
||||||
login = function( self, username, password )
|
login = function( self, username, password )
|
||||||
|
|
||||||
|
|||||||
@@ -46,7 +46,7 @@ Driver =
|
|||||||
return o
|
return o
|
||||||
end,
|
end,
|
||||||
|
|
||||||
connect = function ( self ) return true end,
|
connect = function ( self ) return true end,
|
||||||
|
|
||||||
login = function( self, username, password )
|
login = function( self, username, password )
|
||||||
local postdata='<?xml version="1.0" encoding="UTF-8"?><LoginRequest sync-id="1" user-id="'..username..'" password="'..password..'"></LoginRequest>'
|
local postdata='<?xml version="1.0" encoding="UTF-8"?><LoginRequest sync-id="1" user-id="'..username..'" password="'..password..'"></LoginRequest>'
|
||||||
|
|||||||
@@ -40,24 +40,24 @@ end
|
|||||||
|
|
||||||
action = function(host, port)
|
action = function(host, port)
|
||||||
|
|
||||||
local status --to be used to grab the existing status of the display screen before changing it.
|
local status --to be used to grab the existing status of the display screen before changing it.
|
||||||
local newstatus --used to repoll the printer after setting the display to check that the probe worked.
|
local newstatus --used to repoll the printer after setting the display to check that the probe worked.
|
||||||
local statusmsg --stores the PJL command to get the printer's status
|
local statusmsg --stores the PJL command to get the printer's status
|
||||||
local response --stores the response sent over the network from the printer by the PJL status command
|
local response --stores the response sent over the network from the printer by the PJL status command
|
||||||
|
|
||||||
statusmsg="@PJL INFO STATUS\n"
|
statusmsg="@PJL INFO STATUS\n"
|
||||||
|
|
||||||
local rdymsg="" --string containing text to send to the printer.
|
local rdymsg="" --string containing text to send to the printer.
|
||||||
local rdymsgarg="" --will contain the argument from the command line if one exists
|
local rdymsgarg="" --will contain the argument from the command line if one exists
|
||||||
|
|
||||||
local socket = nmap.new_socket()
|
local socket = nmap.new_socket()
|
||||||
socket:set_timeout(15000)
|
socket:set_timeout(15000)
|
||||||
local try = nmap.new_try(function() socket:close() end)
|
local try = nmap.new_try(function() socket:close() end)
|
||||||
try(socket:connect(host, port))
|
try(socket:connect(host, port))
|
||||||
try(socket:send(statusmsg)) --this block gets the current display status
|
try(socket:send(statusmsg)) --this block gets the current display status
|
||||||
local data
|
local data
|
||||||
response,data=socket:receive()
|
response,data=socket:receive()
|
||||||
if not response then --send an initial probe. If no response, send nothing further.
|
if not response then --send an initial probe. If no response, send nothing further.
|
||||||
socket:close()
|
socket:close()
|
||||||
if nmap.verbosity() > 0 then
|
if nmap.verbosity() > 0 then
|
||||||
return "No response from printer: "..data
|
return "No response from printer: "..data
|
||||||
@@ -85,9 +85,9 @@ action = function(host, port)
|
|||||||
end
|
end
|
||||||
|
|
||||||
rdymsg="@PJL RDYMSG DISPLAY = \""..rdymsgarg.."\"\r\n"
|
rdymsg="@PJL RDYMSG DISPLAY = \""..rdymsgarg.."\"\r\n"
|
||||||
try(socket:send(rdymsg)) --actually set the display message here.
|
try(socket:send(rdymsg)) --actually set the display message here.
