From ad63f0691bbe927ba604c57ea45000806ff855a3 Mon Sep 17 00:00:00 2001 From: adrien Date: Tue, 4 Feb 2025 13:35:46 +0100 Subject: [PATCH] script-args --- .gitignore | 3 +- home.php | 102 ------------------ script-args.ini | 3 + scripts/README.md | 34 ++++++ scripts/http-info.nse | 113 ++++++++++++++++++++ scripts/smb-shares-size.nse | 206 ++++++++++++++++++++++++++++++++++++ stylesheets/hostScan.xsl | 103 ++++++++++-------- stylesheets/lanScan.xsl | 10 +- stylesheets/nav.xsl | 58 +++++++--- 9 files changed, 467 insertions(+), 165 deletions(-) delete mode 100644 home.php create mode 100644 script-args.ini create mode 100644 scripts/README.md create mode 100644 scripts/http-info.nse create mode 100644 scripts/smb-shares-size.nse diff --git a/.gitignore b/.gitignore index d91083d..4733cef 100644 --- a/.gitignore +++ b/.gitignore @@ -1,3 +1,2 @@ scans/ -datadir/script-args.ini -test.php \ No newline at end of file +test.php diff --git a/home.php b/home.php deleted file mode 100644 index a36aa8d..0000000 --- a/home.php +++ /dev/null @@ -1,102 +0,0 @@ - - - - - - - lanScan - - - - - - - - -
-
- -
-
-

Découvrir ou superviser un réseau

-
- -
-
- -
-
- -
- Options avancées -
-
-
- - - - - - - - +@output +80/tcp open http +| http-info: +| status-line: HTTP/1.1 200 OK\x0D +| +| title: Go ahead and ScanMe! +| favicon: http://scanme.nmap.org:80/shared/images/tiny-eyeicon.png +|_ status: 200 +``` + +## smb-shares-size.nse + +Return free and total size in octets of each SMB shares + +```lua +@args See the documentation for the smbauth library. +@usage nmap -p137-139,445 --script smb-shares-size.nse --script-args-file smb-shares-size.ini +@output +Host script results: +| smb-shares-size: +| data: +| FreeSize: 38495883264 +| TotalSize: 500961574912 +|_ IPC$: NT_STATUS_ACCESS_DENIED +``` diff --git a/scripts/http-info.nse b/scripts/http-info.nse new file mode 100644 index 0000000..885c5cd --- /dev/null +++ b/scripts/http-info.nse @@ -0,0 +1,113 @@ +local shortport = require "shortport" + +description = [[ +Return status, title and favicon URL of a webpage +]] + +--- +-- @args http-get.path Path to get. Default /. +-- +-- @usage nmap -phttp,https --script http-info.nse --script-args http-info.path=/ +-- +-- @output +-- 80/tcp open http +-- | http-info: +-- | status-line: HTTP/1.1 200 OK\x0D +-- | +-- | title: Go ahead and ScanMe! +-- | favicon: http://scanme.nmap.org:80/shared/images/tiny-eyeicon.png +-- |_ status: 200 +--- + +categories = {"discovery", "intrusive"} +author = "Adrien Malingrey" +license = "Same as Nmap--See https://nmap.org/book/man-legal.html" + +portrule = shortport.http + +local http = require "http" +local stdnse = require "stdnse" + +action = function(host, port) + local scheme = "" + local hostaddress = (host.name ~= '' and host.name) or host.ip + local path = "/" + local favicon_relative_uri = "/favicon.ico" + local favicon + + stdnse.debug1("port", port.service) + if (port.service == "ssl") then + scheme = "https" + else + scheme = port.service + end + stdnse.debug1("scheme", scheme) + + if(stdnse.get_script_args('http-get.path')) then + path = stdnse.get_script_args('http-info.path') + end + + stdnse.debug1("Try to download %s", path) + local answer = http.get(hostaddress, port, path) + + local output = {status=answer.status, ["status-line"]=answer["status-line"]} + + if (answer and answer.status == 200) then + stdnse.debug1("[SUCCESS] Load page %s", path) + -- Taken from http-title.nse by Diman Todorov + local title = string.match(answer.body, "<[Tt][Ii][Tt][Ll][Ee][^>]*>([^<]*)") + if (title) then + output.title = title + end + stdnse.debug1("[INFO] Try favicon %s", favicon_relative_uri) + favicon_relative_uri = parseIcon(answer.body) or favicon_relative_uri + else + stdnse.debug1("[ERROR] Can't load page %s", path) + end + + favicon = http.get(hostaddress, port, favicon_relative_uri) + + if (favicon and favicon.status == 200) then + stdnse.debug1("[SUCCESS] Load favicon %s", favicon_relative_uri) + output.favicon = favicon_relative_uri + else + stdnse.debug1("[ERROR] Can't load favicon %s", favicon_relative_uri) + end + + return output +end + +--- function taken from http_favicon.nse by Vlatko Kosturjak + +function parseIcon( body ) + local _, i, j + local rel, href, word + + -- Loop through link elements. + i = 0 + while i do + _, i = string.find(body, "<%s*[Ll][Ii][Nn][Kk]%s", i + 1) + if not i then + return nil + end + -- Loop through attributes. + j = i + while true do + local name, quote, value + _, j, name, quote, value = string.find(body, "^%s*(%w+)%s*=%s*([\"'])(.-)%2", j + 1) + if not j then + break + end + if string.lower(name) == "rel" then + rel = value + elseif string.lower(name) == "href" then + href = value + end + end + for word in string.gmatch(rel or "", "%S+") do + if string.lower(word) == "icon" then + return href + end + end + end +end diff --git a/scripts/smb-shares-size.nse b/scripts/smb-shares-size.nse new file mode 100644 index 0000000..324bf2a --- /dev/null +++ b/scripts/smb-shares-size.nse @@ -0,0 +1,206 @@ +local shortport = require "shortport" + +description = [[ +Return free and total size in octets of each SMB shares +]] + +--- +-- @args See the documentation for the smbauth library. +-- +-- @usage nmap -p137-139,445 --script smb-shares-size.nse --script-args-file smb-authentication.ini +-- +-- @output +-- Host script results: +-- | smb-shares-size: +-- | data: +-- | FreeSize: 38495883264 +-- | TotalSize: 500961574912 +-- |_ IPC$: NT_STATUS_ACCESS_DENIED +--- + +categories = {"discovery", "intrusive"} +author = "Adrien Malingrey" +license = "Same as Nmap--See https://nmap.org/book/man-legal.html" + +portrule = shortport.service({"microsoft-ds", "netbios-ssn", "smb"}) + +local stdnse = require "stdnse" +local smb = require "smb" +local smb2 = require "smb2" +local msrpc = require "msrpc" +local bin = require "bin" + +action = function(host) + local status, shares, extra + local response = stdnse.output_table() + + -- Try and do this the good way, make a MSRPC call to get the shares + stdnse.debug1("SMB: Attempting to log into the system to enumerate shares") + status, shares = msrpc.enum_shares(host) + if(status == false) then + return stdnse.format_output(false, string.format("Couldn't enumerate shares: %s", shares)) + end + + -- Get more information on each share + for i = 1, #shares, 1 do + local share = shares[i] + if (share ~= nil) then + local status, result = get_share_info(host, share) + if (status) then + response[share] = result + end + end + end + + return response +end + +TRANS2_QUERY_FS_INFORMATION = 0x0003 +SMB_QUERY_FS_SIZE_INFO = 0x0103 +---Attempts to retrieve additional information about a share. Will fail unless we have +-- administrative access. +-- +--@param host The host object. +--@return Status (true or false). +--@return A table of information about the share (if status is true) or an an error string (if +-- status is false). +function get_share_info(host, share) + local status, smbstate, err + local hostaddress = (host.name ~= '' and host.name) or host.ip + local path = "\\\\" .. hostaddress .. "\\" .. share + + status, smbstate = smb.start(host) + status, err = smb.negotiate_protocol(smbstate, {}) + status, err = smb.start_session(smbstate, {}) + status, err = smb.tree_connect(smbstate, path, {}) + + stdnse.debug1("SMB: Getting information for share: %s", path) + + local status, err = send_transaction2(smbstate, TRANS2_QUERY_FS_INFORMATION, bin.pack(" - + - - + + - + @@ -30,7 +34,8 @@
- + @@ -52,9 +57,12 @@ $('.ui.dropdown').dropdown() - - - + + + @@ -67,13 +75,13 @@ $('.ui.dropdown').dropdown()

