From ed549d89a56561a346057cd5b7d3adfbf96a258c Mon Sep 17 00:00:00 2001
From: dmiller <dmiller@e0a8ed71-7df4-0310-8962-fdc924857419>
Date: Thu, 14 Jun 2018 22:19:25 +0000
Subject: [PATCH] New service probe and match lines for ADB

---
 CHANGELOG           |  4 ++++
 nmap-service-probes | 17 +++++++++++++++++
 2 files changed, 21 insertions(+)

diff --git a/CHANGELOG b/CHANGELOG
index eaba48b5b..d48211aa7 100644
--- a/CHANGELOG
+++ b/CHANGELOG
@@ -1,5 +1,9 @@
 #Nmap Changelog ($Id$); -*-text-*-
 
+o New service probe and match lines for adb, the Android Debug Bridge, which
+  allows remote code execution and is left enabled by default on many devices.
+  [Daniel Miller]
+
 o [Ncat][GH#1237] Fixed literal IPv6 URL format for connecting through
   HTTP proxies. [Phil Dibowitz]
 
diff --git a/nmap-service-probes b/nmap-service-probes
index 762fc687c..20b32ee35 100644
--- a/nmap-service-probes
+++ b/nmap-service-probes
@@ -16266,3 +16266,20 @@ ports 10002
 
 # Fake impossible match; delete once we get a real probe response
 match sharp-remote m|^(?!x)x|
+
+##############################NEXT PROBE##############################
+# Android Debug Bridge CONNECT probe
+# https://android.googlesource.com/platform/system/core/+/master/adb/protocol.txt
+Probe TCP adbConnect q|CNXN\0\0\0\x01\0\x10\0\0\x07\0\0\0\x32\x02\0\0\xbc\xb1\xa7\xb1host::\0|
+rarity 8
+ports 5555
+
+match adb m|^CNXN\0\0\0\x01\0\x10\0\0........\xbc\xb1\xa7\xb1(\w+)::ro.product.name=([^;]+);ro.product.model=([^;]+);ro.product.device=([^;]+);\0$|s p/Android Debug Bridge $1/ i/name: $2; model: $3; device: $4/ o/Android/ cpe:/o:google:android/a cpe:/o:linux:linux_kernel/a
+match adb m|^CNXN\0\0\0\x01\0\x10\0\0........\xbc\xb1\xa7\xb1(\w+)::ro.product.name=([^;]+);ro.product.model=([^;]+);ro.product.device=([^;]+);features=([^\0]+)$|s p/Android Debug Bridge $1/ i/name: $2; model: $3; device: $4; features: $5/ o/Android/ cpe:/o:google:android/a cpe:/o:linux:linux_kernel/a
+
+match adb m|CNXN\0\0\0\x01\0\x10\0\0\t\0\0\0\xe4\x02\0\0\xbc\xb1\xa7\xb1device::\0$| p/Android Debug Bridge device/ i/no auth/ o/Android/ cpe:/o:google:android/a cpe:/o:linux:linux_kernel/a
+# If it has identifying info, softmatch so we can make a better fingerprint
+softmatch adb m|^CNXN\0\0\0\x01\0\x10\0\0........\xbc\xb1\xa7\xb1(\w+):[^:]*:[^\0]+\0$|s p/Android Debug Bridge $1/ i/no auth/ o/Android/ cpe:/o:google:android/a cpe:/o:linux:linux_kernel/a
+
+match adb m|^AUTH\x01\0\0\0\0\0\0\0........\xbc\xb1\xa7\xb1|s p/Android Debug Bridge/ i/token auth required/ o/Android/ cpe:/o:google:android/a cpe:/o:linux:linux_kernel/a
+softmatch adb m|^AUTH(.)\0\0\0\0\0\0\0........\xbc\xb1\xa7\xb1|s p/Android Debug Bridge/ i/auth required: $I(1,"<")/ o/Android/ cpe:/o:google:android/a cpe:/o:linux:linux_kernel/a