mirror of
https://github.com/nmap/nmap.git
synced 2025-12-09 22:21:29 +00:00
Merged in my changes from nmap-smb. The primary changes are:
* Updated the way authentication works on smb -- it's significantly cleaner now * smb-enum-shares.nse gives significantly better output now (it checks if shares are writable) * Added a script that checks if smbv2 is enabled on a server * Added smb-psexec, a script for executing commands on a remote Windows server. I also included some default scripts, a compiled .exe to run everything, and a ton of documentation (in the form of NSEDoc) * Added 'override' parameters to some of the functions in smb.lua, which lets the programmer override any field in an outgoing SMB packet without modifying smb.lua. * Lots of random code cleanups in the smb-* scripts/libraries
This commit is contained in:
@@ -27,7 +27,12 @@ author = "Ron Bowes"
|
||||
license = "Same as Nmap--See http://nmap.org/book/man-legal.html"
|
||||
categories = {"discovery", "safe"}
|
||||
|
||||
-- Set the runlevel to above 1 to ensure this runs after the bulk of the scripts. That lets us more effectively
|
||||
-- find out which account we've been using.
|
||||
runlevel = 1.01
|
||||
|
||||
require 'smb'
|
||||
require 'stdnse'
|
||||
|
||||
-- Check whether or not this script should be run.
|
||||
hostrule = function(host)
|
||||
@@ -39,6 +44,7 @@ action = function(host)
|
||||
|
||||
local state
|
||||
local status, err
|
||||
local overrides = {}
|
||||
|
||||
status, state = smb.start(host)
|
||||
if(status == false) then
|
||||
@@ -49,7 +55,7 @@ action = function(host)
|
||||
end
|
||||
end
|
||||
|
||||
status, err = smb.negotiate_protocol(state)
|
||||
status, err = smb.negotiate_protocol(state, overrides)
|
||||
|
||||
if(status == false) then
|
||||
smb.stop(state)
|
||||
@@ -63,6 +69,11 @@ action = function(host)
|
||||
local security_mode = state['security_mode']
|
||||
|
||||
local response = ""
|
||||
|
||||
local result, username, domain = smb.get_account(host)
|
||||
if(result ~= false) then
|
||||
response = string.format("Account that was used for smb scripts: %s\%s\n", domain, stdnse.string_or_blank(username, '<blank>'))
|
||||
end
|
||||
|
||||
-- User-level authentication or share-level authentication
|
||||
if(bit.band(security_mode, 1) == 1) then
|
||||
|
||||
Reference in New Issue
Block a user