1
0
mirror of https://github.com/nmap/nmap.git synced 2025-12-06 12:41:29 +00:00

Merged -r13793:HEAD from nmap-exp/dev/nmap branch now that we're opening up trunk development

again.  Here are the items which were merged:

------------------------------------------------------------------------
r13971 | jah | 2009-06-29 14:30:27 -0700 (Mon, 29 Jun 2009) | 2 lines

Improved a pattern for matching HTTP status-line, tidy away some variables and
fix a typo.
------------------------------------------------------------------------
r13967 | daniel | 2009-06-29 13:47:04 -0700 (Mon, 29 Jun 2009) | 5 lines

o Added a convenience top-level BSD makefile redirecting BSD make
  to GNU make on BSD systems.  This should help prevent bogus
  error reports when users run "make" instead of "gmake" on BSD
  systems. [Daniel Roethlisberger]

------------------------------------------------------------------------
r13965 | batrick | 2009-06-29 06:50:11 -0700 (Mon, 29 Jun 2009) | 14 lines

[NSE] The NSE Nsock Library binding no longer relies on garbage collection to
monitor the use of socket "slots". A thread (script) attempting to connect must
first obtain one of a limited number of available socket locks (usually 10 or
--max-parallelism). The binding would use garbage collection of sockets to
determine when a thread has finished using its allocated sockets. This is
unfortunately slow and requires us to constantly run the garbage collector to
cause timely reallocation. I have changed the binding to now regularly inspect
allocated sockets in the nsock_loop function. Available sockets slots are now
immediately reallocated and done with far less execution time.

See [1] for benchmarks and further explanation.

[1] http://seclists.org/nmap-dev/2009/q2/0624.html

------------------------------------------------------------------------
r13964 | batrick | 2009-06-29 06:37:49 -0700 (Mon, 29 Jun 2009) | 10 lines

[NSE] Fixed a rare (and usually undetectable) bug that can cause a SEGFAULT.
The NSE nsock library binding may attempt to push values on the stack of
a thread that ended due to an error. It is possible that the internal
Lua stack was completely full and any further pushed values would result
in a segmentation memory violation.

This bug is very hard to reproduce with a SEGFAULT but is usually visible
when Lua assertion checks are turned on. A socket handler routine must be
called AFTER a thread has ended in error.

------------------------------------------------------------------------
r13963 | batrick | 2009-06-29 05:51:20 -0700 (Mon, 29 Jun 2009) | 3 lines

Fixed some global scoped variables to be local. This caused a many scripts to
overwrite each others' sockets, options, etc.

------------------------------------------------------------------------
r13939 | joao | 2009-06-27 16:07:35 -0700 (Sat, 27 Jun 2009) | 2 lines

Fixed port rule to include ssl pop3 port, now that pop3.lua supports SSL connections in function capabilities

------------------------------------------------------------------------
r13938 | joao | 2009-06-27 16:06:28 -0700 (Sat, 27 Jun 2009) | 2 lines

Added transparent SSL support using comm.tryssl

------------------------------------------------------------------------
r13937 | joao | 2009-06-27 16:05:19 -0700 (Sat, 27 Jun 2009) | 2 lines

Added transparent SSL support using comm.tryssl

------------------------------------------------------------------------
r13936 | joao | 2009-06-27 16:03:50 -0700 (Sat, 27 Jun 2009) | 2 lines

Added SSL transparent support using comm.tryssl

------------------------------------------------------------------------
r13935 | joao | 2009-06-27 16:02:39 -0700 (Sat, 27 Jun 2009) | 2 lines

Added SSL transparent support using comm.tryssl

------------------------------------------------------------------------
r13934 | joao | 2009-06-27 16:01:38 -0700 (Sat, 27 Jun 2009) | 2 lines

Added SSL transparent support using comm.tryssl

------------------------------------------------------------------------
r13933 | joao | 2009-06-27 16:00:27 -0700 (Sat, 27 Jun 2009) | 2 lines

SSL transparent support using comm.tryssl

------------------------------------------------------------------------
r13932 | joao | 2009-06-27 15:19:58 -0700 (Sat, 27 Jun 2009) | 2 lines

Included transparent ssl support to function pop3.capabilities using comm.tryssl

------------------------------------------------------------------------
r13931 | joao | 2009-06-27 15:19:06 -0700 (Sat, 27 Jun 2009) | 3 lines

New version of comm.lua with function tryssl, that transparently adds support to ssl connections


------------------------------------------------------------------------
r13930 | joao | 2009-06-27 14:50:38 -0700 (Sat, 27 Jun 2009) | 6 lines

Fixed buffering problem exposed by david on nmap-dev list.
The problem was solved using a buffer to receive the data, making the script work fine in cases where the ssh packets are fragmented.

