diff --git a/CHANGELOG b/CHANGELOG index 41de2861c..850287cb8 100644 --- a/CHANGELOG +++ b/CHANGELOG @@ -1,5 +1,9 @@ # Nmap Changelog ($Id$); -*-text-*- +o [NSE] Update to enable smb-os-discovery to augment version detection + for certain SMB related services using data that the script discovers. + [Tom Sellers] + o Improved version detection and descriptions for Microsoft and Samba SMB services. Also addresses certain issues with OS identification. [Tom Sellers] diff --git a/nselib/smb.lua b/nselib/smb.lua index 1942553e6..96064ae51 100644 --- a/nselib/smb.lua +++ b/nselib/smb.lua @@ -3279,6 +3279,7 @@ end -- * date: "2012-09-08 09:24:30" -- * timezone: -7 -- * timezone_str: UTC-7 +-- * port: 445 -- The table may also contain these additional keys: -- * fqdn: "Sql2008.lab.test.local" -- * domain_dns: "lab.test.local" @@ -3312,6 +3313,7 @@ function get_os(host) response['time'] = smbstate['time'] response['timezone_str'] = smbstate['timezone_str'] response['timezone'] = smbstate['timezone'] + response['port'] = smbstate['port'] -- Kill SMB stop(smbstate) diff --git a/scripts/smb-os-discovery.nse b/scripts/smb-os-discovery.nse index 67b7db6dc..0f85dc96f 100644 --- a/scripts/smb-os-discovery.nse +++ b/scripts/smb-os-discovery.nse @@ -29,6 +29,9 @@ Other systems (like embedded printers) will simply leave out the information. Ot systems will blank out various pieces (some will send back 0 for the current time, for example). +If this script is used in conjunction with version detection it can augment the +standard nmap version detection information with data that this script has discovered. + Retrieving the name and operating system of a server is a vital step in targeting an attack against it, and this script makes that retrieval easy. Additionally, if a penetration tester is choosing between multiple targets, the time can help identify @@ -186,9 +189,27 @@ action = function(host) end add_to_output(output_lines, "System time", response.date or "Unknown") + -- Augment service version detection + if result.port and response.lanmanager then + local proto + if result.port == 445 or result.port == 139 then + proto = 'tcp' + else + proto = 'udp' + end + + local port = nmap.get_port_state(host,{number=result.port,protocol=proto}) + + local version, product + if string.match(response.lanmanager,"^Samba ") then + port.version.product = 'Samba smbd' + port.version.version = string.match(response.lanmanager,"^Samba (.*)") + nmap.set_port_version(host,port) + elseif smb.get_windows_version(response.os) then + port.version.product = string.format("%s %s",smb.get_windows_version(response.os), port.version.name) + nmap.set_port_version(host,port) + end + end + return response, stdnse.format_output(true, output_lines) end - - - -