diff --git a/nselib/data/packetdecoders.lua b/nselib/data/packetdecoders.lua index 9f875e845..cf56d76cd 100644 --- a/nselib/data/packetdecoders.lua +++ b/nselib/data/packetdecoders.lua @@ -70,7 +70,7 @@ Decoders = { new = function(self) local o = { dups = {} } setmetatable(o, self) - self.__index = self + self.__index = self return o end, @@ -113,7 +113,7 @@ Decoders = { new = function(self) local o = { dups = {} } setmetatable(o, self) - self.__index = self + self.__index = self return o end, @@ -193,511 +193,502 @@ Decoders = { new = function(self) local o = { dups = {} } setmetatable(o, self) - self.__index = self + self.__index = self return o end, process = function(self, layer3) - local p = packet.Packet:new( layer3, #layer3 ) -- EIGRP is IP protocol 88 (0x58), so verify this if ( p.ip_p ~= 88 ) then return end - - local data = layer3:sub(p.ip_data_offset + 1) + local data = layer3:sub(p.ip_data_offset + 1) local eigrp = require("eigrp") local route_type, proto_name -- Extract the EIGRP header local response = eigrp.EIGRP.parse(data) if response then - -- Iterate over tlv tables - for _, tlv in pairs(response.tlvs) do - if eigrp.EIGRP.isRoutingTLV(tlv.type) then - - if ( not(self.results) ) then - self.results = tab.new(7) - tab.addrow(self.results, 'Sender IP', 'AS#', 'Route Type', 'Destination', 'Next hop', 'Ext Protocol', 'Orig Router ID') - end - if tlv.type == 0x102 then - route_type = "Internal" - elseif tlv.type == 0x103 then - route_type = "External" - for name, value in pairs(eigrp.EXT_PROTO) do - if value == tlv.eproto then - proto_name = name - break - end + -- Iterate over tlv tables + for _, tlv in pairs(response.tlvs) do + if eigrp.EIGRP.isRoutingTLV(tlv.type) then + if ( not(self.results) ) then + self.results = tab.new(7) + tab.addrow(self.results, 'Sender IP', 'AS#', 'Route Type', 'Destination', 'Next hop', 'Ext Protocol', 'Orig Router ID') + end + if tlv.type == 0x102 then + route_type = "Internal" + elseif tlv.type == 0x103 then + route_type = "External" + for name, value in pairs(eigrp.EXT_PROTO) do + if value == tlv.eproto then + proto_name = name + break + end + end + end + if ( not(self.dups[("%s:%s:s:%s"):format(p.ip_src, response.as, tlv.type, tlv.dst)]) ) then + if ( target.ALLOW_NEW_TARGETS ) then target.add(p.ip_src) end + self.dups[("%s:%s:%s:%s"):format(p.ip_src, response.as, tlv.type, tlv.dst)] = true + tab.addrow( self.results, p.ip_src, response.as, route_type, tlv.dst, tlv.nexth, proto_name or 'X', tlv.orouterid or 'X') + end + end end - end - if ( not(self.dups[("%s:%s:s:%s"):format(p.ip_src, response.as, tlv.type, tlv.dst)]) ) then - if ( target.ALLOW_NEW_TARGETS ) then target.add(p.ip_src) end - self.dups[("%s:%s:%s:%s"):format(p.ip_src, response.as, tlv.type, tlv.dst)] = true - tab.addrow( self.results, p.ip_src, response.as, route_type, tlv.dst, tlv.nexth, proto_name or 'X', tlv.orouterid or 'X') - end end - end - end - end, - getResults = function(self) return { name = "EIGRP Update", (self.results and tab.dump(self.results) or "") } end, + end, + + getResults = function(self) return { name = "EIGRP Update", (self.results and tab.dump(self.results) or "") } end, }, ['0205....0000'] = { - new = function(self) - local o = { dups = {} } - setmetatable(o, self) - self.__index = self - return o - end, + new = function(self) + local o = { dups = {} } + setmetatable(o, self) + self.__index = self + return o + end, - process = function(self, layer3) + process = function(self, layer3) - local p = packet.Packet:new( layer3, #layer3 ) - -- EIGRP is IP protocol 88 (0x58), so verify this - if ( p.ip_p ~= 88 ) then return end + local p = packet.Packet:new( layer3, #layer3 ) + -- EIGRP is IP protocol 88 (0x58), so verify this + if ( p.ip_p ~= 88 ) then return end - local data = layer3:sub(p.ip_data_offset + 1) + local data = layer3:sub(p.ip_data_offset + 1) + local eigrp = require("eigrp") + -- Extract the EIGRP header + local response = eigrp.EIGRP.parse(data) + -- See if Software version TLV is included + local swvertlv + for num, tlv in pairs(response.tlvs) do + if tlv.type == eigrp.TLV.SWVER then + swvertlv = num + end + end - local eigrp = require("eigrp") - -- Extract the EIGRP header - local response = eigrp.EIGRP.parse(data) - -- See