mirror of
https://github.com/nmap/nmap.git
synced 2025-12-07 21:21:31 +00:00
Be more strict about NetBus protocol. Fixes false positives
Had a report via service fingerprint correction of netbus-version reporting an unrelated service as NetBuster. This would happen for any service on port 12345 that responds with a banner containing less than 2 carriage returns, or which closes the connection after the first NetBus protocol message. Now, all netbus-* scripts require the banner to begin with "NetBus" before they will continue.
This commit is contained in:
@@ -37,7 +37,11 @@ action = function( host, port )
|
|||||||
return
|
return
|
||||||
end
|
end
|
||||||
local buffer, _ = stdnse.make_buffer(socket, "\r")
|
local buffer, _ = stdnse.make_buffer(socket, "\r")
|
||||||
buffer() --discard banner
|
_ = buffer()
|
||||||
|
if not (_ and _:match("^NetBus")) then
|
||||||
|
stdnse.debug1("Not NetBus")
|
||||||
|
return nil
|
||||||
|
end
|
||||||
|
|
||||||
-- The first argument of Password is the super-login bit.
|
-- The first argument of Password is the super-login bit.
|
||||||
-- On vulnerable servers any password will do as long as
|
-- On vulnerable servers any password will do as long as
|
||||||
|
|||||||
@@ -35,6 +35,10 @@ action = function( host, port )
|
|||||||
end
|
end
|
||||||
local buffer, err = stdnse.make_buffer(socket, "\r")
|
local buffer, err = stdnse.make_buffer(socket, "\r")
|
||||||
local _ = buffer() --skip the banner
|
local _ = buffer() --skip the banner
|
||||||
|
if not (_ and _:match("^NetBus")) then
|
||||||
|
stdnse.debug1("Not NetBus")
|
||||||
|
return nil
|
||||||
|
end
|
||||||
for password in passwords do
|
for password in passwords do
|
||||||
local foo = string.format("Password;0;%s\r", password)
|
local foo = string.format("Password;0;%s\r", password)
|
||||||
socket:send(foo)
|
socket:send(foo)
|
||||||
|
|||||||
@@ -164,6 +164,10 @@ action = function( host, port )
|
|||||||
local status, err = socket:connect(host.ip, port.number)
|
local status, err = socket:connect(host.ip, port.number)
|
||||||
local buffer, err = stdnse.make_buffer(socket, "\r")
|
local buffer, err = stdnse.make_buffer(socket, "\r")
|
||||||
local _ = buffer()
|
local _ = buffer()
|
||||||
|
if not (_ and _:match("^NetBus")) then
|
||||||
|
stdnse.debug1("Not NetBus")
|
||||||
|
return nil
|
||||||
|
end
|
||||||
socket:send(string.format("Password;1;%s\r", password))
|
socket:send(string.format("Password;1;%s\r", password))
|
||||||
local gotin = buffer()
|
local gotin = buffer()
|
||||||
if gotin == "Access;0" then
|
if gotin == "Access;0" then
|
||||||
|
|||||||
@@ -30,7 +30,11 @@ action = function( host, port )
|
|||||||
return
|
return
|
||||||
end
|
end
|
||||||
local buffer, _ = stdnse.make_buffer(socket, "\r")
|
local buffer, _ = stdnse.make_buffer(socket, "\r")
|
||||||
buffer() --discard banner
|
_ = buffer()
|
||||||
|
if not (_ and _:match("^NetBus")) then
|
||||||
|
stdnse.debug1("Not NetBus")
|
||||||
|
return nil
|
||||||
|
end
|
||||||
socket:send("Password;0;\r")
|
socket:send("Password;0;\r")
|
||||||
|
|
||||||
--NetBus answers to auth
|
--NetBus answers to auth
|
||||||
|
|||||||
Reference in New Issue
Block a user