mirror of
https://github.com/nmap/nmap.git
synced 2026-08-04 14:49:29 +00:00
Change explicit X==false to not X
Some checks are pending
nmap multiplatform autobuilds / build (arm64, gcc, ubuntu-latest-gcc-arm64, ubuntu-latest) (push) Waiting to run
nmap multiplatform autobuilds / build (clang, freebsd-15-clang, ubuntu-latest) (push) Waiting to run
nmap multiplatform autobuilds / build (clang, macos-15-clang, macos-15) (push) Waiting to run
nmap multiplatform autobuilds / build (clang, macos-26-clang, macos-26) (push) Waiting to run
nmap multiplatform autobuilds / build (clang, netbsd-10-clang, ubuntu-latest) (push) Waiting to run
nmap multiplatform autobuilds / build (clang, openbsd-7-clang, ubuntu-latest) (push) Waiting to run
nmap multiplatform autobuilds / build (clang, solaris-11-clang, ubuntu-latest) (push) Waiting to run
nmap multiplatform autobuilds / build (clang, ubuntu-latest-clang, ubuntu-latest) (push) Waiting to run
nmap multiplatform autobuilds / build (egcc, openbsd-7-gcc, ubuntu-latest) (push) Waiting to run
nmap multiplatform autobuilds / build (gcc, freebsd-15-gcc, ubuntu-latest) (push) Waiting to run
nmap multiplatform autobuilds / build (gcc, netbsd-10-gcc, ubuntu-latest) (push) Waiting to run
nmap multiplatform autobuilds / build (gcc, solaris-11-gcc, ubuntu-latest) (push) Waiting to run
nmap multiplatform autobuilds / build (gcc, ubuntu-latest-gcc, ubuntu-latest) (push) Waiting to run
nmap multiplatform autobuilds / build (msvc, windows-latest-msvc, windows-latest) (push) Waiting to run
Some checks are pending
nmap multiplatform autobuilds / build (arm64, gcc, ubuntu-latest-gcc-arm64, ubuntu-latest) (push) Waiting to run
nmap multiplatform autobuilds / build (clang, freebsd-15-clang, ubuntu-latest) (push) Waiting to run
nmap multiplatform autobuilds / build (clang, macos-15-clang, macos-15) (push) Waiting to run
nmap multiplatform autobuilds / build (clang, macos-26-clang, macos-26) (push) Waiting to run
nmap multiplatform autobuilds / build (clang, netbsd-10-clang, ubuntu-latest) (push) Waiting to run
nmap multiplatform autobuilds / build (clang, openbsd-7-clang, ubuntu-latest) (push) Waiting to run
nmap multiplatform autobuilds / build (clang, solaris-11-clang, ubuntu-latest) (push) Waiting to run
nmap multiplatform autobuilds / build (clang, ubuntu-latest-clang, ubuntu-latest) (push) Waiting to run
nmap multiplatform autobuilds / build (egcc, openbsd-7-gcc, ubuntu-latest) (push) Waiting to run
nmap multiplatform autobuilds / build (gcc, freebsd-15-gcc, ubuntu-latest) (push) Waiting to run
nmap multiplatform autobuilds / build (gcc, netbsd-10-gcc, ubuntu-latest) (push) Waiting to run
nmap multiplatform autobuilds / build (gcc, solaris-11-gcc, ubuntu-latest) (push) Waiting to run
nmap multiplatform autobuilds / build (gcc, ubuntu-latest-gcc, ubuntu-latest) (push) Waiting to run
nmap multiplatform autobuilds / build (msvc, windows-latest-msvc, windows-latest) (push) Waiting to run
This commit is contained in:
parent
02f6f8fdd3
commit
ce2b1e6d39
50 changed files with 348 additions and 348 deletions
|
|
@ -1286,7 +1286,7 @@ COAP.header.options.value.block.build = function(val)
|
|||
-- Finally, we want to check that we haven't over-shifted, which is
|
||||
-- characterized by the result being longer than expected based on
|
||||
-- the original number.
|
||||
if val.number == 0 and val.more == false and val.length == 16 then
|
||||
if val.number == 0 and not val.more and val.length == 16 then
|
||||
assert(#str == 0)
|
||||
elseif val.number <= 15 then
|
||||
assert(#str == 1)
|
||||
|
|
|
|||
|
|
@ -532,7 +532,7 @@ function dhcp_parse(data, transaction_id)
|
|||
stdnse.debug2("dhcp-discover: Attempting to parse %s", action['name'])
|
||||
pos, value = action['func'](data, pos, length)
|
||||
|
||||
if(nmap.verbosity() == 0 and action.default == false) then
|
||||
if(nmap.verbosity() == 0 and not action.default) then
|
||||
stdnse.debug1("dhcp-discover: Server returned unrequested option (%s => %s)", action['name'], value)
|
||||
|
||||
else
|
||||
|
|
|
|||
|
|
@ -71,7 +71,7 @@ function start_connection(host, port)
|
|||
|
||||
status, err = dcm['socket']:connect(host, port, "tcp")
|
||||
|
||||
if(status == false) then
|
||||
if not status then
|
||||
return false, "DICOM: Failed to connect to host: " .. err
|
||||
end
|
||||
|
||||
|
|
@ -90,7 +90,7 @@ function send(dcm, data)
|
|||
stdnse.debug2("DICOM: Sending DICOM packet (%d)", #data)
|
||||
if dcm['socket'] then
|
||||
status, err = dcm['socket']:send(data)
|
||||
if status == false then
|
||||
if not status then
|
||||
return false, err
|
||||
end
|
||||
else
|
||||
|
|
@ -107,7 +107,7 @@ end
|
|||
---
|
||||
function receive(dcm)
|
||||
local status, data = dcm['socket']:receive()
|
||||
if status == false then
|
||||
if not status then
|
||||
return false, data
|
||||
end
|
||||
stdnse.debug1("DICOM: receive() read %d bytes", #data)
|
||||
|
|
@ -156,7 +156,7 @@ function associate(host, port, calling_aet, called_aet)
|
|||
local userinfo_context = ""
|
||||
|
||||
local status, dcm = start_connection(host, port)
|
||||
if status == false then
|
||||
if not status then
|
||||
return false, dcm
|
||||
end
|
||||
|
||||
|
|
@ -220,7 +220,7 @@ function associate(host, port, calling_aet, called_aet)
|
|||
local status, header = pdu_header_encode(PDU_CODES["ASSOCIATE_REQUEST"], #assoc_request)
|
||||
|
||||
-- Something might be wrong with our header
|
||||
if status == false then
|
||||
if not status then
|
||||
return false, header
|
||||
end
|
||||
|
||||
|
|
@ -231,11 +231,11 @@ function associate(host, port, calling_aet, called_aet)
|
|||
return false, string.format("ASSOCIATE request PDU must be at least %d bytes and we tried to send %d.", MIN_SIZE_ASSOC_REQ, #assoc_request)
|
||||
end
|
||||
local status, err = send(dcm, assoc_request)
|
||||
if status == false then
|
||||
if not status then
|
||||
return false, string.format("Couldn't send ASSOCIATE request:%s", err)
|
||||
end
|
||||
status, err = receive(dcm)
|
||||
if status == false then
|
||||
if not status then
|
||||
return false, string.format("Couldn't read ASSOCIATE response:%s", err)
|
||||
end
|
||||
|
||||
|
|
@ -254,12 +254,12 @@ end
|
|||
|
||||
function send_pdata(dicom, data)
|
||||
local status, header = pdu_header_encode(PDU_CODES["DATA"], #data)
|
||||
if status == false then
|
||||
if not status then
|
||||
return false, header
|
||||
end
|
||||
local err
|
||||
status, err = send(dicom, header .. data)
|
||||
if status == false then
|
||||
if not status then
|
||||
return false, err
|
||||
end
|
||||
end
|
||||
|
|
|
|||
|
|
@ -1739,7 +1739,7 @@ local ret_false = function () return false end
|
|||
-- @return redirect_ok function used to validate HTTP redirects
|
||||
local function get_redirect_ok(host, port, options)
|
||||
if ( options ) then
|
||||
if ( options.redirect_ok == false ) then
|
||||
if not options.redirect_ok then
|
||||
return ret_false
|
||||
elseif( "function" == type(options.redirect_ok) ) then
|
||||
return options.redirect_ok(host, port)
|
||||
|
|
|
|||
168
nselib/msrpc.lua
168
nselib/msrpc.lua
|
|
@ -435,12 +435,12 @@ function call_function(smbstate, opnum, arguments)
|
|||
is_last = ((result['packet_flags'] & 0x02) == 0x02)
|
||||
|
||||
-- We have a fragmented packet, make sure it's the first (if we're on the first)
|
||||
if(first == true and is_first == false) then
|
||||
if first and not is_first then
|
||||
return false, "MSRPC: First fragment doesn't have proper 'first' (0x01) flag set"
|
||||
end
|
||||
|
||||
-- We have a fragmented packet, make sure it isn't the first (if we aren't on the first)
|
||||
if(first == false and is_first) then
|
||||
if not first and is_first then
|
||||
return false, "MSRPC: Middle (or last) fragment doesn't have proper 'first' (0x01) flag set"
|
||||
end
|
||||
|
||||
|
|
@ -3792,20 +3792,20 @@ function samr_enum_users(host)
|
|||
-- Create the SMB session
|
||||
status, smbstate = start_smb(host, SAMR_PATH, true)
|
||||
|
||||
if(status == false) then
|
||||
if not status then
|
||||
return false, smbstate
|
||||
end
|
||||
|
||||
-- Bind to SAMR service
|
||||
status, bind_result = bind(smbstate, SAMR_UUID, SAMR_VERSION, nil)
|
||||
if(status == false) then
|
||||
if not status then
|
||||
stop_smb(smbstate)
|
||||
return false, bind_result
|
||||
end
|
||||
|
||||
-- Call connect4()
|
||||
status, connect4_result = samr_connect4(smbstate, host.ip)
|
||||
if(status == false) then
|
||||
if not status then
|
||||
stop_smb(smbstate)
|
||||
return false, connect4_result
|
||||
end
|
||||
|
|
@ -3815,7 +3815,7 @@ function samr_enum_users(host)
|
|||
|
||||
-- Call EnumDomains()
|
||||
status, enumdomains_result = samr_enumdomains(smbstate, connect_handle)
|
||||
if(status == false) then
|
||||
if not status then
|
||||
stop_smb(smbstate)
|
||||
return false, enumdomains_result
|
||||
end
|
||||
|
|
@ -3834,7 +3834,7 @@ function samr_enum_users(host)
|
|||
if(domain ~= 'Builtin') then
|
||||
-- Call LookupDomain()
|
||||
local status, lookupdomain_result = samr_lookupdomain(smbstate, connect_handle, domain)
|
||||
if(status == false) then
|
||||
if not status then
|
||||
stop_smb(smbstate)
|
||||
return false, lookupdomain_result
|
||||
end
|
||||
|
|
@ -3844,7 +3844,7 @@ function samr_enum_users(host)
|
|||
|
||||
-- Call OpenDomain()
|
||||
local status, opendomain_result = samr_opendomain(smbstate, connect_handle, sid)
|
||||
if(status == false) then
|
||||
if not status then
|
||||
stop_smb(smbstate)
|
||||
return false, opendomain_result
|
||||
end
|
||||
|
|
@ -3857,7 +3857,7 @@ function samr_enum_users(host)
|
|||
repeat
|
||||
-- Call QueryDisplayInfo()
|
||||
local status, querydisplayinfo_result = samr_querydisplayinfo(smbstate, domain_handle, j, SAMR_GROUPSIZE)
|
||||
if(status == false) then
|
||||
if not status then
|
||||
stop_smb(smbstate)
|
||||
return false, querydisplayinfo_result
|
||||
end
|
||||
|
|
@ -3911,20 +3911,20 @@ function samr_enum_groups(host)
|
|||
-- Create the SMB session
|
||||
local status, smbstate = start_smb(host, SAMR_PATH, true)
|
||||
|
||||
if(status == false) then
|
||||
if not status then
|
||||
return false, smbstate
|
||||
end
|
||||
|
||||
-- Bind to SAMR service
|
||||
local status, bind_result = bind(smbstate, SAMR_UUID, SAMR_VERSION, nil)
|
||||
if(status == false) then
|
||||
if not status then
|
||||
stop_smb(smbstate)
|
||||
return false, bind_result
|
||||
end
|
||||
|
||||
-- Call connect4()
|
||||
local status, connect4_result = samr_connect4(smbstate, host.ip)
|
||||
if(status == false) then
|
||||
if not status then
|
||||
stop_smb(smbstate)
|
||||
return false, connect4_result
|
||||
end
|
||||
|
|
@ -3934,7 +3934,7 @@ function samr_enum_groups(host)
|
|||
|
||||
-- Call EnumDomains()
|
||||
local status, enumdomains_result = samr_enumdomains(smbstate, connect_handle)
|
||||
if(status == false) then
|
||||
if not status then
|
||||
stop_smb(smbstate)
|
||||
return false, enumdomains_result
|
||||
end
|
||||
|
|
@ -3954,7 +3954,7 @@ function samr_enum_groups(host)
|
|||
|
||||
-- Call LookupDomain()
|
||||
local status, lookupdomain_result = samr_lookupdomain(smbstate, connect_handle, domain)
|
||||
if(status == false) then
|
||||
if not status then
|
||||
stop_smb(smbstate)
|
||||
return false, lookupdomain_result
|
||||
end
|
||||
|
|
@ -3964,7 +3964,7 @@ function samr_enum_groups(host)
|
|||
|
||||
-- Call OpenDomain()
|
||||
local status, opendomain_result = samr_opendomain(smbstate, connect_handle, domain_sid)
|
||||
if(status == false) then
|
||||
if not status then
|
||||
stop_smb(smbstate)
|
||||
return false, opendomain_result
|
||||
end
|
||||
|
|
@ -3974,7 +3974,7 @@ function samr_enum_groups(host)
|
|||
|
||||
-- Get a list of groups
|
||||
local status, enumaliases_result = samr_enumdomainaliases(smbstate, domain_handle)
|
||||
if(status == false) then
|
||||
if not status then
|
||||
stop_smb(smbstate)
|
||||
return false, "Couldn't enumerate groups: " .. enumaliases_result
|
||||
end
|
||||
|
|
@ -4049,20 +4049,20 @@ function samr_enum_groups(host)
|
|||
-- Now, we need a handle to LSA (in order to convert the RIDs to users
|
||||
-- Create the SMB session
|
||||
local status, smbstate = start_smb(host, LSA_PATH, true)
|
||||
if(status == false) then
|
||||
if not status then
|
||||
return false, smbstate
|
||||
end
|
||||
|
||||
-- Bind to LSA service
|
||||
local status, bind_result = bind(smbstate, LSA_UUID, LSA_VERSION, nil)
|
||||
if(status == false) then
|
||||
if not status then
|
||||
stop_smb(smbstate)
|
||||
return false, bind_result
|
||||
end
|
||||
|
||||
-- Open the LSA policy
|
||||
local status, openpolicy2_result = lsa_openpolicy2(smbstate, host.ip)
|
||||
if(status == false) then
|
||||
if not status then
|
||||
stop_smb(smbstate)
|
||||
return false, openpolicy2_result
|
||||
end
|
||||
|
|
@ -4072,7 +4072,7 @@ function samr_enum_groups(host)
|
|||
for group_rid, group in pairs(domain_data) do
|
||||
-- Look up the SIDs
|
||||
local status, lookupsids2_result = lsa_lookupsids2(smbstate, openpolicy2_result['policy_handle'], group['member_sids'])
|
||||
if(status == false) then
|
||||
if not status then
|
||||
stop_smb(smbstate)
|
||||
return false, "Error looking up RIDs: " .. lookupsids2_result
|
||||
end
|
||||
|
|
@ -4117,20 +4117,20 @@ function lsa_enum_users(host)
|
|||
|
||||
-- Create the SMB session
|
||||
status, smbstate = start_smb(host, LSA_PATH, true)
|
||||
if(status == false) then
|
||||
if not status then
|
||||
return false, smbstate
|
||||
end
|
||||
|
||||
-- Bind to LSA service
|
||||
status, bind_result = bind(smbstate, LSA_UUID, LSA_VERSION, nil)
|
||||
if(status == false) then
|
||||
if not status then
|
||||
stop_smb(smbstate)
|
||||
return false, bind_result
|
||||
end
|
||||
|
||||
-- Open the LSA policy
|
||||
status, openpolicy2_result = lsa_openpolicy2(smbstate, host.ip)
|
||||
if(status == false) then
|
||||
if not status then
|
||||
stop_smb(smbstate)
|
||||
return false, openpolicy2_result
|
||||
end
|
||||
|
|
@ -4160,7 +4160,7 @@ function lsa_enum_users(host)
|
|||
|
||||
-- Look up the names, if any are valid than the server's SID will be returned
|
||||
status, lookupnames2_result = lsa_lookupnames2(smbstate, openpolicy2_result['policy_handle'], names)
|
||||
if(status == false) then
|
||||
if not status then
|
||||
stop_smb(smbstate)
|
||||
return false, lookupnames2_result
|
||||
end
|
||||
|
|
@ -4176,7 +4176,7 @@ function lsa_enum_users(host)
|
|||
end
|
||||
|
||||
status, lookupsids2_result = lsa_lookupsids2(smbstate, openpolicy2_result['policy_handle'], sids)
|
||||
if(status == false) then
|
||||
if not status then
|
||||
stdnse.debug1("Error looking up RIDs: %s", lookupsids2_result)
|
||||
else
|
||||
-- Put the details for each name into an array
|
||||
|
|
@ -4210,7 +4210,7 @@ function lsa_enum_users(host)
