Merged Lpeg branch

scripts/http-affiliate-id.nse

@@ -1,6 +1,6 @@
 local http = require "http"
 local nmap = require "nmap"
-local pcre = require "pcre"
+local re = require "re"
 local shortport = require "shortport"
 local stdnse = require "stdnse"
 local table = require "table"
@@ -42,7 +42,7 @@ Supported IDs:
 -- |   thisisphotobomb.memebase.com:80/
 -- |_  memebase.com:80/
 
-author = "Hani Benhabiles, Daniel Miller"
+author = "Hani Benhabiles, Daniel Miller, Patrick Donnelly"
 
 license = "Same as Nmap--See http://nmap.org/book/man-legal.html"
 
@@ -51,9 +51,13 @@ categories = {"safe", "discovery"}
 
 -- these are the regular expressions for affiliate IDs
 local AFFILIATE_PATTERNS = {
-  ["Google Analytics ID"] = "(?P<id>UA-[0-9]{6,9}-[0-9]{1,2})",
-  ["Google Adsense ID"] = "(?P<id>pub-[0-9]{16,16})",
-  ["Amazon Associates ID"] = "http://(www%.amazon%.com/[^\"']*[\\?&;]tag|rcm%.amazon%.com/[^\"']*[\\?&;]t)=(?P<id>\\w+-\\d+)",
+  ["Google Analytics ID"] = re.compile [[{| ({'UA-' [%d]^6 [%d]^-3 '-' [%d][%d]?} / .)* |}]],
+  ["Google Adsense ID"] = re.compile [[{| ({'pub-' [%d]^16} / .)* |}]],
+  ["Amazon Associates ID"] = re.compile [[
+  body <- {| (uri / .)* |}
+  uri <- 'http://' ('www.amazon.com/' ([\?&;] 'tag=' tag / [^"'])*) / ('rcm.amazon.com/' ([\?&;] 't=' tag / [^"'])*)
+  tag <- {[%w]+ '-' [%d]+}
+]],
 }
 
 portrule = shortport.http
@@ -83,13 +87,14 @@ portaction = function(host, port)
   end
 
   -- Here goes affiliate matching
-  for name, re in pairs(AFFILIATE_PATTERNS) do
-    local regex = pcre.new(re, 0, "C")
-    local limit, limit2, matches = regex:match(body)
-    if limit ~= nil then
-      local affiliateid = matches["id"]
-      result[#result + 1] = name .. ": " .. affiliateid
-      add_key_to_registry(host, port, url_path, result[#result])
+  for name, pattern in pairs(AFFILIATE_PATTERNS) do
+    local ids = {}
+    for i, id in ipairs(pattern:match(body)) do
+      if not ids[id] then
+        result[#result + 1] = name .. ": " .. id
+        add_key_to_registry(host, port, url_path, result[#result])
+        ids[id] = true
+      end
     end
   end
 

scripts/http-drupal-modules.nse

@@ -1,7 +1,6 @@
 local http = require "http"
 local io = require "io"
 local nmap = require "nmap"
-local pcre = require "pcre"
 local shortport = require "shortport"
 local stdnse = require "stdnse"
 local string = require "string"
@@ -68,14 +67,8 @@ local get_modules_path = function(host, port, root)
   local modules_path = stdnse.get_script_args(SCRIPT_NAME .. '.modules_path')
 
   if modules_path == nil then
-    -- greps response body for sign of the modules path
-    local pathregex = "sites/[a-zA-Z0-9.-]*/modules/"
     local body = http.get(host, port, root).body
-    local regex = pcre.new(pathregex, 0, "C")
-    local limit, limit2, matches = regex:match(body)
-    if limit ~= nil then
-      modules_path = body:sub(limit, limit2)
-    end
+    modules_path = body:match "sites/[%w.-]*/modules/"
   end
   return modules_path or default_path
 end

