PenTest/nmap
1
0
Fork 0
mirror of https://github.com/nmap/nmap.git synced 2025-12-07 21:21:31 +00:00
Code Issues Projects Releases Wiki Activity

Eliminate reflection false positives in http-shellshock. Closes #2089

Browse Source
This commit is contained in:
nnposter
2020-07-29 23:19:25 +00:00
parent 5ff407be40
commit f278aca7ab
2 changed files with 11 additions and 12 deletions
Download Patch File Download Diff File Expand all files Collapse all files

3
CHANGELOG
View File

@@ -1,5 +1,8 @@
#Nmap Changelog ($Id$); -*-text-*- #Nmap Changelog ($Id$); -*-text-*-
o [NSE][GH#2089] Eliminated false positives in script http-shellshock caused by
simple reflection of HTTP request data [Anders Kaseorg]
o [NSE][GH#1473] SNMP scripts are now enabled on non-standard ports where SNMP o [NSE][GH#1473] SNMP scripts are now enabled on non-standard ports where SNMP
has been detected [usd-markus, nnposter] has been detected [usd-markus, nnposter]

18
scripts/http-shellshock.nse
View File

@@ -83,12 +83,13 @@ portrule = shortport.http
function generate_http_req(host, port, uri, custom_header, cmd) function generate_http_req(host, port, uri, custom_header, cmd)
local rnd = nil local rnd = nil
--Set custom or probe with random string as cmd --Set custom or probe with random string as cmd
if cmd ~= nil then if not cmd then
cmd = '() { :;}; '..cmd local rnd1 = rand.random_alpha(7)
else local rnd2 = rand.random_alpha(7)
rnd = rand.random_alpha(15) rnd = rnd1 .. rnd2
cmd = '() { :;}; echo; echo "'..rnd..'"' cmd = ("echo; echo -n %s; echo %s"):format(rnd1, rnd2)
end end
cmd = "() { :;}; " .. cmd
-- Plant the payload in the HTTP headers -- Plant the payload in the HTTP headers
local options = {header={}} local options = {header={}}
options["no_cache"] = true options["no_cache"] = true
@@ -104,20 +105,15 @@ function generate_http_req(host, port, uri, custom_header, cmd)
end end
local req = http.get(host, port, uri, options) local req = http.get(host, port, uri, options)
if not(cmd) then
return req
else
return req, rnd return req, rnd
end end
end
action = function(host, port) action = function(host, port)
local cmd = stdnse.get_script_args(SCRIPT_NAME..".cmd") or nil local cmd = stdnse.get_script_args(SCRIPT_NAME..".cmd") or nil
local http_header = stdnse.get_script_args(SCRIPT_NAME..".header") or nil local http_header = stdnse.get_script_args(SCRIPT_NAME..".header") or nil
local uri = stdnse.get_script_args(SCRIPT_NAME..".uri") or '/' local uri = stdnse.get_script_args(SCRIPT_NAME..".uri") or '/'
local rnd = nil
local req, rnd = generate_http_req(host, port, uri, http_header, nil) local req, rnd = generate_http_req(host, port, uri, http_header, nil)
if req.status == 200 and string.match(req.body, rnd) ~= nil then if req.status == 200 and req.body:find(rnd, 1, true) then
local vuln_report = vulns.Report:new(SCRIPT_NAME, host, port) local vuln_report = vulns.Report:new(SCRIPT_NAME, host, port)
local vuln = { local vuln = {
title = 'HTTP Shellshock vulnerability', title = 'HTTP Shellshock vulnerability',