|
|||
|
||||
-- Try converting this group of RIDs into names
|
||||
status, lookupsids2_result = lsa_lookupsids2(smbstate, openpolicy2_result['policy_handle'], sids)
|
||||
if(status == false) then
|
||||
if not status then
|
||||
stdnse.debug1("Error looking up RIDs: %s", lookupsids2_result)
|
||||
else
|
||||
-- Put the details for each name into an array
|
||||
|
|
@ -4251,7 +4251,7 @@ function lsa_enum_users(host)
|
|||
|
||||
-- Go to the next set of RIDs
|
||||
start = start + LSA_GROUPSIZE
|
||||
until (status == false or (empty == LSA_MINEMPTY))
|
||||
until not status or (empty == LSA_MINEMPTY)
|
||||
end
|
||||
|
||||
-- Close the handle
|
||||
|
|
@ -4276,7 +4276,7 @@ function get_user_list(host)
|
|||
local names = {}
|
||||
|
||||
status_lsa, result_lsa = lsa_enum_users(host)
|
||||
if(status_lsa == false) then
|
||||
if not status_lsa then
|
||||
stdnse.debug1("MSRPC: Failed to enumerate users through LSA: %s", result_lsa)
|
||||
else
|
||||
for i = 1, #result_lsa, 1 do
|
||||
|
|
@ -4287,7 +4287,7 @@ function get_user_list(host)
|
|||
end
|
||||
|
||||
status_samr, result_samr = samr_enum_users(host)
|
||||
if(status_samr == false) then
|
||||
if not status_samr then
|
||||
stdnse.debug1("MSRPC: Failed to enumerate users through SAMR: %s", result_samr)
|
||||
else
|
||||
for i = 1, #result_samr, 1 do
|
||||
|
|
@ -4297,7 +4297,7 @@ function get_user_list(host)
|
|||
end
|
||||
end
|
||||
|
||||
if(status_samr == false and status_lsa == false) then
|
||||
if not status_samr and not status_lsa then
|
||||
return false, "MSRPC: Couldn't enumerate users; see debug output for more information"
|
||||
end
|
||||
|
||||
|
|
@ -4317,27 +4317,27 @@ local function get_domain_info(host, domain)
|
|||
|
||||
-- Create the SMB session
|
||||
status, smbstate = start_smb(host, SAMR_PATH)
|
||||
if(status == false) then
|
||||
if not status then
|
||||
return false, smbstate
|
||||
end
|
||||
|
||||
-- Bind to SAMR service
|
||||
status, bind_result = bind(smbstate, SAMR_UUID, SAMR_VERSION, nil)
|
||||
if(status == false) then
|
||||
if not status then
|
||||
stop_smb(smbstate)
|
||||
return false, bind_result
|
||||
end
|
||||
|
||||
-- Call connect4()
|
||||
status, connect4_result = samr_connect4(smbstate, host.ip)
|
||||
if(status == false) then
|
||||
if not status then
|
||||
stop_smb(smbstate)
|
||||
return false, connect4_result
|
||||
end
|
||||
|
||||
-- Call LookupDomain()
|
||||
status, lookupdomain_result = samr_lookupdomain(smbstate, connect4_result['connect_handle'], domain)
|
||||
if(status == false) then
|
||||
if not status then
|
||||
samr_close(smbstate, connect4_result['connect_handle'])
|
||||
stop_smb(smbstate)
|
||||
return false, "Couldn't look up the domain: " .. lookupdomain_result
|
||||
|
|
@ -4345,7 +4345,7 @@ local function get_domain_info(host, domain)
|
|||
|
||||
-- Call OpenDomain()
|
||||
status, opendomain_result = samr_opendomain(smbstate, connect4_result['connect_handle'], lookupdomain_result['sid'])
|
||||
if(status == false) then
|
||||
if not status then
|
||||
samr_close(smbstate, connect4_result['connect_handle'])
|
||||
stop_smb(smbstate)
|
||||
return false, opendomain_result
|
||||
|
|
@ -4357,19 +4357,19 @@ local function get_domain_info(host, domain)
|
|||
local status_8, querydomaininfo2_result_8 = samr_querydomaininfo2(smbstate, opendomain_result['domain_handle'], 8)
|
||||
local status_12, querydomaininfo2_result_12 = samr_querydomaininfo2(smbstate, opendomain_result['domain_handle'], 12)
|
||||
|
||||
if(status_1 == false) then
|
||||
if not status_1 then
|
||||
samr_close(smbstate, connect4_result['connect_handle'])
|
||||
stop_smb(smbstate)
|
||||
return false, querydomaininfo2_result_1
|
||||
end
|
||||
|
||||
if(status_8 == false) then
|
||||
if not status_8 then
|
||||
samr_close(smbstate, connect4_result['connect_handle'])
|
||||
stop_smb(smbstate)
|
||||
return false, querydomaininfo2_result_8
|
||||
end
|
||||
|
||||
if(status_12 == false) then
|
||||
if not status_12 then
|
||||
samr_close(smbstate, connect4_result['connect_handle'])
|
||||
stop_smb(smbstate)
|
||||
return false, querydomaininfo2_result_12
|
||||
|
|
@ -4377,7 +4377,7 @@ local function get_domain_info(host, domain)
|
|||
|
||||
-- Call EnumDomainUsers() to get users
|
||||
status, enumdomainusers_result = samr_enumdomainusers(smbstate, opendomain_result['domain_handle'])
|
||||
if(status == false) then
|
||||
if not status then
|
||||
samr_close(smbstate, connect4_result['connect_handle'])
|
||||
stop_smb(smbstate)
|
||||
return false, enumdomainusers_result
|
||||
|
|
@ -4385,7 +4385,7 @@ local function get_domain_info(host, domain)
|
|||
|
||||
-- Call EnumDomainAliases() to get groups
|
||||
local status, enumdomaingroups_result = samr_enumdomainaliases(smbstate, opendomain_result['domain_handle'])
|
||||
if(status == false) then
|
||||
if not status then
|
||||
samr_close(smbstate, connect4_result['connect_handle'])
|
||||
stop_smb(smbstate)
|
||||
return false, enumdomaingroups_result
|
||||
|
|
@ -4485,27 +4485,27 @@ function get_domains(host)
|
|||
|
||||
-- Create the SMB session
|
||||
status, smbstate = start_smb(host, SAMR_PATH)
|
||||
if(status == false) then
|
||||
if not status then
|
||||
return false, smbstate
|
||||
end
|
||||
|
||||
-- Bind to SAMR service
|
||||
status, bind_result = bind(smbstate, SAMR_UUID, SAMR_VERSION, nil)
|
||||
if(status == false) then
|
||||
if not status then
|
||||
stop_smb(smbstate)
|
||||
return false, bind_result
|
||||
end
|
||||
|
||||
-- Call connect4()
|
||||
status, connect4_result = samr_connect4(smbstate, host.ip)
|
||||
if(status == false) then
|
||||
if not status then
|
||||
stop_smb(smbstate)
|
||||
return false, connect4_result
|
||||
end
|
||||
|
||||
-- Call EnumDomains()
|
||||
status, enumdomains_result = samr_enumdomains(smbstate, connect4_result['connect_handle'])
|
||||
if(status == false) then
|
||||
if not status then
|
||||
samr_close(smbstate, connect4_result['connect_handle'])
|
||||
stop_smb(smbstate)
|
||||
|
||||
|
|
@ -4569,13 +4569,13 @@ function service_create(host, servicename, path)
|
|||
|
||||
-- Create the SMB session
|
||||
status, smbstate = start_smb(host, SVCCTL_PATH)
|
||||
if(status == false) then
|
||||
if not status then
|
||||
return false, smbstate
|
||||
end
|
||||
|
||||
-- Bind to SVCCTL service
|
||||
status, bind_result = bind(smbstate, SVCCTL_UUID, SVCCTL_VERSION, nil)
|
||||
if(status == false) then
|
||||
if not status then
|
||||
smb.stop(smbstate)
|
||||
return false, bind_result
|
||||
end
|
||||
|
|
@ -4583,7 +4583,7 @@ function service_create(host, servicename, path)
|
|||
-- Open the service manager
|
||||
stdnse.debug2("Opening the remote service manager")
|
||||
status, open_result = svcctl_openscmanagerw(smbstate, host.ip, 0x02000000)
|
||||
if(status == false) then
|
||||
if not status then
|
||||
smb.stop(smbstate)
|
||||
return false, open_result
|
||||
end
|
||||
|
|
@ -4591,20 +4591,20 @@ function service_create(host, servicename, path)
|
|||
-- Create the service
|
||||
stdnse.debug2("Creating the service")
|
||||
status, create_result = svcctl_createservicew(smbstate, open_result['handle'], servicename, servicename, path)
|
||||
if(status == false) then
|
||||
if not status then
|
||||
smb.stop(smbstate)
|
||||
return false, create_result
|
||||
end
|
||||
-- Close the handle to the service
|
||||
status, close_result = svcctl_closeservicehandle(smbstate, create_result['handle'])
|
||||
if(status == false) then
|
||||
if not status then
|
||||
smb.stop(smbstate)
|
||||
return false, close_result
|
||||
end
|
||||
|
||||
-- Close the service manager
|
||||
status, close_result = svcctl_closeservicehandle(smbstate, open_result['handle'])
|
||||
if(status == false) then
|
||||
if not status then
|
||||
smb.stop(smbstate)
|
||||
return false, close_result
|
||||
end
|
||||
|
|
@ -4633,13 +4633,13 @@ function service_start(host, servicename, args)
|
|||
|
||||
-- Create the SMB session
|
||||
status, smbstate = start_smb(host, SVCCTL_PATH)
|
||||
if(status == false) then
|
||||
if not status then
|
||||
return false, smbstate
|
||||
end
|
||||
|
||||
-- Bind to SVCCTL service
|
||||
status, bind_result = bind(smbstate, SVCCTL_UUID, SVCCTL_VERSION, nil)
|
||||
if(status == false) then
|
||||
if not status then
|
||||
smb.stop(smbstate)
|
||||
return false, bind_result
|
||||
end
|
||||
|
|
@ -4647,7 +4647,7 @@ function service_start(host, servicename, args)
|
|||
-- Open the service manager
|
||||
stdnse.debug1("Opening the remote service manager")
|
||||
status, open_result = svcctl_openscmanagerw(smbstate, host.ip, 0x02000000)
|
||||
if(status == false) then
|
||||
if not status then
|
||||
smb.stop(smbstate)
|
||||
return false, open_result
|
||||
end
|
||||
|
|
@ -4655,7 +4655,7 @@ function service_start(host, servicename, args)
|
|||
-- Get a handle to the service
|
||||
stdnse.debug2("Getting a handle to the service")
|
||||
status, open_service_result = svcctl_openservicew(smbstate, open_result['handle'], servicename, 0x000f01ff)
|
||||
if(status == false) then
|
||||
if not status then
|
||||
smb.stop(smbstate)
|
||||
return false, open_service_result
|
||||
end
|
||||
|
|
@ -4663,7 +4663,7 @@ function service_start(host, servicename, args)
|
|||
-- Start it
|
||||
stdnse.debug2("Starting the service")
|
||||
status, start_result = svcctl_startservicew(smbstate, open_service_result['handle'], args)
|
||||
if(status == false) then
|
||||
if not status then
|
||||
smb.stop(smbstate)
|
||||
return false, start_result
|
||||
end
|
||||
|
|
@ -4672,7 +4672,7 @@ function service_start(host, servicename, args)
|
|||
stdnse.debug1("Waiting for the service to start")
|
||||
repeat
|
||||
status, query_result = svcctl_queryservicestatus(smbstate, open_service_result['handle'])
|
||||
if(status == false) then
|
||||
if not status then
|
||||
smb.stop(smbstate)
|
||||
return false, query_result
|
||||
end
|
||||
|
|
@ -4681,14 +4681,14 @@ function service_start(host, servicename, args)
|
|||
|
||||
-- Close the handle to the service
|
||||
status, close_result = svcctl_closeservicehandle(smbstate, open_service_result['handle'])
|
||||
if(status == false) then
|
||||
if not status then
|
||||
smb.stop(smbstate)
|
||||
return false, close_result
|
||||
end
|
||||
|
||||
-- Close the service manager
|
||||
status, close_result = svcctl_closeservicehandle(smbstate, open_result['handle'])
|
||||
if(status == false) then
|
||||
if not status then
|
||||
smb.stop(smbstate)
|
||||
return false, close_result
|
||||
end
|
||||
|
|
@ -4715,13 +4715,13 @@ function service_stop(host, servicename)
|
|||
|
||||
-- Create the SMB session
|
||||
status, smbstate = start_smb(host, SVCCTL_PATH)
|
||||
if(status == false) then
|
||||
if not status then
|
||||
return false, smbstate
|
||||
end
|
||||
|
||||
-- Bind to SVCCTL service
|
||||
status, bind_result = bind(smbstate, SVCCTL_UUID, SVCCTL_VERSION, nil)
|
||||
if(status == false) then
|
||||
if not status then
|
||||
smb.stop(smbstate)
|
||||
return false, bind_result
|
||||
end
|
||||
|
|
@ -4729,7 +4729,7 @@ function service_stop(host, servicename)
|
|||
-- Open the service manager
|
||||
stdnse.debug2("Opening the remote service manager")
|
||||
status, open_result = svcctl_openscmanagerw(smbstate, host.ip, 0x02000000)
|
||||
if(status == false) then
|
||||
if not status then
|
||||
smb.stop(smbstate)
|
||||
return false, open_result
|
||||
end
|
||||
|
|
@ -4737,7 +4737,7 @@ function service_stop(host, servicename)
|
|||
-- Get a handle to the service
|
||||
stdnse.debug2("Getting a handle to the service")
|
||||
status, open_service_result = svcctl_openservicew(smbstate, open_result['handle'], servicename, 0x000f01ff)
|
||||
if(status == false) then
|
||||
if not status then
|
||||
smb.stop(smbstate)
|
||||
return false, open_service_result
|
||||
end
|
||||
|
|
@ -4745,7 +4745,7 @@ function service_stop(host, servicename)
|
|||
-- Stop it
|
||||
stdnse.debug2("Stopping the service")
|
||||
status, control_result = svcctl_controlservice(smbstate, open_service_result['handle'], "SERVICE_CONTROL_STOP")
|
||||
if(status == false) then
|
||||
if not status then
|
||||
smb.stop(smbstate)
|
||||
return false, control_result
|
||||
end
|
||||
|
|
@ -4754,7 +4754,7 @@ function service_stop(host, servicename)
|
|||
stdnse.debug2("Waiting for the service to stop")
|
||||
repeat
|
||||
status, query_result = svcctl_queryservicestatus(smbstate, open_service_result['handle'])
|
||||
if(status == false) then
|
||||
if not status then
|
||||
smb.stop(smbstate)
|
||||
return false, query_result
|
||||
end
|
||||
|
|
@ -4763,14 +4763,14 @@ function service_stop(host, servicename)
|
|||
|
||||
-- Close the handle to the service
|
||||
status, close_result = svcctl_closeservicehandle(smbstate, open_service_result['handle'])
|
||||
if(status == false) then
|
||||
if not status then
|
||||
smb.stop(smbstate)
|
||||
return false, close_result
|
||||
end
|
||||
|
||||
-- Close the service manager
|
||||
status, close_result = svcctl_closeservicehandle(smbstate, open_result['handle'])
|
||||
if(status == false) then
|
||||
if not status then
|
||||
smb.stop(smbstate)
|
||||
return false, close_result
|
||||
end
|
||||
|
|
@ -4794,13 +4794,13 @@ function service_delete(host, servicename)
|
|||
|
||||
-- Create the SMB session
|
||||
status, smbstate = start_smb(host, SVCCTL_PATH)
|
||||
if(status == false) then
|
||||
if not status then
|
||||
return false, smbstate
|
||||
end
|
||||
|
||||
-- Bind to SVCCTL service
|
||||
status, bind_result = bind(smbstate, SVCCTL_UUID, SVCCTL_VERSION, nil)
|
||||
if(status == false) then
|
||||
if not status then
|
||||
smb.stop(smbstate)
|
||||
return false, bind_result
|
||||
end
|
||||
|
|
@ -4808,7 +4808,7 @@ function service_delete(host, servicename)
|
|||
-- Open the service manager
|
||||
stdnse.debug2("Opening the remote service manager")
|
||||
status, open_result = svcctl_openscmanagerw(smbstate, host.ip, 0x02000000)
|
||||
if(status == false) then
|
||||
if not status then
|
||||
smb.stop(smbstate)
|
||||
return false, open_result
|
||||
end
|
||||
|
|
@ -4816,7 +4816,7 @@ function service_delete(host, servicename)
|
|||
-- Get a handle to the service
|
||||
stdnse.debug2("Getting a handle to the service: %s", servicename)
|
||||
status, open_service_result = svcctl_openservicew(smbstate, open_result['handle'], servicename, 0x000f01ff)
|
||||
if(status == false) then
|
||||
if not status then
|
||||
smb.stop(smbstate)
|
||||
return false, open_service_result
|
||||
end
|
||||
|
|
@ -4824,21 +4824,21 @@ function service_delete(host, servicename)
|
|||
-- Delete the service
|
||||
stdnse.debug2("Deleting the service")
|
||||
status, delete_result = svcctl_deleteservice(smbstate, open_service_result['handle'])
|
||||
if(status == false) then
|
||||