|
||||||
|
|
||||||
try(socket:send(statusmsg)) --this block gets the status again for comparison
|
try(socket:send(statusmsg)) --this block gets the status again for comparison
|
||||||
response,data=socket:receive()
|
response,data=socket:receive()
|
||||||
if not response then
|
if not response then
|
||||||
socket:close()
|
socket:close()
|
||||||
|
|||||||
@@ -58,15 +58,15 @@ local filter = {
|
|||||||
|
|
||||||
["redis_version"] = { name = "Version", func = cb_parse_version },
|
["redis_version"] = { name = "Version", func = cb_parse_version },
|
||||||
["os"] = { name = "Operating System" },
|
["os"] = { name = "Operating System" },
|
||||||
["arch_bits"] = { name = "Architecture", func = cb_parse_architecture },
|
["arch_bits"] = { name = "Architecture", func = cb_parse_architecture },
|
||||||
["process_id"] = { name = "Process ID"},
|
["process_id"] = { name = "Process ID"},
|
||||||
["uptime"] = { name = "Uptime", func = function(h, p, v) return ("%s seconds"):format(v) end },
|
["uptime"] = { name = "Uptime", func = function(h, p, v) return ("%s seconds"):format(v) end },
|
||||||
["used_cpu_sys"]= { name = "Used CPU (sys)"},
|
["used_cpu_sys"]= { name = "Used CPU (sys)"},
|
||||||
["used_cpu_user"] = { name = "Used CPU (user)"},
|
["used_cpu_user"] = { name = "Used CPU (user)"},
|
||||||
["connected_clients"] = { name = "Connected clients"},
|
["connected_clients"] = { name = "Connected clients"},
|
||||||
["connected_slaves"] = { name = "Connected slaves"},
|
["connected_slaves"] = { name = "Connected slaves"},
|
||||||
["used_memory_human"] = { name = "Used memory"},
|
["used_memory_human"] = { name = "Used memory"},
|
||||||
["role"] = { name = "Role"}
|
["role"] = { name = "Role"}
|
||||||
|
|
||||||
}
|
}
|
||||||
|
|
||||||
|
|||||||
@@ -93,13 +93,13 @@ local filter = {
|
|||||||
local order = {
|
local order = {
|
||||||
"nodename", "sys_system_architecture", "storage_backend", "mem_total",
|
"nodename", "sys_system_architecture", "storage_backend", "mem_total",
|
||||||
"crypto_version", "skerl_version", "os_mon_version", "basho_stats_version",
|
"crypto_version", "skerl_version", "os_mon_version", "basho_stats_version",
|
||||||
"lager_version", "cluster_info_version", "luke_version", "sasl_version",
|
"lager_version", "cluster_info_version", "luke_version", "sasl_version",
|
||||||
"sys_driver_version", "bitcask_version", "riak_search_version",
|
"sys_driver_version", "bitcask_version", "riak_search_version",
|
||||||
"kernel_version", "stdlib_version", "basho_metrics_version",
|
"kernel_version", "stdlib_version", "basho_metrics_version",
|
||||||
"webmachine_version", "public_key_version", "riak_core_version",
|
"webmachine_version", "public_key_version", "riak_core_version",
|
||||||
"riak_pipe_version", "runtime_tools_version", "ssl_version",
|
"riak_pipe_version", "runtime_tools_version", "ssl_version",
|
||||||
"mochiweb_version", "erlang_js_version", "riak_kv_version",
|
"mochiweb_version", "erlang_js_version", "riak_kv_version",
|
||||||
"luwak_version", "merge_index_version", "inets_version", "riak_sysmon_version"
|
"luwak_version", "merge_index_version", "inets_version", "riak_sysmon_version"
|
||||||
}
|
}
|
||||||
|
|
||||||
|
|
||||||
|
|||||||
@@ -36,7 +36,7 @@ portrule = shortport.port_or_service(873, "rsync", "tcp")
|
|||||||
Driver = {
|
Driver = {
|
||||||
|
|
||||||
new = function(self, host, port, options)
|
new = function(self, host, port, options)
|
||||||
local o = { host = host, port = port, options = options }
|
local o = { host = host, port = port, options = options }
|
||||||
setmetatable(o, self)
|
setmetatable(o, self)
|
||||||
self.__index = self
|
self.__index = self
|
||||||
return o
|
return o
|
||||||
|
|||||||
@@ -148,17 +148,17 @@ action = function(host, port)
|
|||||||
table.insert(failure_urls, r.url)
|
table.insert(failure_urls, r.url)
|
||||||
elseif ( r.status == 200 ) then
|
elseif ( r.status == 200 ) then
