From 9f06bd0b66243e795bd3263bf8e50410f45ee189 Mon Sep 17 00:00:00 2001 From: adrien Date: Fri, 18 Oct 2024 01:30:05 +0200 Subject: [PATCH] add personnal scripts --- scripts/README.md | 34 ++++++ scripts/http-info.nse | 114 ++++++++++++++++++ scripts/smb-authentication.ini | 2 + scripts/smb-shares-size.nse | 206 +++++++++++++++++++++++++++++++++ 4 files changed, 356 insertions(+) create mode 100644 scripts/README.md create mode 100644 scripts/http-info.nse create mode 100644 scripts/smb-authentication.ini create mode 100644 scripts/smb-shares-size.nse diff --git a/scripts/README.md b/scripts/README.md new file mode 100644 index 0000000..10f436d --- /dev/null +++ b/scripts/README.md @@ -0,0 +1,34 @@ +# nmap-scripts + +## http-info.nse + +Return status, title and favicon URL of a webpage + +```lua +@args http-get.path Path to get. Default /. +@usage nmap -phttp,https --script http-info.nse --script-args http-info.path=/ +@output +80/tcp open http +| http-info: +| status-line: HTTP/1.1 200 OK\x0D +| +| title: Go ahead and ScanMe! +| favicon: http://scanme.nmap.org:80/shared/images/tiny-eyeicon.png +|_ status: 200 +``` + +## smb-shares-size.nse + +Return free and total size in octets of each SMB shares + +```lua +@args See the documentation for the smbauth library. +@usage nmap -p137-139,445 --script smb-shares-size.nse --script-args-file smb-shares-size.ini +@output +Host script results: +| smb-shares-size: +| data: +| FreeSize: 38495883264 +| TotalSize: 500961574912 +|_ IPC$: NT_STATUS_ACCESS_DENIED +``` diff --git a/scripts/http-info.nse b/scripts/http-info.nse new file mode 100644 index 0000000..676cc54 --- /dev/null +++ b/scripts/http-info.nse @@ -0,0 +1,114 @@ +local shortport = require "shortport" + +description = [[ +Return status, title and favicon URL of a webpage +]] + +--- +-- @args http-get.path Path to get. Default /. +-- +-- @usage nmap -phttp,https --script http-info.nse --script-args http-info.path=/ +-- +-- @output +-- 80/tcp open http +-- | http-info: +-- | status-line: HTTP/1.1 200 OK\x0D +-- | +-- | title: Go ahead and ScanMe! +-- | favicon: http://scanme.nmap.org:80/shared/images/tiny-eyeicon.png +-- |_ status: 200 +--- + +categories = {"discovery", "intrusive"} +author = "Adrien Malingrey" +license = "Same as Nmap--See https://nmap.org/book/man-legal.html" + +portrule = shortport.service({"http", "https", "ssl"}) + +local http = require "http" +local stdnse = require "stdnse" + +action = function(host, port) + local scheme = "" + local hostaddress = (host.name ~= '' and host.name) or host.ip + local path = "/" + local uri + local favicon_relative_uri = "/favicon.ico" + local favicon + + if (port.service == "ssl") then + scheme = "https" + else + scheme = port.service + end + + if(stdnse.get_script_args('http-get.path')) then + path = stdnse.get_script_args('http-info.path') + end + + uri = scheme.."://"..hostaddress..":"..port.number..path + stdnse.debug1("Try to download %s", uri) + local answer = http.get_url(uri, {}) + + local output = {status=answer.status, ["status-line"]=answer["status-line"]} + + if (answer and answer.status == 200) then + stdnse.debug1("[SUCCESS] Load page %s", uri) + -- Taken from http-title.nse by Diman Todorov + local title = string.match(answer.body, "<[Tt][Ii][Tt][Ll][Ee][^>]*>([^<]*)") + if (title) then + output.title = title + end + stdnse.debug1("[INFO] Try favicon %s", favicon_relative_uri) + favicon_relative_uri = parseIcon(answer.body) or "favicon.ico" + else + stdnse.debug1("[ERROR] Can't load page %s", uri) + end + + favicon_absolute_uri = scheme.."://"..hostaddress..":"..port.number..favicon_relative_uri + favicon = http.get_url(favicon_absolute_uri, {}) + + if (favicon and favicon.status == 200) then + stdnse.debug1("[SUCCESS] Load