if not status then
|
||||
smb.stop(smbstate)
|
||||
return false, delete_result
|
||||
end
|
||||
|
||||
-- Close the handle to the service
|
||||
status, close_result = svcctl_closeservicehandle(smbstate, open_service_result['handle'])
|
||||
if(status == false) then
|
||||
if not status then
|
||||
smb.stop(smbstate)
|
||||
return false, close_result
|
||||
end
|
||||
|
||||
-- Close the service manager
|
||||
status, close_result = svcctl_closeservicehandle(smbstate, open_result['handle'])
|
||||
if(status == false) then
|
||||
if not status then
|
||||
smb.stop(smbstate)
|
||||
return false, close_result
|
||||
end
|
||||
|
|
@ -4864,20 +4864,20 @@ function get_server_stats(host)
|
|||
|
||||
-- Create the SMB session
|
||||
status, smbstate = start_smb(host, SRVSVC_PATH)
|
||||
if(status == false) then
|
||||
if not status then
|
||||
return false, smbstate
|
||||
end
|
||||
|
||||
-- Bind to SRVSVC service
|
||||
local status, bind_result = bind(smbstate, SRVSVC_UUID, SRVSVC_VERSION, nil)
|
||||
if(status == false) then
|
||||
if not status then
|
||||
smb.stop(smbstate)
|
||||
return false, bind_result
|
||||
end
|
||||
|
||||
-- Call netservergetstatistics for 'server'
|
||||
local status, netservergetstatistics_result = srvsvc_netservergetstatistics(smbstate, host.ip)
|
||||
if(status == false) then
|
||||
if not status then
|
||||
smb.stop(smbstate)
|
||||
return false, netservergetstatistics_result
|
||||
end
|
||||
|
|
@ -4925,20 +4925,20 @@ function enum_shares(host)
|
|||
|
||||
-- Create the SMB session
|
||||
status, smbstate = start_smb(host, SRVSVC_PATH)
|
||||
if(status == false) then
|
||||
if not status then
|
||||
return false, smbstate
|
||||
end
|
||||
|
||||
-- Bind to SRVSVC service
|
||||
status, bind_result = bind(smbstate, SRVSVC_UUID, SRVSVC_VERSION, nil)
|
||||
if(status == false) then
|
||||
if not status then
|
||||
smb.stop(smbstate)
|
||||
return false, bind_result
|
||||
end
|
||||
|
||||
-- Call netshareenumall
|
||||
status, netshareenumall_result = srvsvc_netshareenumall(smbstate, host.ip)
|
||||
if(status == false) then
|
||||
if not status then
|
||||
smb.stop(smbstate)
|
||||
return false, netshareenumall_result
|
||||
end
|
||||
|
|
@ -4968,13 +4968,13 @@ function get_share_info(host, name)
|
|||
|
||||
-- Create the SMB session
|
||||
local status, smbstate = start_smb(host, SRVSVC_PATH)
|
||||
if(status == false) then
|
||||
if not status then
|
||||
return false, smbstate
|
||||
end
|
||||
|
||||
-- Bind to SRVSVC service
|
||||
local status, bind_result = bind(smbstate, SRVSVC_UUID, SRVSVC_VERSION, nil)
|
||||
if(status == false) then
|
||||
if not status then
|
||||
smb.stop(smbstate)
|
||||
return false, bind_result
|
||||
end
|
||||
|
|
@ -4983,7 +4983,7 @@ function get_share_info(host, name)
|
|||
|
||||
local status, netsharegetinfo_result = srvsvc_netsharegetinfo(smbstate, host.ip, name, 2)
|
||||
stdnse.debug2("NetShareGetInfo status:%s result:%s", status, netsharegetinfo_result)
|
||||
if(status == false) then
|
||||
if not status then
|
||||
if(string.find(netsharegetinfo_result, "NT_STATUS_WERR_ACCESS_DENIED")) then
|
||||
stdnse.debug2("Calling NetShareGetInfo with information level 1")
|
||||
status, netsharegetinfo_result = srvsvc_netsharegetinfo(smbstate, host.ip, name, 1)
|
||||
|
|
@ -5128,7 +5128,7 @@ function RRAS_SubmitRequest(smbstate, pReqBuffer, dwcbBufSize)
|
|||
RRAS_Opnums["RasRpcSubmitRequest"],
|
||||
req_blob)
|
||||
--sanity check
|
||||
if(status == false) then
|
||||
if not status then
|
||||
stdnse.debug(
|
||||
RRAS_DEBUG_LVL,
|
||||
"RRAS_SubmitRequest: Call function failed: %s",
|
||||
|
|
@ -5266,7 +5266,7 @@ function DNSSERVER_Query(smbstate, server_name, zone, operation)
|
|||
DNSSERVER_Opnums['R_DnssrvQuery'],
|
||||
req_blob)
|
||||
--sanity check
|
||||
if(status == false) then
|
||||
if not status then
|
||||
stdnse.debug(
|
||||
DNSSERVER_DEBUG_LVL,
|
||||
"DNSSERVER_Query: Call function failed: %s",
|
||||
|
|
|
|||
|
|
@ -435,26 +435,26 @@ function get_performance_data(host, objects)
|
|||
|
||||
-- Create the SMB session
|
||||
local status, smbstate = msrpc.start_smb(host, msrpc.WINREG_PATH)
|
||||
if(status == false) then
|
||||
if not status then
|
||||
return false, smbstate
|
||||
end
|
||||
|
||||
-- Bind to WINREG service
|
||||
local status, bind_result = msrpc.bind(smbstate, msrpc.WINREG_UUID, msrpc.WINREG_VERSION, nil)
|
||||
if(status == false) then
|
||||
if not status then
|
||||
msrpc.stop_smb(smbstate)
|
||||
return false, bind_result
|
||||
end
|
||||
|
||||
-- Open HKEY_PERFORMANCE_DATA
|
||||
local status, openhkpd_result = msrpc.winreg_openhkpd(smbstate)
|
||||
if(status == false) then
|
||||
if not status then
|
||||
msrpc.stop_smb(smbstate)
|
||||
return false, openhkpd_result
|
||||
end
|
||||
|
||||
local status, queryvalue_result = msrpc.winreg_queryvalue(smbstate, openhkpd_result['handle'], "Counter 009")
|
||||
if(status == false) then
|
||||
if not status then
|
||||
msrpc.stop_smb(smbstate)
|
||||
return false, queryvalue_result
|
||||
end
|
||||
|
|
@ -464,7 +464,7 @@ function get_performance_data(host, objects)
|
|||
local status
|
||||
local result = {}
|
||||
status, pos, result['title_database'] = parse_perf_title_database(queryvalue_result['value'], pos)
|
||||
if(status == false) then
|
||||
if not status then
|
||||
msrpc.stop_smb(smbstate)
|
||||
return false, pos
|
||||
end
|
||||
|
|
@ -474,7 +474,7 @@ function get_performance_data(host, objects)
|
|||
if(objects ~= nil and #objects > 0) then
|
||||
-- Query for the objects
|
||||
local status, queryvalue_result = msrpc.winreg_queryvalue(smbstate, openhkpd_result['handle'], objects)
|
||||
if(status == false) then
|
||||
if not status then
|
||||
msrpc.stop_smb(smbstate)
|
||||
return false, queryvalue_result
|
||||
end
|
||||
|
|
@ -483,7 +483,7 @@ function get_performance_data(host, objects)
|
|||
pos = 1
|
||||
local status, data_block
|
||||
status, pos, data_block = parse_perf_data_block(queryvalue_result['value'], pos)
|
||||
if(status == false) then
|
||||
if not status then
|
||||
msrpc.stop_smb(smbstate)
|
||||
return false, pos
|
||||
end
|
||||
|
|
@ -502,7 +502,7 @@ function get_performance_data(host, objects)
|
|||
-- Get the type of the object (this is basically the class definition -- info about the object instances)
|
||||
local status, object_type
|
||||
status, pos, object_type = parse_perf_object_type(queryvalue_result['value'], pos)
|
||||
if(status == false) then
|
||||
if not status then
|
||||
msrpc.stop_smb(smbstate)
|
||||
return false, pos
|
||||
end
|
||||
|
|
@ -523,7 +523,7 @@ function get_performance_data(host, objects)
|
|||
-- Parse the counter definitions
|
||||
for j = 1, object_type['NumCounters'], 1 do
|
||||
status, pos, counter_definitions[j] = parse_perf_counter_definition(queryvalue_result['value'], pos)
|
||||
if(status == false) then
|
||||
if not status then
|
||||
msrpc.stop_smb(smbstate)
|
||||
return false, pos
|
||||
end
|
||||
|
|
@ -542,7 +542,7 @@ function get_performance_data(host, objects)
|
|||
-- Instance definition
|
||||
local status
|
||||
status, pos, object_instances[j] = parse_perf_instance_definition(queryvalue_result['value'], pos)
|
||||
if(status == false) then
|
||||
if not status then
|
||||
msrpc.stop_smb(smbstate)
|
||||
return false, pos
|
||||
end
|
||||
|
|
@ -563,7 +563,7 @@ function get_performance_data(host, objects)
|
|||
-- The counter block
|
||||
local status, counter_block
|
||||
status, pos, counter_block = parse_perf_counter_block(queryvalue_result['value'], pos)
|
||||
if(status == false) then
|
||||
if not status then
|
||||
msrpc.stop_smb(smbstate)
|
||||
return false, pos
|
||||
end
|
||||
|
|
@ -572,7 +572,7 @@ function get_performance_data(host, objects)
|
|||
-- Each individual counter
|
||||
local status, counter_result
|
||||
status, pos, counter_result = parse_perf_counter(queryvalue_result['value'], pos, counter_definitions[k])
|
||||
if(status == false) then
|
||||
if not status then
|
||||
msrpc.stop_smb(smbstate)
|
||||
return false, pos
|
||||
end
|
||||
|
|
@ -592,7 +592,7 @@ function get_performance_data(host, objects)
|
|||
-- Each individual counter
|
||||
local status, counter_result
|
||||
status, pos, counter_result = parse_perf_counter(queryvalue_result['value'], pos, counter_definitions[k])
|
||||
if(status == false) then
|
||||
if not status then
|
||||
msrpc.stop_smb(smbstate)
|
||||
return false, pos
|
||||
end
|
||||
|
|
|
|||
|
|
@ -786,7 +786,7 @@ function marshall_int16(int16, pad)
|
|||
|
||||
stdnse.debug4("MSRPC: Entering marshall_int16()")
|
||||
|
||||
if(pad == false) then
|
||||
if not pad then
|
||||
return string.pack("<I2", int16)
|
||||
end
|
||||
|
||||
|
|
@ -811,7 +811,7 @@ function marshall_int8(int8, pad)
|
|||
|
||||
stdnse.debug4("MSRPC: Entering marshall_int8()")
|
||||
|
||||
if(pad == false) then
|
||||
if not pad then
|
||||
return string.pack("<B", int8)
|
||||
end
|
||||
|
||||
|
|
|
|||
|
|
@ -161,7 +161,7 @@ function get_server_name(host, names)
|
|||
if names == nil then
|
||||
status, names = do_nbstat(host)
|
||||
|
||||
if(status == false) then
|
||||
if not status then
|
||||
return false, names
|
||||
end
|
||||
end
|
||||
|
|
@ -189,7 +189,7 @@ function get_workstation_name(host, names)
|
|||
if names == nil then
|
||||
status, names = do_nbstat(host)
|
||||
|
||||
if(status == false) then
|
||||
if not status then
|
||||
return false, names
|
||||
end
|
||||
end
|
||||
|
|
@ -215,14 +215,14 @@ function get_user_name(host, names)
|
|||
|
||||
local status, server_name = get_server_name(host, names)
|
||||
|
||||
if(status == false) then
|
||||
if not status then
|
||||
return false, server_name
|
||||
end
|
||||
|
||||
if(names == nil) then
|
||||
status, names = do_nbstat(host)
|
||||
|
||||
if(status == false) then
|
||||
if not status then
|
||||
return false, names
|
||||
end
|
||||
end
|
||||
|
|
@ -328,24 +328,24 @@ function do_nbstat(host)
|
|||
0x0001 -- Class = IN
|
||||
)
|
||||
status, err = socket:connect(host, 137, "udp")
|
||||
if(status == false) then
|
||||
if not status then
|
||||
return false, err
|
||||
end
|
||||
|
||||
status, err = socket:send(query)
|
||||
if(status == false) then
|
||||
if not status then
|
||||
return false, err
|
||||
end
|
||||
|
||||
socket:set_timeout(1000)
|
||||
|
||||
local status, result = socket:receive_bytes(1)
|
||||
if(status == false) then
|
||||
if not status then
|
||||
return false, result
|
||||
end
|
||||
|
||||
local close_status, err = socket:close()
|
||||
if(close_status == false) then
|
||||
if not close_status then
|
||||
return false, err
|
||||
end
|
||||
|
||||
|
|
|
|||
158
nselib/smb.lua
158
nselib/smb.lua
|
|
@ -308,7 +308,7 @@ function start(host)
|
|||
status, state['socket'] = start_raw(host, port)
|
||||
state['port'] = port
|
||||
|
||||
if(status == false) then
|
||||
if not status then
|
||||
return false, state['socket']
|
||||
end
|
||||
return true, state
|
||||
|
|
@ -316,7 +316,7 @@ function start(host)
|
|||
else
|
||||
status, state['socket'] = start_netbios(host, port)
|
||||
state['port'] = port
|
||||
if(status == false) then
|
||||
if not status then
|
||||
return false, state['socket']
|
||||
end
|
||||
return true, state
|
||||
|
|
@ -358,7 +358,7 @@ function start_ex(host, bool_negotiate_protocol, bool_start_session, str_tree_co
|
|||
|
||||
-- Begin the SMB session
|
||||
status, smbstate = start(host)
|
||||
if(status == false) then
|
||||
if not status then
|
||||
return false, smbstate
|
||||
end
|
||||
|
||||
|
|
@ -370,7 +370,7 @@ function start_ex(host, bool_negotiate_protocol, bool_start_session, str_tree_co
|
|||
if(bool_negotiate_protocol == true) then
|
||||
-- Negotiate the protocol
|
||||
status, err = negotiate_protocol(smbstate, overrides)
|
||||
if(status == false) then
|
||||
if not status then
|
||||
stop(smbstate)
|
||||
return false, err
|
||||
end
|
||||
|
|
@ -378,7 +378,7 @@ function start_ex(host, bool_negotiate_protocol, bool_start_session, str_tree_co
|
|||
if(bool_start_session == true) then
|
||||
-- Start up a session
|
||||
status, err = start_session(smbstate, overrides)
|
||||
if(status == false) then
|
||||
if not status then
|
||||
stop(smbstate)
|
||||
return false, err
|
||||
end
|
||||
|
|
@ -386,7 +386,7 @@ function start_ex(host, bool_negotiate_protocol, bool_start_session, str_tree_co
|
|||
if(str_tree_connect ~= nil) then
|
||||
-- Connect to share
|
||||
status, err = tree_connect(smbstate, str_tree_connect, overrides)
|
||||
if(status == false) then
|
||||
if not status then
|
||||
stop(smbstate)
|
||||
return false, err
|
||||
end
|
||||
|
|
@ -394,7 +394,7 @@ function start_ex(host, bool_negotiate_protocol, bool_start_session, str_tree_co
|
|||
if(str_create_file ~= nil) then
|
||||
-- Try to connect to requested pipe
|
||||
status, err = create_file(smbstate, str_create_file, overrides)
|
||||
if(status == false) then
|
||||
if not status then
|
||||
stop(smbstate)
|
||||
return false, err
|
||||
end
|
||||
|
|
@ -429,7 +429,7 @@ function stop(smb)
|
|||
if(smb['socket'] ~= nil) then
|
||||
local status, err = smb['socket']:close()
|
||||
|
||||
if(status == false) then
|
||||
if not status then
|
||||
return false, "SMB: Failed to close socket: " .. err
|
||||
end
|
||||
end
|
||||
|
|
@ -451,7 +451,7 @@ function start_raw(host, port)
|
|||
socket:set_timeout(TIMEOUT)
|
||||
status, err = socket:connect(host, port, "tcp")
|
||||
|
||||
if(status == false) then
|
||||
if not status then
|
||||
return false, "SMB: Failed to connect to host: " .. err
|
||||
end
|
||||
|
||||
|
|
@ -561,7 +561,7 @@ function start_netbios(host, port, name)
|
|||
stdnse.debug3("SMB: Connecting to %s", host.ip)
|
||||
socket:set_timeout(TIMEOUT)
|
||||
status, err = socket:connect(host, port, "tcp")
|
||||
if(status == false) then
|
||||
if not status then
|
||||
socket:close()
|
||||
return false, "SMB: Failed to connect: " .. err
|
||||
end
|
||||
|
|
@ -569,7 +569,7 @@ function start_netbios(host, port, name)
|
|||
-- Send the session request
|
||||
stdnse.debug3("SMB: Sending NetBIOS session request with name %s", name)
|
||||
status, err = socket:send(session_request)
|
||||
if(status == false) then
|
||||
if not status then
|
||||
socket:close()
|
||||
return false, "SMB: Failed to send: " .. err
|
||||
end
|
||||
|
|
@ -578,7 +578,7 @@ function start_netbios(host, port, name)
|
|||
-- Receive the session response
|
||||
stdnse.debug3("SMB: Receiving NetBIOS session response")
|
||||
status, result = socket:receive_buf(match.numbytes(4), true);
|
||||
if(status == false) then
|
||||
if not status then
|
||||
socket:close()
|
||||
return false, "SMB: Failed to close socket: " .. result
|
||||
end
|
||||
|
|
@ -873,7 +873,7 @@ function smb_read(smb, read_data)
|
|||
|
||||