if Software version TLV is included - local swvertlv - for num, tlv in pairs(response.tlvs) do - if tlv.type == eigrp.TLV.SWVER then - swvertlv = num - end - end - if swvertlv then - if ( not(self.results) ) then - self.results = tab.new(5) - tab.addrow(self.results, 'Sender IP', 'AS number', 'EIGRP version', 'IOS version') - end + if swvertlv then + if ( not(self.results) ) then + self.results = tab.new(5) + tab.addrow(self.results, 'Sender IP', 'AS number', 'EIGRP version', 'IOS version') + end - if ( not(self.dups[("%s:%s"):format(p.ip_src,response.as)]) ) then - if ( target.ALLOW_NEW_TARGETS ) then target.add(p.ip_src) end - self.dups[("%s:%s"):format(p.ip_src,response.as)] = true - tab.addrow( self.results, p.ip_src, response.as, response.tlvs[swvertlv].majv .. '.' .. response.tlvs[swvertlv].minv, response.tlvs[swvertlv].majtlv .. '.' .. response.tlvs[swvertlv].mintlv) - end - end - end, + if ( not(self.dups[("%s:%s"):format(p.ip_src,response.as)]) ) then + if ( target.ALLOW_NEW_TARGETS ) then target.add(p.ip_src) end + self.dups[("%s:%s"):format(p.ip_src,response.as)] = true + tab.addrow( self.results, p.ip_src, response.as, response.tlvs[swvertlv].majv .. '.' .. response.tlvs[swvertlv].minv, response.tlvs[swvertlv].majtlv .. '.' .. response.tlvs[swvertlv].mintlv) + end + end + end, - getResults = function(self) return { name = "EIGRP Hello", (self.results and tab.dump(self.results) or "") } end, + getResults = function(self) return { name = "EIGRP Hello", (self.results and tab.dump(self.results) or "") } end, }, -- OSPF ['02010'] = { -- OSPFv2 Hello packet - new = function(self) - local o = { dups = {} } - setmetatable(o, self) - self.__index = self - return o - end, + new = function(self) + local o = { dups = {} } + setmetatable(o, self) + self.__index = self + return o + end, - process = function(self, layer3) - local p = packet.Packet:new( layer3, #layer3 ) - -- IP Protocol is 89 for OSPF - if p.ip_p ~= 89 then return end + process = function(self, layer3) + local p = packet.Packet:new( layer3, #layer3 ) + -- IP Protocol is 89 for OSPF + if p.ip_p ~= 89 then return end - local ospf = require("ospf") + local ospf = require("ospf") + local data = layer3:sub(p.ip_data_offset + 1) + local header = ospf.OSPF.Header.parse(data) + if header then + if not(self.results) then + self.results = tab.new(5) + tab.addrow(self.results, 'Source IP', 'Router ID', 'Area ID', 'Auth Type', 'Password') + end + local srcip = p.ip_src + local areaid = header.area_id + local routerid = header.router_id + local authtype = header.auth_type + local authdata - local data = layer3:sub(p.ip_data_offset + 1) - local header = ospf.OSPF.Header.parse(data) - if header then - if not(self.results) then - self.results = tab.new(5) - tab.addrow(self.results, 'Source IP', 'Router ID', 'Area ID', 'Auth Type', 'Password') - end - local srcip = p.ip_src - local areaid = header.area_id - local routerid = header.router_id - local authtype = header.auth_type - local authdata - -- Format authentication type and data - if header.auth_type == 0 then - authtype = "None" - authdata = '' - elseif header.auth_type == 1 then - authtype = "Password" - authdata = header.auth_data.password - elseif header.auth_type == 2 then - authtype = "OSPF MD5" - authdata = "" -- Not really helpful, as the MD5 - -- is applied to the whole packet+password - else - -- Error - stdnse.print_debug("Unknown OSPF auth type %d", header.auth_type) - return - end + -- Format authentication type and data + if header.auth_type == 0 then + authtype = "None" + authdata = '' + elseif header.auth_type == 1 then + authtype = "Password" + authdata = header.auth_data.password + elseif header.auth_type == 2 then + authtype = "OSPF MD5" + authdata = "" -- Not really helpful, as the MD5 + -- is applied to the whole packet+password + else + -- Error + stdnse.print_debug("Unknown OSPF auth type %d", header.auth_type) + return + end - if ( not(self.dups[("%s:%s"):format(routerid,areaid)]) ) then - if ( target.ALLOW_NEW_TARGETS ) then target.add(routerid) end - self.dups[("%s:%s"):format(routerid,areaid)] = true - tab.addrow( self.results, srcip, routerid, areaid, authtype, authdata) - end - else - return nil - end + if ( not(self.dups[("%s:%s"):format(routerid,areaid)]) ) then + if ( target.ALLOW_NEW_TARGETS ) then target.add(routerid) end + self.dups[("%s:%s"):format(routerid,areaid)] = true + tab.addrow( self.results, srcip, routerid, areaid, authtype, authdata) + end + else + return nil + end + end, - end, - - getResults = function(self) return { name = "OSPF Hello", (self.results and tab.dump(self.results) or "") } end, - }, + getResults = function(self) return { name = "OSPF Hello", (self.results and tab.dump(self.results) or "") } end, + }, }, udp = { - -- DHCP - [68] = { + -- DHCP + [68] = { new = function(self) - local o = { dups = {} } - setmetatable(o, self) - self.__index = self - return o + local o = { dups = {} } + setmetatable(o, self) + self.__index = self + return o end, getOption = function(options, name) - for _, v in ipairs(options) do - if ( v.name == name ) then - if ( type(v.value) == "table" ) then - return stdnse.strjoin(", ", v.value) - else - return v.value - end + for _, v in ipairs(options) do + if ( v.name == name ) then + if ( type(v.value) == "table" ) then + return stdnse.strjoin(", ", v.value) + else + return v.value + end + end end - end end, process = function(self, layer3) - local dhcp = require("dhcp") - local p = packet.Packet:new( layer3, #layer3 ) - local data = layer3:sub(p.udp_offset + 9) + local dhcp = require("dhcp") + local p = packet.Packet:new( layer3, #layer3 ) + local data = layer3:sub(p.udp_offset + 9) - -- the dhcp.parse function isn't optimal for doing - -- this, but it will do for now. First, we need to - -- extract the xid as the parse function checks that it - -- was the same as in the request, which we didn't do. - local pos, msgtype, _, _, _, xid = bin.unpack(" 0 ) then + name = dresp.questions[1].dname + elseif ( dresp.answers and #dresp.answers > 0 ) then + name = dresp.answers[1].dname + end - local dresp = dns.decode(data) - local name + if ( not(name) ) then return end - if ( dresp.questions and #dresp.questions > 0 ) then - name = dresp.questions[1].dname - elseif ( dresp.answers and #dresp.answers > 0 ) then - name = dresp.answers[1].dname - end + if ( not(self.results) ) then + self.results = tab.new(2) + tab.addrow( self.results, 'ip', 'query' ) + end - if ( not(name) ) then return end - - if ( not(self.results) ) then - self.results = tab.new(2) - tab.addrow( self.results, 'ip', 'query' ) - end - - -- check for duplicates - if ( not(self.dups[("%s:%s"):format(p.ip_src, name)]) ) then - tab.addrow( self.results, p.ip_src, name ) - self.dups[("%s:%s"):format(p.ip_src, name)] = true - if ( target.ALLOW_NEW_TARGETS ) then target.add(p.ip_src) end - end + -- check for duplicates + if ( not(self.dups[("%s:%s"):format(p.ip_src, name)]) ) then + tab.addrow( self.results, p.ip_src, name ) + self.dups[("%s:%s"):format(p.ip_src, name)] = true + if ( target.ALLOW_NEW_TARGETS ) then target.add(p.ip_src) end + end end, getResults = function(self) return { name = "MDNS", (self.results and tab.dump(self.results) or "") } end, - }, + }, - --- Spotify - [57621] = { + --- Spotify + [57621] = { new = function(self) - local o = { dups = {} } - setmetatable(o, self) - self.__index = self - return o + local o = { dups = {} } + setmetatable(o, self) + self.__index = self + return o end, process = function(self, layer3) - local p = packet.Packet:new( layer3, #layer3 ) - local data = layer3:sub(p.udp_offset + 9) + local p = packet.Packet:new( layer3, #layer3 ) + local data = layer3:sub(p.udp_offset + 9) - if ( data:match("^SpotUdp") ) then - if ( not(self.results) ) then - self.results = tab.new(1) - tab.addrow( self.results, 'ip' ) - end + if ( data:match("^SpotUdp") ) then + if ( not(self.results) ) then + self.results = tab.new(1) + tab.addrow( self.results, 'ip' ) + end - if ( not(self.dups[p.ip_src]) ) then - tab.addrow( self.results, p.ip_src ) - self.dups[p.ip_src] = true - if ( target.ALLOW_NEW_TARGETS ) then target.add(p.ip_src) end + if ( not(self.dups[p.ip_src]) ) then + tab.addrow( self.results, p.ip_src ) + self.dups[p.ip_src] = true + if ( target.ALLOW_NEW_TARGETS ) then target.add(p.ip_src) end + end end - end end, getResults = function(self) return { name = "Spotify", (self.results and tab.dump(self.results) or "") } end, - } - } - } + + } +}