A very similar solution was applied to ssh1.lua.


------------------------------------------------------------------------
r13928 | batrick | 2009-06-27 04:43:12 -0700 (Sat, 27 Jun 2009) | 18 lines

[NSE] We now propogate a NSE initiated yield on a script through all user
coroutines so that NSE may resume control. Previously, scripts that would yield
in a child coroutine (e.g. a script's child coroutine generated by Lua's
coroutine.create function) would give control back to the script. A script
would yield in this way by making a blocking socket operation. NSE would be
unable to correctly resume child coroutine when the socket operation is
finished processing.

By yielding the chain of coroutines a script has operating, we allow to NSE to
handle the socket operation properly. NSE would then resume the entire chain so
execution may correctly resume at the coroutine which initiated the socket
operation. This restores the "illusion" that a script executes without
interruption.

See [1] for more information, further explanation, and some use cases.

[1] http://seclists.org/nmap-dev/2009/q2/0586.html

------------------------------------------------------------------------
r13817 | david | 2009-06-18 15:57:29 -0700 (Thu, 18 Jun 2009) | 3 lines

Improve an OS fingerprint with a model number and broader matching.
Based on a follow-up report from a submitter.

------------------------------------------------------------------------
r13814 | josh | 2009-06-17 21:34:15 -0700 (Wed, 17 Jun 2009) | 3 lines

[zenmap] Added support to zenmap for the new SCTP options: -PY, -sY and -sZ


------------------------------------------------------------------------
r13797 | ron | 2009-06-17 11:02:18 -0700 (Wed, 17 Jun 2009) | 1 line

Applied a patch from Mak Kolibabi that enhances the output of smb-enum-processes. The output is now modeled after the output of the 'ps' tool for higher verbosity levels.
------------------------------------------------------------------------
r13795 | david | 2009-06-17 09:05:21 -0700 (Wed, 17 Jun 2009) | 6 lines

The configure script now allows cross-compiling by assuming that
libpcap is recent enough. Previously it would quit because a test
program could not be run. libpcap will always be recent enough when
the included copy is used. The patch was contributed by Mike
Frysinger.
This commit is contained in:
fyodor
2009-06-29 23:48:19 +00:00
parent 5016893ab8
commit 9ca4041ec1
24 changed files with 730 additions and 433 deletions