-- Check the message signature (ignoring the first four bytes, which are the netbios header)
|
||||
local good_signature = message_check_signature(smb, string.sub(result, 5))
|
||||
if(good_signature == false) then
|
||||
if not good_signature then
|
||||
return false, "SMB: ERROR: Server returned invalid signature"
|
||||
end
|
||||
|
||||
|
|
@ -945,7 +945,7 @@ function negotiate_v1(smb, overrides)
|
|||
-- Send the negotiate request
|
||||
stdnse.debug2("SMB: Sending SMB_COM_NEGOTIATE")
|
||||
local result, err = smb_send(smb, header, parameters, data, overrides)
|
||||
if(result == false) then
|
||||
if not result then
|
||||
return false, err
|
||||
end
|
||||
-- Read the result
|
||||
|
|
@ -1098,7 +1098,7 @@ function list_dialects(host, overrides)
|
|||
-- Check for SMBv1 first
|
||||
stdnse.debug2("Checking if SMBv1 is supported")
|
||||
status, smbstate = start(host)
|
||||
if(status == false) then
|
||||
if not status then
|
||||
return false, smbstate
|
||||
end
|
||||
|
||||
|
|
@ -1109,7 +1109,7 @@ function list_dialects(host, overrides)
|
|||
stop(smbstate) -- Finish SMBv1 and close connection
|
||||
|
||||
status, smbstate = start(host)
|
||||
if(status == false) then
|
||||
if not status then
|
||||
return false, smbstate
|
||||
end
|
||||
stdnse.debug2("Checking if SMB 2+ is supported in general")
|
||||
|
|
@ -1130,7 +1130,7 @@ function list_dialects(host, overrides)
|
|||
local dialect_name = smb2.dialect_name(dialect)
|
||||
-- we need a clean connection for each negotiate request
|
||||
status, smbstate = start(host)
|
||||
if(status == false) then
|
||||
if not status then
|
||||
return false, smbstate
|
||||
end
|
||||
stdnse.debug2("SMB2: Checking if dialect '%s' is supported", dialect_name)
|
||||
|
|
@ -1206,7 +1206,7 @@ local function start_session_basic(smb, log_errors, overrides)
|
|||
-- Send the session setup request
|
||||
stdnse.debug2("SMB: Sending SMB_COM_SESSION_SETUP_ANDX")
|
||||
result, err = smb_send(smb, header, parameters, data, overrides)
|
||||
if(result == false) then
|
||||
if not result then
|
||||
return false, err
|
||||
end
|
||||
|
||||
|
|
@ -1389,7 +1389,7 @@ local function start_session_extended(smb, log_errors, overrides)
|
|||
end
|
||||
|
||||
-- There was an error processing the security blob
|
||||
if(status == false) then
|
||||
if not status then
|
||||
return false, string.format("SMB: ERROR: Security blob: %s", security_blob)
|
||||
end
|
||||
|
||||
|
|
@ -1420,7 +1420,7 @@ local function start_session_extended(smb, log_errors, overrides)
|
|||
-- Send the session setup request
|
||||
stdnse.debug2("SMB: Sending SMB_COM_SESSION_SETUP_ANDX")
|
||||
result, err = smb_send(smb, header, parameters, data, overrides)
|
||||
if(result == false) then
|
||||
if not result then
|
||||
return false, err
|
||||
end
|
||||
|
||||
|
|
@ -1632,7 +1632,7 @@ function tree_connect(smb, path, overrides)
|
|||
-- Send the tree connect request
|
||||
stdnse.debug2("SMB: Sending SMB_COM_TREE_CONNECT_ANDX")
|
||||
result, err = smb_send(smb, header, parameters, data, overrides)
|
||||
if(result == false) then
|
||||
if not result then
|
||||
return false, err
|
||||
end
|
||||
|
||||
|
|
@ -1677,7 +1677,7 @@ function tree_disconnect(smb, overrides)
|
|||
-- Send the tree disconnect request
|
||||
stdnse.debug2("SMB: Sending SMB_COM_TREE_DISCONNECT")
|
||||
local result, err = smb_send(smb, header, "", "", overrides)
|
||||
if(result == false) then
|
||||
if not result then
|
||||
return false, err
|
||||
end
|
||||
|
||||
|
|
@ -1728,7 +1728,7 @@ function logoff(smb, overrides)
|
|||
-- Send the tree disconnect request
|
||||
stdnse.debug2("SMB: Sending SMB_COM_LOGOFF_ANDX")
|
||||
local result, err = smb_send(smb, header, parameters, "", overrides)
|
||||
if(result == false) then
|
||||
if not result then
|
||||
return false, err
|
||||
end
|
||||
|
||||
|
|
@ -1812,7 +1812,7 @@ function create_file(smb, path, overrides)
|
|||
-- Send the create file
|
||||
stdnse.debug2("SMB: Sending SMB_COM_NT_CREATE_ANDX")
|
||||
local result, err = smb_send(smb, header, parameters, data, overrides)
|
||||
if(result == false) then
|
||||
if not result then
|
||||
mutex "done"
|
||||
return false, err
|
||||
end
|
||||
|
|
@ -1907,7 +1907,7 @@ function read_file(smb, offset, count, overrides)
|
|||
-- Send the create file
|
||||
stdnse.debug2("SMB: Sending SMB_COM_READ_ANDX")
|
||||
local result, err = smb_send(smb, header, parameters, data, overrides)
|
||||
if(result == false) then
|
||||
if not result then
|
||||
return false, err
|
||||
end
|
||||
|
||||
|
|
@ -2003,7 +2003,7 @@ function write_file(smb, write_data, offset, overrides)
|
|||
-- Send the create file
|
||||
stdnse.debug2("SMB: Sending SMB_COM_WRITE_ANDX")
|
||||
local result, err = smb_send(smb, header, parameters, data, overrides)
|
||||
if(result == false) then
|
||||
if not result then
|
||||
return false, err
|
||||
end
|
||||
|
||||
|
|
@ -2066,7 +2066,7 @@ function close_file(smb, overrides)
|
|||
-- Send the close file
|
||||
stdnse.debug2("SMB: Sending SMB_CLOSE")
|
||||
local result, err = smb_send(smb, header, parameters, data, overrides)
|
||||
if(result == false) then
|
||||
if not result then
|
||||
return false, err
|
||||
end
|
||||
|
||||
|
|
@ -2116,7 +2116,7 @@ function delete_file(smb, path, overrides)
|
|||
-- Send the close file
|
||||
stdnse.debug2("SMB: Sending SMB_CLOSE")
|
||||
local result, err = smb_send(smb, header, parameters, data, overrides)
|
||||
if(result == false) then
|
||||
if not result then
|
||||
return false, err
|
||||
end
|
||||
|
||||
|
|
@ -2346,7 +2346,7 @@ function send_transaction_named_pipe(smb, function_parameters, function_data, pi
|
|||
-- Send the transaction request
|
||||
stdnse.debug2("SMB: Sending SMB_COM_TRANSACTION")
|
||||
local result, err = smb_send(smb, header, parameters, data, overrides)
|
||||
if(result == false) then
|
||||
if not result then
|
||||
return false, err
|
||||
end
|
||||
|
||||
|
|
@ -2433,7 +2433,7 @@ function send_transaction_waitnamedpipe(smb, priority, pipe, overrides)
|
|||
-- Send the transaction request
|
||||
stdnse.debug2("SMB: Sending SMB_COM_TRANSACTION (WaitNamedPipe)")
|
||||
local result, err = smb_send(smb, header, parameters, data, overrides)
|
||||
if(result == false) then
|
||||
if not result then
|
||||
return false, err
|
||||
end
|
||||
|
||||
|
|
@ -2499,7 +2499,7 @@ function file_upload(host, localfile, share, remotefile, overrides, encoded)
|
|||
|
||||
-- Create the SMB session
|
||||
status, smbstate = start_ex(host, true, true, share, remotefile, nil, overrides)
|
||||
if(status == false) then
|
||||
if not status then
|
||||
return false, smbstate
|
||||
end
|
||||
|
||||
|
|
@ -2517,7 +2517,7 @@ function file_upload(host, localfile, share, remotefile, overrides, encoded)
|
|||
end
|
||||
|
||||
status, err = write_file(smbstate, data, i)
|
||||
if(status == false) then
|
||||
if not status then
|
||||
stop(smbstate)
|
||||
return false, err
|
||||
end
|
||||
|
|
@ -2528,7 +2528,7 @@ function file_upload(host, localfile, share, remotefile, overrides, encoded)
|
|||
|
||||
handle:close()
|
||||
status, err = close_file(smbstate)
|
||||
if(status == false) then
|
||||
if not status then
|
||||
stop(smbstate)
|
||||
return false, err
|
||||
end
|
||||
|
|
@ -2561,7 +2561,7 @@ function file_write(host, data, share, remotefile, use_anonymous)
|
|||
-- Create the SMB session
|
||||
status, smbstate = start_ex(host, true, true, share, remotefile, nil, overrides)
|
||||
|
||||
if(status == false) then
|
||||
if not status then
|
||||
return false, smbstate
|
||||
end
|
||||
|
||||
|
|
@ -2569,7 +2569,7 @@ function file_write(host, data, share, remotefile, use_anonymous)
|
|||
while(i <= #data) do
|
||||
local chunkdata = string.sub(data, i, i + chunk - 1)
|
||||
status, err = write_file(smbstate, chunkdata, i - 1)
|
||||
if(status == false) then
|
||||
if not status then
|
||||
stop(smbstate)
|
||||
return false, err
|
||||
end
|
||||
|
|
@ -2578,7 +2578,7 @@ function file_write(host, data, share, remotefile, use_anonymous)
|
|||
end
|
||||
|
||||
status, err = close_file(smbstate)
|
||||
if(status == false) then
|
||||
if not status then
|
||||
stop(smbstate)
|
||||
return false, err
|
||||
end
|
||||
|
|
@ -2615,14 +2615,14 @@ function file_read(host, share, remotefile, use_anonymous, overrides)
|
|||
-- Create the SMB session
|
||||
status, smbstate = start_ex(host, true, true, share, remotefile, nil, overrides)
|
||||
|
||||
if(status == false) then
|
||||
if not status then
|
||||
return false, smbstate
|
||||
end
|
||||
|
||||
local i = 1
|
||||
while true do
|
||||
status, result = read_file(smbstate, i - 1, chunk)
|
||||
if(status == false) then
|
||||
if not status then
|
||||
stop(smbstate)
|
||||
return false, result
|
||||
end
|
||||
|
|
@ -2636,7 +2636,7 @@ function file_read(host, share, remotefile, use_anonymous, overrides)
|
|||
end
|
||||
|
||||
status, err = close_file(smbstate)
|
||||
if(status == false) then
|
||||
if not status then
|
||||
stop(smbstate)
|
||||
return false, err
|
||||
end
|
||||
|
|
@ -2667,7 +2667,7 @@ function files_exist(host, share, files, overrides)
|
|||
-- Create the SMB session
|
||||
status, smbstate = start_ex(host, true, true, share, nil, nil, overrides)
|
||||
|
||||
if(status == false) then
|
||||
if not status then
|
||||
return false, smbstate
|
||||
end
|
||||
|
||||
|
|
@ -2688,7 +2688,7 @@ function files_exist(host, share, files, overrides)
|
|||
exist = exist + 1
|
||||
table.insert(list, file)
|
||||
status, err = close_file(smbstate)
|
||||
if(status == false) then
|
||||
if not status then
|
||||
stop(smbstate)
|
||||
return false, err
|
||||
end
|
||||
|
|
@ -2711,7 +2711,7 @@ function file_delete(host, share, remotefile)
|
|||
|
||||
-- Create the SMB session
|
||||
status, smbstate = start_ex(host, true, true, share)
|
||||
if(status == false) then
|
||||
if not status then
|
||||
return false, smbstate
|
||||
end
|
||||
|
||||
|
|
@ -2723,7 +2723,7 @@ function file_delete(host, share, remotefile)
|
|||
|
||||
for _, file in ipairs(remotefile) do
|
||||
status, err = delete_file(smbstate, file)
|
||||
if(status == false) then
|
||||
if not status then
|
||||
stdnse.debug1("SMB: Couldn't delete %s\\%s: %s", share, file, err)
|
||||
if(err ~= 'NT_STATUS_OBJECT_NAME_NOT_FOUND') then
|
||||
stop(smbstate)
|
||||
|
|
@ -2942,7 +2942,7 @@ function share_anonymous_can_write(host, share)
|
|||
|
||||
-- Next, attempt to write to that file
|
||||
status, err = file_write(host, string.rep("ABCDEFGHIJKLMNOPQRSTUVWXYZ", 10), share, filename, true)
|
||||
if(status == false) then
|
||||
if not status then
|
||||
if(err == "NT_STATUS_OBJECT_NAME_NOT_FOUND") then
|
||||
return false, err
|
||||
end
|
||||
|
|
@ -2956,7 +2956,7 @@ function share_anonymous_can_write(host, share)
|
|||
|
||||
-- Now the important part: delete it
|
||||
status, err = file_delete(host, share, filename)
|
||||
if(status == false) then
|
||||
if not status then
|
||||
return false, "Error deleting test file as anonymous: " .. err
|
||||
end
|
||||
|
||||
|
|
@ -2981,7 +2981,7 @@ function share_user_can_write(host, share)
|
|||
|
||||
-- Next, attempt to write to that file
|
||||
status, err = file_write(host, string.rep("ABCDEFGHIJKLMNOPQRSTUVWXYZ", 10), share, filename)
|
||||
if(status == false) then
|
||||
if not status then
|
||||
if(err == "NT_STATUS_OBJECT_NAME_NOT_FOUND") then
|
||||
return false, err
|
||||
end
|
||||
|
|
@ -2995,7 +2995,7 @@ function share_user_can_write(host, share)
|
|||
|
||||
-- Now the important part: delete it
|
||||
status, err = file_delete(host, share, filename)
|
||||
if(status == false) then
|
||||
if not status then
|
||||
return false, "Error deleting test file as user: " .. err
|
||||
end
|
||||
|
||||
|
|
@ -3015,13 +3015,13 @@ function share_anonymous_can_read(host, share)
|
|||
|
||||
-- Begin the SMB session
|
||||
status, smbstate = start(host)
|
||||
if(status == false) then
|
||||
if not status then
|
||||
return false, smbstate
|
||||
end
|
||||
|
||||
-- Negotiate the protocol
|
||||
status, err = negotiate_protocol(smbstate, overrides)
|
||||
if(status == false) then
|
||||
if not status then
|
||||
stop(smbstate)
|
||||
return false, err
|
||||
end
|
||||
|
|
@ -3029,14 +3029,14 @@ function share_anonymous_can_read(host, share)
|
|||
-- Start up a null session
|
||||
status, err = start_session(smbstate, overrides)
|
||||
|
||||
if(status == false) then
|
||||
if not status then
|
||||
stop(smbstate)
|
||||
return false, err
|
||||
end
|
||||
|
||||
-- Attempt a connection to the share
|
||||
status, err = tree_connect(smbstate, share, overrides)
|
||||
if(status == false) then
|
||||
if not status then
|
||||
|
||||
-- Stop the session
|
||||
stop(smbstate)
|
||||
|
|
@ -3068,27 +3068,27 @@ function share_user_can_read(host, share)
|
|||
|
||||
-- Begin the SMB session
|
||||
status, smbstate = start(host)
|
||||
if(status == false) then
|
||||
if not status then
|
||||
return false, smbstate
|
||||
end
|
||||
|
||||
-- Negotiate the protocol
|
||||
status, err = negotiate_protocol(smbstate, overrides)
|
||||
if(status == false) then
|
||||
if not status then
|
||||
stop(smbstate)
|
||||
return false, err
|
||||
end
|
||||
|
||||
-- Start up a null session
|
||||
status, err = start_session(smbstate, overrides)
|
||||
if(status == false) then
|
||||
if not status then
|
||||
stop(smbstate)
|
||||
return false, err
|
||||
end
|
||||
|
||||
-- Attempt a connection to the share
|
||||
status, err = tree_connect(smbstate, share, overrides)
|
||||
if(status == false) then
|
||||
if not status then
|
||||
|
||||
-- Stop the session
|
||||
stop(smbstate)
|
||||
|
|
@ -3123,20 +3123,20 @@ function share_host_returns_proper_error(host, use_anonymous)
|
|||
|
||||
-- Begin the SMB session
|
||||
status, smbstate = start(host)
|
||||
if(status == false) then
|
||||
if not status then
|
||||
return false, smbstate
|
||||
end
|
||||
|
||||
-- Negotiate the protocol
|
||||
status, err = negotiate_protocol(smbstate, overrides)
|
||||
if(status == false) then
|
||||
if not status then
|
||||
stop(smbstate)
|
||||
return false, err
|
||||
end
|
||||
|
||||
-- Start up a null session
|
||||
status, err = start_session(smbstate, overrides)
|
||||
if(status == false) then
|
||||
if not status then
|
||||
stop(smbstate)
|
||||
return false, err
|
||||
end
|
||||
|
|
@ -3145,7 +3145,7 @@ function share_host_returns_proper_error(host, use_anonymous)
|
|||
stdnse.debug1("SMB: Trying a random share to see if server responds properly: %s", share)
|
||||
status, err = tree_connect(smbstate, share, overrides)
|
||||
|
||||
if(status == false) then
|
||||
if not status then
|
||||
-- If the error is NT_STATUS_ACCESS_DENIED (0xc0000022), that's bad -- we don't want non-existent shares
|
||||
-- showing up as 'access denied'. Any other error is ok.
