Server : Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips PHP/7.4.20 System : Linux st2.domain.com 3.10.0-1127.10.1.el7.x86_64 #1 SMP Wed Jun 3 14:28:03 UTC 2020 x86_64 User : apache ( 48) PHP Version : 7.4.20 Disable Function : NONE Directory : /usr/share/nmap/scripts/ |
local brute = require "brute" local creds = require "creds" local nmap = require "nmap" local shortport = require "shortport" description=[[ Performs brute force password auditing against a Nessus vulnerability scanning daemon using the NTP 1.2 protocol. ]] --- -- @usage -- nmap --script nessus-brute -p 1241 <host> -- -- @output -- PORT STATE SERVICE -- 1241/tcp open nessus -- | nessus-brute: -- | Accounts -- | nessus:nessus - Valid credentials -- | Statistics -- |_ Performed 35 guesses in 75 seconds, average tps: 0 -- -- This script does not appear to perform well when run using multiple threads -- Although, it's very slow running under a single thread it does work as intended -- -- -- Version 0.1 -- Created 22/10/2011 - v0.1 - created by Patrik Karlsson <[email protected]> -- author = "Patrik Karlsson" license = "Same as Nmap--See http://nmap.org/book/man-legal.html" categories = {"intrusive", "brute"} portrule = shortport.port_or_service(1241, "nessus", "tcp") Driver = { new = function(self, host, port) local o = { host = host, port = port } setmetatable(o, self) self.__index = self return o end, connect = function( self ) self.socket = nmap.new_socket() if ( not(self.socket:connect(self.host, self.port, "ssl")) ) then return false end return true end, login = function( self, username, password ) local handshake = "< NTP/1.2 >< plugins_cve_id plugins_version timestamps dependencies fast_login >\n" local status, err = self.socket:send(handshake) if ( not(status) ) then local err = brute.Error:new( "Failed to send handshake to server" ) err:setAbort(true) return false, err end local line status, line = self.socket:receive_buf("\r?\n", false) if ( not(status) or line ~= "< NTP/1.2 >" ) then local err = brute.Error:new( "The server failed to respond to handshake" ) err:setAbort( true ) return false, err end status, line = self.socket:receive() if ( not(status) or line ~= "User : ") then local err = brute.Error:new( "Expected \"User : \", got something else" ) err:setRetry( true ) return false, err end status = self.socket:send(username .. "\n") if ( not(status) ) then local err = brute.Error:new( "Failed to send username to server" ) err:setAbort( true ) return false, err end status, line = self.socket:receive() if ( not(status) or line ~= "Password : ") then local err = brute.Error:new( "Expected \"Password : \", got something else" ) err:setRetry( true ) return false, err end status = self.socket:send(password) if ( not(status) ) then local err = brute.Error:new( "Failed to send password to server" ) err:setAbort( true ) return false, err end -- the line feed has to be sent separate like this, otherwise we don't -- receive the server response and the server simply hangs up status = self.socket:send("\n") if ( not(status) ) then local err = brute.Error:new( "Failed to send password to server" ) err:setAbort( true ) return false, err end -- we force a brief incorrect statement just to get an error message to -- confirm that we've succesfully authenticated to the server local bad_cli_pref = "CLIENT <|> PREFERENCES <|>\n<|> CLIENT\n" status = self.socket:send(bad_cli_pref) if ( not(status) ) then local err = brute.Error:new( "Failed to send bad client preferences packet to server" ) err:setAbort( true ) return false, err end -- if the server disconnects us at this point, it's most likely due to -- that the authentication failed, so simply treat it as an incorrect -- password, rather than abort. status, line = self.socket:receive() if ( not(status) ) then return false, brute.Error:new( "Incorrect password" ) end if ( line:match("SERVER <|> PREFERENCES_ERRORS <|>") ) then return true, brute.Account:new(username, password, creds.State.VALID) end return false, brute.Error:new( "Incorrect password" ) end, disconnect = function( self ) self.socket:close() end, } action = function(host, port) local engine = brute.Engine:new(Driver, host, port) engine.options.script_name = SCRIPT_NAME -- the nessus service doesn't appear to do very well with multiple threads engine:setMaxThreads(1) local status, result = engine:start() return result end