diff --git a/CHANGELOG b/CHANGELOG
index 41de2861c..850287cb8 100644
--- a/CHANGELOG
+++ b/CHANGELOG
@@ -1,5 +1,9 @@
# Nmap Changelog ($Id$); -*-text-*-
+o [NSE] Update to enable smb-os-discovery to augment version detection
+ for certain SMB related services using data that the script discovers.
+ [Tom Sellers]
+
o Improved version detection and descriptions for Microsoft and Samba
SMB services. Also addresses certain issues with OS identification.
[Tom Sellers]
diff --git a/nselib/smb.lua b/nselib/smb.lua
index 1942553e6..96064ae51 100644
--- a/nselib/smb.lua
+++ b/nselib/smb.lua
@@ -3279,6 +3279,7 @@ end
-- * date: "2012-09-08 09:24:30"
-- * timezone: -7
-- * timezone_str: UTC-7
+-- * port: 445
-- The table may also contain these additional keys:
-- * fqdn: "Sql2008.lab.test.local"
-- * domain_dns: "lab.test.local"
@@ -3312,6 +3313,7 @@ function get_os(host)
response['time'] = smbstate['time']
response['timezone_str'] = smbstate['timezone_str']
response['timezone'] = smbstate['timezone']
+ response['port'] = smbstate['port']
-- Kill SMB
stop(smbstate)
diff --git a/scripts/smb-os-discovery.nse b/scripts/smb-os-discovery.nse
index 67b7db6dc..0f85dc96f 100644
--- a/scripts/smb-os-discovery.nse
+++ b/scripts/smb-os-discovery.nse
@@ -29,6 +29,9 @@ Other systems (like embedded printers) will simply leave out the information. Ot
systems will blank out various pieces (some will send back 0 for the current
time, for example).
+If this script is used in conjunction with version detection it can augment the
+standard nmap version detection information with data that this script has discovered.
+
Retrieving the name and operating system of a server is a vital step in targeting
an attack against it, and this script makes that retrieval easy. Additionally, if
a penetration tester is choosing between multiple targets, the time can help identify
@@ -186,9 +189,27 @@ action = function(host)
end
add_to_output(output_lines, "System time", response.date or "Unknown")
+ -- Augment service version detection
+ if result.port and response.lanmanager then
+ local proto
+ if result.port == 445 or result.port == 139 then
+ proto = 'tcp'
+ else
+ proto = 'udp'
+ end
+
+ local port = nmap.get_port_state(host,{number=result.port,protocol=proto})
+
+ local version, product
+ if string.match(response.lanmanager,"^Samba ") then
+ port.version.product = 'Samba smbd'
+ port.version.version = string.match(response.lanmanager,"^Samba (.*)")
+ nmap.set_port_version(host,port)
+ elseif smb.get_windows_version(response.os) then
+ port.version.product = string.format("%s %s",smb.get_windows_version(response.os), port.version.name)
+ nmap.set_port_version(host,port)
+ end
+ end
+
return response, stdnse.format_output(true, output_lines)
end
-
-
-
-