|
||||
if(err == 0xc0000022 or err == 'NT_STATUS_ACCESS_DENIED') then
|
||||
|
|
@ -3188,7 +3188,7 @@ function share_get_details(host, share)
|
|||
-- Check if the current user can read the share
|
||||
stdnse.debug1("SMB: Checking if share %s can be read by the current user", share)
|
||||
status, result = share_user_can_read(host, share)
|
||||
if(status == false) then
|
||||
if not status then
|
||||
return false, result
|
||||
end
|
||||
details['user_can_read'] = result
|
||||
|
|
@ -3203,7 +3203,7 @@ function share_get_details(host, share)
|
|||
-- Check if the current user can write to the share
|
||||
stdnse.debug1("SMB: Checking if share %s can be written by the current user", share)
|
||||
status, result = share_user_can_write(host, share)
|
||||
if(status == false) then
|
||||
if not status then
|
||||
if(result == "NT_STATUS_OBJECT_NAME_NOT_FOUND") then
|
||||
details['user_can_write'] = "NT_STATUS_OBJECT_NAME_NOT_FOUND"
|
||||
else
|
||||
|
|
@ -3215,7 +3215,7 @@ function share_get_details(host, share)
|
|||
-- Check if the anonymous user can write to the share
|
||||
stdnse.debug1("SMB: Checking if share %s can be written by the anonymous user", share)
|
||||
status, result = share_anonymous_can_write(host, share)
|
||||
if(status == false and result == "NT_STATUS_OBJECT_NAME_NOT_FOUND") then
|
||||
if not status and result == "NT_STATUS_OBJECT_NAME_NOT_FOUND" then
|
||||
details['anonymous_can_write'] = "NT_STATUS_OBJECT_NAME_NOT_FOUND"
|
||||
elseif( status == true ) then
|
||||
details['anonymous_can_write'] = result
|
||||
|
|
@ -3223,7 +3223,7 @@ function share_get_details(host, share)
|
|||
|
||||
-- Try and get full details about the share
|
||||
status, result = msrpc.get_share_info(host, share)
|
||||
if(status == false) then
|
||||
if not status then
|
||||
-- We don't stop for this error (it's pretty common since administrative privileges are required here)
|
||||
stdnse.debug1("SMB: Failed to get share info for %s: %s", share, result)
|
||||
details['details'] = result
|
||||
|
|
@ -3263,7 +3263,7 @@ function share_get_list(host)
|
|||
|
||||
-- If that failed, try doing it with brute force. This almost certainly won't find everything, but it's the
|
||||
-- best we can do.
|
||||
if(enum_status == false) then
|
||||
if not enum_status then
|
||||
stdnse.debug1("SMB: Enumerating shares failed, guessing at common ones (%s)", shares)
|
||||
extra = string.format("ERROR: Enumerating shares failed, guessing at common ones (%s)", shares)
|
||||
|
||||
|
|
@ -3292,12 +3292,12 @@ function share_get_list(host)
|
|||
for _, anon in ipairs({true, false}) do
|
||||
status, result = share_host_returns_proper_error(host, anon)
|
||||
|
||||
if(status == true and result == false) then
|
||||
if status and not result then
|
||||
return false, "Server doesn't return proper value for non-existent shares; can't enumerate shares"
|
||||
end
|
||||
end
|
||||
|
||||
if(status == false) then
|
||||
if not status then
|
||||
return false, result
|
||||
end
|
||||
|
||||
|
|
@ -3306,9 +3306,9 @@ function share_get_list(host)
|
|||
local status, result
|
||||
stdnse.debug1("SMB: Getting information for share: %s", shares[i])
|
||||
status, result = share_get_details(host, shares[i])
|
||||
if(status == false and result == 'NT_STATUS_BAD_NETWORK_NAME') then
|
||||
if not status and result == 'NT_STATUS_BAD_NETWORK_NAME' then
|
||||
stdnse.debug1("SMB: Share doesn't exist: %s", shares[i])
|
||||
elseif(status == false) then
|
||||
elseif not status then
|
||||
stdnse.debug1("SMB: Error while getting share details: %s", result)
|
||||
return false, result
|
||||
else
|
||||
|
|
@ -3334,7 +3334,7 @@ function share_find_writable(host)
|
|||
local writable = {}
|
||||
|
||||
status, shares = share_get_list(host)
|
||||
if(status == false) then
|
||||
if not status then
|
||||
return false, shares
|
||||
end
|
||||
|
||||
|
|
@ -3403,7 +3403,7 @@ function get_os(host)
|
|||
|
||||
-- Start up SMB
|
||||
status, smbstate = start_ex(host, true, true, nil, nil, true)
|
||||
if(status == false) then
|
||||
if not status then
|
||||
return false, smbstate
|
||||
end
|
||||
|
||||
|
|
@ -3470,13 +3470,13 @@ function get_socket_info(host)
|
|||
|
||||
-- Start SMB (we need a socket to get the proper local ip
|
||||
status, smbstate = start_ex(host)
|
||||
if(status == false) then
|
||||
if not status then
|
||||
return false, smbstate
|
||||
end
|
||||
|
||||
socket = smbstate['socket']
|
||||
status, lhost, lport, rhost, rport = socket:get_info()
|
||||
if(status == false) then
|
||||
if not status then
|
||||
return false, lhost
|
||||
end
|
||||
|
||||
|
|
@ -3554,21 +3554,21 @@ function is_admin(host, username, domain, password, password_hash, hash_type)
|
|||
stdnse.debug1("SMB: Checking if %s is an administrator", username)
|
||||
|
||||
local status, smbstate = start(host)
|
||||
if(status == false) then
|
||||
if not status then
|
||||
stdnse.debug1("SMB; is_admin: Failed to start SMB: %s [%s]", smbstate, username)
|
||||
stop(smbstate)
|
||||
return false
|
||||
end
|
||||
|
||||
local status, err = negotiate_protocol(smbstate, overrides)
|
||||
if(status == false) then
|
||||
if not status then
|
||||
stdnse.debug1("SMB; is_admin: Failed to negotiate protocol: %s [%s]", err, username)
|
||||
stop(smbstate)
|
||||
return false
|
||||
end
|
||||
|
||||
status, err = start_session(smbstate, overrides)
|
||||
if(status == false) then
|
||||
if not status then
|
||||
stdnse.debug1("SMB; is_admin: Failed to start session %s [%s]", err, username)
|
||||
stop(smbstate)
|
||||
return false
|
||||
|
|
@ -3576,21 +3576,21 @@ function is_admin(host, username, domain, password, password_hash, hash_type)
|
|||
|
||||
local _, fqpn_share = get_fqpn(host, "IPC$")
|
||||
status, err = tree_connect(smbstate, fqpn_share, overrides)
|
||||
if(status == false) then
|
||||
if not status then
|
||||
stdnse.debug1("SMB; is_admin: Failed to connect tree: %s [%s]", err, username)
|
||||
stop(smbstate)
|
||||
return false
|
||||
end
|
||||
|
||||
status, err = create_file(smbstate, msrpc.SRVSVC_PATH, overrides)
|
||||
if(status == false) then
|
||||
if not status then
|
||||
stdnse.debug1("SMB; is_admin: Failed to create file: %s [%s]", err, username)
|
||||
stop(smbstate)
|
||||
return false
|
||||
end
|
||||
|
||||
status, err = msrpc.bind(smbstate, msrpc.SRVSVC_UUID, msrpc.SRVSVC_VERSION, nil)
|
||||
if(status == false) then
|
||||
if not status then
|
||||
stdnse.debug1("SMB; is_admin: Failed to bind: %s [%s]", err, username)
|
||||
stop(smbstate)
|
||||
return false
|
||||
|
|
@ -3598,7 +3598,7 @@ function is_admin(host, username, domain, password, password_hash, hash_type)
|
|||
|
||||
-- Call netservergetstatistics for 'server'
|
||||
status, err = msrpc.srvsvc_netservergetstatistics(smbstate, host.ip)
|
||||
if(status == false) then
|
||||
if not status then
|
||||
stdnse.debug1("SMB; is_admin: Couldn't get server stats (may be normal): %s [%s]", err, username)
|
||||
stop(smbstate)
|
||||
return false
|
||||
|
|
|
|||
|
|
@ -315,8 +315,8 @@ fetch_host_key = function( host, port, key_type )
|
|||
-- check for proper msg code
|
||||
local msg_code = kexdh_reply:byte(1)
|
||||
|
||||
if ( kexdh_gex_used == true and msg_code ~= SSH2.SSH_MSG_KEX_DH_GEX_REPLY )
|
||||
or ( kexdh_gex_used == false and msg_code ~= SSH2.SSH_MSG_KEXDH_REPLY )
|
||||
if ( kexdh_gex_used and msg_code ~= SSH2.SSH_MSG_KEX_DH_GEX_REPLY )
|
||||
or ( not kexdh_gex_used and msg_code ~= SSH2.SSH_MSG_KEXDH_REPLY )
|
||||
then
|
||||
socket:close()
|
||||
return
|
||||
|
|
|
|||
|
|
@ -1380,13 +1380,13 @@ function standard_query(socket, type)
|
|||
|
||||
--try to pull the information
|
||||
local status, result = send_query(socket, query)
|
||||
if(status == false) then
|
||||
if not status then
|
||||
stdnse.debug1("Socket error sending query: %s", result)
|
||||
return nil
|
||||
end
|
||||
-- receive packet from response
|
||||
local rcvstatus, response = socket:receive()
|
||||
if(rcvstatus == false) then
|
||||
if not rcvstatus then
|
||||
stdnse.debug1("Socket error receiving: %s", response)
|
||||
return nil
|
||||
end
|
||||
|
|
@ -1424,13 +1424,13 @@ function vendornum_query(socket)
|
|||
|
||||
--send the vendor information
|
||||
local status, result = send_query(socket, vendor_query)
|
||||
if(status == false) then
|
||||
if not status then
|
||||
stdnse.debug1("Socket error sending vendor query: %s", result)
|
||||
return nil
|
||||
end
|
||||
-- receive vendor information packet
|
||||
local rcvstatus, response = socket:receive()
|
||||
if(rcvstatus == false) then
|
||||
if not rcvstatus then
|
||||
stdnse.debug1("Socket error receiving vendor query: %s", response)
|
||||
return nil
|
||||
end
|
||||
|
|
@ -1486,7 +1486,7 @@ action = function(host, port)
|
|||
-- scanning more than one host at a time, may fix some issues seen on Windows
|
||||
--
|
||||
local status, err = sock:bind(nil, port.number)
|
||||
if(status == false) then
|
||||
if not status then
|
||||
stdnse.debug1("Couldn't bind to %s/udp. Continuing anyway, results may vary", port.number)
|
||||
end
|
||||
-- connect to the remote host
|
||||
|
|
@ -1504,7 +1504,7 @@ action = function(host, port)
|
|||
|
||||
-- receive response
|
||||
local rcvstatus, response = sock:receive()
|
||||
if(rcvstatus == false) then
|
||||
if not rcvstatus then
|
||||
stdnse.debug1("Receive error: %s", response)
|
||||
return nil
|
||||
end
|
||||
|
|
|
|||
|
|
@ -50,7 +50,7 @@ portrule = shortport.port_or_service({104, 2345, 2761, 2762, 4242, 11112}, "dico
|
|||
action = function(host, port)
|
||||
local output = stdnse.output_table()
|
||||
local dcm_conn_status, err = dicom.associate(host, port)
|
||||
if dcm_conn_status == false then
|
||||
if not dcm_conn_status then
|
||||
stdnse.debug1("Association failed:%s", err)
|
||||
if err == "ASSOCIATE REJECT received" then
|
||||
port.version.name = "dicom"
|
||||
|
|
|
|||
|
|
@ -1682,7 +1682,7 @@ action = function(host,port)
|
|||
socket:close()
|
||||
|
||||
-- abort if no response
|
||||
if(rcvstatus == false) then
|
||||
if not rcvstatus then
|
||||
return nil
|
||||
end
|
||||
|
||||
|
|
|
|||
|
|
@ -123,7 +123,7 @@ action = function(host,port)
|
|||
try(socket:send(sessInitQuery))
|
||||
|
||||
local rcvstatus, response = socket:receive()
|
||||
if(rcvstatus == false) then
|
||||
if not rcvstatus then
|
||||
stdnse.debug(1, "#- session initiation with HART device - FAIL.")
|
||||
return nil
|
||||
end
|
||||
|
|
@ -137,7 +137,7 @@ action = function(host,port)
|
|||
try(socket:send(cmd0Req))
|
||||
|
||||
local rcvstatus, response = socket:receive()
|
||||
if(rcvstatus == false) then
|
||||
if not rcvstatus then
|
||||
stdnse.debug(1, "#- command 0 Read Unique Identifier request - FAIL.")
|
||||
return nil
|
||||
end
|
||||
|
|
@ -220,7 +220,7 @@ action = function(host,port)
|
|||
try(socket:send(cmd20Req))
|
||||
|
||||
local rcvstatus, response = socket:receive()
|
||||
if(rcvstatus == false) then
|
||||
if not rcvstatus then
|
||||
stdnse.debug(1, "#- command 20 Read Long Tag request - FAIL.")
|
||||
output['Device Information'] = deviceInfo
|
||||
return output
|
||||
|
|
@ -255,7 +255,7 @@ action = function(host,port)
|
|||
try(socket:send(cmd84Req))
|
||||
|
||||
local rcvstatus, response = socket:receive()
|
||||
if(rcvstatus == false) then
|
||||
if not rcvstatus then
|
||||
stdnse.debug(1, "#- command 84 Read Sub-Device Identity Summary request - FAIL.")