scripts/http-traceroute.nse

@@ -1,6 +1,5 @@
 local http = require "http"
 local nmap = require "nmap"
-local pcre = require "pcre"
 local shortport = require "shortport"
 local stdnse = require "stdnse"
 local table = require "table"
@@ -69,29 +68,15 @@ portrule = shortport.service("http")
 --- Attempts to extract the html title
 -- from an HTTP response body.
 --@param responsebody Response's body.
-local extract_title = function(responsebody)
-  local title = ''
-  local titlere = '<title>(?P<title>.*)</title>'
-  local regex = pcre.new(titlere, 0, "C")
-  local limit, limit2, matches = regex:match(responsebody)
-  if limit ~= nil then
-    title = matches["title"]
-  end
-  return title
+local function extract_title (responsebody)
+  return responsebody:match "<title>(.-)</title>"
 end
 
 --- Attempts to extract the X-Forwarded-For header
 -- from an HTTP response body in case of TRACE requests.
 --@param responsebody Response's body.
-local extract_xfwd = function(responsebody)
-  local xfwd = ''
-  local xfwdre = '(?P<xfwd>X-Forwarded-For: .*)'
-  local regex = pcre.new(xfwdre, 0, "C")
-  local limit, limit2, matches = regex:match(responsebody)
-  if limit ~= nil then
-    xfwd = matches["xfwd"]
-  end
-  return xfwd
+local function extract_xfwd (responsebody)
+  return responsebody:match "X-Forwarded-For: [^\r\n]*"
 end
 
 ---  Check for differences in response headers, status code

scripts/irc-info.nse

@@ -1,7 +1,6 @@
 local comm = require "comm"
 local math = require "math"
 local nmap = require "nmap"
-local pcre = require "pcre"
 local shortport = require "shortport"
 local stdnse = require "stdnse"
 local string = require "string"
@@ -40,213 +39,144 @@ It uses STATS, LUSERS, and other queries to obtain this information.
 -- <elem key="source host">source.example.com</elem>
 -- <elem key="source ident">NONE or BLOCKED</elem>
 
-
-author = "Doug Hoyte"
+author = "Doug Hoyte, Patrick Donnelly"
 
 license = "Same as Nmap--See http://nmap.org/book/man-legal.html"
 
 categories = {"default", "discovery", "safe"}
 
-
 portrule = shortport.port_or_service({6666,6667,6697,6679},{"irc","ircs"})
 
-local init = function()
-  -- Start of MOTD, we'll take the server name from here
-  nmap.registry.ircserverinfo_375 = nmap.registry.ircserverinfo_375
-    or pcre.new("^:([\\w-_.]+) 375", 0, "C")
+local banner_timeout = 60
 
