diff --git a/nselib/sslv2.lua b/nselib/sslv2.lua index d956ac5d7..6d4e93909 100644 --- a/nselib/sslv2.lua +++ b/nselib/sslv2.lua @@ -9,6 +9,8 @@ local stdnse = require "stdnse" local bin = require "bin" local bit = require "bit" local table = require "table" +local nmap = require "nmap" +local sslcert = require "sslcert" _ENV = stdnse.module("sslv2", stdnse.seeall) SSL_MESSAGE_TYPES = { @@ -290,4 +292,57 @@ function record_buffer(sock, buffer, i) return true, buffer end +function test_sslv2 (host, port) + local timeout = stdnse.get_timeout(host, 10000, 5000) + + -- Create socket. + local status, socket, err + local starttls = sslcert.getPrepareTLSWithoutReconnect(port) + if starttls then + status, socket = starttls(host, port) + if not status then + stdnse.debug(1, "Can't connect using STARTTLS: %s", socket) + return nil + end + else + socket = nmap.new_socket() + socket:set_timeout(timeout) + status, err = socket:connect(host, port) + if not status then + stdnse.debug(1, "Can't connect: %s", err) + return nil + end + end + + socket:set_timeout(timeout) + + local ssl_v2_hello = client_hello(stdnse.keys(SSL_CIPHER_CODES)) + + socket:send(ssl_v2_hello) + + local status, record = record_buffer(socket) + socket:close(); + if not status then + return nil + end + + local _, message = record_read(record) + + -- some sanity checks: + -- is it SSLv2? + if not message or not message.body then + return + end + -- is response a server hello? + if (message.message_type ~= SSL_MESSAGE_TYPES.SERVER_HELLO) then + return + end + ---- is certificate in X.509 format? + --if (message.body.cert_type ~= 1) then + -- return + --end + + return message.body.ciphers +end + return _ENV; diff --git a/scripts/sslv2.nse b/scripts/sslv2.nse index 9eb860cb3..0b7e0a4d0 100644 --- a/scripts/sslv2.nse +++ b/scripts/sslv2.nse @@ -1,11 +1,4 @@ -local nmap = require "nmap" -local match = require "match" local shortport = require "shortport" -local string = require "string" -local table = require "table" -local bin = require "bin" -local bit = require "bit" -local stdnse = require "stdnse" local sslcert = require "sslcert" local sslv2 = require "sslv2" @@ -40,7 +33,7 @@ supports. -- -author = "Matthew Boyle" +author = {"Matthew Boyle", "Daniel Miller"} license = "Same as Nmap--See https://nmap.org/book/man-legal.html" categories = {"default", "safe"} @@ -51,58 +44,14 @@ portrule = function(host, port) end action = function(host, port) - local timeout = stdnse.get_timeout(host, 10000, 5000) + local ciphers = sslv2.test_sslv2(host, port) - -- Create socket. - local status, socket, err - local starttls = sslcert.getPrepareTLSWithoutReconnect(port) - if starttls then - status, socket = starttls(host, port) - if not status then - stdnse.debug(1, "Can't connect using STARTTLS: %s", socket) - return nil - end - else - socket = nmap.new_socket() - socket:set_timeout(timeout) - status, err = socket:connect(host, port) - if not status then - stdnse.debug(1, "Can't connect: %s", err) - return nil - end + if ciphers then + host.registry.sslv2 = host.registry.sslv2 or {} + host.registry.sslv2[port.number .. port.protocol] = ciphers + return { + "SSLv2 supported", + ciphers = #ciphers > 0 and ciphers or "none" + } end - - socket:set_timeout(timeout) - - local ssl_v2_hello = sslv2.client_hello(stdnse.keys(sslv2.SSL_CIPHER_CODES)) - - socket:send(ssl_v2_hello) - - local status, record = sslv2.record_buffer(socket) - socket:close(); - if not status then - return nil - end - - local _, message = sslv2.record_read(record) - - -- some sanity checks: - -- is it SSLv2? - if not message or not message.body then - return - end - -- is response a server hello? - if (message.message_type ~= sslv2.SSL_MESSAGE_TYPES.SERVER_HELLO) then - return - end - ---- is certificate in X.509 format? - --if (message.body.cert_type ~= 1) then - -- return - --end - - return { - "SSLv2 supported", - ciphers = #message.body.ciphers > 0 and message.body.ciphers or "none" - } - end