|
||||
output['Device Information'] = deviceInfo
|
||||
return output
|
||||
|
|
|
|||
|
|
@ -50,7 +50,7 @@ action = function(host, port)
|
|||
end
|
||||
|
||||
-- If head failed, try using GET
|
||||
if(status == false) then
|
||||
if not status then
|
||||
stdnse.debug1("HEAD request failed, falling back to GET")
|
||||
result = http.get(host, port, path)
|
||||
request_type = "GET"
|
||||
|
|
|
|||
|
|
@ -202,11 +202,11 @@ action = function(host, port)
|
|||
else
|
||||
local status, results, is_vulnerable = go(host, port)
|
||||
|
||||
if(status == false) then
|
||||
if not status then
|
||||
return fail(results)
|
||||
else
|
||||
if(#results == 0) then
|
||||
if(is_vulnerable == false) then
|
||||
if not is_vulnerable then
|
||||
return nmap.verbosity() > 0 and "WebDAV is ENABLED. Protected folder found but could not be exploited. Server does not appear to be vulnerable." or nil
|
||||
else
|
||||
return nmap.verbosity() > 0 and "WebDAV is ENABLED. No protected folder found; check not run. If you know a protected folder, add --script-args=webdavfolder=<path>" or nil
|
||||
|
|
|
|||
|
|
@ -40,7 +40,7 @@ portrule = shortport.http
|
|||
action = function(host, port)
|
||||
-- Check what response we get for a 404
|
||||
local result, result_404, known_404 = http.identify_404(host, port)
|
||||
if(result == false) then
|
||||
if not result then
|
||||
return stdnse.format_output(false, "Couldn't identify 404 message: " .. result_404)
|
||||
end
|
||||
|
||||
|
|
|
|||
|
|
@ -78,13 +78,13 @@ end
|
|||
action = function(host,port)
|
||||
local status, smbstate
|
||||
status, smbstate = msrpc.start_smb(host,msrpc.EPMAPPER_PATH,true)
|
||||
if(status == false) then
|
||||
if not status then
|
||||
stdnse.debug1("SMB: " .. smbstate)
|
||||
return false, smbstate
|
||||
end
|
||||
local bind_result,epresult -- bind to endpoint mapper service
|
||||
status, bind_result = msrpc.bind(smbstate,msrpc.EPMAPPER_UUID, msrpc.EPMAPPER_VERSION, nil)
|
||||
if(status == false) then
|
||||
if not status then
|
||||
msrpc.stop_smb(smbstate)
|
||||
stdnse.debug1("SMB: " .. bind_result)
|
||||
return false, bind_result
|
||||
|
|
|
|||
|
|
@ -119,25 +119,25 @@ action = function(host)
|
|||
status, names, statistics = netbios.do_nbstat(host)
|
||||
status, names, statistics = netbios.do_nbstat(host)
|
||||
status, names, statistics = netbios.do_nbstat(host)
|
||||
if(status == false) then
|
||||
if not status then
|
||||
return stdnse.format_output(false, names)
|
||||
end
|
||||
|
||||
-- Get the server name
|
||||
local status, server_name = netbios.get_server_name(host, names)
|
||||
if(status == false) then
|
||||
if not status then
|
||||
return stdnse.format_output(false, server_name)
|
||||
end
|
||||
|
||||
-- Get the workstation name
|
||||
local status, workstation_name = netbios.get_workstation_name(host, names)
|
||||
if(status == false) then
|
||||
if not status then
|
||||
return stdnse.format_output(false, workstation_name)
|
||||
end
|
||||
|
||||
-- Get the logged in user
|
||||
local status, user_name = netbios.get_user_name(host, names)
|
||||
if(status == false) then
|
||||
if not status then
|
||||
return stdnse.format_output(false, user_name)
|
||||
end
|
||||
|
||||
|
|
|
|||
|
|
@ -258,7 +258,7 @@ local function prng_generate_ports(ip, seed)
|
|||
|
||||
ports[(i % 2) + 3] = (v2 & 0xFFFF) ~ ports[(i % 2) + 3]
|
||||
end
|
||||
until(is_blacklisted_port(ports[3]) == false and is_blacklisted_port(ports[4]) == false and ports[3] ~= ports[4])
|
||||
until not is_blacklisted_port(ports[3]) and not is_blacklisted_port(ports[4]) and ports[3] ~= ports[4]
|
||||
|
||||
return {ports[1], ports[2], ports[3], ports[4]}
|
||||
end
|
||||
|
|
@ -483,7 +483,7 @@ local function conficker_check(ip, port, protocol)
|
|||
local response
|
||||
|
||||
status, packet = p2p_create_packet(protocol)
|
||||
if(status == false) then
|
||||
if not status then
|
||||
return false, packet
|
||||
end
|
||||
|
||||
|
|
@ -491,7 +491,7 @@ local function conficker_check(ip, port, protocol)
|
|||
socket = nmap.new_socket()
|
||||
socket:set_timeout(5000)
|
||||
status, response = socket:connect(ip, port, protocol)
|
||||
if(status == false) then
|
||||
if not status then
|
||||
return false, "Couldn't establish connection (" .. response .. ")"
|
||||
end
|
||||
|
||||
|
|
@ -500,7 +500,7 @@ local function conficker_check(ip, port, protocol)
|
|||
|
||||
-- Read a response (2 bytes minimum, because that's the TCP length)
|
||||
status, response = socket:receive_bytes(2)
|
||||
if(status == false) then
|
||||
if not status then
|
||||
return false, "Couldn't receive bytes: " .. response
|
||||
elseif(response == "ERROR") then
|
||||
return false, "Failed to receive data"
|
||||
|
|
@ -522,7 +522,7 @@ local function conficker_check(ip, port, protocol)
|
|||
tries = tries - 1
|
||||
|
||||
local status, response2 = socket:receive_bytes(length - (#response - 2))
|
||||
if(status == false) then
|
||||
if not status then
|
||||
return false, "Couldn't receive bytes: " .. response2
|
||||
elseif(response2 == "ERROR") then
|
||||
return false, "Failed to receive data"
|
||||
|
|
@ -544,7 +544,7 @@ local function conficker_check(ip, port, protocol)
|
|||
|
||||
local status, result = p2p_parse(response)
|
||||
|
||||
if(status == false) then
|
||||
if not status then
|
||||
return false, "Data received, but wasn't Conficker data: " .. result
|
||||
end
|
||||
|
||||
|
|
|
|||
|
|
@ -63,12 +63,12 @@ portrule = shortport.version_port_or_service(102, "iso-tsap", "tcp")
|
|||
-- @param bytes how many bytes (minimum) you expect back
|
||||
local function send_receive(socket, query, bytes)
|
||||
local sendstatus, senderr = socket:send(query)
|
||||
if(sendstatus == false) then
|
||||
if not sendstatus then
|
||||
return "Error Sending S7COMM"
|
||||
end
|
||||
-- receive response
|
||||
local rcvstatus, response = socket:receive_bytes(bytes)
|
||||
if(rcvstatus == false) then
|
||||
if not rcvstatus then
|
||||
return "Error Reading S7COMM"
|
||||
end
|
||||
return response
|
||||
|
|
|
|||
|
|
@ -96,14 +96,14 @@ from an anonymous connection.
|
|||
-- create SMB session
|
||||
local status, smbstate
|
||||
status, smbstate = msrpc.start_smb(host, msrpc.SAMR_PATH,true)
|
||||
if(status == false) then
|
||||
if not status then
|
||||
return false, smbstate
|
||||
end
|
||||
|
||||
-- bind to SAMR service
|
||||
local bind_result
|
||||
status, bind_result = msrpc.bind(smbstate, msrpc.SAMR_UUID, msrpc.SAMR_VERSION, nil)
|
||||
if(status == false) then
|
||||
if not status then
|
||||
msrpc.stop_smb(smbstate)
|
||||
return false, bind_result
|
||||
end
|
||||
|
|
@ -119,7 +119,7 @@ from an anonymous connection.
|
|||
local marshaledHandle = string.rep("X",20)
|
||||
status, result = msrpc.samr_getaliasmembership(smbstate,marshaledHandle, data)
|
||||
stdnse.debug2("msrpc.samr_getaliasmembership: %s, '%s'", status, result)
|
||||
if(status == false and string.find(result,"Failed to receive bytes after 5 attempts") ~= nil) then
|
||||
if not status and string.find(result, "Failed to receive bytes after 5 attempts") then
|
||||
samba_cve.state = vulns.STATE.VULN -- connection dropped, server crashed
|
||||
end
|
||||
|
||||
|
|
|
|||
|
|
@ -254,7 +254,7 @@ local function stop_session(hostinfo)
|
|||
if(hostinfo['smbstate'] ~= nil) then
|
||||
stdnse.debug2("Stopping the SMB session")
|
||||
status, err = smb.stop(hostinfo['smbstate'])
|
||||
if(status == false) then
|
||||
if not status then
|
||||
return false, err
|
||||
end
|
||||
|
||||
|
|
@ -277,7 +277,7 @@ local function restart_session(hostinfo)
|
|||
|
||||
stdnse.debug2("Starting the SMB session")
|
||||
status, smbstate = smb.start_ex(hostinfo['host'], true, nil, nil, nil, true)
|
||||
if(status == false) then
|
||||
if not status then
|
||||
return false, smbstate
|
||||
end
|
||||
|
||||
|
|
@ -547,7 +547,7 @@ local function initialize(host)
|
|||
|
||||
-- Get the OS (identifying windows versions tells us which hash to use)
|
||||
result, os = smb.get_os(host)
|
||||
if(result == false or os['os'] == nil) then
|
||||
if not result or not os['os'] then
|
||||
hostinfo['os'] = "<Unknown>"
|
||||
else
|
||||
hostinfo['os'] = os['os']
|
||||
|
|
@ -577,7 +577,7 @@ local function initialize(host)
|
|||
if(not(hostinfo['have_user_list'])) then
|
||||
stdnse.debug1("Couldn't enumerate users (normal for Windows XP and higher), using unpwdb initially")
|
||||
status, hostinfo['user_list_default'] = unpwdb.usernames()
|
||||
if(status == false) then
|
||||
if not status then
|
||||
return false, "Couldn't open username file"
|
||||
end
|
||||
end
|
||||
|
|
@ -585,7 +585,7 @@ local function initialize(host)
|
|||
-- Open the password file
|
||||
stdnse.debug1("Opening password list")
|
||||
status, hostinfo['password_list'] = unpwdb.passwords()
|
||||
if(status == false) then
|
||||
if not status then
|
||||
return false, "Couldn't open password file"
|
||||
end
|
||||
|
||||
|
|
@ -593,7 +593,7 @@ local function initialize(host)
|
|||
stdnse.debug1("Starting the initial SMB session")
|
||||
local err
|
||||
status, err = restart_session(hostinfo)
|
||||
if(status == false) then
|
||||
if not status then
|
||||
stop_session(hostinfo)
|
||||
return false, err
|
||||
end
|
||||
|
|
@ -630,7 +630,7 @@ local function initialize(host)
|
|||
-- Restart the SMB connection so we have a clean slate
|
||||
stdnse.debug1("Restarting the session before the bruteforce")
|
||||
status, err = restart_session(hostinfo)
|
||||
if(status == false) then
|
||||
if not status then
|
||||
stop_session(hostinfo)
|
||||
return false, err
|
||||
end
|
||||
|
|
@ -808,7 +808,7 @@ local function validate_usernames(hostinfo)
|
|||
|
||||
-- Start a session
|
||||
status, err = restart_session(hostinfo)
|
||||
if(status == false) then
|
||||
if not status then
|
||||
return false, err
|
||||
end
|
||||
|
||||
|
|
@ -850,13 +850,13 @@ local function validate_usernames(hostinfo)
|
|||
-- Any password works (often happens with 'guest' account)
|
||||
stdnse.debug1("All passwords accepted for %s (goes to %s)", username, result_short_strings[result])
|
||||
status, err = found_account(hostinfo, username, "<anything>", result)
|
||||
if(status == false) then
|
||||
if not status then
|
||||
return false, err
|
||||
end
|
||||
else
|
||||
-- Blank password worked, but not random one
|
||||
status, err = found_account(hostinfo, username, "", result)
|
||||
if(status == false) then
|
||||
if not status then
|
||||
return false, err
|
||||
end
|
||||
end
|
||||
|
|
@ -901,7 +901,7 @@ function found_account(hostinfo, username, password, result)
|
|||
if(result == results.SUCCESS) then
|
||||
-- Stop the connection -- this lets us do some queries
|
||||
status, err = stop_session(hostinfo)
|
||||
if(status == false) then
|
||||
if not status then
|
||||
return false, err
|
||||
end
|
||||
|
||||
|
|
@ -925,7 +925,7 @@ function found_account(hostinfo, username, password, result)
|
|||
end
|
||||
|
||||
-- If we haven't retrieved the real user list yet, do so
|
||||
if(hostinfo['have_user_list'] == false) then
|
||||
if not hostinfo['have_user_list'] then
|
||||
-- Attempt to enumerate users
|
||||
stdnse.debug1("Trying to get user list from server using newly discovered account")
|
||||
local _
|
||||
|
|
@ -947,7 +947,7 @@ function found_account(hostinfo, username, password, result)
|
|||
|
||||
-- Start the session again
|
||||
status, err = restart_session(hostinfo)
|
||||
if(status == false) then
|
||||
if not status then
|
||||
return false, err
|
||||
end
|
||||
|
||||
|
|
@ -968,20 +968,20 @@ local function go(host)
|
|||
|
||||
-- Initialize the hostinfo object, which sets up the initial variables
|
||||
result, hostinfo = initialize(host)
|
||||
if(result == false) then
|
||||
if not result then
|
||||
return false, hostinfo
|
||||
end
|
||||
|
||||
-- If invalid accounts don't give guest, we can determine the existence of users by trying to
|
||||
-- log in with an invalid password and checking the value
|
||||
status, err = validate_usernames(hostinfo)
|
||||
if(status == false) then
|
||||
if not status then
|
||||
return false, err
|
||||
end
|
||||
|
||||
-- Start up the SMB session
|
||||
status, err = restart_session(hostinfo)
|
||||
if(status == false) then
|
||||
if not status then
|
||||
return false, err
|
||||
end
|
||||
|
||||
|
|
@ -1015,7 +1015,7 @@ local function go(host)
|
|||
if(not(stdnse.get_script_args( "smblockout" ))) then
|
||||
-- Mark it as found, which is technically true
|
||||
status, err = found_account(hostinfo, username, nil, results.ACCOUNT_LOCKED_NOW)
|
||||
if(status == false) then
|
||||
if not status then
|
||||
return err
|
||||
end
|
||||
|
||||
|
|
@ -1032,7 +1032,7 @@ local function go(host)
|
|||
-- Reset the connection
|
||||
stdnse.debug2("Found an account; resetting connection")
|
||||
status, err = restart_session(hostinfo)
|
||||
if(status == false) then
|
||||
if not status then
|
||||
return false, err
|
||||
end
|
||||
|
||||
|
|
@ -1048,7 +1048,7 @@ local function go(host)
|
|||
|
||||
-- Take normal actions for finding an account
|
||||
status, err = found_account(hostinfo, username, case_password, result)
|
||||
if(status == false) then
|
||||
if not status then
|
||||
return err
|
||||
end
|
||||
end
|
||||
|
|
@ -1075,7 +1075,7 @@ action = function(host)
|
|||
local locked_result
|
||||
|
||||
status, result, locked_result = go(host)
|
||||
if(status == false) then
|
||||
if not status then
|
||||
return stdnse.format_output(false, result)
|
||||
end
|
||||
|
||||
|
|
|
|||
|
|
@ -84,7 +84,7 @@ local function send_transaction2(smbstate, sub_command, function_parameters, fun
|
|||
-- Send the transaction request
|
||||
stdnse.debug2("SMB: Sending SMB_COM_TRANSACTION2")
|
||||
local result, err = smb.smb_send(smbstate, header, parameters, data, overrides)
|
||||
if(result == false) then
|
||||
if not result then
|
||||
return false, err
|
||||
end
|
||||
|
||||
|
|
|
|||
|
|
@ -197,7 +197,7 @@ end
|
|||
action = function(host)
|
||||
-- Get the process list
|
||||
local status, result = msrpcperformance.get_performance_data(host, "230")
|
||||
if status == false then
|
||||
if not status then
|
||||
return stdnse.format_output(false, result)
|
||||
end
|
||||
|
||||
|
|
|
|||
|
|
@ -868,7 +868,7 @@ action = function(host, port)
|
|||
|
||||
status, bind_result = msrpc.bind(smbstate, msrpc.SVCCTL_UUID, msrpc.SVCCTL_VERSION, nil)
|
||||
|
||||
if(status == false) then
|
||||
if not status then
|
||||
smb.stop(smbstate)
|
||||
return nil, stdnse.format_output(false, bind_result)
|
||||
end
|
||||
|
|
@ -878,7 +878,7 @@ action = function(host, port)
|
|||
|
||||
status, open_result = msrpc.svcctl_openscmanagerw(smbstate, host.ip, 0x02000000)
|
||||
|
||||
if(status == false) then
|
||||
if not status then
|
||||
smb.stop(smbstate)
|
||||
return nil, stdnse.format_output(false, open_result)
|
||||
end
|
||||
|
|
@ -904,7 +904,7 @@ action = function(host, port)
|
|||
-- Fetches service name, display name and service status of every service.
|
||||
status, result = msrpc.svcctl_enumservicesstatusw(smbstate, open_result["handle"], dwservicetype, dwservicestate)
|
||||
|
||||
if(status == false) then
|
||||
if not status then
|
||||
smb.stop(smbstate)
|
||||
return nil, stdnse.format_output(false, result)
|
||||
end
|
||||
|
|
|
|||
|
|
@ -86,20 +86,20 @@ local function srvsvc_enum_sessions(host)
|
|||
|
||||
-- Create the SMB session
|
||||
status, smbstate = msrpc.start_smb(host, msrpc.SRVSVC_PATH)
|
||||
if(status == false) then
|
||||
if not status then
|
||||
return false, smbstate
|
||||
end
|
||||
|
||||
-- Bind to SRVSVC service
|
||||
status, bind_result = msrpc.bind(smbstate, msrpc.SRVSVC_UUID, msrpc.SRVSVC_VERSION, nil)
|
||||
if(status == false) then
|
||||
if not status then
|
||||
msrpc.stop_smb(smbstate)
|
||||
return false, bind_result
|
||||
end
|
||||
|
||||
-- Call netsessenum
|
||||
status, netsessenum_result = msrpc.srvsvc_netsessenum(smbstate, host.ip)
|
||||
if(status == false) then
|
||||
if not status then
|
||||
msrpc.stop_smb(smbstate)
|
||||
return false, netsessenum_result
|
||||
end
|
||||
|
|
@ -125,19 +125,19 @@ local function winreg_enum_rids(host)
|
|||
|
||||
-- Create the SMB session
|
||||
local status, smbstate = msrpc.start_smb(host, msrpc.WINREG_PATH)
|
||||
if(status == false) then
|
||||
if not status then
|
||||
return false, smbstate
|
||||
end
|
||||
|
||||
-- Bind to WINREG service
|
||||
local status, bind_result = msrpc.bind(smbstate, msrpc.WINREG_UUID, msrpc.WINREG_VERSION, nil)
|
||||
if(status == false) then
|
||||
if not status then
|
||||
msrpc.stop_smb(smbstate)
|
||||
return false, bind_result
|
||||
end
|
||||
|
||||
local status, openhku_result = msrpc.winreg_openhku(smbstate)
|
||||
if(status == false) then
|
||||
if not status then
|
||||
msrpc.stop_smb(smbstate)
|
||||
return false, openhku_result
|
||||
end
|
||||
|
|
@ -161,13 +161,13 @@ local function winreg_enum_rids(host)
|
|||
|
||||
-- Query the info about this key. The response will tell us when the user logged into the server.
