From 2d8fd95bff602149fb5e88c570bd75667bf6a919 Mon Sep 17 00:00:00 2001 From: fyodor Date: Thu, 6 Oct 2005 03:38:16 +0000 Subject: [PATCH] post 3.93 work --- CHANGELOG | 6 ++++++ nmap-service-probes | 5 ++++- service_scan.cc | 33 +++++++++++++++++++-------------- 3 files changed, 29 insertions(+), 15 deletions(-) diff --git a/CHANGELOG b/CHANGELOG index b52ad8a83..4ea92049f 100644 --- a/CHANGELOG +++ b/CHANGELOG @@ -1,5 +1,11 @@ # Nmap Changelog ($Id$) +o Version detection softmatches (when Nmap determines the service + protocol such as smtp but isn't able to determine the app name such as + Postfix) can now parse out the normal match line fields such as + hostname, device type, and extra info. For example, we may not know + what vendor created an sshd, but we can still parse out the protocol + number. This was a patch from Doug Hoyte (doug(a)hcsw.org). o Fixed a possible aliasing problem in tcpip.cc by applying a patch sent in by Gwenole Beauchesne (gbeauchesne(a)mandriva.com). This problem diff --git a/nmap-service-probes b/nmap-service-probes index ff1077d55..26394618d 100644 --- a/nmap-service-probes +++ b/nmap-service-probes @@ -452,6 +452,8 @@ match ftp-proxy m|^220 ([\w-_.]+) \(NetCache\) .*\r\n| p/NetApp NetCache ftp pro #match ftp m|^421 Service not available \(The FTP server is not responding\.\)\n$| v/unknown FTP server//service not responding/ match vdr m|^220 (\S+) SVDRP VideoDiskRecorder (\d[^\;]+);| p/VDR/ h/$1/ v/$2/ d/media device/ +softmatch ftp m/^220 ([-.\w]+) [-.\w ]+ftp.*\r\n$/i h/$1/ +softmatch ftp m/^220-([-.\w]+) [-.\w ]+ftp.*\r\n220/i h/$1/ softmatch ftp m/^220 [-.\w ]+ftp.*\r\n$/i softmatch ftp m/^220-[-.\w ]+ftp.*\r\n220/i softmatch ftp m/^220[- ].*ftp server.*\r\n/i @@ -573,6 +575,7 @@ match imap m|^\* OK IMAP4rev1 server ready at \d\d/\d\d/\d\d \d\d:\d\d:\d\d \r\n match imap m|^\* OK IMAP4 Ready ([\w-_.]+) \w+\r\n| p/Perdition imapd/ h/$1/ match imap m|^\* OK ([\w-_.]+) IMAP server ready\r\n| p/hMailServer imapd/ h/$1/ o/Windows/ +softmatch imap m/^\* OK ([-.\w]+) [-.\w,:+ ]+imap[-.\w,:+ ]+\r\n$/i h/$1/ softmatch imap m/^\* OK [-.\w,:+ ]+imap[-.\w,:+ ]+\r\n$/i match imap-proxy m|^\* OK IMAP4 proxy ready\r\n| p/imap proxy/ @@ -1351,7 +1354,7 @@ match ssh m|^SSH-2\.0-RomCliSecure_([\d.]+)\r\n| p/Adtran Netvanta RomCliSecure match ssh m|^SSH-2\.0-([\d.]+) sshlib: GlobalScape\r\n| p/GlobalScape CuteFTP sshd/ v/$1/ o/Windows/ match ssh m|^SSH-2\.0-APSSH_([\w.]+)\n| p/APSSHd/ v/$1/ i/protocol 2.0/ -softmatch ssh m/^SSH-([.\d]+)-/ +softmatch ssh m/^SSH-([.\d]+)-/ i/protocol $1/ match soldat m|^Soldat Admin Connection Established\.\.\.\r\nAdmin connected\.\r\n| p/Soldat multiplayer-game server/ match solproxy m|^The solproxy is used by [\d.]+\n\rThe client is closed!\n\r| p/Dell Serial Over LAN proxy/ diff --git a/service_scan.cc b/service_scan.cc index f07205a5c..f05160a78 100644 --- a/service_scan.cc +++ b/service_scan.cc @@ -395,9 +395,6 @@ void ServiceProbeMatch::InitMatch(const char *matchtext, int lineno) { while(isspace(*matchtext)) matchtext++; if (*matchtext == '\0' || *matchtext == '\r' || *matchtext == '\n') break; - if (isSoft) - fatal("ServiceProbeMatch::InitMatch: illegal trailing garbage on line %d of nmap-service-probes - note that softmatch lines cannot have a version specifier.", lineno); - modechar = *(matchtext++); if (*matchtext == 0 || *matchtext == '\r' || *matchtext == '\n') fatal("ServiceProbeMatch::InitMatch: parse error on line %d of nmap-service-probes", lineno); @@ -2143,6 +2140,22 @@ void servicescan_read_handler(nsock_pool nsp, nsock_event nse, void *mydata) { return; } + +// This is used in processResults to determine whether a FP +// should be printed based on type of match, version intensity, etc. + +int shouldWePrintFingerprint(ServiceNFO *svc) { + // Never print FP if hardmatched + if (svc->probe_state == PROBESTATE_FINISHED_HARDMATCHED) + return 0; + + // If we were called with a version_intensity less than + // the default, don't bother printing. + if (o.version_intensity < 7) return 0; + + return 1; +} + // This is passed a completed ServiceGroup which contains the scanning results for every service. // The function iterates through each finished service and adds the results to Target structure for // Nmap to output later. @@ -2151,7 +2164,7 @@ static void processResults(ServiceGroup *SG) { list::iterator svc; for(svc = SG->services_finished.begin(); svc != SG->services_finished.end(); svc++) { - if ((*svc)->probe_state == PROBESTATE_FINISHED_HARDMATCHED) { + if ((*svc)->probe_state != PROBESTATE_FINISHED_NOMATCH) { (*svc)->port->setServiceProbeResults((*svc)->probe_state, (*svc)->probe_matched, (*svc)->tunnel, @@ -2161,16 +2174,8 @@ list::iterator svc; *(*svc)->hostname_matched? (*svc)->hostname_matched : NULL, *(*svc)->ostype_matched? (*svc)->ostype_matched : NULL, *(*svc)->devicetype_matched? (*svc)->devicetype_matched : NULL, - NULL); - - } else if ((*svc)->probe_state == PROBESTATE_FINISHED_SOFTMATCHED) { - (*svc)->port->setServiceProbeResults((*svc)->probe_state, - (*svc)->probe_matched, - (*svc)->tunnel, - NULL, NULL, NULL, NULL, NULL, NULL, - (*svc)->getServiceFingerprint(NULL)); - - } else if ((*svc)->probe_state == PROBESTATE_FINISHED_NOMATCH) { + shouldWePrintFingerprint(*svc) ? (*svc)->getServiceFingerprint(NULL) : NULL); + } else { if ((*svc)->getServiceFingerprint(NULL)) (*svc)->port->setServiceProbeResults((*svc)->probe_state, NULL, (*svc)->tunnel, NULL, NULL, NULL, NULL, NULL, NULL,