-  -- MOTD could be missing, we want to handle that scenario as well
-  nmap.registry.ircserverinfo_422 = nmap.registry.ircserverinfo_422
-    or pcre.new("^:([\\w-_.]+) 422", 0, "C")
-
-  -- NICK already in use
-  nmap.registry.ircserverinfo_433 = nmap.registry.ircserverinfo_433
-    or pcre.new("^:[\\w-_.]+ 433", 0, "C")
-
-  -- PING/PONG
-  nmap.registry.ircserverinfo_ping = nmap.registry.ircserverinfo_ping
-    or pcre.new("^PING :(.+)", 0, "C")
-
-  -- Server version info
-  nmap.registry.ircserverinfo_351 = nmap.registry.ircserverinfo_351
-    or pcre.new("^:[\\w-_.]+ 351 \\w+ ([^:]+)", 0, "C")
-
-  -- Various bits of info
-  nmap.registry.ircserverinfo_251_efnet = nmap.registry.ircserverinfo_251_efnet
-    or pcre.new("^:[\\w-_.]+ 251 \\w+ :There are (\\d+) users and (\\d+) invisible on (\\d+) servers", 0, "C")
-
-  nmap.registry.ircserverinfo_251_ircnet = nmap.registry.ircserverinfo_251_ircnet
-    or pcre.new("^:[\\w-_.]+ 251 \\w+ :There are (\\d+) users and \\d+ services on (\\d+) servers", 0, "C")
-
-  nmap.registry.ircserverinfo_252 = nmap.registry.ircserverinfo_252
-    or pcre.new("^:[\\w-_.]+ 252 \\w+ (\\d+) :", 0, "C")
-
-  nmap.registry.ircserverinfo_254 = nmap.registry.ircserverinfo_254
-    or pcre.new("^:[\\w-_.]+ 254 \\w+ (\\d+) :", 0, "C")
-
-  nmap.registry.ircserverinfo_255_efnet = nmap.registry.ircserverinfo_255_efnet
-    or pcre.new("^:[\\w-_.]+ 255 \\w+ :I have (\\d+) clients and (\\d+) server", 0, "C")
-
-  nmap.registry.ircserverinfo_255_ircnet = nmap.registry.ircserverinfo_255_ircnet
-    or pcre.new("^:[\\w-_.]+ 255 \\w+ :I have (\\d+) users, \\d+ services and (\\d+) server", 0, "C")
-
-  nmap.registry.ircserverinfo_242 = nmap.registry.ircserverinfo_242
-    or pcre.new("^:[\\w-_.]+ 242 \\w+ :Server Up (\\d+ days, [\\d:]+)", 0, "C")
-
-  nmap.registry.ircserverinfo_352 = nmap.registry.ircserverinfo_352
-    or pcre.new("^:[\\w-_.]+ 352 \\w+ \\S+ (\\S+) ([\\w-_.]+)", 0, "C")
-
-  nmap.registry.ircserverinfo_error = nmap.registry.ircserverinfo_error
-    or pcre.new("^ERROR :(.*)", 0, "C")
+local function random_nick ()
+  local t = {}
+  for i = 1, 9 do -- minimum 9 char nick
+    t[i] = math.random(97, 122) -- lowercase ascii
+  end
+  return ("%c"):rep(#t):format(table.unpack(t))
 end
 
-action = function(host, port)
+function action (host, port)
   local sd = nmap.new_socket()
-  local curr_nick = random_nick()
-  local sver, shost, susers, sservers, schans, sircops, slusers, slservers, sup, serr
-  local myhost, myident
-  local s, e, t
-  local buf
-  local banner_timeout = 60
-  local make_output = function()
-    local o = stdnse.output_table()
-    if (not shost) then
-      if serr then
-        return "ERROR: " .. serr .. "\n"
-      else
-        return nil
-      end
-    end
+  local nick = random_nick()
 
-    o["server"] = shost
-    o["version"] = sver
-    o["servers"] = sservers
-    o["ops"] = sircops
-    o["chans"] = schans
-    o["users"] = susers
-    o["lservers"] = slservers
-    o["lusers"] = slusers
-    o["uptime"] = sup
-    o["source host"] = myhost
-    if myident and string.find(myident, "^~") then
-      o["source ident"] = "NONE or BLOCKED"
-    else
-      o["source ident"] = myident
-    end
+  local output = stdnse.output_table()
 
-    return o
-  end
-
-  init()
-
-  local sd, line = comm.tryssl(host, port, "USER nmap +iw nmap :Nmap Wuz Here\nNICK " .. curr_nick .. "\n")
+  local sd, line = comm.tryssl(host, port, "USER nmap +iw nmap :Nmap Wuz Here\nNICK " .. nick .. "\n")
   if not sd then return "Unable to open connection" end
 
   -- set a healthy banner timeout
   sd:set_timeout(banner_timeout * 1000)
 
-  buf = stdnse.make_buffer(sd, "\r?\n")
+  local buf = stdnse.make_buffer(sd, "\r?\n")
 
-  while true do
-    if (not line) then break end
+  while line do
+    stdnse.print_debug(2, "%s", line)
 