|
||||
local status, queryinfokey_result = msrpc.winreg_queryinfokey(smbstate, openkey_result['handle'])
|
||||
if(status == false) then
|
||||
if not status then
|
||||
msrpc.stop_smb(smbstate)
|
||||
return false, queryinfokey_result
|
||||
end
|
||||
|
||||
local status, closekey_result = msrpc.winreg_closekey(smbstate, openkey_result['handle'])
|
||||
if(status == false) then
|
||||
if not status then
|
||||
msrpc.stop_smb(smbstate)
|
||||
return false, closekey_result
|
||||
end
|
||||
|
|
@ -184,7 +184,7 @@ local function winreg_enum_rids(host)
|
|||
until status ~= true
|
||||
|
||||
local status, closekey_result = msrpc.winreg_closekey(smbstate, openhku_result['handle'])
|
||||
if(status == false) then
|
||||
if not status then
|
||||
msrpc.stop_smb(smbstate)
|
||||
return false, closekey_result
|
||||
end
|
||||
|
|
@ -193,20 +193,20 @@ local function winreg_enum_rids(host)
|
|||
|
||||
-- Start a new SMB session
|
||||
local status, smbstate = msrpc.start_smb(host, msrpc.LSA_PATH)
|
||||
if(status == false) then
|
||||
if not status then
|
||||
return false, smbstate
|
||||
end
|
||||
|
||||
-- Bind to LSA service
|
||||
local status, bind_result = msrpc.bind(smbstate, msrpc.LSA_UUID, msrpc.LSA_VERSION, nil)
|
||||
if(status == false) then
|
||||
if not status then
|
||||
msrpc.stop_smb(smbstate)
|
||||
return false, bind_result
|
||||
end
|
||||
|
||||
-- Get a policy handle
|
||||
local status, openpolicy2_result = msrpc.lsa_openpolicy2(smbstate, host.ip)
|
||||
if(status == false) then
|
||||
if not status then
|
||||
msrpc.stop_smb(smbstate)
|
||||
return false, openpolicy2_result
|
||||
end
|
||||
|
|
@ -223,7 +223,7 @@ local function winreg_enum_rids(host)
|
|||
|
||||
local status, lookupsids2_result = msrpc.lsa_lookupsids2(smbstate, openpolicy2_result['policy_handle'], {elements[i]['name']})
|
||||
|
||||
if(status == false) then
|
||||
if not status then
|
||||
-- It may not succeed, if it doesn't that's ok
|
||||
stdnse.debug3("MSRPC: Lookup failed")
|
||||
else
|
||||
|
|
@ -273,7 +273,7 @@ action = function(host)
|
|||
-- Enumerate the logged in users
|
||||
local logged_in = {}
|
||||
local status1, users = winreg_enum_rids(host)
|
||||
if(status1 == false) then
|
||||
if not status1 then
|
||||
logged_in['warning'] = "Couldn't enumerate login sessions: " .. users
|
||||
else
|
||||
logged_in['name'] = "Users logged in"
|
||||
|
|
@ -292,7 +292,7 @@ action = function(host)
|
|||
-- Get the connected sessions
|
||||
local sessions_output = {}
|
||||
local status2, sessions = srvsvc_enum_sessions(host)
|
||||
if(status2 == false) then
|
||||
if not status2 then
|
||||
sessions_output['warning'] = "Couldn't enumerate SMB sessions: " .. sessions
|
||||
else
|
||||
sessions_output['name'] = "Active SMB sessions"
|
||||
|
|
|
|||
|
|
@ -108,7 +108,7 @@ action = function(host)
|
|||
|
||||
-- Get the list of shares
|
||||
status, shares, extra = smb.share_get_list(host)
|
||||
if(status == false) then
|
||||
if not status then
|
||||
return stdnse.format_output(false, string.format("Couldn't enumerate shares: %s", shares))
|
||||
end
|
||||
|
||||
|
|
@ -118,7 +118,7 @@ action = function(host)
|
|||
|
||||
-- Find out who the current user is
|
||||
local result, username, domain = smb.get_account(host)
|
||||
if(result == false) then
|
||||
if not result then
|
||||
username = "<unknown>"
|
||||
domain = ""
|
||||
end
|
||||
|
|
|
|||
|
|
@ -200,7 +200,7 @@ action = function(host)
|
|||
end
|
||||
|
||||
-- Check if both failed
|
||||
if(samr_status == false and lsa_status == false) then
|
||||
if not samr_status and not lsa_status then
|
||||
if(string.find(lsa_result, 'ACCESS_DENIED')) then
|
||||
return stdnse.format_output(false, "Access denied while trying to enumerate users; except against Windows 2000, Guest or better is typically required")
|
||||
end
|
||||
|
|
|
|||
|
|
@ -151,7 +151,7 @@ action = function(host)
|
|||
local request_time = os.time()
|
||||
local status, result = smb.get_os(host)
|
||||
|
||||
if(status == false) then
|
||||
if not status then
|
||||
return stdnse.format_output(false, result)
|
||||
end
|
||||
|
||||
|
|
|
|||
|
|
@ -57,14 +57,14 @@ action = function(host,port)
|
|||
file:close()
|
||||
end
|
||||
status, smbstate = msrpc.start_smb(host, msrpc.SPOOLSS_PATH,true)
|
||||
if(status == false) then
|
||||
if not status then
|
||||
stdnse.debug1("SMB: " .. smbstate)
|
||||
return false, smbstate
|
||||
end
|
||||
|
||||
local bind_result
|
||||
status, bind_result = msrpc.bind(smbstate,msrpc.SPOOLSS_UUID, msrpc.SPOOLSS_VERSION, nil)
|
||||
if(status == false) then
|
||||
if not status then
|
||||
msrpc.stop_smb(smbstate)
|
||||
stdnse.debug1("SMB: " .. bind_result)
|
||||
return false, bind_result
|
||||
|
|
@ -77,7 +77,7 @@ action = function(host,port)
|
|||
local REMSmb_NetShareEnum_P = "WrLeh"
|
||||
local REMSmb_share_info_1 = "B13BWz"
|
||||
status, lanman_result = msrpc.call_lanmanapi(smbstate,0,REMSmb_NetShareEnum_P,REMSmb_share_info_1,string.pack("<I2I2", 0x01, 65406))
|
||||
if status == false then
|
||||
if not status then
|
||||
stdnse.debug1("SMB: " .. lanman_result)
|
||||
stdnse.debug1("SMB: Looks like LANMAN API is not available. Try setting printer script arg.")
|
||||
return false
|
||||
|
|
|
|||
|
|
@ -554,28 +554,28 @@ local function get_service_files(host)
|
|||
|
||||
-- Get the name of the service
|
||||
status, service_name = smb.get_uniqueish_name(host)
|
||||
if(status == false) then
|
||||
if not status then
|
||||
return false, string.format("Error generating service name: %s", service_name)
|
||||
end
|
||||
stdnse.debug1("Generated static service name: %s", service_name)
|
||||
|
||||
-- Get the name and service's executable file (with a .txt extension for fun)
|
||||
status, service_file = smb.get_uniqueish_name(host, "txt")
|
||||
if(status == false) then
|
||||
if not status then
|
||||
return false, string.format("Error generating remote filename: %s", service_file)
|
||||
end
|
||||
stdnse.debug1("Generated static service name: %s", service_name)
|
||||
|
||||
-- Get the temporary output file
|
||||
status, temp_output_file = smb.get_uniqueish_name(host, "out.tmp")
|
||||
if(status == false) then
|
||||
if not status then
|
||||
return false, string.format("Error generating remote filename: %s", temp_output_file)
|
||||
end
|
||||
stdnse.debug1("Generated static service filename: %s", temp_output_file)
|
||||
|
||||
-- Get the actual output file
|
||||
status, output_file = smb.get_uniqueish_name(host, "out")
|
||||
if(status == false) then
|
||||
if not status then
|
||||
return false, string.format("Error generating remote output file: %s", output_file)
|
||||
end
|
||||
stdnse.debug1("Generated static output filename: %s", output_file)
|
||||
|
|
@ -603,13 +603,13 @@ function cleanup(host, config)
|
|||
stdnse.debug1("Entering cleanup() -- errors here can generally be ignored")
|
||||
-- Try stopping the service
|
||||
status, err = msrpc.service_stop(host, config.service_name)
|
||||
if(status == false) then
|
||||
if not status then
|
||||
stdnse.debug1("[cleanup] Couldn't stop service: %s", err)
|
||||
end
|
||||
|
||||
-- Try deleting the service
|
||||
status, err = msrpc.service_delete(host, config.service_name)
|
||||
if(status == false) then
|
||||
if not status then
|
||||
stdnse.debug1("[cleanup] Couldn't delete service: %s", err)
|
||||
end
|
||||
|
||||
|
|
@ -722,7 +722,7 @@ local function find_share(host)
|
|||
else
|
||||
-- Try and find a share to use.
|
||||
status, share, path, shares = smb.share_find_writable(host)
|
||||
if(status == false) then
|
||||
if not status then
|
||||
return false, share .. " (May not have an administrator account)"
|
||||
end
|
||||
if(path == nil) then
|
||||
|
|
@ -839,7 +839,7 @@ local function get_config(host, config)
|
|||
|
||||
-- Get information about the socket; it's a bit out of place here, but it should go before the mod loop
|
||||
status, config.lhost, config.lport, config.rhost, config.rport, config.lmac = smb.get_socket_info(host)
|
||||
if(status == false) then
|
||||
if not status then
|
||||
return false, "Couldn't get socket information: " .. config.lhost
|
||||
end
|
||||
|
||||
|
|
@ -1127,7 +1127,7 @@ local function upload_everything(host, config)
|
|||
stdnse.debug1("Uploading: %s => \\\\%s\\%s", config.local_service_file, config.share, config.service_file)
|
||||
local status, err
|
||||
status, err = smb.file_upload(host, config.local_service_file, config.share, "\\" .. config.service_file, overrides, is_xor_encoded)
|
||||
if(status == false) then
|
||||
if not status then
|
||||
cleanup(host, config)
|
||||
return false, string.format("Couldn't upload the service file: %s\n", err)
|
||||
end
|
||||
|
|
@ -1140,7 +1140,7 @@ local function upload_everything(host, config)
|
|||
if(mod.upload) then
|
||||
stdnse.debug1("Uploading: %s => \\\\%s\\%s", mod.filename, config.share, mod.upload_name)
|
||||
status, err = smb.file_upload(host, mod.filename, config.share, "\\" .. mod.upload_name, overrides)
|
||||
if(status == false) then
|
||||
if not status then
|
||||
cleanup(host, config)
|
||||
return false, string.format("Couldn't upload module %s: %s\n", mod.program, err)
|
||||
end
|
||||
|
|
@ -1159,7 +1159,7 @@ local function upload_everything(host, config)
|
|||
|
||||
stdnse.debug1("Uploading extra file: %s => \\\\%s\\%s", extrafile_local, config.share, extrafile)
|
||||
status, err = smb.file_upload(host, extrafile_local, config.share, extrafile, overrides)
|
||||
if(status == false) then
|
||||
if not status then
|
||||
cleanup(host, config)
|
||||
return false, string.format("Couldn't upload extra file %s: %s\n", extrafile_local, err)
|
||||
end
|
||||
|
|
@ -1178,7 +1178,7 @@ end
|
|||
--@return err An error message if status is false.
|
||||
local function create_service(host, config)
|
||||
local status, err = msrpc.service_create(host, config.service_name, config.path .. "\\" .. config.service_file)
|
||||
if(status == false) then
|
||||
if not status then
|
||||
stdnse.debug1("Couldn't create the service: %s", err)
|
||||
cleanup(host, config)
|
||||
|
||||
|
|
@ -1235,7 +1235,7 @@ end
|
|||
--@return err An error message if status is false.
|
||||
local function start_service(host, config, params)
|
||||
local status, err = msrpc.service_start(host, config.service_name, params)
|
||||
if(status == false) then
|
||||
if not status then
|
||||
stdnse.debug1("Couldn't start the service: %s", err)
|
||||
return false, string.format("Couldn't start the service on the remote machine: %s", err)
|
||||
end
|
||||
|
|
@ -1546,7 +1546,7 @@ and place it in nselib/data/psexec/ under the Nmap DATADIR.
|
|||
-- Build the output into a nice table
|
||||
local response
|
||||
status, response = parse_output(config, result)
|
||||
if(status == false) then
|
||||
if not status then
|
||||
return stdnse.format_output(false, "Couldn't parse output: " .. response)
|
||||
end
|
||||
|
||||
|
|
|
|||
|
|
@ -93,12 +93,12 @@ action = function(host)
|
|||
local overrides = {}
|
||||
|
||||
status, state = smb.start(host)
|
||||
if(status == false) then
|
||||
if not status then
|
||||
return stdnse.format_output(false, state)
|
||||
end
|
||||
|
||||
status, err = smb.negotiate_protocol(state, overrides)
|
||||
if(status == false) then
|
||||
if not status then
|
||||
smb.stop(state)
|
||||
return stdnse.format_output(false, err)
|
||||
end
|
||||
|
|
|
|||
|
|
@ -51,7 +51,7 @@ action = function(host)
|
|||
|
||||
result, stats = msrpc.get_server_stats(host)
|
||||
|
||||
if(result == false) then
|
||||
if not result then
|
||||
return stdnse.format_output(false, response)
|
||||
end
|
||||
|
||||
|
|
|
|||
|
|
@ -74,19 +74,19 @@ end
|
|||
local function reg_get_value(smbstate, handle, key, value)
|
||||
-- Open the key
|
||||
local status, openkey_result = msrpc.winreg_openkey(smbstate, handle, key)
|
||||
if(status == false) then
|
||||
if not status then
|
||||
return false, openkey_result
|
||||
end
|
||||
|
||||
-- Query the value
|
||||
local status, queryvalue_result = msrpc.winreg_queryvalue(smbstate, openkey_result['handle'], value)
|
||||
if(status == false) then
|
||||
if not status then
|
||||
return false, queryvalue_result
|
||||
end
|
||||
|
||||
-- Close the key
|
||||
local status, closekey_result = msrpc.winreg_closekey(smbstate, openkey_result['handle'], value)
|
||||
if(status == false) then
|
||||
if not status then
|
||||
return false, closekey_result
|
||||
end
|
||||
|
||||
|
|
@ -99,27 +99,27 @@ local function get_info_registry(host)
|
|||
|
||||
-- Create the SMB session
|
||||
local status, smbstate = msrpc.start_smb(host, msrpc.WINREG_PATH)
|
||||
if(status == false) then
|
||||
if not status then
|
||||
return false, smbstate
|
||||
end
|
||||
|
||||
-- Bind to WINREG service
|
||||
local status, bind_result = msrpc.bind(smbstate, msrpc.WINREG_UUID, msrpc.WINREG_VERSION, nil)
|
||||
if(status == false) then
|
||||
if not status then
|
||||
msrpc.stop_smb(smbstate)
|
||||
return false, bind_result
|
||||
end
|
||||
|
||||
-- Open HKEY_LOCAL_MACHINE
|
||||
local status, openhklm_result = msrpc.winreg_openhklm(smbstate)
|
||||
if(status == false) then
|
||||
if not status then
|
||||
msrpc.stop_smb(smbstate)
|
||||
return false, openhklm_result
|
||||
end
|
||||
|
||||
-- Processor information
|
||||
result['status-number_of_processors'], result['number_of_processors'] = reg_get_value(smbstate, openhklm_result['handle'], "SYSTEM\\CurrentControlSet\\Control\\Session Manager\\Environment", "NUMBER_OF_PROCESSORS")
|
||||
if(result['status-number_of_processors'] == false) then
|
||||
if not result['status-number_of_processors'] then
|
||||
result['number_of_processors'] = 0
|
||||
end
|
||||
result['status-os'], result['os'] = reg_get_value(smbstate, openhklm_result['handle'], "SYSTEM\\CurrentControlSet\\Control\\Session Manager\\Environment", "OS")
|
||||
|
|
@ -148,7 +148,7 @@ local function get_info_registry(host)
|
|||
|
||||
-- OS Information
|
||||
result['status-csdversion'], result['csdversion'] = reg_get_value(smbstate, openhklm_result['handle'], "Software\\Microsoft\\Windows NT\\CurrentVersion", "CSDVersion")
|
||||
if(result['status-csdversion'] == false) then
|
||||
if not result['status-csdversion'] then
|
||||
result['csdversion'] = "(no service packs)"
|
||||
end
|
||||
result['status-currentbuildnumber'], result['currentbuildnumber'] = reg_get_value(smbstate, openhklm_result['handle'], "Software\\Microsoft\\Windows NT\\CurrentVersion", "CurrentBuildNumber")
|
||||
|
|
@ -172,7 +172,7 @@ local function get_info_registry(host)
|
|||
-- Software versions
|
||||
result['status-ie_version'], result['ie_version'] = reg_get_value(smbstate, openhklm_result['handle'], "Software\\Microsoft\\Internet Explorer\\Version Vector", "IE")
|
||||
result['status-ff_version'], result['ff_version'] = reg_get_value(smbstate, openhklm_result['handle'], "Software\\Mozilla\\Mozilla Firefox", "CurrentVersion")
|
||||
if(result['status-ff_version'] == false) then
|
||||
if not result['status-ff_version'] then
|
||||
result['ff_version'] = "<not installed>"
|
||||
end
|
||||
|
||||
|
|
@ -185,7 +185,7 @@ action = function(host)
|
|||
|
||||
local status, result = get_info_registry(host)
|
||||
|
||||
if(status == false) then
|
||||
if not status then
|
||||
return stdnse.format_output(false, result)
|
||||
end
|
||||
|
||||
|
|
@ -207,7 +207,7 @@ action = function(host)
|
|||
-- remove trailing zero terminator
|
||||
local num_procs = result['number_of_processors']:match("^[^%z]*")
|
||||
for i = 0, tonumber(num_procs) - 1, 1 do
|
||||
if(result['status-processornamestring'..i] == false) then
|
||||
if not result['status-processornamestring'..i] then
|
||||
result['status-processornamestring'..i] = "Unknown"
|
||||
end
|
||||
|
||||
|
|
|
|||
|
|
@ -108,13 +108,13 @@ function check_conficker(host)
|
|||
|
||||
-- Create the SMB session
|
||||
status, smbstate = msrpc.start_smb(host, "\\\\BROWSER", true)
|
||||
if(status == false) then
|
||||
if not status then
|
||||
return false, smbstate
|
||||
end
|
||||
|
||||
-- Bind to SRVSVC service
|
||||
status, bind_result = msrpc.bind(smbstate, msrpc.SRVSVC_UUID, msrpc.SRVSVC_VERSION, nil)
|
||||
if(status == false) then
|
||||
if not status then
|
||||
msrpc.stop_smb(smbstate)
|
||||
return false, bind_result
|
||||
end
|
||||
|
|
@ -130,7 +130,7 @@ function check_conficker(host)
|
|||
-- Try checking an illegal string ("\..\") to find Conficker.C and earlier
|
||||
status, netpathcanonicalize_result, error_result = msrpc.srvsvc_netpathcanonicalize(smbstate, host.ip, "\\..\\")
|
||||
|
||||
if(status == false) then
|
||||
if not status then
|
||||
if(string.find(netpathcanonicalize_result, "INVALID_NAME")) then
|
||||
msrpc.stop_smb(smbstate)
|
||||
return true, CLEAN
|
||||
|
|
@ -168,7 +168,7 @@ This system shows signs of being infected by a variant of the worm Conficker.]],
|
|||
|
||||
-- Check for Conficker
|
||||
status, result = check_conficker(host)
|
||||
if(status == false) then
|
||||
if not status then
|
||||
vuln_table.extra_info = CONFICKER_ERROR_HELP[result] or "UNKNOWN; got error " .. result
|
||||
vuln_table.state = vulns.STATE.NOT_VULN
|
||||
else
|
||||
|
|
|
|||
|
|
@ -459,7 +459,7 @@ and execute it.
