diff --git a/scripts/smb-enum-shares.nse b/scripts/smb-enum-shares.nse index 00a7c8608..1ea84c0cc 100644 --- a/scripts/smb-enum-shares.nse +++ b/scripts/smb-enum-shares.nse @@ -34,29 +34,62 @@ for shares that require a user account. -- --@output -- Host script results: --- | smb-enum-shares: --- | | ADMIN$ --- | | | Type: STYPE_DISKTREE_HIDDEN --- | | | Comment: Remote Admin --- | | | Users: 0, Max: --- | | | Path: C:\WINNT --- | | | Anonymous access: --- | | |_ Current user ('administrator') access: READ/WRITE --- | | C$ --- | | | Type: STYPE_DISKTREE_HIDDEN --- | | | Comment: Default share --- | | | Users: 0, Max: --- | | | Path: C:\ --- | | | Anonymous access: --- | | |_ Current user ('administrator') access: READ --- | | IPC$ --- | | | Type: STYPE_IPC_HIDDEN --- | | | Comment: Remote IPC --- | | | Users: 1, Max: --- | | | Path: --- | | | Anonymous access: READ --- |_ |_ |_ Current user ('administrator') access: READ ------------------------------------------------------------------------ +-- | smb-enum-shares: +-- | account_used: WORKGROUP\Administrator +-- | ADMIN$ +-- | Type: STYPE_DISKTREE_HIDDEN +-- | Comment: Remote Admin +-- | Users: 0 +-- | Max Users: +-- | Path: C:\WINNT +-- | Anonymous access: +-- | Current user access: READ/WRITE +-- | C$ +-- | Type: STYPE_DISKTREE_HIDDEN +-- | Comment: Default share +-- | Users: 0 +-- | Max Users: +-- | Path: C:\ +-- | Anonymous access: +-- | Current user access: READ +-- | IPC$ +-- | Type: STYPE_IPC_HIDDEN +-- | Comment: Remote IPC +-- | Users: 1 +-- | Max Users: +-- | Path: +-- | Anonymous access: READ +-- |_ Current user access: READ +-- +-- @xmloutput +-- WORKGROUP\Administrator +-- +-- STYPE_DISKTREE_HIDDEN +-- Remote Admin +-- 0 +-- +-- C:\WINNT +-- +-- READ/WRITE +--
+-- +-- STYPE_DISKTREE_HIDDEN +-- Default share +-- 0 +-- +-- C:\ +-- +-- READ +--
+-- +-- STYPE_IPC_HIDDEN +-- Remote IPC +-- 1 +-- +-- +-- READ +-- READ +--
author = "Ron Bowes" copyright = "Ron Bowes" @@ -71,7 +104,7 @@ end action = function(host) local status, shares, extra - local response = {} + local response = stdnse.output_table() -- Get the list of shares status, shares, extra = smb.share_get_list(host) @@ -79,79 +112,67 @@ action = function(host) return stdnse.format_output(false, string.format("Couldn't enumerate shares: %s", shares)) end + if(extra ~= nil and extra ~= '') then + response.note = extra + end + -- Find out who the current user is local result, username, domain = smb.get_account(host) if(result == false) then username = "" domain = "" end - - if(extra ~= nil and extra ~= '') then - table.insert(response, extra) + if domain and domain ~= "" then + domain = domain .. "\\" end + response.account_used = string.format("%s%s", domain, stdnse.string_or_blank(username, '')) for i = 1, #shares, 1 do local share = shares[i] - local share_output = {} - share_output['name'] = share['name'] + local share_output = stdnse.output_table() if(type(share['details']) ~= 'table') then share_output['warning'] = string.format("Couldn't get details for share: %s", share['details']) + -- A share of 'NT_STATUS_OBJECT_NAME_NOT_FOUND' indicates this isn't a fileshare + if(share['user_can_write'] == "NT_STATUS_OBJECT_NAME_NOT_FOUND") then + share_output["Type"] = "Not a file share" + end else local details = share['details'] - table.insert(share_output, string.format("Type: %s", details['sharetype'])) - table.insert(share_output, string.format("Comment: %s", details['comment'])) - table.insert(share_output, string.format("Users: %s, Max: %s", details['current_users'], details['max_users'])) - table.insert(share_output, string.format("Path: %s", details['path'])) + share_output["Type"] = details.sharetype + share_output["Comment"] = details.comment + share_output["Users"] = details.current_users + share_output["Max Users"] = details.max_users + share_output["Path"] = details.path end - - - -- A share of 'NT_STATUS_OBJECT_NAME_NOT_FOUND' indicates this isn't a fileshare - if(share['user_can_write'] == "NT_STATUS_OBJECT_NAME_NOT_FOUND") then - -- Print details for a non-file share - if(share['anonymous_can_read']) then - table.insert(share_output, "Anonymous access: READ ") - else - table.insert(share_output, "Anonymous access: ") - end - - -- Don't bother printing this if we're already anonymous - if(username ~= '') then - if(share['user_can_read']) then - table.insert(share_output, "Current user ('" .. username .. "') access: READ ") - else - table.insert(share_output, "Current user ('" .. username .. "') access: ") - end - end + -- Print details for a file share + if(share['anonymous_can_read'] and share['anonymous_can_write']) then + share_output["Anonymous access"] = "READ/WRITE" + elseif(share['anonymous_can_read'] and not(share['anonymous_can_write'])) then + share_output["Anonymous access"] = "READ" + elseif(not(share['anonymous_can_read']) and share['anonymous_can_write']) then + share_output["Anonymous access"] = "WRITE" else - -- Print details for a file share - if(share['anonymous_can_read'] and share['anonymous_can_write']) then - table.insert(share_output, "Anonymous access: READ/WRITE") - elseif(share['anonymous_can_read'] and not(share['anonymous_can_write'])) then - table.insert(share_output, "Anonymous access: READ") - elseif(not(share['anonymous_can_read']) and share['anonymous_can_write']) then - table.insert(share_output, "Anonymous access: WRITE") - else - table.insert(share_output, "Anonymous access: ") - end + share_output["Anonymous access"] = "" + end - if(username ~= '') then - if(share['user_can_read'] and share['user_can_write']) then - table.insert(share_output, "Current user ('" .. username .. "') access: READ/WRITE") - elseif(share['user_can_read'] and not(share['user_can_write'])) then - table.insert(share_output, "Current user ('" .. username .. "') access: READ") - elseif(not(share['user_can_read']) and share['user_can_write']) then - table.insert(share_output, "Current user ('" .. username .. "') access: WRITE") - else - table.insert(share_output, "Current user ('" .. username .. "') access: ") - end + -- Don't bother printing this if we're already anonymous + if(username ~= '') then + if(share['user_can_read'] and share['user_can_write']) then + share_output["Current user access"] = "READ/WRITE" + elseif(share['user_can_read'] and not(share['user_can_write'])) then + share_output["Current user access"] = "READ" + elseif(not(share['user_can_read']) and share['user_can_write']) then + share_output["Current user access"] = "WRITE" + else + share_output["Current user access"] = "" end end - table.insert(response, share_output) + response[share.name] = share_output end - return stdnse.format_output(true, response) + return response end