nmap_cmd.xsl

@@ -10,7 +10,7 @@
 <xsl:template match="lanScan">
 <xsl:text>nmap -v -T4 -p </xsl:text>
 <xsl:apply-templates select="//service[not(.=preceding::*)]" />
-<xsl:text> --script nse/ --datadir nse/ --script-args-file nse_args.ini -oX "</xsl:text>
+<xsl:text> --script "nse/" -oX "</xsl:text>
 <xsl:value-of select="@scanpath"/>
 <xsl:text>.tmp" </xsl:text>
 <xsl:apply-templates select="//host"/>

nse/http-info.nse

@@ -7,7 +7,7 @@ Get and return a page info
 ---
 -- @args http-get.path Path to get. Default /.
 --
--- @usage nmap -p80 --script http-info.nse --script-args http-info.path=/ <host>
+-- @usage nmap -p80 --script http-info.nse --script-args http-info.path=/ <target>
 --
 -- @output
 -- status: 200

nse/nse_args.ini

@@ -1,2 +0,0 @@
-smbuser=<user name>
-smbpassword=<user password>

nse/smb-shares-du.nse

@@ -1,35 +1,13 @@
-local stdnse = require "stdnse"
+  local stdnse = require "stdnse"
-local smb    = require "smb"
+  local smb = require "smb"
-local msrpc  = require "msrpc"
+  local msrpc = require "msrpc"
-local bin    = require "bin"
+  local msrpctypes = require "msrpctypes"
 
-description = [[
+  hostrule = function(host)
-Return free and total size in octets of each SMB shares
-]]
-
----
--- @args See the documentation for the smbauth library.
---
--- @usage nmap -p445 --script smb-shares-du.nse <host>
---
--- @output
--- Host script results:
--- | smb-shares-du:
--- |   data:
--- |     FreeSize: 38495883264
--- |     TotalSize: 500961574912
--- |_  IPC$: NT_STATUS_ACCESS_DENIED
----
-
-categories = {"discovery", "intrusive"}
-author = "Adrien Malingrey"
-license = "Same as Nmap--See https://nmap.org/book/man-legal.html"
-
-hostrule = function(host)
       return smb.get_port(host) ~= nil
-end
+  end
 
-action = function(host)
+  action = function(host)
     local status, shares, extra
     local response = stdnse.output_table()
 
@@ -43,154 +21,119 @@ action = function(host)
     -- Get more information on each share
     for i = 1, #shares, 1 do
       local share = shares[i]
+      stdnse.debug1("SMB: Getting information for share: %s", share)
 
-    local status, result = get_share_info(host, share)
+      status, result = get_share_info(host, share)
       response[share] = result
     end
 
-  --table.sort(response)
-
     return response
-end
-
-TRANS2_QUERY_FS_INFORMATION = 0x0003
-SMB_QUERY_FS_SIZE_INFO      = 0x0103
----Attempts to retrieve additional information about a share. Will fail unless we have
--- administrative access.
---
---@param host The host object.
---@return Status (true or false).
---@return A table of information about the share (if status is true) or an an error string (if
---        status is false).
-function get_share_info(host, share)
-  local status, smbstate, err
-  local hostaddress = (host.name ~= '' and host.name) or host.ip
-  local path = "\\\\" .. hostaddress .. "\\" .. share
-
-  status, smbstate = smb.start(host)
-  status, err      = smb.negotiate_protocol(smbstate, {})
-  status, err      = smb.start_session(smbstate, {})
-  status, err      = smb.tree_connect(smbstate, path, {})
-  
-  stdnse.debug1("SMB: Getting information for share: %s", path)
-  
-  local status, err = send_transaction2(smbstate, TRANS2_QUERY_FS_INFORMATION, bin.pack("<S", SMB_QUERY_FS_SIZE_INFO))
-  if ( not(status) ) then
-    status, err      = smb.stop(smbstate)
-    return false, "Failed to send data to server: send_transaction2"
   end
 
-  local status, response = receive_transaction2(smbstate)
-  if ( not(status) ) then
-    status, err      = smb.stop(smbstate)
-    return false, response
-  end
 