     -- This one lets us know we've connected, pre-PONGed, and got a NICK
-    s, e, t = nmap.registry.ircserverinfo_375:exec(line, 0, 0)
-    if (s) then
-      shost = string.sub(line, t[1], t[2])
-      sd:send("LUSERS\nVERSION\nSTATS u\nWHO " .. curr_nick .. "\nQUIT\n")
+    -- Start of MOTD, we'll take the server name from here
+    local info = line:match "^:([%w-_.]+) 375"
+    if info then
+      output.server = info
+      sd:send("LUSERS\nVERSION\nSTATS u\nWHO " .. nick .. "\nQUIT\n")
     end
 
-    s, e, t = nmap.registry.ircserverinfo_422:exec(line, 0, 0)
-    if (s) then
-      shost = string.sub(line, t[1], t[2])
-      sd:send("LUSERS\nVERSION\nSTATS u\nWHO " .. curr_nick .. "\nQUIT\n")
+    -- MOTD could be missing, we want to handle that scenario as well
+    info = line:match "^:([%w-_.]+) 422"
+    if info then
+      output.server = info
+      sd:send("LUSERS\nVERSION\nSTATS u\nWHO " .. nick .. "\nQUIT\n")
     end
 
-    s, e, t = nmap.registry.ircserverinfo_433:exec(line, 0, 0)
-    if (s) then
-      curr_nick = random_nick()
-      sd:send("NICK " .. curr_nick .. "\n")
+    -- NICK already in use
+    info = line:match "^:([%w-_.]+) 433"
+    if info then
+      nick = random_nick()
+      sd:send("NICK " .. nick .. "\n")
     end
 
-    s, e, t = nmap.registry.ircserverinfo_ping:exec(line, 0, 0)
-    if (s) then
-      sd:send("PONG :" .. string.sub(line, t[1], t[2]) .. "\n")
+    info = line:match "^:([%w-_.]+) 433"
+    if info then
+      nick = random_nick()
+      sd:send("NICK " .. nick .. "\n")
     end
 
-    s, e, t = nmap.registry.ircserverinfo_351:exec(line, 0, 0)
-    if (s) then
-      sver = string.sub(line, t[1], t[2])
+    -- PING/PONG
+    local dummy = line:match "^PING :(.*)"
+    if dummy then
+      sd:send("PONG :" .. dummy .. "\n")
     end
 
-    s, e, t = nmap.registry.ircserverinfo_251_efnet:exec(line, 0, 0)
-    if (s) then
-      susers = (string.sub(line, t[1], t[2]) + string.sub(line, t[3], t[4]))
-      sservers = string.sub(line, t[5], t[6])
+    -- Server version info
+    info = line:match "^:[%w-_.]+ 351 %w+ ([^:]+)"
+    if info then
+      output.version = info
     end
 
-    s, e, t = nmap.registry.ircserverinfo_251_ircnet:exec(line, 0, 0)
-    if (s) then
-      susers = string.sub(line, t[1], t[2])
-      sservers = string.sub(line, t[3], t[4])
+    -- Various bits of info
+    local users, invisible, servers = line:match "^:[%w-_.]+ 251 %w+ :There are (%d+) users and (%d+) invisible on (%d+) servers"
+    if users then
+      output.users = users + invisible
+      output.servers = servers
     end
 
-    s, e, t = nmap.registry.ircserverinfo_252:exec(line, 0, 0)
-    if (s) then
-      sircops = string.sub(line, t[1], t[2])
+    local users, servers = line:match "^:[%w-_.]+ 251 %w+ :There are (%d+) users and %d+ services on (%d+) servers"
+    if users then
+      output.users = users
+      output.servers = servers
     end
 
-    s, e, t = nmap.registry.ircserverinfo_254:exec(line, 0, 0)
-    if (s) then
-      schans = string.sub(line, t[1], t[2])
+    info = line:match "^:[%w-_.]+ 252 %w+ (%d+) :"
+    if info then
+      output.ops = info
     end
 