- - ui inverted header + + ui inverted header - green - red - - + green + red + + @@ -84,7 +92,8 @@ $('.ui.dropdown').dropdown()

- +
@@ -144,20 +153,23 @@ $('.ui.dropdown').dropdown()
-
-
- - Informations supplémentaires + +
+
+ Informations supplémentaires
+
+ +
-
- -
-
+ -

Services

+

Services

- + @@ -170,9 +182,12 @@ $('.ui.dropdown').dropdown() - - - + + + red @@ -184,7 +199,8 @@ $('.ui.dropdown').dropdown() -
+
@@ -222,9 +238,7 @@ $('.ui.dropdown').dropdown()
- - Détails -
+ Détails
@@ -233,7 +247,8 @@ $('.ui.dropdown').dropdown()
- + @@ -241,7 +256,8 @@ $('.ui.dropdown').dropdown() rdp.php?v= &p= - + @@ -253,15 +269,15 @@ $('.ui.dropdown').dropdown() :// - + : - - Ouvrir - + Ouvrir
@@ -277,13 +293,14 @@ $('.ui.dropdown').dropdown() - +
- + @@ -303,7 +320,7 @@ $('.ui.dropdown').dropdown()
- +
@@ -314,7 +331,7 @@ $('.ui.dropdown').dropdown() -
+
@@ -325,7 +342,7 @@ $('.ui.dropdown').dropdown() -
+ diff --git a/stylesheets/lanScan.xsl b/stylesheets/lanScan.xsl index 9eda03d..3b13075 100644 --- a/stylesheets/lanScan.xsl +++ b/stylesheets/lanScan.xsl @@ -41,7 +41,7 @@ + class="ui sortable small compact stuck striped table"> @@ -54,7 +54,7 @@ + select="host | $init/host[not(address/@addr=$current/host/address/@addr)][not(status/@state='down')]"> @@ -127,7 +127,7 @@ $('.ui.dropdown').dropdown() -
down
 +
down
Etat
@@ -146,7 +146,7 @@ $('.ui.dropdown').dropdown() @@ -156,7 +156,7 @@ $('.ui.dropdown').dropdown() - + scan.php?host= diff --git a/stylesheets/nav.xsl b/stylesheets/nav.xsl index 1237863..78b28cc 100644 --- a/stylesheets/nav.xsl +++ b/stylesheets/nav.xsl @@ -1,15 +1,16 @@ + xmlns:xsl="http://www.w3.org/1999/XSL/Transform" + xmlns:xs="http://www.w3.org/2001/XMLSchema" + version="1.1"> - -
+
+ + + + + \ No newline at end of file