-  local pos, totalAllocationUnits, totalFreeAllocationUnits, sectorsPerAllocationUnit, bytesPerSector = bin.unpack("<LLII", response.data)
+  ---Attempts to retrieve additional information about a share. Will fail unless we have
-
+  -- administrative access.
-  status, err      = smb.stop(smbstate)
+  --
-
+  --@param host The host object.
-  return true, {
+  --@return Status (true or false).
-    TotalSize = totalAllocationUnits * sectorsPerAllocationUnit * bytesPerSector,
+  --@return A table of information about the share (if status is true) or an an error string (if
-    FreeSize = totalFreeAllocationUnits * sectorsPerAllocationUnit * bytesPerSector
+  --        status is false).
-  }
+  function get_share_info(host, name)
-end
-
--- Taken from smb lib
-
-function send_transaction2(smbstate, sub_command, function_parameters, function_data, overrides)
-  overrides = overrides or {}
-  local header1, header2, header3, header4, command, status, flags, flags2, pid_high, signature, unused, pid, mid
-  local header, parameters, data
-  local parameter_offset = 0
-  local parameter_size   = 0
-  local data_offset      = 0
-  local data_size        = 0
-  local total_word_count, total_data_count, reserved1, parameter_count, parameter_displacement, data_count, data_displacement, setup_count, reserved2
     local response = {}
 
-  -- Header is 0x20 bytes long (not counting NetBIOS header).
+    -- Create the SMB session
-  header = smb.smb_encode_header(smbstate, smb.command_codes['SMB_COM_TRANSACTION2'], overrides) -- 0x32 = SMB_COM_TRANSACTION2
+    local status, smbstate = msrpc.start_smb(host, msrpc.SRVSVC_PATH)
-
+    if(status == false) then
-  if(function_parameters) then
+      return false, smbstate
-    parameter_offset = 0x44
-    parameter_size = #function_parameters
-    data_offset = #function_parameters + 33 + 32
     end
 
-  -- Parameters are 0x20 bytes long.
+    -- Bind to SRVSVC service
-  parameters = bin.pack("<SSSSCCSISSSSSCCS",
+    local status, bind_result = msrpc.bind(smbstate, msrpc.SRVSVC_UUID, msrpc.SRVSVC_VERSION, nil)
-    parameter_size,                  -- Total parameter count.
+    if(status == false) then
-    data_size,                       -- Total data count.
+      smb.stop(smbstate)
-    0x000a,                          -- Max parameter count.
+      return false, bind_result
-    0x3984,                          -- Max data count.
-    0x00,                            -- Max setup count.
-    0x00,                            -- Reserved.
-    0x0000,                          -- Flags (0x0000 = 2-way transaction, don't disconnect TIDs).
-    0x00001388,                      -- Timeout (0x00000000 = return immediately).
-    0x0000,                          -- Reserved.
-    parameter_size,                  -- Parameter bytes.
-    parameter_offset,                -- Parameter offset.
-    data_size,                       -- Data bytes.
-    data_offset,                     -- Data offset.
-    0x01,                            -- Setup Count
-    0x00,                            -- Reserved
-    sub_command                      -- Sub command
-    )
-
-  local data = "\0\0\0" .. (function_parameters or '')
-  .. (function_data or '')
-
-  -- Send the transaction request
-  stdnse.debug2("SMB: Sending SMB_COM_TRANSACTION2")
-  local result, err = smb.smb_send(smbstate, header, parameters, data, overrides)
-  if(result == false) then
-    return false, err
     end
 
-  return true
+    -- Call NetShareGetInfo
-end
 
-function receive_transaction2(smbstate)
+    local status, netsharegetinfo_result = srvsvc_netsharegetinfo(smbstate, host.ip, name, 2)
+    stdnse.debug2("NetShareGetInfo status:%s result:%s", status, netsharegetinfo_result)
+    if(status == false) then
+      if(string.find(netsharegetinfo_result, "NT_STATUS_WERR_ACCESS_DENIED")) then
+        stdnse.debug2("Calling NetShareGetInfo with information level 1")
+        status, netsharegetinfo_result = srvsvc_netsharegetinfo(smbstate, host.ip, name, 1)
+        if status then
+          smb.stop(smbstate)
+          return true, netsharegetinfo_result
+        end
+      end
+      smb.stop(smbstate)
+      return false, netsharegetinfo_result
+    end
 