|
||||||
table.insert(success_urls, r.url)
|
table.insert(success_urls, r.url)
|
||||||
-- elseif ( r.status == 401 ) then
|
-- elseif ( r.status == 401 ) then
|
||||||
-- table.insert(auth_urls, r.url )
|
-- table.insert(auth_urls, r.url )
|
||||||
end
|
end
|
||||||
end
|
end
|
||||||
|
|
||||||
local result = { success_urls, failure_urls }
|
local result = { success_urls, failure_urls }
|
||||||
|
|
||||||
-- -- insert our URLs requiring auth ONLY if not ALL urls returned auth
|
-- insert our URLs requiring auth ONLY if not ALL urls returned auth
|
||||||
-- if (#result > #auth_urls) then
|
--if (#result > #auth_urls) then
|
||||||
-- table.insert(result, 2, auth_urls)
|
-- table.insert(result, 2, auth_urls)
|
||||||
-- end
|
--end
|
||||||
|
|
||||||
return stdnse.format_output(true, result )
|
return stdnse.format_output(true, result )
|
||||||
end
|
end
|
||||||
|
|||||||
@@ -68,7 +68,7 @@ Driver = {
|
|||||||
return true, brute.Account:new(username, password, creds.State.VALID)
|
return true, brute.Account:new(username, password, creds.State.VALID)
|
||||||
end,
|
end,
|
||||||
|
|
||||||
disconnect = function(self) return self.helper:close() end,
|
disconnect = function(self) return self.helper:close() end,
|
||||||
}
|
}
|
||||||
|
|
||||||
-- Function used to check if we can distinguish existing from non-existing
|
-- Function used to check if we can distinguish existing from non-existing
|
||||||
|
|||||||
@@ -325,9 +325,9 @@ local function check_login(hostinfo, username, password, logintype)
|
|||||||
local status, err
|
local status, err
|
||||||
if(#password == 32 or #password == 64 or #password == 65) then
|
if(#password == 32 or #password == 64 or #password == 65) then
|
||||||
-- It's a hash (note: we always use NTLM hashes)
|
-- It's a hash (note: we always use NTLM hashes)
|
||||||
status, err = smb.start_session(smbstate, smb.get_overrides(username, domain, nil, password, "ntlm"), false)
|
status, err = smb.start_session(smbstate, smb.get_overrides(username, domain, nil, password, "ntlm"), false)
|
||||||
else
|
else
|
||||||
status, err = smb.start_session(smbstate, smb.get_overrides(username, domain, password, nil, logintype), false)
|
status, err = smb.start_session(smbstate, smb.get_overrides(username, domain, password, nil, logintype), false)
|
||||||
end
|
end
|
||||||
|
|
||||||
if(status == true) then
|
if(status == true) then
|
||||||
@@ -1080,7 +1080,7 @@ end
|
|||||||
|
|
||||||
--_G.TRACEBACK = TRACEBACK or {}
|
--_G.TRACEBACK = TRACEBACK or {}
|
||||||
action = function(host)
|
action = function(host)
|
||||||
-- TRACEBACK[coroutine.running()] = true;
|
-- TRACEBACK[coroutine.running()] = true;
|
||||||
|
|
||||||
local status, result
|
local status, result
|
||||||
local response = {}
|
local response = {}
|
||||||
|
|||||||
@@ -172,7 +172,7 @@ function check_ms08_067(host)
|
|||||||
end
|
end
|
||||||
|
|
||||||
-- Call netpathcanonicalize
|
-- Call netpathcanonicalize
|
||||||
-- status, netpathcanonicalize_result = msrpc.srvsvc_netpathcanonicalize(smbstate, host.ip, "\\a", "\\test\\")
|
-- status, netpathcanonicalize_result = msrpc.srvsvc_netpathcanonicalize(smbstate, host.ip, "\\a", "\\test\\")
|
||||||
|
|
||||||
local path1 = "\\AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\\..\\n"
|
local path1 = "\\AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\\..\\n"
|
||||||
local path2 = "\\n"
|
local path2 = "\\n"
|
||||||
@@ -435,12 +435,12 @@ end
|
|||||||
--its dependencies.
|
--its dependencies.
|
||||||
--@param host Host object.
|
--@param host Host object.
|
||||||
--@return (status, result)
|
--@return (status, result)
|
||||||
--* <code>status == false</code> -> <code>result == NOTUP</code> which designates
|
--* <code>status == false</code> -> <code>result == NOTUP</code> which designates
|
||||||
--that the targeted Ras RPC service is not active.
|
--that the targeted Ras RPC service is not active.
