mirror of
https://github.com/nmap/nmap.git
synced 2025-12-20 22:49:01 +00:00
Whitespace in ike.lua.
This commit is contained in:
david
130
nselib/ike.lua
130
nselib/ike.lua
@@ -15,14 +15,14 @@ The current funcionality includes:
|
||||
1. Generating a Main or Aggressive Mode IKE request packet with a variable amount of transforms and a vpn group.
|
||||
2. Sending a packet
|
||||
3. Receiving the response
|
||||
4. Parsing the response for VIDs
|
||||
5. Searching for the VIDs in 'ike-fingerprints.lua'
|
||||
6. returning a parsed info table
|
||||
4. Parsing the response for VIDs
|
||||
5. Searching for the VIDs in 'ike-fingerprints.lua'
|
||||
6. returning a parsed info table
|
||||
|
||||
This library is meant for extension, which could include:
|
||||
1. complete parsing of the response packet (might allow for better fingerprinting)
|
||||
2. adding more options to the request packet
|
||||
vendor field (might give better fingerprinting of services, e.g. Checkpoint)
|
||||
1. complete parsing of the response packet (might allow for better fingerprinting)
|
||||
2. adding more options to the request packet
|
||||
vendor field (might give better fingerprinting of services, e.g. Checkpoint)
|
||||
3. backoff pattern analyses
|
||||
...
|
||||
|
||||
@@ -36,28 +36,47 @@ author = "Jesper Kueckelhahn"
|
||||
license = "Same as Nmap--See http://nmap.org/book/man-legal.html"
|
||||
categories = {"discovery", "safe"}
|
||||
|
||||
local enc_methods = {
|
||||
["des"] = 0x80010001,
|
||||
["3des"] = 0x80010005,
|
||||
["aes/128"]= { 0x80010007, 0x800E0080 },
|
||||
["aes/192"]= { 0x80010007, 0x800E00C0 },
|
||||
["aes/256"]= { 0x80010007, 0x800E0100 }
|
||||
local enc_methods = {
|
||||
["des"] = 0x80010001,
|
||||
["3des"] = 0x80010005,
|
||||
["aes/128"] = { 0x80010007, 0x800E0080 },
|
||||
["aes/192"] = { 0x80010007, 0x800E00C0 },
|
||||
["aes/256"] = { 0x80010007, 0x800E0100 },
|
||||
}
|
||||
|
||||
local authentication= {
|
||||
["psk"] = 0x80030001,
|
||||
["rsa"] = 0x80030003,
|
||||
["Hybrid"] = 0x8003FADD,
|
||||
["XAUTH"] = 0x8003FDE9,
|
||||
}
|
||||
|
||||
local authentication= { ["psk"] = 0x80030001, ["rsa"] = 0x80030003, ["Hybrid"] = 0x8003FADD, ["XAUTH"] = 0x8003FDE9}
|
||||
local hash_algo = {
|
||||
["md5"] = 0x80020001,
|
||||
["sha1"] = 0x80020002,
|
||||
}
|
||||
|
||||
local hash_algo = { ["md5"] = 0x80020001, ["sha1"] = 0x80020002}
|
||||
local group_desc = { ["768"] = 0x80040001, ["1024"] = 0x80040002, ["1536"]= 0x80040005}
|
||||
local exchange_mode = { ["Main"] = 0x02, ["Aggressive"]= 0x04}
|
||||
local protocol_ids = { ["tcp"] = "06", ["udp"]= "11"}
|
||||
local group_desc = {
|
||||
["768"] = 0x80040001,
|
||||
["1024"] = 0x80040002,
|
||||
["1536"] = 0x80040005,
|
||||
}
|
||||
|
||||
local exchange_mode = {
|
||||
["Main"] = 0x02,
|
||||
["Aggressive"] = 0x04,
|
||||
}
|
||||
|
||||
local protocol_ids = {
|
||||
["tcp"] = "06",
|
||||
["udp"] = "11",
|
||||
}
|
||||
|
||||
-- Response packet types
|
||||
local response_exchange_type = {
|
||||
["02"] = "Main",
|
||||
["04"] = "Aggressive",
|
||||
["05"] = "Informational"
|
||||
["05"] = "Informational",
|
||||
}
|
||||
|
||||
-- Payload names
|
||||
@@ -69,7 +88,7 @@ local payloads = {
|
||||
["05"] = "ID",
|
||||
["08"] = "Hash",
|
||||
["0A"] = "Nonce",
|
||||
["0D"] = "VID"
|
||||
["0D"] = "VID",
|
||||
}
|
||||
|
||||
|
||||
@@ -125,7 +144,6 @@ end
|
||||
--
|
||||
local function convert_to_hex(id)
|
||||
local hex_str = ""
|
||||
|
||||
for c in string.gmatch(id, ".") do
|
||||
hex_str = hex_str .. string.format("%X", c:byte())
|
||||
end
|
||||
@@ -140,8 +158,8 @@ local function extract_payloads(packet)
|
||||
if packet:len() < 61 then return {} end
|
||||
|
||||
local np = packet:sub(33,34) -- next payload
|
||||
local index = 61 -- starting point for search
|
||||
local ike_headers = {} -- ike headers
|
||||
local index = 61 -- starting point for search
|
||||
local ike_headers = {} -- ike headers
|
||||
local payload = ''
|
||||
|
||||
-- loop over packet
|
||||
@@ -217,7 +235,6 @@ local function lookup(vendor_ids)
|
||||
|
||||
-- Only store the first match
|
||||
if info.vendor == nil then
