CERBERUS/nmap
1
0
Fork 0
mirror of https://github.com/nmap/nmap.git synced 2026-08-04 14:49:29 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions

Added check for ACF2 detection

Browse source 
Added ACF2 based username enumeration
This commit is contained in:
Tim Brown 2017-08-25 16:43:23 +01:00
parent 29b46159f8
commit 235e1a46cd
1 changed files with 22 additions and 6 deletions
Download patch file Download diff file Expand all files Collapse all files

28
scripts/tso-enum.nse
View file

@ -117,7 +117,8 @@ Driver = {
if not self.tn3270:find("ENTER USERID")
and not self.tn3270:find("TSO/E LOGON")
and not self.tn3270:find("IKJ56710I INVALID USERID") then
and not self.tn3270:find("IKJ56710I INVALID USERID")
and not self.tn3270:find("ACF2, ENTER LOGON ID") then
local err = brute.Error:new("Too many connections")
-- This error occurs on too many concurrent application requests it
-- should be temporary. We use the new setReduce function.
@ -131,12 +132,17 @@ Driver = {
self.tn3270:send_cursor(pass)
self.tn3270:get_all_data()
-- some systems require an enter after sending a valid user ID
if self.tn3270:find("ACF2, ENTER PASSWORD OR PASSWORD PHRASE") then
self.tn3270:send_cursor("notreal")
self.tn3270:get_all_data()
end
end
stdnse.debug(2,"Screen Received for User ID: %s", pass)
self.tn3270:get_screen_debug(2)
if self.tn3270:find('not authorized to use TSO') or
self.tn3270:find('IKJ56710I INVALID USERID') then -- invalid user ID
self.tn3270:find('IKJ56710I INVALID USERID') or
self.tn3270:find('NOT FOUND') then -- invalid user ID
return false, brute.Error:new( "Incorrect User ID" )
elseif self.tn3270:find('NO USER APPLID AVAILABLE') or self.tn3270:isClear()
or not (self.tn3270:find('TSO/E LOGON') or
@ -180,17 +186,25 @@ local function tso_test( host, port, commands )
end
tn:get_screen_debug(2)
if tn:find("***") then
if tn:find("***") or tn:find("ACF2") then
secprod = "TopSecret/ACF2"
end
if tn:find("ENTER USERID") or tn:find("TSO/E LOGON") then
if tn:find("ENTER USERID") or tn:find("TSO/E LOGON") or tn:find("ENTER LOGON ID") then
tso = true
-- Patch OA44855 removed the ability to enumerate users
tn:send_cursor("notreal")
tn:get_all_data()
if tn:find("IKJ56476I ENTER PASSWORD") then
return false, secprod, "Enumeration is not possible. PASSWORDPREPROMPT is set to ON."
if tn:find("ACF2, ENTER PASSWORD OR PASSWORD PHRASE") then
tn:send_cursor("notreal")
tn:get_all_data()
if not tn:find("LOGONID NOTREAL NOT FOUND") then
return false, secprod, "Enumeration is not possible."
end
else
if tn:find("IKJ56476I ENTER PASSWORD") then
return false, secprod, "Enumeration is not possible. PASSWORDPREPROMPT is set to ON."
end
end
end
tn:send_pf(3)
@ -280,6 +294,8 @@ action = function(host, port)
nmap.set_port_version(host, port)
return result
else
port.version.extrainfo = "Security: " .. secprod
nmap.set_port_version(host, port)
return err
end