|
||||||
--* <code>status == true</code> ->
|
--* <code>status == true</code> ->
|
||||||
-- ** <code>result == VULNERABLE</code> for vulnerable.
|
-- ** <code>result == VULNERABLE</code> for vulnerable.
|
||||||
-- ** <code>result == PATCHED</code> for not vulnerable.
|
-- ** <code>result == PATCHED</code> for not vulnerable.
|
||||||
-- ** <code>result == NOTRUN</code> if check skipped.
|
-- ** <code>result == NOTRUN</code> if check skipped.
|
||||||
function check_ms06_025(host)
|
function check_ms06_025(host)
|
||||||
--check for safety flag
|
--check for safety flag
|
||||||
if(nmap.registry.args.safe ~= nil) then
|
if(nmap.registry.args.safe ~= nil) then
|
||||||
@@ -498,12 +498,12 @@ end
|
|||||||
--This check is not safe as it crashes the Dns Server RPC service its dependencies.
|
--This check is not safe as it crashes the Dns Server RPC service its dependencies.
|
||||||
--@param host Host object.
|
--@param host Host object.
|
||||||
--@return (status, result)
|
--@return (status, result)
|
||||||
--* <code>status == false</code> -> <code>result == NOTUP</code> which designates
|
--* <code>status == false</code> -> <code>result == NOTUP</code> which designates
|
||||||
--that the targeted Dns Server RPC service is not active.
|
--that the targeted Dns Server RPC service is not active.
|
||||||
--* <code>status == true</code> ->
|
--* <code>status == true</code> ->
|
||||||
-- ** <code>result == VULNERABLE</code> for vulnerable.
|
-- ** <code>result == VULNERABLE</code> for vulnerable.
|
||||||
-- ** <code>result == PATCHED</code> for not vulnerable.
|
-- ** <code>result == PATCHED</code> for not vulnerable.
|
||||||
-- ** <code>result == NOTRUN</code> if check skipped.
|
-- ** <code>result == NOTRUN</code> if check skipped.
|
||||||
function check_ms07_029(host)
|
function check_ms07_029(host)
|
||||||
--check for safety flag
|
--check for safety flag
|
||||||
if(nmap.registry.args.safe ~= nil) then
|
if(nmap.registry.args.safe ~= nil) then
|
||||||
|
|||||||
@@ -138,7 +138,7 @@ local function get_info_registry(host)
|
|||||||
result['status-processornamestring'..i], result['processornamestring' .. i] = reg_get_value(smbstate, openhklm_result['handle'], "HARDWARE\\DESCRIPTION\\System\\CentralProcessor\\" .. i, "ProcessorNameString")
|
result['status-processornamestring'..i], result['processornamestring' .. i] = reg_get_value(smbstate, openhklm_result['handle'], "HARDWARE\\DESCRIPTION\\System\\CentralProcessor\\" .. i, "ProcessorNameString")
|
||||||
result['status-vendoridentifier'..i], result['vendoridentifier' .. i] = reg_get_value(smbstate, openhklm_result['handle'], "HARDWARE\\DESCRIPTION\\System\\CentralProcessor\\" .. i, "VendorIdentifier")
|
result['status-vendoridentifier'..i], result['vendoridentifier' .. i] = reg_get_value(smbstate, openhklm_result['handle'], "HARDWARE\\DESCRIPTION\\System\\CentralProcessor\\" .. i, "VendorIdentifier")
|
||||||
end
|
end
|
||||||
-- status, result['physicalmemory'] = reg_get_value(smbstate, openhklm_result['handle'], "HARDWARE\\ResourceMap\\System Resources\\Physical Memory", ".Translated")
|
-- status, result['physicalmemory'] = reg_get_value(smbstate, openhklm_result['handle'], "HARDWARE\\ResourceMap\\System Resources\\Physical Memory", ".Translated")
|
||||||
|
|
||||||
-- TODO: Known DLLs?
|
-- TODO: Known DLLs?
|
||||||
|
|
||||||
|
|||||||
@@ -160,7 +160,7 @@ aka "Print Spooler Service Impersonation Vulnerability."