-    s, e, t = nmap.registry.ircserverinfo_255_efnet:exec(line, 0, 0)
-    if (s) then
-      slusers = string.sub(line, t[1], t[2])
-      slservers = string.sub(line, t[3], t[4])
+    info = line:match "^:[%w-_.]+ 254 %w+ (%d+) :"
+    if info then
+      output.chans = info
     end
 
-    s, e, t = nmap.registry.ircserverinfo_255_ircnet:exec(line, 0, 0)
-    if (s) then
-      slusers = string.sub(line, t[1], t[2])
-      slservers = string.sub(line, t[3], t[4])
+    -- efnet
+    local clients, servers = line:match "^:[%w-_.]+ 255 %w+ :I have (%d+) clients and (%d+) server"
+    if clients then
+      output.lusers = clients
+      output.lservers = servers
     end
 
-    s, e, t = nmap.registry.ircserverinfo_242:exec(line, 0, 0)
-    if (s) then
-      sup = string.sub(line, t[1], t[2])
+    -- ircnet
+    local clients, servers = line:match "^:[%w-_.]+ 255 %w+ :I have (%d+) users, %d+ services and (%d+) server"
+    if clients then
+      output.lusers = clients
+      output.lservers = servers
     end
 
-    s, e, t = nmap.registry.ircserverinfo_352:exec(line, 0, 0)
-    if (s) then
-      myident = string.sub(line, t[1], t[2])
-      myhost = string.sub(line, t[3], t[4])
+    local uptime = line:match "^:[%w-_.]+ 242 %w+ :Server Up (%d+ days, [%d:]+)"
+    if uptime then
+      output.uptime = uptime
     end
 
-    s, e, t = nmap.registry.ircserverinfo_error:exec(line, 0, 0)
-    if (s) then
-      serr = string.sub(line, t[1], t[2])
-      return make_output()
+    local ident, host = line:match "^:[%w-_.]+ 352 %w+ %S+ (%S+) ([%w-_.]+)"
+    if ident then
+      if ident:find "^~" then
+        output["source ident"] = "NONE or BLOCKED"
+      else
+        output["source ident"] = ident
+      end
+      output["source host"] = host
+    end
+
+    local err = line:match "^ERROR :(.*)"
+    if err then
+      output.error = err
     end
 
     line = buf()
   end
 
-  return make_output()
-
-end
-
-
-
-
-random_nick = function()
-  local nick = ""
-
-  -- NICKLEN is at least 9
-  for i = 0, 8, 1 do
-    nick = nick .. string.char(math.random(97, 122)) -- lowercase ascii
+  if output.server then
+    return output
+  else
+    return nil
   end
-
-  return nick
 end

scripts/telnet-brute.nse

@@ -1,12 +1,24 @@
 local comm = require "comm"
 local coroutine = require "coroutine"
 local nmap = require "nmap"
+local re = require "re"
+local U = require "lpeg.utility"
 local shortport = require "shortport"
 local stdnse = require "stdnse"
 local strbuf = require "strbuf"
 local string = require "string"
 local brute = require "brute"
-local pcre = require "pcre"
+
+local P = lpeg.P;
+local R = lpeg.R;
+local S = lpeg.S;
+local V = lpeg.V;
+local C = lpeg.C;
+local Cb = lpeg.Cb;
+local Cc = lpeg.Cc;
+local Cf = lpeg.Cf;
+local Cg = lpeg.Cg;
+local Ct = lpeg.Ct;
 
 description = [[
 Performs brute-force password auditing against telnet servers.
@@ -32,7 +44,7 @@ Performs brute-force password auditing against telnet servers.
 --                              count based on the behavior of the target
 --                              (default: "true")
 
-author = "nnposter"
+author = "nnposter, Patrick Donnelly"
 license = "Same as Nmap--See http://nmap.org/book/man-legal.html"
 categories = {'brute', 'intrusive'}
 
@@ -52,9 +64,6 @@ local login_debug = 2     -- debug level for printing attempted credentials
 local detail_debug = 3    -- debug level for printing individual login steps
                           --                          and thread-level info
 
