mirror of
https://github.com/nmap/nmap.git
synced 2025-12-09 22:21:29 +00:00
Move service fingerprint unwrapping code from scripts to lpeg-utility
This commit is contained in:
@@ -4,7 +4,6 @@ local table = require "table"
|
||||
local shortport = require "shortport"
|
||||
local nmap = require "nmap"
|
||||
local stdnse = require "stdnse"
|
||||
local lpeg = require "lpeg"
|
||||
local U = require "lpeg-utility"
|
||||
|
||||
description = [[
|
||||
@@ -37,43 +36,15 @@ portrule = function(host, port)
|
||||
return (shortport.http(host,port) and nmap.version_intensity() >= 7)
|
||||
end
|
||||
|
||||
-- Cache the returned pattern
|
||||
local getquote = U.escaped_quote()
|
||||
|
||||
-- Substitution pattern to unescape a string
|
||||
local unescape = lpeg.P {
|
||||
-- Substitute captures
|
||||
lpeg.Cs((lpeg.V "simple_char" + lpeg.V "unesc")^0),
|
||||
-- Escape char is '\'
|
||||
esc = lpeg.P "\\",
|
||||
-- Simple char is anything but escape char
|
||||
simple_char = lpeg.P(1) - lpeg.V "esc",
|
||||
-- If we hit an escape, process specials or hex code, otherwise remove the escape
|
||||
unesc = (lpeg.V "esc" * lpeg.Cs( lpeg.V "specials" + lpeg.V "code" + lpeg.P(1) ))/"%1",
|
||||
-- single-char escapes. These are the only ones service_scan uses
|
||||
specials = lpeg.S "trn0" / {t="\t", r="\r", n="\n", ["0"]="\0"},
|
||||
-- hex escape: convert to char
|
||||
code = (lpeg.P "x" * lpeg.C(lpeg.S "0123456789abcdefABCDEF"^-2))/function(c)
|
||||
return string.char(tonumber(c,16)) end,
|
||||
}
|
||||
|
||||
-- Turn the service fingerprint reply to a probe into a binary blob
|
||||
local function get_response (fp, probe)
|
||||
local i, e = string.find(fp, string.format("%s,%%x+,", probe))
|
||||
if i == nil then return nil end
|
||||
return unescape:match(getquote:match(fp, e+1))
|
||||
end
|
||||
|
||||
action = function(host, port)
|
||||
local responses = {}
|
||||
-- Did the service engine already do the hard work?
|
||||
if port.version and port.version.service_fp then
|
||||
-- Probes sent, replies received, but no match. Unwrap the fingerprint:
|
||||
local fp = string.gsub(port.version.service_fp, "\nSF:", "")
|
||||
-- Probes sent, replies received, but no match.
|
||||
-- Loop through the probes most likely to receive HTTP responses
|
||||
for _, p in ipairs({"GetRequest", "GenericLines", "HTTPOptions",
|
||||
"FourOhFourRequest", "NULL", "RTSPRequest", "Help", "SIPOptions"}) do
|
||||
responses[#responses+1] = get_response(fp, p)
|
||||
responses[#responses+1] = U.get_response(port.version.service_fp, p)
|
||||
end
|
||||
end
|
||||
if #responses == 0 then
|
||||
|
||||
Reference in New Issue
Block a user