Add script nbns-interfaces. Closes #2201

CHANGELOG

@@ -25,6 +25,9 @@ o Nmap no longer considers an ICMP Host Unreachable as confirmation that a
 o [NSE][GH#711] New script openflow-info gathers preferred and supported
   protocol versions from OpenFlow devices [Jay Smith, Mak Kolybabi]
 
+o [NSE][GH#2201] New script nbns-interfaces queries NetBIOS name service (NBNS)
+  to gather IP addresses of the target's network interfaces [Andrey Zhukov]
+
 o New UDP payloads:
   + [GH#1279] TS3INIT1 for UDP 3389 [colcrunch]
   + [GH#1895] DTLS for UDP 3391 (RD Gateway) [Arnim Rupp]

nselib/netbios.lua

@@ -445,12 +445,12 @@ function nbquery(host, nbname, options)
         return false, "ERROR: Response contained no answers"
       end
       local dname = string.char(#resp.output.answers[1].dname) .. resp.output.answers[1].dname
-      table.insert( results, { peer = resp.peer, name = name_decode(dname) } )
+      table.insert( results, { peer = resp.peer, name = name_decode(dname), data = resp.output.answers[1].data } )
     end
     return true, results
   else
     local dname = string.char(#response.answers[1].dname) .. response.answers[1].dname
-    return true, { { peer = host.ip, name = name_decode(dname) } }
+    return true, { { peer = host.ip, name = name_decode(dname), data = response.answers[1].data } }
   end
 end
 

scripts/nbns-interfaces.nse

@@ -0,0 +1,69 @@
+local shortport = require "shortport"
+local netbios = require "netbios"
+local nmap = require "nmap"
+local stdnse = require "stdnse"
+local string = require "string"
+local table = require "table"
+
+description = [[
+Retrieves IP addresses of the target's network interfaces via NetBIOS NS.
+Additional network interfaces may reveal more information about the target,
+including finding paths to hidden non-routed networks via multihomed systems.
+]]
+
+---
+-- @usage
+-- nmap -sU -p 137 --script nbns-interfaces <host>
+--
+-- @output
+-- PORT    STATE SERVICE
+-- 137/udp open  netbios-ns
+-- | nbns-interfaces:
+-- |   hostname: NOTEBOOK-NB3
+-- |   interfaces:
+-- |     10.5.4.89
+-- |     192.168.56.1
+-- |_    172.24.80.1
+-- MAC Address: 9C:7B:EF:AA:BB:CC (Hewlett Packard)
+--
+-- @xmloutput
+-- <elem key="hostname">NOTEBOOK-NB3</elem>
+-- <table key="interfaces">
+--   <elem>10.5.4.89</elem>
+--   <elem>192.168.56.1</elem>
+--   <elem>172.24.80.1</elem>
+-- </table>
+---
+
+author = {"Andrey Zhukov from USSC"}
+license = "Same as Nmap--See https://nmap.org/book/man-legal.html"
+
+categories = {"default", "discovery", "safe"}
+
+portrule = nmap.address_family() == 'inet' -- NBNS is IPv4 only
+           and shortport.portnumber(137, "udp")
+           or function () return false end
+
+get_ip = function (buf)
+  return table.concat({buf:byte(1, 4)}, ".")
+end
+
+action = function (host)
+  local output = stdnse.output_table()
+  local status, server_name = netbios.get_server_name(host)
+  if not (status and server_name) then
+    return stdnse.format_output(false, "Failed to get NetBIOS server name of the target")
+  end
+  local status, result = netbios.nbquery(host, server_name)
+  if not status then
+    return stdnse.format_output(false, "Failed to get remote network interfaces")
+  end
+  output.hostname = server_name
+  output.interfaces = {}
+  for _, v in ipairs(result) do
+    for i=1, #v.data, 6 do
+      output.interfaces[#output.interfaces + 1] = get_ip(v.data:sub(i+2, i+2+3))
+    end
+  end
+  return output
+end

scripts/script.db

@@ -389,6 +389,7 @@ Entry { filename = "ndmp-fs-info.nse", categories = { "discovery", "safe", } }
 Entry { filename = "ndmp-version.nse", categories = { "version", } }
 Entry { filename = "nessus-brute.nse", categories = { "brute", "intrusive", } }
 Entry { filename = "nessus-xmlrpc-brute.nse", categories = { "brute", "intrusive", } }
+Entry { filename = "nbns-interfaces.nse", categories = { "default", "discovery", "safe", } }
 Entry { filename = "netbus-auth-bypass.nse", categories = { "auth", "safe", "vuln", } }
 Entry { filename = "netbus-brute.nse", categories = { "brute", "intrusive", } }
 Entry { filename = "netbus-info.nse", categories = { "default", "discovery", "safe", } }