|
|||
if not version then
|
||||
local status, result = smb.get_os(host)
|
||||
|
||||
if(status == false) then
|
||||
if not status then
|
||||
return stdnse.format_output(false, result)
|
||||
end
|
||||
|
||||
|
|
|
|||
|
|
@ -85,13 +85,13 @@ local function check_smbv2_dos(host)
|
|||
end
|
||||
|
||||
local status, result = socket:connect(host, 445)
|
||||
if(status == false) then
|
||||
if not status then
|
||||
socket:close()
|
||||
return false, "Couldn't connect to host: " .. result
|
||||
end
|
||||
|
||||
status, result = socket:send(buf)
|
||||
if(status == false) then
|
||||
if not status then
|
||||
socket:close()
|
||||
return false, "Couldn't send the buffer: " .. result
|
||||
end
|
||||
|
|
@ -115,7 +115,7 @@ local function check_smbv2_dos(host)
|
|||
status, result = socket:connect(host, 445)
|
||||
|
||||
-- Check the result
|
||||
if(status == false or status == nil) then
|
||||
if not status then
|
||||
stdnse.debug1("Connect failed, host is likely vulnerable!")
|
||||
socket:close()
|
||||
return true, VULNERABLE
|
||||
|
|
@ -124,7 +124,7 @@ local function check_smbv2_dos(host)
|
|||
-- Try sending something
|
||||
stdnse.debug1("Attempting to send data to the host")
|
||||
status, result = socket:send("AAAA")
|
||||
if(status == false or status == nil) then
|
||||
if not status then
|
||||
stdnse.debug1("Send failed, host is likely vulnerable!")
|
||||
socket:close()
|
||||
return true, VULNERABLE
|
||||
|
|
@ -161,7 +161,7 @@ action = function(host)
|
|||
|
||||
-- Check for SMBv2 vulnerability
|
||||
status, result = check_smbv2_dos(host)
|
||||
if(status == false) then
|
||||
if not status then
|
||||
vuln_table.state = vulns.STATE.NOT_VULN
|
||||
else
|
||||
if(result == VULNERABLE) then
|
||||
|
|
|
|||
|
|
@ -80,10 +80,10 @@ function check_ms06_025(host)
|
|||
--first we try with the "\router" pipe, then the "\srvsvc" pipe.
|
||||
local status, smb_result, smbstate, err_msg
|
||||
status, smb_result = msrpc.start_smb(host, msrpc.ROUTER_PATH)
|
||||
if(status == false) then
|
||||
if not status then
|
||||
err_msg = smb_result
|
||||
status, smb_result = msrpc.start_smb(host, msrpc.SRVSVC_PATH) --rras is also accessible across SRVSVC pipe
|
||||
if(status == false) then
|
||||
if not status then
|
||||
return false, NOTUP --if not accessible across both pipes then service is inactive
|
||||
end
|
||||
end
|
||||
|
|
@ -91,7 +91,7 @@ function check_ms06_025(host)
|
|||
--bind to RRAS service
|
||||
local bind_result
|
||||
status, bind_result = msrpc.bind(smbstate, msrpc.RASRPC_UUID, msrpc.RASRPC_VERSION, nil)
|
||||
if(status == false) then
|
||||
if not status then
|
||||
msrpc.stop_smb(smbstate)
|
||||
return false, UNKNOWN --if bind operation results with a false status we can't conclude anything.
|
||||
end
|
||||
|
|
@ -107,7 +107,7 @@ function check_ms06_025(host)
|
|||
status, sr_result = msrpc.RRAS_SubmitRequest(smbstate, req)
|
||||
msrpc.stop_smb(smbstate)
|
||||
--sanity check
|
||||
if(status == false) then
|
||||
if not status then
|
||||
stdnse.debug3("check_ms06_025: RRAS_SubmitRequest failed")
|
||||
if(sr_result == "NT_STATUS_PIPE_BROKEN") then
|
||||
return true, VULNERABLE
|
||||
|
|
@ -142,7 +142,7 @@ action = function(host)
|
|||
|
||||
-- Check for ms06-025
|
||||
status, result = check_ms06_025(host)
|
||||
if(status == false) then
|
||||
if not status then
|
||||
if(result == NOTUP) then
|
||||
vuln_table.extra_info = "Ras RPC service is not enabled."
|
||||
vuln_table.state = vulns.STATE.NOT_VULN
|
||||
|
|
|
|||
|
|
@ -76,14 +76,14 @@ function check_ms07_029(host)
|
|||
--create the SMB session
|
||||
local status, smbstate
|
||||
status, smbstate = msrpc.start_smb(host, msrpc.DNSSERVER_PATH)
|
||||
if(status == false) then
|
||||
if not status then
|
||||
stdnse.debug1("check_ms07_029: Service is not active.")
|
||||
return false, NOTUP --if not accessible across pipe then the service is inactive
|
||||
end
|
||||
--bind to DNSSERVER service
|
||||
local bind_result
|
||||
status, bind_result = msrpc.bind(smbstate, msrpc.DNSSERVER_UUID, msrpc.DNSSERVER_VERSION)
|
||||
if(status == false) then
|
||||
if not status then
|
||||
stdnse.debug1("check_ms07_029: false")
|
||||
msrpc.stop_smb(smbstate)
|
||||
return false, UNKNOWN --if bind operation results with a false status we can't conclude anything.
|
||||
|
|
@ -97,7 +97,7 @@ function check_ms07_029(host)
|
|||
1)--any op num will do
|
||||
--sanity check
|
||||
msrpc.stop_smb(smbstate)
|
||||
if(status == false) then
|
||||
if not status then
|
||||
stdnse.debug1("check_ms07_029: DNSSERVER_Query failed")
|
||||
if(q_result == "NT_STATUS_PIPE_BROKEN") then
|
||||
return true, VULNERABLE
|
||||
|
|
@ -132,7 +132,7 @@ action = function(host)
|
|||
|
||||
-- Check for ms07-029
|
||||
status, result = check_ms07_029(host)
|
||||
if(status == false) then
|
||||
if not status then
|
||||
if(result == NOTUP) then
|
||||
vuln_table.extra_info = "Service is not active."
|
||||
vuln_table.state = vulns.STATE.NOT_VULN
|
||||
|
|
|
|||
|
|
@ -80,13 +80,13 @@ function check_ms08_067(host)
|
|||
|
||||
-- Create the SMB session
|
||||
status, smbstate = msrpc.start_smb(host, "\\\\BROWSER")
|
||||
if(status == false) then
|
||||
if not status then
|
||||
return false, smbstate
|
||||
end
|
||||
|
||||
-- Bind to SRVSVC service
|
||||
status, bind_result = msrpc.bind(smbstate, msrpc.SRVSVC_UUID, msrpc.SRVSVC_VERSION, nil)
|
||||
if(status == false) then
|
||||
if not status then
|
||||
msrpc.stop_smb(smbstate)
|
||||
return false, bind_result
|
||||
end
|
||||
|
|
@ -101,7 +101,7 @@ function check_ms08_067(host)
|
|||
-- Stop the SMB session
|
||||
msrpc.stop_smb(smbstate)
|
||||
|
||||
if(status == false) then
|
||||
if not status then
|
||||
if(string.find(netpathcompare_result, "WERR_INVALID_PARAMETER") ~= nil) then
|
||||
return true, INFECTED
|
||||
elseif(string.find(netpathcompare_result, "INVALID_NAME") ~= nil) then
|
||||
|
|
@ -136,7 +136,7 @@ action = function(host)
|
|||
}
|
||||
-- Check for ms08-067
|
||||
status, result, message = check_ms08_067(host)
|
||||
if(status == false) then
|
||||
if not status then
|
||||
vuln_table.state = vulns.STATE.NOT_VULN
|
||||
else
|
||||
if(result == VULNERABLE) then
|
||||
|
|
|
|||
|
|
@ -90,7 +90,7 @@ local function send_transaction2(smbstate, sub_command, function_parameters)
|
|||
-- Send the transaction request
|
||||
stdnse.debug2("SMB: Sending SMB_COM_TRANSACTION2")
|
||||
local result, err = smb.smb_send(smbstate, header, parameters, data, {})
|
||||
if(result == false) then
|
||||
if not result then
|
||||
return false, err
|
||||
end
|
||||
|
||||
|
|
|
|||
|
|
@ -91,14 +91,14 @@ aka "Print Spooler Service Impersonation Vulnerability."
|
|||
ms10_061.state = vulns.STATE.NOT_VULN
|
||||
local status, smbstate
|
||||
status, smbstate = msrpc.start_smb(host, msrpc.SPOOLSS_PATH,true)
|
||||
if(status == false) then
|
||||
if not status then
|
||||
stdnse.debug1("SMB: " .. smbstate)
|
||||
return false, smbstate
|
||||
end
|
||||
|
||||
local bind_result
|
||||
status, bind_result = msrpc.bind(smbstate,msrpc.SPOOLSS_UUID, msrpc.SPOOLSS_VERSION, nil)
|
||||
if(status == false) then
|
||||
if not status then
|
||||
msrpc.stop_smb(smbstate)
|
||||
stdnse.debug1("SMB: " .. bind_result)
|
||||
return false, bind_result
|
||||
|
|
@ -112,7 +112,7 @@ aka "Print Spooler Service Impersonation Vulnerability."
|
|||
local REMSmb_share_info_1 = "B13BWz"
|
||||
status, lanman_result = msrpc.call_lanmanapi(
|
||||
smbstate, 0, REMSmb_NetShareEnum_P, REMSmb_share_info_1, "\x01\x00\x7e\xff")
|
||||
if status == false then
|
||||
if not status then
|
||||
stdnse.debug1("SMB: " .. lanman_result)
|
||||
stdnse.debug1("SMB: Looks like LANMAN API is not available. Try setting printer script arg.")
|
||||
end
|
||||
|
|
|
|||
|
|
@ -123,7 +123,7 @@ local function check_ms17010(host, port, sharename)
|
|||
)
|
||||
stdnse.debug2("SMB: Sending SMB_COM_TRANSACTION")
|
||||
local result, err = smb.smb_send(smbstate, smb_header, smb_params, '', overrides)
|
||||
if(result == false) then
|
||||
if not result then
|
||||
stdnse.debug1("There was an error in the SMB_COM_TRANSACTION request")
|
||||
return false, err
|
||||
end
|
||||
|
|
|
|||
|
|
@ -66,20 +66,20 @@ function check_winreg_Enum_crash(host)
|
|||
|
||||
-- Create the SMB session
|
||||
status, smbstate = msrpc.start_smb(host, msrpc.WINREG_PATH)
|
||||
if(status == false) then
|
||||
if not status then
|
||||
return false, smbstate
|
||||
end
|
||||
|
||||
-- Bind to WINREG service
|
||||
status, bind_result = msrpc.bind(smbstate, msrpc.WINREG_UUID, msrpc.WINREG_VERSION, nil)
|
||||
if(status == false) then
|
||||
if not status then
|
||||
msrpc.stop_smb(smbstate)
|
||||
return false, bind_result
|
||||
end
|
||||
|
||||
local openhku_result
|
||||
status, openhku_result = msrpc.winreg_openhku(smbstate)
|
||||
if(status == false) then
|
||||
if not status then
|
||||
msrpc.stop_smb(smbstate)
|
||||
return false, openhku_result
|
||||
end
|
||||
|
|
@ -89,7 +89,7 @@ function check_winreg_Enum_crash(host)
|
|||
status, enumkey_result = msrpc.winreg_enumkey(smbstate, openhku_result['handle'], 0, nil)
|
||||
msrpc.stop_smb(smbstate)
|
||||
|
||||
if(status == false) then
|
||||
if not status then
|
||||
return true, VULNERABLE
|
||||
end
|
||||
return true, PATCHED
|
||||
|
|
@ -111,7 +111,7 @@ while working on smb-enum-sessions.
|
|||
|
||||
-- Check for a winreg_Enum crash
|
||||
status, result = check_winreg_Enum_crash(host)
|
||||
if(status == false) then
|
||||
if not status then
|
||||
vuln_table.state = vulns.STATE.NOT_VULN
|
||||
else
|
||||
if(result == VULNERABLE) then
|
||||
|
|
|
|||
|
|
@ -105,7 +105,7 @@ action = function(host, port)
|
|||
end
|
||||
|
||||
local open_status, open_service_result = msrpc.svcctl_openservicew(smbstate, open_result['handle'], 'webexservice', 0x00010)
|
||||
if open_status == false then
|
||||
if not open_status then
|
||||
status, close_result = msrpc.svcctl_closeservicehandle(smbstate, open_result['handle'])
|
||||
smb.stop(smbstate)
|
||||
if string.match(open_service_result, 'NT_STATUS_SERVICE_DOES_NOT_EXIST') then
|
||||
|
|
|
|||
|
|
@ -96,7 +96,7 @@ action = function(host, port)
|
|||
|
||||
local open_status, open_service_result = msrpc.svcctl_openservicew(smbstate, open_result['handle'], 'webexservice', 0x00010)
|
||||
|
||||
if open_status == false then
|
||||
if not open_status then
|
||||
status, close_result = msrpc.svcctl_closeservicehandle(smbstate, open_result['handle'])
|
||||
smb.stop(smbstate)
|
||||
if string.match(open_service_result, 'NT_STATUS_SERVICE_DOES_NOT_EXIST') then
|
||||
|
|
|
|||
|
|
@ -59,7 +59,7 @@ action = function(host,port)
|
|||
|
||||
-- Checking if SMB 2+ is supported in general
|
||||
status, smbstate = smb.start(host)
|
||||
if(status == false) then
|
||||
if not status then
|
||||
return false, smbstate
|
||||
end
|
||||
local max_dialect
|
||||
|
|
@ -73,7 +73,7 @@ action = function(host,port)
|
|||
for i, dialect in pairs(smb2.dialects()) do
|
||||
-- we need a clean connection for each negotiate request
|
||||
status, smbstate = smb.start(host)
|
||||
if(status == false) then
|
||||
if not status then
|
||||
stdnse.debug1("Could not establish a connection.")
|
||||
return nil
|
||||
end
|
||||
|
|
|
|||
|
|
@ -43,7 +43,7 @@ action = function(host,port)
|
|||
local output = stdnse.output_table()
|
||||
|
||||
local status, smbstate = smb.start(host)
|
||||
if(status == false) then
|
||||
if not status then
|
||||
return false, smbstate
|
||||
end
|
||||
-- SMB signing configuration appears to be global so
|
||||
|
|
|
|||
|
|
@ -247,12 +247,12 @@ action = function(host, port)
|
|||
local socket = nmap.new_socket("udp")
|
||||
status = socket:connect(host, port)
|
||||
|
||||
if ( not(status) ) then
|
||||
if not status then
|
||||
return fail("Failed to connect to server")
|
||||
end
|
||||
|
||||
local status, _, lport = socket:get_info()
|
||||
if( not(status) ) then
|
||||
if not status then
|
||||
return fail("Failed to retrieve local port")
|
||||
end
|
||||
|
||||
|
|
|
|||
Loading…
Add table
Add a link
Reference in a new issue