View File

@@ -1,19 +1,19 @@
description = [[
Pulls a list of processes from the remote server over SMB. This will determine
all running processes, their process IDs, and their parent processes. It is done
by querying the remote registry service, which is disabled by default on Vista; on
all other Windows versions, it requires Administrator privilges.
by querying the remote registry service, which is disabled by default on Vista;
on all other Windows versions, it requires Administrator privileges.
Since this requires administrator privileges, it isn't especially useful for a
Since this requires administrator privileges, it isn't especially useful for a
penetration tester, since they can effectively do the same thing with metasploit
or other tools. It does, however, provide for a quick way to get process lists
for a bunch of systems at the same time.
or other tools. It does, however, provide for a quick way to get process lists
for a bunch of systems at the same time.
WARNING: I have experienced crashes in regsvc.exe while making registry calls
against a fully patched Windows 2000 system; I've fixed the issue that caused it,
but there's no guarantee that it (or a similar vuln in the same code) won't show
up again. Since the process automatically restarts, it doesn't negatively impact
the system, besides showing a message box to the user.
WARNING: I have experienced crashes in regsvc.exe while making registry calls
against a fully patched Windows 2000 system; I've fixed the issue that caused
it, but there's no guarantee that it (or a similar vuln in the same code) won't
show up again. Since the process automatically restarts, it doesn't negatively
impact the system, besides showing a message box to the user.
]]
---
@@ -24,167 +24,174 @@ the system, besides showing a message box to the user.
---
-- @output
-- Host script results:
-- | smb-enum-processes:
-- | -+-Idle(0)---System(8)---SMSS(140)-+-WINLOGON(160)-+-SERVICES(212)-+-spoolsv(432)
-- | | | | +-mstask(536)
-- | | | | +-WinMgmt(592)
-- | | | | +-svchost(620)
-- | | | | `-regsvc(1136)
-- | | | `-LSASS(224)
-- | | `-CSRSS(164)
-- | +-Unknown(296)---explorer(344)-+-firefox(636)---WinRAR(736)
-- | | +-keyfinder(848)
-- | | `-CMD(956)
-- | +-Unknown(400)---IEXPLORE(1036)
-- |_ `-Unknown(840)---DRWTSN32(1192)
--
-- | smb-enum-processes:
-- |_ Idle, System, smss, csrss, winlogon, services, logon.scr, lsass, spoolsv, msdtc, VMwareService, svchost, alg, explorer, VMwareTray, VMwareUser, wmiprvse
--
-- --
-- Host script results:
-- | smb-enum-processes:
-- | Idle [0] (parent: 0, priority: 0, threads: 1, handles: 0)
-- | System [8] (parent: 0, priority: 8, threads: 34, handles: 190)
-- | smss [140] (parent: 8, priority: 11, threads: 6, handles: 33)
-- | winlogon [160] (parent: 140, priority: 13, threads: 14, handles: 335)
-- | csrss [164] (parent: 140, priority: 13, threads: 10, handles: 229)
-- | services [212] (parent: 160, priority: 9, threads: 33, handles: 462)
-- | lsass [224] (parent: 160, priority: 9, threads: 13, handles: 267)
-- | SPOOLSV [412] (parent: 212, priority: 8, threads: 10, handles: 95)
-- | svchost [448] (parent: 212, priority: 8, threads: 24, handles: 369)
-- | mstask [516] (parent: 212, priority: 8, threads: 6, handles: 89)
-- | VMwareService.e [572] (parent: 212, priority: 13, threads: 4, handles: 95)
-- | winmgmt [648] (parent: 212, priority: 8, threads: 3, handles: 89)
-- | cmd [700] (parent: 212, priority: 8, threads: 1, handles: 28)
-- | explorer [720] (parent: 620, priority: 8, threads: 10, handles: 239)
-- | VMwareUser [748] (parent: 720, priority: 8, threads: 1, handles: 30)
-- | VMwareTray [764] (parent: 720, priority: 8, threads: 1, handles: 30)
-- |_ regsvc [868] (parent: 212, priority: 8, threads: 4, handles: 76)
-- | smb-enum-processes:
-- | `+-Idle
-- | | `-System
-- | | `-smss
-- | | `+-csrss
-- | | `-winlogon
-- | | `+-services
-- | | | `+-spoolsv
-- | | | +-msdtc
-- | | | +-VMwareService
-- | | | +-svchost
-- | | | `-alg
-- | | +-logon.scr
-- | | `-lsass
-- | +-explorer
-- | | `+-VMwareTray
-- | | `-VMwareUser
-- |_ `-wmiprvse
--
-- --
-- Host script results:
-- | smb-enum-processes:
