mirror of
https://github.com/nmap/nmap.git
synced 2025-12-07 13:11:28 +00:00
573088f99c
to {"auth", "intrusive", "vuln"}. The first categories are the same as
in realvnc-auth-bypass, which would seems to be a very similar script,
but netbus-auth-bypass can have the additional side effect of breaking
future authentication attempts for all users, which is solidly
intrusive.
56 lines
1.5 KiB
Lua
56 lines
1.5 KiB
Lua
description = [[
|
|
Checks if a NetBus server is vulnerable to authentication bypass.
|
|
Servers with this vulnerability can be accessed without knowing
|
|
the password.
|
|
|
|
For example a server running on TCP port 12345 on localhost with
|
|
this vulnerability is accessible to anyone. An attacker could
|
|
simply form a connection to the server ( ncat -C 127.0.0.1 12345 )
|
|
and login to the service by typing Password;1; into the console.
|
|
]]
|
|
|
|
---
|
|
-- @output
|
|
-- 12345/tcp open netbus
|
|
-- |_netbus-auth-bypass: Vulnerable
|
|
|
|
author = "Toni Ruottu"
|
|
license = "Same as Nmap--See http://nmap.org/book/man-legal.html"
|
|
categories = {"auth", "intrusive", "vuln"}
|
|
|
|
require("nmap")
|
|
require("stdnse")
|
|
require("shortport")
|
|
|
|
dependencies = {"netbus-version", "netbus-brute", "netbus-info"}
|
|
|
|
portrule = shortport.port_or_service (12345, "netbus", {"tcp"})
|
|
|
|
action = function( host, port )
|
|
|
|
local socket = nmap.new_socket()
|
|
local status, err = socket:connect(host.ip, port.number)
|
|
if not status then
|
|
return
|
|
end
|
|
local buffer, _ = stdnse.make_buffer(socket, "\r")
|
|
buffer() --discard banner
|
|
|
|
-- The first argument of Password is the super-login bit.
|
|
-- On vulnerable servers any password will do as long as
|
|
-- we send the super-login bit. Regular NetBus has only
|
|
-- one password. Thus, if we can login with two different
|
|
-- passwords using super-login, the server is vulnerable.
|
|
|
|
socket:send("Password;1;\r") --password: empty
|
|
if buffer() ~= "Access;1" then
|
|
return
|
|
end
|
|
socket:send("Password;1; \r") --password: space
|
|
if buffer() == "Access;1" then
|
|
return "Vulnerable"
|
|
end
|
|
return
|
|
end
|
|
|