mirror of
https://github.com/nmap/nmap.git
synced 2026-10-21 11:22:05 +00:00
o [NSE] Renamed db2-info and db2-brute scripts to drda-*. Updated script
and library to reflect name change. Added support other DRDA based databases such as IBM Informix Dynamic Server and Apache Derby. [Patrik]
This commit is contained in:
patrik
parent
2b44c74187
commit
e570925c37
4 changed files with 229 additions and 132 deletions
|
|
@ -1,19 +1,19 @@
|
|||
description = [[
|
||||
Performs password guessing against IBM DB2.
|
||||
Performs password guessing against databases supporting the IBM DB2 protocol such as Informix, DB2 and Derby
|
||||
]]
|
||||
|
||||
---
|
||||
-- @args db2-brute.threads the amount of accounts to attempt to brute
|
||||
-- @args drda-brute.threads the amount of accounts to attempt to brute
|
||||
-- force in parallell (default 10).
|
||||
-- @args db2-brute.dbname the database name against which to guess
|
||||
-- @args drda-brute.dbname the database name against which to guess
|
||||
-- passwords (default <code>"SAMPLE"</code>).
|
||||
--
|
||||
-- @usage
|
||||
-- nmap -p 50000 --script db2-brute <target>
|
||||
-- nmap -p 50000 --script drda-brute <target>
|
||||
--
|
||||
-- @output
|
||||
-- 50000/tcp open ibm-db2
|
||||
-- | db2-brute:
|
||||
-- 50000/tcp open drda
|
||||
-- | drda-brute:
|
||||
-- |_ db2admin:db2admin => Login Correct
|
||||
|
||||
author = "Patrik Karlsson"
|
||||
|
|
@ -22,15 +22,16 @@ categories={"intrusive", "auth"}
|
|||
|
||||
require "stdnse"
|
||||
require "shortport"
|
||||
require "db2"
|
||||
require "drda"
|
||||
require "unpwdb"
|
||||
|
||||
-- Version 0.3
|
||||
-- Created 05/08/2010 - v0.1 - created by Patrik Karlsson <patrik@cqure.net>
|
||||
-- Revised 05/09/2010 - v0.2 - re-wrote as multi-threaded <patrik@cqure.net>
|
||||
-- Revised 05/10/2010 - v0.3 - revised parallellised design <patrik@cqure.net>
|
||||
-- Revised 08/14/2010 - v0.4 - renamed script and library from db2* to drda* <patrik@cqure.net>
|
||||
|
||||
portrule = shortport.port_or_service({50000,60000},"ibm-db2", "tcp", {"open", "open|filtered"})
|
||||
portrule = shortport.port_or_service({50000,60000}, "drda", "tcp", {"open", "open|filtered"})
|
||||
|
||||
--- Credential iterator
|
||||
--
|
||||
|
|
@ -65,14 +66,14 @@ doLogin = function( host, port, database, creds, valid_accounts )
|
|||
for username, password in creds do
|
||||
-- Checks if a password was already discovered for this account
|
||||
if ( nmap.registry.db2users == nil or nmap.registry.db2users[username] == nil ) then
|
||||
helper = db2.Helper:new()
|
||||
helper = drda.Helper:new()
|
||||
helper:connect( host, port )
|
||||
stdnse.print_debug( "Trying %s/%s against %s...", username, password, host.ip )
|
||||
status, response = helper:login( database, username, password )
|
||||
helper:close()
|
||||
|
||||
if ( status ) then
|
||||
-- Add credentials for future db2 scripts to use
|
||||
-- Add credentials for future drda scripts to use
|
||||
if nmap.registry.db2users == nil then
|
||||
nmap.registry.db2users = {}
|
||||
end
|
||||
|
|
@ -92,7 +93,7 @@ end
|
|||
-- @return status true on success, false on failure
|
||||
isValidDb = function( host, port, database )
|
||||
local status, response
|
||||
local helper = db2.Helper:new()
|
||||
local helper = drda.Helper:new()
|
||||
|
||||
helper:connect( host, port )
|
||||
-- Authenticate with a static probe account to see if the db is valid
|
||||
|
|
@ -127,13 +128,13 @@ action = function( host, port )
|
|||
local result, response, status = {}, nil, nil
|
||||
local valid_accounts, threads = {}, {}
|
||||
local usernames, passwords, creds
|
||||
local database = nmap.registry.args['db2-brute.dbname'] or "SAMPLE"
|
||||
local database = nmap.registry.args['drda-brute.dbname'] or "SAMPLE"
|
||||
local condvar = nmap.condvar( valid_accounts )
|
||||
local max_threads = nmap.registry.args['db2-brute.threads'] and tonumber( nmap.registry.args['db2-brute.threads'] ) or 10
|
||||
local max_threads = nmap.registry.args['drda-brute.threads'] and tonumber( nmap.registry.args['drda-brute.threads'] ) or 10
|
||||
|
||||
-- Check if the DB specified is valid
|
||||
if( not(isValidDb(host, port, database)) ) then
|
||||
return ("The databases %s was not found. (Use --script-args db2-brute.dbname=<dbname> to specify database)"):format(database)
|
||||
return ("The databases %s was not found. (Use --script-args drda-brute.dbname=<dbname> to specify database)"):format(database)
|
||||
end
|
||||
|
||||
status, usernames = unpwdb.usernames()
|
||||
|
|
|
|||
|
|
@ -1,13 +1,14 @@
|
|||
description = [[
|
||||
Attempts to extract information from IBM DB2 Server instances. The script sends a
|
||||
DB2 EXCSAT (exchange server attributes) command packet and parses the response.
|
||||
Attempts to extract information from database servers supporting the DRDA
|
||||
protocol. The script sends a DRDA EXCSAT (exchange server attributes)
|
||||
command packet and parses the response.