-- | PID PPID Priority Threads Handles
-- | ----- ----- -------- ------- -------
-- | 0 0 0 1 0 `+-Idle
-- | 4 0 8 49 395 | `-System
-- | 252 4 11 3 19 | `-smss
-- | 300 252 13 10 338 | `+-csrss
-- | 324 252 13 18 513 | `-winlogon
-- | 372 324 9 16 272 | `+-services
-- | 872 372 8 12 121 | | `+-spoolsv
-- | 896 372 8 13 151 | | +-msdtc
-- | 1172 372 13 3 53 | | +-VMwareService
-- | 1336 372 8 20 158 | | +-svchost
-- | 1476 372 8 6 90 | | `-alg
-- | 376 324 4 1 22 | +-logon.scr
-- | 384 324 9 23 394 | `-lsass
-- | 1720 1684 8 9 259 +-explorer
-- | 1796 1720 8 1 42 | `+-VMwareTray
-- | 1808 1720 8 1 44 | `-VMwareUser
-- |_ 1992 580 8 7 179 `-wmiprvse
-----------------------------------------------------------------------
author = "Ron Bowes"
copyright = "Ron Bowes"
license = "Same as Nmap--See http://nmap.org/book/man-legal.html"
categories = {"discovery","intrusive"}
categories = {"discovery", "intrusive"}
require "bin"
require 'msrpc'
require 'msrpcperformance'
require 'smb'
require 'stdnse'
-- Strings used to separate processes from one another.
local separators = {
first = "-+-";
last = " `-";
middle = " +-";
only = "---";
}
function psl_add (psl, ps)
-- Add process.
psl[ps.pid] = ps
-- Add dummy parent if no real one exists.
if psl[ps.ppid] == nil then
psl[ps.ppid] = {
name = 'Unknown';
pid = ps.ppid;
ppid = ps.ppid;
}
end
end
require "msrpc"
require "msrpcperformance"
require "smb"
require "stdnse"
function psl_mode (list, i)
local mode
-- Decide connector for process.
if table.maxn(list) == 1 then
if #list == 1 then
mode = "only"
elseif i == 1 then
mode = "first"
elseif i == table.maxn(list) then
mode = "last"
else
elseif i < #list then
mode = "middle"
else
mode = "last"
end
return mode
end
function psl_print (psl)
function psl_print (psl, lvl)
-- Print out table header.
local result = ""
if lvl == 2 then
result = result .. " PID PPID Priority Threads Handles\n"
result = result .. "----- ----- -------- ------- -------\n"
end
-- Find how many root processes there are.
local roots = {}
for i,ps in pairs(psl) do
for i, ps in pairs(psl) do
if psl[ps.ppid] == nil or ps.ppid == ps.pid then
table.insert(roots, i)
end
end
table.sort(roots)
-- Create vertical sibling link.
-- Create vertical sibling bars.
local bars = {}
if table.maxn(roots) ~= 1 then
if #roots ~= 1 then
table.insert(bars, 2)
end
-- Print out each root of the tree.
for i,root in ipairs(roots) do
for i, root in ipairs(roots) do
local mode = psl_mode(roots, i)
result = result .. psl_tree(psl, root, 0, bars, mode)
result = result .. psl_tree(psl, root, 0, bars, mode, lvl)
end
return result
end
function psl_tree (psl, pid, column, bars, mode)
function psl_tree (psl, pid, column, bars, mode, lvl)
local ps = psl[pid]
-- Delete vertical sibling link.
if mode == 'last' then
if mode == "last" then
table.remove(bars)
end
-- Print lead-in.
local prefix = ''
if mode == 'middle' or mode == 'last' then
prefix = '\n'
-- Print information table.
local info = ""
if lvl == 2 then
info = info .. string.format("% 5d ", ps.pid)
info = info .. string.format("% 5d ", ps.ppid)
info = info .. string.format("% 8d ", ps.prio)
info = info .. string.format("% 7d ", ps.thrd)
info = info .. string.format("% 7d ", ps.hndl)
end
local i = 1
for j = 1, column do
if table.maxn(bars) >= i and
bars[i] == j then
prefix = prefix .. '|'
i = i + 1
else
prefix = prefix .. ' '
end
-- Print vertical sibling bars.
local prefix = ""
local i = 1
for j = 1, column do
if bars[i] == j then
prefix = prefix .. "|"
i = i + 1
else
prefix = prefix .. " "
end
end
-- Format process itself.
output = separators[mode] .. ps.name .. '(' .. ps.pid .. ')'
column = column + #output
local result = prefix .. output
-- Strings used to separate processes from one another.
local separators = {
first = "`+-";
last = " `-";
middle = " +-";
only = "`-";
}
-- Find process' children.
-- Format process itself.
local result = "\n" .. info .. prefix .. separators[mode] .. ps.name
-- Find children of the process.
local children = {}
for child_pid,child in pairs(psl) do
for child_pid, child in pairs(psl) do
if child_pid ~= pid and child.ppid == pid then
table.insert(children, child_pid)
end
end