|
|||||||
local write_result = string.sub(result.data,25,#result.data-4)
|
local write_result = string.sub(result.data,25,#result.data-4)
|
||||||
stdnse.print_debug("Written %s bytes to a file.",stdnse.tohex(write_result))
|
stdnse.print_debug("Written %s bytes to a file.",stdnse.tohex(write_result))
|
||||||
if stdnse.tohex(write_result) == "00000000" then -- patched version would report 4 bytes written
|
if stdnse.tohex(write_result) == "00000000" then -- patched version would report 4 bytes written
|
||||||
ms10_061.state = vulns.STATE.VULN -- identified by diffing patched an unpatched version
|
ms10_061.state = vulns.STATE.VULN -- identified by diffing patched an unpatched version
|
||||||
end
|
end
|
||||||
-- call abort_printer to stop the actuall printing in case the remote system is not vulnerable
|
-- call abort_printer to stop the actuall printing in case the remote system is not vulnerable
|
||||||
-- we care about the environment and don't want to spend more paper then needed :)
|
-- we care about the environment and don't want to spend more paper then needed :)
|
||||||
|
|||||||
@@ -25,7 +25,7 @@ Performs brute force password auditing against SMTP servers using either LOGIN,
|
|||||||
-- |_ Performed 1160 guesses in 41 seconds, average tps: 33
|
-- |_ Performed 1160 guesses in 41 seconds, average tps: 33
|
||||||
--
|
--
|
||||||
-- @args smtp-brute.auth authentication mechanism to use LOGIN, PLAIN,
|
-- @args smtp-brute.auth authentication mechanism to use LOGIN, PLAIN,
|
||||||
-- CRAM-MD5, DIGEST-MD5 or NTLM
|
-- CRAM-MD5, DIGEST-MD5 or NTLM
|
||||||
|
|
||||||
-- Version 0.1
|
-- Version 0.1
|
||||||
-- Created 07/15/2011 - v0.1 - created by Patrik Karlsson <patrik@cqure.net>
|
-- Created 07/15/2011 - v0.1 - created by Patrik Karlsson <patrik@cqure.net>
|
||||||
|
|||||||
@@ -123,7 +123,7 @@ end
|
|||||||
action = function(host, port)
|
action = function(host, port)
|
||||||
|
|
||||||
local socket = nmap.new_socket()
|
local socket = nmap.new_socket()
|
||||||
local catch = function() socket:close() end
|
local catch = function() socket:close() end
|
||||||
local try = nmap.new_try(catch)
|
local try = nmap.new_try(catch)
|
||||||
local data, oldsnmpoid = nil, "1.3.6.1.4.1.2011.10.2.12.1.1.1"
|
local data, oldsnmpoid = nil, "1.3.6.1.4.1.2011.10.2.12.1.1.1"
|
||||||
local data, newsnmpoid = nil, "1.3.6.1.4.1.25506.2.12.1.1.1"
|
local data, newsnmpoid = nil, "1.3.6.1.4.1.25506.2.12.1.1.1"
|
||||||
|
|||||||
@@ -391,7 +391,7 @@ end
|
|||||||
action = function(host, port)
|
action = function(host, port)
|
||||||
|
|
||||||
local socket = nmap.new_socket()
|
local socket = nmap.new_socket()
|
||||||
local catch = function() socket:close() end
|
local catch = function() socket:close() end
|
||||||
local try = nmap.new_try(catch)
|
local try = nmap.new_try(catch)
|
||||||
-- IF-MIB - used to look up network interfaces
|
-- IF-MIB - used to look up network interfaces
|
||||||
local if_oid = "1.3.6.1.2.1.2.2.1"
|
local if_oid = "1.3.6.1.2.1.2.2.1"
|
||||||
|
|||||||
@@ -63,7 +63,7 @@ end
|
|||||||
|
|
||||||
local function format_output(tbl, prefix)
|
local function format_output(tbl, prefix)
|
||||||
local result = {}
|
local result = {}
|
||||||
for _, v in ipairs(tbl) do
|
for _, v in ipairs(tbl) do
|
||||||
local value = string.format("%-20s %s", v.left, v.right )
|