|
||||
]]
|
||||
|
||||
---
|
||||
-- @output
|
||||
-- PORT STATE SERVICE
|
||||
-- 50000/tcp open ibm-db2
|
||||
-- | db2-info: DB2 Version: 8.02.9
|
||||
-- 50000/tcp open drda
|
||||
-- | drda-info: DB2 Version: 8.02.9
|
||||
-- | Server Platform: QDB2/SUN
|
||||
-- | Instance Name: db2inst1
|
||||
-- |_ External Name: db2inst1db2agent00002B430
|
||||
|
|
@ -20,7 +21,7 @@ categories = {"safe", "discovery", "version"}
|
|||
|
||||
require "stdnse"
|
||||
require "shortport"
|
||||
require "db2"
|
||||
require "drda"
|
||||
|
||||
-- Version 0.1
|
||||
-- Created 05/08/2010 - v0.1 - created by Patrik Karlsson <patrik@cqure.net>
|
||||
|
|
@ -29,8 +30,8 @@ require "db2"
|
|||
-- parseVersion was ripped from the old db2-info.nse written by Tom Sellers
|
||||
--
|
||||
|
||||
portrule = shortport.version_port_or_service({50000,60000},
|
||||
"ibm-db2", "tcp",
|
||||
portrule = shortport.version_port_or_service({50000,60000,9090,1526,1527},
|
||||
{"drda"}, "tcp",
|
||||
{"open", "open|filtered"})
|
||||
|
||||
--- Converts the prodrel server string to a version string
|
||||
|
|
@ -38,8 +39,9 @@ portrule = shortport.version_port_or_service({50000,60000},
|
|||
-- @param server_version string containing the product release
|
||||
-- @return ver string containing the version information
|
||||
local function parseVersion( server_version )
|
||||
|
||||
if string.sub(server_version,1,3) == "SQL" then
|
||||
local pfx = string.sub(server_version,1,3)
|
||||
|
||||
if pfx == "SQL" or pfx == "IFX" then
|
||||
local major_version = string.sub(server_version,4,5)
|
||||
|
||||
-- strip the leading 0 from the major version, for consistency with
|
||||
|
|
@ -50,6 +52,8 @@ local function parseVersion( server_version )
|
|||
local minor_version = string.sub(server_version,6,7)
|
||||
local hotfix = string.sub(server_version,8)
|
||||
server_version = major_version .. "." .. minor_version .. "." .. hotfix
|
||||
elseif( pfx == "CSS" ) then
|
||||
return server_version:match("%w+\/(.*)")
|
||||
end
|
||||
|
||||
return server_version
|
||||
|
|
@ -57,35 +61,50 @@ end
|
|||
|
||||
action = function( host, port )
|
||||
|
||||
local db2helper = db2.Helper:new()
|
||||
local helper = drda.Helper:new()
|
||||
local status, response
|
||||
local results = {}
|
||||
|
||||
status, response = db2helper:connect(host, port)
|
||||
status, response = helper:connect(host, port)
|
||||
if( not(status) ) then
|
||||
return response
|
||||
end
|
||||
|
||||
status, response = db2helper:getServerInfo()
|
||||
status, response = helper:getServerInfo()
|
||||
if( not(status) ) then
|
||||
return response
|
||||
end
|
||||
|
||||
db2helper:close()
|
||||
|
||||
helper:close()
|
||||
|
||||
-- Set port information
|
||||
port.version.name = "ibm-db2"
|
||||
port.version.product = "IBM DB2 Database Server"
|
||||
port.version.name_confidence = 100
|
||||
if ( response.srvclass and response.srvclass:match("IDS\/") ) then
|
||||
port.version.name = "drda"
|
||||
port.version.product = "IBM Informix Dynamic Server"
|
||||
port.version.name_confidence = 100
|
||||
table.insert( results, ("Informix Version: %s"):format( parseVersion(response.prodrel) ) )
|
||||
elseif ( response.srvclass and response.srvclass:match("Apache Derby") ) then
|
||||
port.version.name = "drda"
|
||||
port.version.product = "Apache Derby Server"
|
||||
port.version.name_confidence = 100
|
||||
table.insert( results, ("Derby Version: %s"):format( parseVersion(response.prodrel) ) )
|
||||
elseif ( response.srvclass and response.srvclass:match("DB2") ) then
|
||||
port.version.name = "drda"
|
||||
port.version.product = "IBM DB2 Database Server"
|
||||
port.version.name_confidence = 100
|
||||
table.insert( results, ("DB2 Version: %s"):format( parseVersion(response.prodrel) ) )
|
||||
else
|
||||
table.insert( results, ("Version: %s"):format( response.prodrel ) )
|
||||
end
|
||||
nmap.set_port_state(host, port, "open")
|
||||
if response.srvclass ~= nil then port.version.extrainfo = response.srvclass end
|
||||
|
||||
nmap.set_port_version(host, port, "hardmatched")
|
||||
|
||||
-- Generate results
|
||||
local results = "DB2 Version: " .. parseVersion(response.prodrel) .. "\n"
|
||||
results = results .. "Server Platform: " .. response.srvclass .. "\n"
|
||||
results = results .. "Instance Name: " .. response.srvname .. "\n"
|
||||
results = results .. "External Name: " .. response.extname
|
||||
table.insert( results, ("Server Platform: %s"):format( response.srvclass ) )
|
||||
table.insert( results, ("Instance Name: %s"):format( response.srvname ) )
|
||||
table.insert( results, ("External Name: %s"):format( response.extname ) )
|
||||
|
||||
return results
|
||||
return stdnse.format_output( true, results )
|
||||
end
|
||||
|
|
|
|||
Loading…
Add table
Add a link
Reference in a new issue