table.sort(children)
-- Create vertical sibling link between children.
if table.maxn(children) > 1 then
-- Add vertical sibling link between children.
column = column + #separators[mode]
if #children > 1 then
table.insert(bars, column + 2)
end
-- Format process' children.
for i,pid in ipairs(children) do
-- Format process's children.
for i, pid in ipairs(children) do
local mode = psl_mode(children, i)
result = result .. psl_tree(psl, pid, column, bars, mode)
result = result .. psl_tree(psl, pid, column, bars, mode, lvl)
end
return result
@@ -195,15 +202,12 @@ hostrule = function(host)
end
action = function(host)
local status, result
local process
local response = " \n"
local process, response, result, status
-- Get the process list
status, result = msrpcperformance.get_performance_data(host, "230")
if(status == false) then
if(nmap.debugging() > 0) then
if status == false then
if nmap.debugging() > 0 then
return "ERROR: " .. result
else
return nil
@@ -211,61 +215,76 @@ action = function(host)
end
-- Get the process table
process = result['Process']
process = result["Process"]
-- for i, v in pairs(result['Processor']['_Total']) do
-- io.write(string.format("i = %s\n", i))
-- end
-- Put the processes into an array, and sort them by process id
-- Put the processes into an array, and sort them by pid.
local names = {}
for i, v in pairs(process) do
if(i ~= '_Total') then
if i ~= "_Total" then
names[#names + 1] = i
end
end
table.sort(names, function (a, b) return process[a]['ID Process'] < process[b]['ID Process'] end)
table.sort(names, function (a, b) return process[a]["ID Process"] < process[b]["ID Process"] end)
-- Put the processes into an array indexed by process id and with a value equal to the name (so we can look it up
-- easily when we need to)
-- Put the processes into an array indexed by pid and with a value equal
-- to the name (so we can look it up easily when we need to).
local process_id = {}
for i, v in pairs(process) do
process_id[v['ID Process']] = i
process_id[v["ID Process"]] = i
end
if(nmap.verbosity() == 1) then
local psl = {}
for i,name in ipairs(names) do
if(name ~= '_Total') then
psl_add(psl, {
name = name;
pid = process[name]['ID Process'];
ppid = process[name]['Creating Process ID'];
})
end
-- Fill the process list table.
--
-- Used fields:
-- Creating Process ID
-- Handle Count
-- ID Process
-- Priority Base
-- Thread Count
--
-- Unused fields:
-- % Privileged Time
-- % Processor Time
-- % User Time
-- Elapsed Time
-- IO Data Bytes/sec
-- IO Data Operations/sec
-- IO Other Bytes/sec
-- IO Other Operations/sec
-- IO Read Bytes/sec
-- IO Read Operations/sec
-- IO Write Bytes/sec
-- IO Write Operations/sec
-- Page Faults/sec
-- Page File Bytes
-- Page File Bytes Peak
-- Pool Nonpaged Bytes
-- Pool Paged Bytes
-- Private Bytes
-- Virtual Bytes
-- Virtual Bytes Peak
-- Working Set
-- Working Set Peak
local psl = {}
for i, name in ipairs(names) do
if name ~= "_Total" then
psl[process[name]["ID Process"]] = {
name = name;
pid = process[name]["ID Process"];
ppid = process[name]["Creating Process ID"];
prio = process[name]["Priority Base"];
thrd = process[name]["Thread Count"];
hndl = process[name]["Handle Count"];
}
end
response = ' \n' .. psl_print(psl)
elseif(nmap.verbosity() > 1) then
for i = 1, #names, 1 do
local name = names[i]
if(name ~= '_Total') then
local parent = process_id[process[name]['Creating Process ID']]
if(parent == nil) then
parent = "n/a"
end
end
-- response = response .. string.format("%6d %24s (Parent: %24s, Priority: %4d, Threads: %4d, Handles: %4d)\n", process[name]['ID Process'], name, parent, process[name]['Priority Base'], process[name]['Thread Count'], process[name]['Handle Count'])
response = response .. string.format("%s [%d] (parent: %s, priority: %s, threads: %s, handles: %s)\n", name, process[name]['ID Process'], process[name]['Creating Process ID'], process[name]['Priority Base'], process[name]['Thread Count'], process[name]['Handle Count'])
end
end
else
-- Produce final output.
if nmap.verbosity() == 0 then
response = stdnse.strjoin(", ", names)
else
response = " \n" .. psl_print(psl, nmap.verbosity())
end
return response
end