diff --git a/scripts/script.db b/scripts/script.db index 1a76d4fe8..57d41f223 100644 --- a/scripts/script.db +++ b/scripts/script.db @@ -450,6 +450,7 @@ Entry { filename = "vnc-info.nse", categories = { "default", "discovery", "safe" Entry { filename = "voldemort-info.nse", categories = { "discovery", "safe", } } Entry { filename = "vuze-dht-info.nse", categories = { "discovery", "safe", } } Entry { filename = "wdb-version.nse", categories = { "default", "discovery", "version", "vuln", } } +Entry { filename = "weblogic-t3-info.nse", categories = { "default", "discovery", "safe", "version", } } Entry { filename = "whois-domain.nse", categories = { "discovery", "external", "safe", } } Entry { filename = "whois-ip.nse", categories = { "discovery", "external", "safe", } } Entry { filename = "wsdd-discover.nse", categories = { "default", "discovery", "safe", } } diff --git a/scripts/weblogic-t3-info.nse b/scripts/weblogic-t3-info.nse new file mode 100644 index 000000000..8f8cf774d --- /dev/null +++ b/scripts/weblogic-t3-info.nse @@ -0,0 +1,75 @@ +local comm = require "comm" +local string = require "string" +local shortport = require "shortport" +local nmap = require "nmap" + +description = "Detect the T3 RMI protocol and Weblogic version" +author = "Alessandro ZANNI and Daniel Miller" +license = "Same as Nmap--See http://nmap.org/book/man-legal.html" +categories = {"default","safe","discovery","version"} + +portrule = function(host, port) + if type(port.version) == "table" and port.version.name_confidence > 3 and port.version.product ~= nil then + return string.find(port.version.product, "WebLogic", 1, true) + end + return shortport.version_port_or_service({7001,7002,7003},"http")(host,port) +end + +action = function(host, port) + local status, result = comm.exchange(host, port, + "t3 12.1.2\nAS:2048\nHL:19\n\n", + {proto=port.protocol, timeout=5000}) + + if (not status) then + return nil + end + + local weblogic_version = string.match(result, "^HELO:(%d+%.%d+%.%d+%.%d+)%.") + + local rval = nil + port.version = port.version or {} + local extrainfo = port.version.extrainfo + if extrainfo == nil then + extrainfo = "" + else + extrainfo = extrainfo .. "; " + end + if weblogic_version then + port.version.version = weblogic_version + port.version.extrainfo = extrainfo .. "T3 enabled" + rval = "T3 protocol in use (WebLogic version: " .. weblogic_version .. ")" + elseif string.match(result, "^LGIN:") then + port.version.extrainfo = extrainfo .. "T3 enabled" + rval = "T3 protocol in use (handshake failed)" + elseif string.match(result, "^SERV:") then + port.version.extrainfo = extrainfo .. "T3 enabled" + rval = "T3 protocol in use (No such service)" + elseif string.match(result, "^UNAV:") then + port.version.extrainfo = extrainfo .. "T3 enabled" + rval = "T3 protocol in use (Service unavailable)" + elseif string.match(result, "^LICN:") then + port.version.extrainfo = extrainfo .. "T3 enabled" + rval = "T3 protocol in use (No license)" + elseif string.match(result, "^RESC:") then + port.version.extrainfo = extrainfo .. "T3 enabled" + rval = "T3 protocol in use (No resource)" + elseif string.match(result, "^VERS:") then + port.version.extrainfo = extrainfo .. "T3 enabled" + rval = "T3 protocol in use (Incompatible version)" + elseif string.match(result, "^CATA:") then + port.version.extrainfo = extrainfo .. "T3 enabled" + rval = "T3 protocol in use (Catastrophic failure)" + elseif string.match(result, "^CMND:") then + port.version.extrainfo = extrainfo .. "T3 enabled" + rval = "T3 protocol in use (No such command)" + end + + if rval then + if port.version.product == nil then + port.version.product = "WebLogic application server" + end + nmap.set_port_version(host, port, "hardmatched") + end + + return rval +end