o [NSE] Added the scripts xdmcp-discover, broadcast-xdmcp-discover and the

X Display Manager Control Protocol (xdmcp) library. The scripts discover
  hosts either using unicast or broadcast and try to detect supported
  authentication and authorization mechanisms. [Patrik]

scripts/broadcast-xdmcp-discover.nse

@@ -0,0 +1,69 @@
+description = [[
+Discovers servers running the X Display Manager Control Protocol (XDMCP) by
+sending a XDMCP broadcast request to the LAN. Display managers allowing access
+are marked using the keyword Willing in the result.
+]]
+
+---
+-- @usage
+-- nmap --script broadcast-xdmcp-discover
+--
+-- @output
+-- Pre-scan script results:
+-- | broadcast-xdmcp-discover: 
+-- |_  192.168.2.162 - Willing
+--
+-- @arg broadcast-xdmcp-discover.timeout socket timeout in seconds (default: 5)
+
+author = "Patrik Karlsson"
+license = "Same as Nmap--See http://nmap.org/book/man-legal.html"
+categories = {"broadcast", "safe"}
+
+require 'xdmcp'
+
+prerule = function() return true end
+
+local arg_timeout = stdnse.get_script_args(SCRIPT_NAME .. ".timeout")
+
+action = function()
+
+	local host, port = { ip = "255.255.255.255" }, { number = 177, protocol = "udp" }
+	local options = { timeout = 1 }	
+	local helper = xdmcp.Helper:new(host, port, options)
+	local status = helper:connect()
+	
+	local req = xdmcp.Packet[xdmcp.OpCode.BCAST_QUERY]:new(nil)
+	local status, err = helper:send(req)
+	if ( not(status) ) then
+		return false, response
+	end
+	
+	local timeout = arg_timeout or 5
+	local start = os.time()
+	local result = {}
+	repeat
+
+		local status, response = helper:recv()
+		if ( not(status) and response ~= "TIMEOUT" ) then
+			break
+		elseif ( status ) then
+			local status, _, _, rhost = helper.socket:get_info()
+			if ( response.header.opcode == xdmcp.OpCode.WILLING ) then
+				result[rhost] = true
+			else
+				result[rhost] = false
+			end
+		end
+		
+	until( os.time() - start > timeout )
+
+	local output = {}
+	for ip, res in pairs(result) do
+		if ( res ) then
+			table.insert(output, ("%s - Willing"):format(ip))
+		else
+			table.insert(output, ("%s - Unwilling"):format(ip))
+		end
+	end
+	return stdnse.format_output(true, output)
+end

scripts/script.db

@@ -36,6 +36,7 @@ Entry { filename = "broadcast-upnp-info.nse", categories = { "broadcast", "safe"
 Entry { filename = "broadcast-wake-on-lan.nse", categories = { "broadcast", "safe", } }
 Entry { filename = "broadcast-wpad-discover.nse", categories = { "broadcast", "safe", } }
 Entry { filename = "broadcast-wsdd-discover.nse", categories = { "broadcast", "safe", } }
+Entry { filename = "broadcast-xdmcp-discover.nse", categories = { "broadcast", "safe", } }
 Entry { filename = "citrix-brute-xml.nse", categories = { "auth", "intrusive", } }
 Entry { filename = "citrix-enum-apps-xml.nse", categories = { "discovery", "safe", } }
 Entry { filename = "citrix-enum-apps.nse", categories = { "discovery", "safe", } }
@@ -313,5 +314,6 @@ Entry { filename = "wdb-version.nse", categories = { "default", "discovery", "ve
 Entry { filename = "whois.nse", categories = { "discovery", "external", "safe", } }
 Entry { filename = "wsdd-discover.nse", categories = { "default", "discovery", "safe", } }
 Entry { filename = "x11-access.nse", categories = { "auth", "default", "safe", } }
+Entry { filename = "xdmcp-discover.nse", categories = { "discovery", "safe", } }
 Entry { filename = "xmpp-brute.nse", categories = { "brute", "intrusive", } }
 Entry { filename = "xmpp-info.nse", categories = { "default", "discovery", "safe", "version", } }

scripts/xdmcp-discover.nse

@@ -0,0 +1,64 @@
+description = [[
+Requests a XDMCP session and lists supported authentication and authorization mechanisms 
+]]
+
+---
+-- @usage
+-- nmap -sU -p 177 --script xdmcp-discover <ip>
+--
+-- @output
+-- PORT    STATE         SERVICE
+-- 177/udp open|filtered xdmcp
+-- | xdmcp-discover: 
+-- |   Session id: 0x0000703E
+-- |   Authorization name: MIT-MAGIC-COOKIE-1
+-- |_  Authorization data: c282137c9bf8e2af88879e6eaa922326
+--
+
+author = "Patrik Karlsson"
+license = "Same as Nmap--See http://nmap.org/book/man-legal.html"
+categories = {"safe", "discovery"}
+
+require 'ipOps'
+require 'shortport'
+require 'xdmcp'
+
+portrule = shortport.port_or_service(177, "xdmcp", "udp")
+
+local mutex = nmap.mutex("xdmcp-discover")
+local function fail(err) return ("\n  ERROR: %s"):format(err or "") end
+	
+
+action = function(host, port)
+
+	local DISPLAY_ID = 1
+	local result = {}
+
+	local helper = xdmcp.Helper:new(host, port)
+	local status = helper:connect()
+	if ( not(status) ) then
+		return fail("Failed to connect to server")
+	end
+
+	local status, response = helper:createSession(nil, 
+		{"MIT-MAGIC-COOKIE-1", "XDM-AUTHORIZATION-1"}, DISPLAY_ID)
+	
+	if ( not(status) ) then
+		return fail("Failed to create xdmcp session")
+	end
+
+	table.insert(result, ("Session id: 0x%.8X"):format(response.session_id))
+	if ( response.auth_name and 0 < #response.auth_name ) then
+		table.insert(result, ("Authentication name: %s"):format(response.auth_name))
+	end
+	if ( response.auth_data and 0 < #response.auth_data ) then
+		table.insert(result, ("Authentication data: %s"):format(stdnse.tohex(response.auth_data)))
+	end
+	if ( response.authr_name and 0 < #response.authr_name ) then
+		table.insert(result, ("Authorization name: %s"):format(response.authr_name))
+	end
+	if ( response.authr_data and 0 < #response.authr_data ) then
+		table.insert(result, ("Authorization data: %s"):format(stdnse.tohex(response.authr_data)))
+	end
+	return stdnse.format_output(true, result)
+end