local value = string.format("%-20s %s", v.left, v.right )
|
||||||
table.insert( result, string.format( "%-4s %s", prefix, value ) )
|
table.insert( result, string.format( "%-4s %s", prefix, value ) )
|
||||||
end
|
end
|
||||||
@@ -102,7 +102,7 @@ end
|
|||||||
action = function(host, port)
|
action = function(host, port)
|
||||||
|
|
||||||
local socket = nmap.new_socket()
|
local socket = nmap.new_socket()
|
||||||
local catch = function() socket:close() end
|
local catch = function() socket:close() end
|
||||||
local try = nmap.new_try(catch)
|
local try = nmap.new_try(catch)
|
||||||
local tcp_oid = "1.3.6.1.2.1.6.13.1.1"
|
local tcp_oid = "1.3.6.1.2.1.6.13.1.1"
|
||||||
local udp_oid = "1.3.6.1.2.1.7.5.1.1"
|
local udp_oid = "1.3.6.1.2.1.7.5.1.1"
|
||||||
|
|||||||
@@ -113,7 +113,7 @@ end
|
|||||||
action = function(host, port)
|
action = function(host, port)
|
||||||
|
|
||||||
local socket = nmap.new_socket()
|
local socket = nmap.new_socket()
|
||||||
local catch = function() socket:close() end
|
local catch = function() socket:close() end
|
||||||
local try = nmap.new_try(catch)
|
local try = nmap.new_try(catch)
|
||||||
local data, snmpoid = nil, "1.3.6.1.2.1.25.4.2"
|
local data, snmpoid = nil, "1.3.6.1.2.1.25.4.2"
|
||||||
local shares = {}
|
local shares = {}
|
||||||
|
|||||||
@@ -60,7 +60,7 @@ end
|
|||||||
action = function(host, port)
|
action = function(host, port)
|
||||||
|
|
||||||
local socket = nmap.new_socket()
|
local socket = nmap.new_socket()
|
||||||
local catch = function() socket:close() end
|
local catch = function() socket:close() end
|
||||||
local try = nmap.new_try(catch)
|
local try = nmap.new_try(catch)
|
||||||
local snmpoid = "1.3.6.1.4.1.77.1.2.3.1.1"
|
local snmpoid = "1.3.6.1.4.1.77.1.2.3.1.1"
|
||||||
local services = {}
|
local services = {}
|
||||||
|
|||||||
@@ -79,7 +79,7 @@ end
|
|||||||
action = function(host, port)
|
action = function(host, port)
|
||||||
|
|
||||||
local socket = nmap.new_socket()
|
local socket = nmap.new_socket()
|
||||||
local catch = function() socket:close() end
|
local catch = function() socket:close() end
|
||||||
local try = nmap.new_try(catch)
|
local try = nmap.new_try(catch)
|
||||||
local data, snmpoid = nil, "1.3.6.1.4.1.77.1.2.27"
|
local data, snmpoid = nil, "1.3.6.1.4.1.77.1.2.27"
|
||||||
local shares = {}
|
local shares = {}
|
||||||
|
|||||||
@@ -84,7 +84,7 @@ end
|
|||||||
action = function(host, port)
|
action = function(host, port)
|
||||||
|
|
||||||
local socket = nmap.new_socket()
|
local socket = nmap.new_socket()
|
||||||
local catch = function() socket:close() end
|
local catch = function() socket:close() end
|
||||||
local try = nmap.new_try(catch)
|
local try = nmap.new_try(catch)
|
||||||
local data, snmpoid = nil, "1.3.6.1.2.1.25.6.3.1"
|
local data, snmpoid = nil, "1.3.6.1.2.1.25.6.3.1"
|
||||||
local sw = {}
|
local sw = {}
|
||||||
|
|||||||
@@ -56,7 +56,7 @@ end
|
|||||||
action = function(host, port)
|
action = function(host, port)
|
||||||
|
|
||||||
local socket = nmap.new_socket()
|
local socket = nmap.new_socket()
|
||||||
local catch = function() socket:close() end
|
local catch = function() socket:close() end
|
||||||
local try = nmap.new_try(catch)
|
local try = nmap.new_try(catch)
|
||||||
local snmpoid = "1.3.6.1.4.1.77.1.2.25"
|
local snmpoid = "1.3.6.1.4.1.77.1.2.25"
|
||||||
local users = {}
