From 77f764fe7220e0e38431cece406c046110db2061 Mon Sep 17 00:00:00 2001 From: nnposter Date: Wed, 30 Dec 2020 03:51:21 +0000 Subject: [PATCH] Add script nbns-interfaces. Closes #2201 --- CHANGELOG | 3 ++ nselib/netbios.lua | 4 +-- scripts/nbns-interfaces.nse | 69 +++++++++++++++++++++++++++++++++++++ scripts/script.db | 1 + 4 files changed, 75 insertions(+), 2 deletions(-) create mode 100644 scripts/nbns-interfaces.nse diff --git a/CHANGELOG b/CHANGELOG index e25775853..4e4504d3f 100644 --- a/CHANGELOG +++ b/CHANGELOG @@ -25,6 +25,9 @@ o Nmap no longer considers an ICMP Host Unreachable as confirmation that a o [NSE][GH#711] New script openflow-info gathers preferred and supported protocol versions from OpenFlow devices [Jay Smith, Mak Kolybabi] +o [NSE][GH#2201] New script nbns-interfaces queries NetBIOS name service (NBNS) + to gather IP addresses of the target's network interfaces [Andrey Zhukov] + o New UDP payloads: + [GH#1279] TS3INIT1 for UDP 3389 [colcrunch] + [GH#1895] DTLS for UDP 3391 (RD Gateway) [Arnim Rupp] diff --git a/nselib/netbios.lua b/nselib/netbios.lua index fabab8e5d..47b4d4d98 100644 --- a/nselib/netbios.lua +++ b/nselib/netbios.lua @@ -445,12 +445,12 @@ function nbquery(host, nbname, options) return false, "ERROR: Response contained no answers" end local dname = string.char(#resp.output.answers[1].dname) .. resp.output.answers[1].dname - table.insert( results, { peer = resp.peer, name = name_decode(dname) } ) + table.insert( results, { peer = resp.peer, name = name_decode(dname), data = resp.output.answers[1].data } ) end return true, results else local dname = string.char(#response.answers[1].dname) .. response.answers[1].dname - return true, { { peer = host.ip, name = name_decode(dname) } } + return true, { { peer = host.ip, name = name_decode(dname), data = response.answers[1].data } } end end diff --git a/scripts/nbns-interfaces.nse b/scripts/nbns-interfaces.nse new file mode 100644 index 000000000..5ab6b246a --- /dev/null +++ b/scripts/nbns-interfaces.nse @@ -0,0 +1,69 @@ +local shortport = require "shortport" +local netbios = require "netbios" +local nmap = require "nmap" +local stdnse = require "stdnse" +local string = require "string" +local table = require "table" + +description = [[ +Retrieves IP addresses of the target's network interfaces via NetBIOS NS. +Additional network interfaces may reveal more information about the target, +including finding paths to hidden non-routed networks via multihomed systems. +]] + +--- +-- @usage +-- nmap -sU -p 137 --script nbns-interfaces +-- +-- @output +-- PORT STATE SERVICE +-- 137/udp open netbios-ns +-- | nbns-interfaces: +-- | hostname: NOTEBOOK-NB3 +-- | interfaces: +-- | 10.5.4.89 +-- | 192.168.56.1 +-- |_ 172.24.80.1 +-- MAC Address: 9C:7B:EF:AA:BB:CC (Hewlett Packard) +-- +-- @xmloutput +-- NOTEBOOK-NB3 +-- +-- 10.5.4.89 +-- 192.168.56.1 +-- 172.24.80.1 +--
+--- + +author = {"Andrey Zhukov from USSC"} +license = "Same as Nmap--See https://nmap.org/book/man-legal.html" + +categories = {"default", "discovery", "safe"} + +portrule = nmap.address_family() == 'inet' -- NBNS is IPv4 only + and shortport.portnumber(137, "udp") + or function () return false end + +get_ip = function (buf) + return table.concat({buf:byte(1, 4)}, ".") +end + +action = function (host) + local output = stdnse.output_table() + local status, server_name = netbios.get_server_name(host) + if not (status and server_name) then + return stdnse.format_output(false, "Failed to get NetBIOS server name of the target") + end + local status, result = netbios.nbquery(host, server_name) + if not status then + return stdnse.format_output(false, "Failed to get remote network interfaces") + end + output.hostname = server_name + output.interfaces = {} + for _, v in ipairs(result) do + for i=1, #v.data, 6 do + output.interfaces[#output.interfaces + 1] = get_ip(v.data:sub(i+2, i+2+3)) + end + end + return output +end diff --git a/scripts/script.db b/scripts/script.db index f46fe138c..b5f117c71 100644 --- a/scripts/script.db +++ b/scripts/script.db @@ -389,6 +389,7 @@ Entry { filename = "ndmp-fs-info.nse", categories = { "discovery", "safe", } } Entry { filename = "ndmp-version.nse", categories = { "version", } } Entry { filename = "nessus-brute.nse", categories = { "brute", "intrusive", } } Entry { filename = "nessus-xmlrpc-brute.nse", categories = { "brute", "intrusive", } } +Entry { filename = "nbns-interfaces.nse", categories = { "default", "discovery", "safe", } } Entry { filename = "netbus-auth-bypass.nse", categories = { "auth", "safe", "vuln", } } Entry { filename = "netbus-brute.nse", categories = { "brute", "intrusive", } } Entry { filename = "netbus-info.nse", categories = { "default", "discovery", "safe", } }