-  -- Read the result
+    smb.stop(smbstate)
-  local status, header, parameters, data = smb.smb_read(smbstate)
+
+    return true, netsharegetinfo_result
+  end
+
+
+  ---Call the MSRPC function <code>netsharegetinfo</code> on the remote system. This function retrieves extra information about a share
+  -- on the system.
+  --
+  --@param smbstate The SMB state table
+  --@param server   The IP or Hostname of the server (seems to be ignored but it's a good idea to have it)
+  --@return (status, result) If status is false, result is an error message. Otherwise, result is a table of values, the most
+  --        useful one being 'shares', which is a list of the system's shares.
+  function srvsvc_netsharegetinfo(smbstate, server, share, level)
+    stdnse.debug2("Calling NetShareGetInfo(%s, %s, %d)", server, share, level)
+
+    --NetGetShareInfo seems to reject FQPN and reads the server value from the request
+    --If any function called this function using a FQPN, this should take care of it.
+    local _, _, sharename = string.find(share, "\\\\.*\\(.*)")
+    if sharename then
+      share = sharename
+    end
+    --    [in]   [string,charset(UTF16)] uint16 *server_unc,
+    local arguments = msrpctypes.marshall_unicode_ptr("\\\\" .. server, true)
+
+    --    [in]   [string,charset(UTF16)] uint16 share_name[],
+    .. msrpctypes.marshall_unicode(share, true)
+
+    --    [in]   uint32 level,
+    .. msrpctypes.marshall_int32(level)
+
+    --    [out,switch_is(level)] srvsvc_NetShareInfo info
+
+
+    -- Do the call
+    local status, result = msrpc.call_function(smbstate, smb.command_codes.SMB_COM_QUERY_INFORMATION_DISK, arguments)
     if(status ~= true) then
-    return false, header
+      return false, result
     end
 
-  -- Check if it worked
+    stdnse.debug3("MSRPC: NetShareGetInfo() returned successfully")
-  local pos, header1, header2, header3, header4, command, status, flags, flags2, pid_high, signature, unused, tid, pid, uid, mid = bin.unpack("<CCCCCICSSlSSSSS", header)
+
-  if(header1 == nil or mid == nil) then
+    -- Make arguments easier to use
-    return false, "SMB: ERROR: Server returned less data than it was supposed to (one or more fields are missing); aborting [29]"
+    arguments = result['arguments']
-  end
+    local pos = 1
-  if(status ~= 0) then
+
-    if(smb.status_names[status] == nil) then
+    --    [in]   [string,charset(UTF16)] uint16 *server_unc,
-      return false, string.format("Unknown SMB error: 0x%08x\n", status)
+    --    [in]   [string,charset(UTF16)] uint16 share_name[],
-    else
+    --    [in]   uint32 level,
-      return false, smb.status_names[status]
+    --    [out,switch_is(level)] srvsvc_NetShareInfo info
-    end
+    pos, result['info'] = msrpctypes.unmarshall_srvsvc_NetShareInfo(arguments, pos)
+    if(pos == nil) then
+      return false, "unmarshall_srvsvc_NetShareInfo() returned an error"
     end
 
-  -- Parse the parameters
+    -- The return value
-  local pos, total_word_count, total_data_count, reserved1, parameter_count, parameter_offset, parameter_displacement, data_count, data_offset, data_displacement, setup_count, reserved2 = bin.unpack("<SSSSSSSSSCC", parameters)
+    pos, result['return'] = msrpctypes.unmarshall_int32(arguments, pos)
-  if(total_word_count == nil or reserved2 == nil) then
+    if(result['return'] == nil) then
-    return false, "SMB: ERROR: Server returned less data than it was supposed to (one or more fields are missing); aborting [30]"
+      return false, "Read off the end of the packet (srvsvc.netsharegetinfo)"
+    end
+    if(result['return'] ~= 0) then
+      return false, smb.get_status_name(result['return']) .. " (srvsvc.netsharegetinfo)"
     end
 