-local pcreptn = {}        -- cache of compiled PCRE patterns
-
-
 ---
 -- Print debug messages, prepending them with the script name
 --
@@ -65,6 +74,20 @@ local print_debug = function (level, fmt, ...)
   stdnse.print_debug(level, "%s: " .. fmt, SCRIPT_NAME, ...)
 end
 
+local patt_login = U.atwordboundary(re.compile [[([uU][sS][eE][rR][nN][aA][mM][eE] / [lL][oO][gG][iI][nN]) %s* ':' %s* !.]])
+
+local patt_password = U.atwordboundary(re.compile [[[pP][aA][sS][sS] ([wW][oO][rR][dD] / [cC][oO][dD][eE]) %s* ':' %s* !.]])
+
+local patt_login_success = re.compile([[
+  prompt <- [/>%$#] \ -- general prompt
+            [lL][aA][sS][tT] %s+ [lL][oO][gG][iI][nN] %s* ':' \ -- linux telnetd
+            [A-Z] ':\\' \ -- Windows telnet
+            'Main' (%s \ %ESC '[' %d+ ';' %d+ 'H') 'Menu' \ -- Netgear RM356
+            [mM][aA][iI][nN] (%s \ '\x1B'  ) [mM][eE][nN][uU] ! %a \ -- Netgear RM356
+            [eE][nN][tT][eE][rR] %s+ [tT][eE][rR][mM][iI][nN][aA][lL] %s+ [eE][mM][uU][lL][aA][tT][iI][oO][nN] %s* ':' -- Hummingbird telnetd
+]], {ESC = "\x1B"})
+
+local patt_login_failure = U.atwordboundary(U.caseless "incorrect" + U.caseless "failed" + U.caseless "denied" + U.caseless "invalid" + U.caseless "bad")
 
 ---
 -- Decide whether a given string (presumably received from a telnet server)
@@ -73,10 +96,7 @@ end
 -- @param str The string to analyze
 -- @return Verdict (true or false)
 local is_username_prompt = function (str)
-  pcreptn.username_prompt = pcreptn.username_prompt
-    or pcre.new("\\b(?:username|login)\\s*:\\s*$",
-      pcre.flags().CASELESS, "C")
-  return pcreptn.username_prompt:match(str)
+  return not not login_patt:match(str)
 end
 
 
@@ -87,10 +107,7 @@ end
 -- @param str The string to analyze
 -- @return Verdict (true or false)
 local is_password_prompt = function (str)
-  pcreptn.password_prompt = pcreptn.password_prompt
-    or pcre.new("\\bpass(?:word|code)\\s*:\\s*$",
-      pcre.flags().CASELESS, "C")
-  return pcreptn.password_prompt:match(str)
+  return not not password_patt:match(str)
 end
 
 
@@ -101,14 +118,7 @@ end
 -- @param str The string to analyze
 -- @return Verdict (true or false)
 local is_login_success = function (str)
-  pcreptn.login_success = pcreptn.login_success
-  or pcre.new("[/>%$#]\\s*$" -- general prompt
-    .. "|^Last login\\s*:" -- linux telnetd
-    .. "|^(?-i:[A-Z]):\\\\" -- Windows telnet
-    .. "|Main(?:\\s|\\x1B\\[\\d+;\\d+H)Menu\\b" -- Netgear RM356
-    .. "|^Enter Terminal Emulation:\\s*$", -- Hummingbird telnetd
-  pcre.flags().CASELESS, "C")
-  return pcreptn.login_success:match(str)
+  return not not password_login_success:match(str)
 end
 
 
@@ -119,10 +129,7 @@ end
 -- @param str The string to analyze
 -- @return Verdict (true or false)
 local is_login_failure = function (str)
-  pcreptn.login_failure = pcreptn.login_failure
-    or pcre.new("\\b(?:incorrect|failed|denied|invalid|bad)\\b",
-      pcre.flags().CASELESS, "C")
-  return pcreptn.login_failure:match(str)
+  return not not patt_login_failure:match(str)
 end