|
local users = {}
|
||||||
|
|||||||
@@ -102,11 +102,11 @@ end
|
|||||||
-- @return Verdict (true or false)
|
-- @return Verdict (true or false)
|
||||||
local is_login_success = function (str)
|
local is_login_success = function (str)
|
||||||
pcreptn.login_success = pcreptn.login_success
|
pcreptn.login_success = pcreptn.login_success
|
||||||
or pcre.new("[/>%$#]\\s*$" -- general prompt
|
or pcre.new("[/>%$#]\\s*$" -- general prompt
|
||||||
.. "|^Last login\\s*:" -- linux telnetd
|
.. "|^Last login\\s*:" -- linux telnetd
|
||||||
.. "|^(?-i:[A-Z]):\\\\" -- Windows telnet
|
.. "|^(?-i:[A-Z]):\\\\" -- Windows telnet
|
||||||
.. "|Main(?:\\s|\\x1B\\[\\d+;\\d+H)Menu\\b" -- Netgear RM356
|
.. "|Main(?:\\s|\\x1B\\[\\d+;\\d+H)Menu\\b" -- Netgear RM356
|
||||||
.. "|^Enter Terminal Emulation:\\s*$", -- Hummingbird telnetd
|
.. "|^Enter Terminal Emulation:\\s*$", -- Hummingbird telnetd
|
||||||
pcre.flags().CASELESS, "C")
|
pcre.flags().CASELESS, "C")
|
||||||
return pcreptn.login_success:match(str)
|
return pcreptn.login_success:match(str)
|
||||||
end
|
end
|
||||||
|
|||||||
@@ -49,13 +49,13 @@ action = function(host, port)
|
|||||||
local result = stdnse.output_table()
|
local result = stdnse.output_table()
|
||||||
|
|
||||||
status, data = vnc:connect()
|
status, data = vnc:connect()
|
||||||
if ( not(status) ) then return " \n ERROR: " .. data end
|
if ( not(status) ) then return " \n ERROR: " .. data end
|
||||||
|
|
||||||
status, data = vnc:handshake()
|
status, data = vnc:handshake()
|
||||||
if ( not(status) ) then return " \n ERROR: " .. data end
|
if ( not(status) ) then return " \n ERROR: " .. data end
|
||||||
|
|
||||||
status, data = vnc:getSecTypesAsTable()
|
status, data = vnc:getSecTypesAsTable()
|
||||||
if ( not(status) ) then return " \n ERROR: " .. data end
|
if ( not(status) ) then return " \n ERROR: " .. data end
|
||||||
|
|
||||||
result["Protocol version"] = vnc:getProtocolVersion()
|
result["Protocol version"] = vnc:getProtocolVersion()
|
||||||
|
|
||||||
|
|||||||
@@ -25,9 +25,10 @@ Performs brute force password auditing against XMPP (Jabber) instant messaging s
|
|||||||
-- |_ Performed 6237 guesses in 5 seconds, average tps: 1247
|
-- |_ Performed 6237 guesses in 5 seconds, average tps: 1247
|
||||||
--
|
--
|
||||||
-- @args xmpp-brute.auth authentication mechanism to use LOGIN, PLAIN, CRAM-MD5
|
-- @args xmpp-brute.auth authentication mechanism to use LOGIN, PLAIN, CRAM-MD5
|
||||||
-- or DIGEST-MD5
|
-- or DIGEST-MD5
|
||||||
-- @args xmpp-brute.servername needed when host name cannot be automatically
|
-- @args xmpp-brute.servername needed when host name cannot be automatically
|
||||||
-- determined (eg. when running against an IP, instead of hostname)
|
-- determined (eg. when running against an IP,
|
||||||
|
-- instead of hostname)
|
||||||
--
|
--
|
||||||
|
|
||||||
-- Version 0.1
|
-- Version 0.1
|
||||||
@@ -121,7 +122,7 @@ action = function(host, port)
|
|||||||
|
|
||||||
for _, mp in ipairs(mech_prio) do
|
for _, mp in ipairs(mech_prio) do
|
||||||
for m, _ in pairs(mechs) do
|
for m, _ in pairs(mechs) do
|
||||||
if ( mp == m ) then mech = m; break end
|
if ( mp == m ) then mech = m; break end
|
||||||
end
|
end
|
||||||
if ( mech ) then break end
|
if ( mech ) then break end
|
||||||
end
|
end
|
||||||
|
|||||||
Reference in New Issue
Block a user