-  -- Convert the parameter/data offsets into something more useful (the offset into the data section)
+    return true, result
-  -- - 0x20 for the header, - 0x01 for the length.
+  end
-  parameter_offset = parameter_offset - 0x20 - 0x01 - #parameters - 0x02;
-  -- - 0x20 for the header, - 0x01 for parameter length, the parameter length, and - 0x02 for the data length.
-  data_offset = data_offset - 0x20 - 0x01 - #parameters - 0x02;
-
-  -- I'm not sure I entirely understand why the '+1' is here, but I think it has to do with the string starting at '1' and not '0'.
-  local function_parameters = string.sub(data, parameter_offset + 1, parameter_offset + parameter_count)
-  local function_data       = string.sub(data, data_offset      + 1, data_offset      + data_count)
-
-  local response = {}
-  response['parameters'] = function_parameters
-  response['data']       = function_data
-
-  return true, response
-end

results.xsl

@@ -94,12 +94,6 @@
             </xsl:otherwise>
         </xsl:choose>
     </xsl:variable>
-    <xsl:variable name="name">
-        <xsl:choose>
-            <xsl:when test="@name"><xsl:value-of select="@name"/></xsl:when>
-            <xsl:when test="$scannedHost/hostnames/hostname/@name"><xsl:value-of select="substring-before($scannedHost/hostnames/hostname/@name, '.')"/></xsl:when>
-        </xsl:choose>
-    </xsl:variable>
     <div class="column">
         <xsl:variable name="status">
             <xsl:choose>
@@ -116,9 +110,10 @@
                     <i class="server icon"></i>
                 </xsl:otherwise>
             </xsl:choose>
-            <input type="text" readonly="" value="{$name}" placeholder="{$scannedHost/address/@addr}"
+            <input type="text" readonly="" value="{substring-before($scannedHost/hostnames/hostname/@name, '.')}"
-            title="{@comment} {$scannedHost/hostnames/hostname/@name} ({$scannedHost/address/@addr}) "
+                title="{$scannedHost/hostnames/hostname/@name} ({$scannedHost/address/@addr})" placeholder="{$scannedHost/address/@addr}"
-                onfocus="this.value='{$scannedHostAddress}'; this.select()" onblur="this.value='{$name}'"
+                onfocus="this.value='{$scannedHostAddress}'; this.select()"
+                onblur="this.value='{substring-before($scannedHost/hostnames/hostname/@name, '.')}'"
             />
             <xsl:apply-templates select="service">
                 <xsl:with-param name="scannedHost" select="$scannedHost"/>
@@ -150,8 +145,9 @@
         <xsl:value-of select="$scannedPort/state/@state"/>
         <xsl:text> </xsl:text>
         <xsl:value-of select="$scannedPort/service/@name"/>
-        <xsl:if test="$scannedPort/script[@id='http-info']"><xsl:text>
+        <xsl:if test="$scannedPort/script[@id='http-info']">
-</xsl:text><xsl:value-of select="$scannedPort/script[@id='http-info']/elem[@key='status-line']"/>
+            <xsl:text> </xsl:text>
+            <xsl:value-of select="$scannedPort/script[@id='http-info']/elem[@key='status-line']"/>
             <xsl:value-of select="$scannedPort/script[@id='http-info']/elem[@key='title']"/>
         </xsl:if>
     </xsl:variable>
@@ -167,7 +163,7 @@
                 </div>
             </div>
         </xsl:when>
-        <xsl:when test="$scannedPort/service/@name='ms-wbt-server' or $scannedPort/service/@name='msrpc'">
+        <xsl:when test="$scannedPort/service/@name='ms-wbt-server' or $scannedPort/service/@name='rdp'">
             <a class="ui {$state} mini button" href="../rdp.php?v={$scannedHostAddress}:{$scannedPort/@portid}" title="{$title}">
                 <xsl:value-of select="$serviceName"/>
             </a>

scan

@@ -8,8 +8,8 @@ fi
 pushd "$(dirname -- "$0")" > /dev/null
 site="$(basename ${1/.yaml/})"
 
-php "to_XML.php" "configs/$site.yaml" > "site/$site.xml" \
+php "to_XML.php" "configs/$site.yaml" > "site/$site.xml"
-&& eval $(xsltproc "nmap_cmd.xsl" "site/$site.xml") \
+eval $(xsltproc "nmap_cmd.xsl" "site/$site.xml")
-&& mv "scans/$site.xml.tmp" "scans/$site.xml"
+mv "scans/$site.xml.tmp" "scans/$site.xml"
 
 popd  > /dev/null

scan_all

@@ -9,7 +9,7 @@ for config in configs/*.yaml
 do
     site="$(basename ${config/.yaml/})"
     echo "Scan $site"
-    ./scan "$site"
+    ./scan "$site" &
 done
 
 popd > /dev/null