|
||||
|
||||
-- the fingerprint contains information about the VID
|
||||
info.vendor = row
|
||||
|
||||
@@ -379,25 +396,24 @@ local function generate_aggressive(port, protocol, id, diffie)
|
||||
key_length = 128
|
||||
end
|
||||
|
||||
|
||||
return bin.pack(">SHHSSHSHCHHH",
|
||||
-- Key Exchange
|
||||
0x0a00 , -- Next payload (Nonce)
|
||||
0x0a00 , -- Next payload (Nonce)
|
||||
string.format("%04X", key_length+4) , -- Length (132-bit)
|
||||
generate_random(key_length) , -- Random key data
|
||||
generate_random(key_length) , -- Random key data
|
||||
|
||||
-- Nonce
|
||||
0x0500 , -- Next payload (Identification)
|
||||
0x0018 , -- Length (24)
|
||||
generate_random(20) , -- Nonce data
|
||||
0x0500 , -- Next payload (Identification)
|
||||
0x0018 , -- Length (24)
|
||||
generate_random(20) , -- Nonce data
|
||||
|
||||
-- Identification
|
||||
0x0000 , -- Next Payload (None)
|
||||
id_len , -- Payload length (id + 8)
|
||||
0x03 , -- ID Type (USER_FQDN)
|
||||
hex_prot , -- Protocol ID (UDP)
|
||||
hex_port , -- Port (500)
|
||||
convert_to_hex(id) -- Id Data (as hex)
|
||||
0x0000 , -- Next Payload (None)
|
||||
id_len , -- Payload length (id + 8)
|
||||
0x03 , -- ID Type (USER_FQDN)
|
||||
hex_prot , -- Protocol ID (UDP)
|
||||
hex_port , -- Port (500)
|
||||
convert_to_hex(id) -- Id Data (as hex)
|
||||
)
|
||||
end
|
||||
|
||||
@@ -435,12 +451,12 @@ local function generate_transform(auth, encryption, hash, group, number, total)
|
||||
next_payload , -- Next payload
|
||||
trans_length , -- Transform length
|
||||
payload_number , -- Transform number
|
||||
0x01 , -- Transform ID (IKE)
|
||||
0x0000 , -- spacers ?
|
||||
enc , -- Encryption algorithm
|
||||
0x01 , -- Transform ID (IKE)
|
||||
0x0000 , -- spacers ?
|
||||
enc , -- Encryption algorithm
|
||||
hash_algo[hash] , -- Hash algorithm
|
||||
authentication[auth], -- Authentication method
|
||||
group_desc[group] -- Group Description
|
||||
authentication[auth] , -- Authentication method
|
||||
group_desc[group] -- Group Description
|
||||
)
|
||||
|
||||
if key_length ~= nil then
|
||||
@@ -448,8 +464,8 @@ local function generate_transform(auth, encryption, hash, group, number, total)
|
||||
end
|
||||
|
||||
trans = trans .. bin.pack(">IL",
|
||||
0x800b0001 , -- Life type (seconds)
|
||||
0x000c000400007080 -- Life duration (28800)
|
||||
0x800b0001 , -- Life type (seconds)
|
||||
0x000c000400007080 -- Life duration (28800)
|
||||
)
|
||||
|
||||
return trans
|
||||
@@ -457,7 +473,7 @@ end
|
||||
|
||||
|
||||
-- Generate multiple transforms
|
||||
-- Input nust be a table of complete transforms
|
||||
-- Input nust be a table of complete transforms
|
||||
--
|
||||
local function generate_transforms(transform_table)
|
||||
local transforms = ''
|
||||
@@ -500,26 +516,26 @@ function request(port, proto, mode, transforms, diffie, id)
|
||||
local packet = bin.pack(">HLCCCCIHSHIISHCCCH",
|
||||
generate_random(8) , -- Initiator cookie
|
||||
0x0000000000000000 , -- Responder cookie
|
||||
0x01 , -- Next payload (SA)
|
||||
0x10 , -- Version
|
||||
0x01 , -- Next payload (SA)
|
||||
0x10 , -- Version
|
||||
exchange_mode[mode] , -- Exchange type
|
||||
0x00 , -- Flags
|
||||
0x00000000 , -- Message id
|
||||
l , -- packet length
|
||||
0x00 , -- Flags
|
||||
0x00000000 , -- Message id
|
||||
l , -- packet length
|
||||
|
||||
|
||||
--# Security Association
|
||||
-- Security Association
|
||||
payload_after_sa , -- Next payload (Key exchange, if aggressive mode)
|
||||
l_sa , -- Length
|
||||
0x00000001 , -- IPSEC
|
||||
0x00000001 , -- Situation
|
||||
l_sa , -- Length
|
||||
0x00000001 , -- IPSEC
|
||||
0x00000001 , -- Situation
|
||||
|
||||
--## Proposal
|
||||
0x0000 , -- Next payload (None)
|
||||
l_pro , -- Payload length
|
||||
0x01 , -- Proposal number
|
||||
0x01 , -- Protocol ID (ISAKMP)
|
||||
0x00 , -- SPI Size
|
||||
0x0000 , -- Next payload (None)
|
||||
l_pro , -- Payload length
|
||||
0x01 , -- Proposal number
|
||||
0x01 , -- Protocol ID (ISAKMP)
|
||||
0x00 , -- SPI Size
|
||||
number_transforms -- Proposal transforms
|
||||
)
|
||||
|
||||
|
||||
Reference in New Issue
Block a user