favicon %s", favicon_absolute_uri) + output.favicon = favicon_absolute_uri + else + stdnse.debug1("[ERROR] Can't load favicon %s", favicon_absolute_uri) + end + + return output +end + +--- function taken from http_favicon.nse by Vlatko Kosturjak + +function parseIcon( body ) + local _, i, j + local rel, href, word + + -- Loop through link elements. + i = 0 + while i do + _, i = string.find(body, "<%s*[Ll][Ii][Nn][Kk]%s", i + 1) + if not i then + return nil + end + -- Loop through attributes. + j = i + while true do + local name, quote, value + _, j, name, quote, value = string.find(body, "^%s*(%w+)%s*=%s*([\"'])(.-)%2", j + 1) + if not j then + break + end + if string.lower(name) == "rel" then + rel = value + elseif string.lower(name) == "href" then + href = value + end + end + for word in string.gmatch(rel or "", "%S+") do + if string.lower(word) == "icon" then + return href + end + end + end +end diff --git a/scripts/smb-authentication.ini b/scripts/smb-authentication.ini new file mode 100644 index 0000000..f8b93ee --- /dev/null +++ b/scripts/smb-authentication.ini @@ -0,0 +1,2 @@ +smbuser = +smbpassword = diff --git a/scripts/smb-shares-size.nse b/scripts/smb-shares-size.nse new file mode 100644 index 0000000..c7b4dcd --- /dev/null +++ b/scripts/smb-shares-size.nse @@ -0,0 +1,206 @@ +local stdnse = require "stdnse" +local smb = require "smb" +local smb2 = require "smb2" +local msrpc = require "msrpc" +local bin = require "bin" +local shortport = require "shortport" + +description = [[ +Return free and total size in octets of each SMB shares +]] + +--- +-- @args See the documentation for the smbauth library. +-- +-- @usage nmap -p137-139,445 --script smb-shares-size.nse --script-args-file smb-authentication.ini +-- +-- @output +-- Host script results: +-- | smb-shares-size: +-- | data: +-- | FreeSize: 38495883264 +-- | TotalSize: 500961574912 +-- |_ IPC$: NT_STATUS_ACCESS_DENIED +--- + +categories = {"discovery", "intrusive"} +author = "Adrien Malingrey" +license = "Same as Nmap--See https://nmap.org/book/man-legal.html" + +portrule = shortport.service({"microsoft-ds", "netbios-ssn", "smb"}) + + +action = function(host) + local status, shares, extra + local response = stdnse.output_table() + + -- Try and do this the good way, make a MSRPC call to get the shares + stdnse.debug1("SMB: Attempting to log into the system to enumerate shares") + status, shares = msrpc.enum_shares(host) + if(status == false) then + return stdnse.format_output(false, string.format("Couldn't enumerate shares: %s", shares)) + end + + -- Get more information on each share + for i = 1, #shares, 1 do + local share = shares[i] + if (share ~= nil) then + local status, result = get_share_info(host, share) + if (status) then + response[share] = result + end + end + end + + return response +end + +TRANS2_QUERY_FS_INFORMATION = 0x0003 +SMB_QUERY_FS_SIZE_INFO = 0x0103 +---Attempts to retrieve additional information about a share. Will fail unless we have +-- administrative access. +-- +--@param host The host object. +--@return Status (true or false). +--@return A table of information about the share (if status is true) or an an error string (if +-- status is false). +function get_share_info(host, share) + local status, smbstate, err + local hostaddress = (host.name ~= '' and host.name) or host.ip + local path = "\\\\" .. hostaddress .. "\\" .. share + + status, smbstate = smb.start(host) + status, err = smb.negotiate_protocol(smbstate, {}) + status, err = smb.start_session(smbstate, {}) + status, err = smb.tree_connect(smbstate, path, {}) + + stdnse.debug1("SMB: Getting information for share: %s", path) + + local status, err = send_transaction2(smbstate, TRANS2_QUERY_FS_INFORMATION, bin.pack("