542 lines
18 KiB
Lua
542 lines
18 KiB
Lua
--- The credential class stores found credentials in the Nmap registry
|
|
--
|
|
-- The credentials library may be used by scripts to store credentials in
|
|
-- a common format in the nmap registry. The Credentials class serves as
|
|
-- a primary interface for scripts to the library.
|
|
--
|
|
-- The State table keeps track of possible account states and a corresponding
|
|
-- message to return for each state.
|
|
--
|
|
-- The following code illustrates how a script may add discovered credentials
|
|
-- to the database:
|
|
-- <code>
|
|
-- local c = creds.Credentials:new( {"myapp"}, host, port )
|
|
-- c:add("patrik", "secret", creds.State.VALID )
|
|
-- </code>
|
|
--
|
|
-- The following code illustrates how a script can return a table of discovered
|
|
-- credentials at the end of execution:
|
|
-- <code>
|
|
-- return tostring(creds.Credentials:new({"myapp"}, host, port))
|
|
-- </code>
|
|
--
|
|
-- Another script can iterate over credential already discovered by other
|
|
-- scripts just by referring to the same tag:
|
|
-- <code>
|
|
-- local c = creds.Credentials:new({"myapp", "yourapp"}, host, port)
|
|
-- for cred in c:getCredentials(creds.State.VALID) do
|
|
-- showContentForUser(cred.user, cred.pass)
|
|
-- end
|
|
-- </code>
|
|
--
|
|
-- The following code illustrates how a script may iterate over all discovered
|
|
-- credentials:
|
|
-- <code>
|
|
-- local c = creds.Credentials:new(creds.ALL_DATA, host, port)
|
|
-- for cred in c:getCredentials(creds.State.VALID) do
|
|
-- showContentForUser(cred.user, cred.pass)
|
|
-- end
|
|
-- </code>
|
|
--
|
|
-- The library also enables users to add credentials through script arguments
|
|
-- either globally or per service. These credentials may be retrieved by script
|
|
-- through the same functions as any other discovered credentials. Arguments
|
|
-- passed using script arguments will be added with the PARAM state. The
|
|
-- following code may be used by a scripts to retrieve these credentials:
|
|
-- <code>
|
|
-- local c = creds.Credentials:new(creds.ALL_DATA, host, port)
|
|
-- for cred in c:getCredentials(creds.State.PARAM) do
|
|
-- ... do something ...
|
|
-- end
|
|
-- </code>
|
|
--
|
|
-- Any globally added credentials will be made available to all scripts,
|
|
-- regardless of what service is being filtered through the host and port
|
|
-- arguments when instantiating the Credentials class. Service specific
|
|
-- arguments will only be made available to scripts with ports matching
|
|
-- the service name. The following two examples illustrate how credentials are
|
|
-- added globally and for the http service:
|
|
-- <code>
|
|
-- --script-args creds.global='admin:nimda'
|
|
-- --script-args creds.http='webadmin:password'
|
|
-- </code>
|
|
--
|
|
-- The service name at this point may be anything and the entry is created
|
|
-- dynamically without validating whether the service exists or not.
|
|
--
|
|
-- The credential argument is not documented in this library using the <at>args
|
|
-- function as the argument would incorrectly show up in all scripts making use
|
|
-- of this library. This would show that credentials could be added to scripts
|
|
-- that do not make use of this function. Therefore any scripts that make use
|
|
-- of the credentials passing arguments need to have appropriate documentation
|
|
-- added to them.
|
|
--
|
|
--
|
|
-- The following code illustrates how a script may save its discovered credentials
|
|
-- to a file:
|
|
-- <code>
|
|
-- local c = creds.Credentials:new( SCRIPT_NAME, host, port )
|
|
-- c:add("patrik", "secret", creds.State.VALID )
|
|
-- status, err = c:saveToFile("outputname","csv")
|
|
-- </code>
|
|
--
|
|
-- Supported output formats are CSV, verbose and plain. In both verbose and plain
|
|
-- records are separated by colons. The difference between the two is that verbose
|
|
-- includes the credential state. The file extension is automatically added to
|
|
-- the filename based on the type requested.
|
|
--
|
|
-- @args creds.global Credentials to be returned by Credentials.getCredentials
|
|
-- regardless of the service.
|
|
-- @args creds.[service] Credentials to be returned by
|
|
-- Credentials.getCredentials for [service]. E.g.
|
|
-- creds.http=admin:password
|
|
--
|
|
-- @author Patrik Karlsson <patrik@cqure.net>
|
|
-- @copyright Same as Nmap--See https://nmap.org/book/man-legal.html
|
|
|
|
-- Version 0.5
|
|
-- Created 2011/02/06 - v0.1 - created by Patrik Karlsson <patrik@cqure.net>
|
|
-- Revised 2011/27/06 - v0.2 - revised by Patrik Karlsson <patrik@cqure.net>
|
|
-- * added documentation
|
|
-- * added getCredentials function
|
|
--
|
|
-- Revised 2011/05/07 - v0.3 - revised by Patrik Karlsson <patrik@cqure.net>
|
|
-- * modified getCredentials to return an iterator
|
|
-- * added support for adding credentials as
|
|
-- script arguments
|
|
--
|
|
-- Revised 2011/09/04 - v0.4 - revised by Tom Sellers
|
|
-- * added saveToFile function for saving credential
|
|
-- * table to file in CSV or text formats
|
|
--
|
|
-- Revised 2015/19/08 - v0.5 - Gioacchino Mazzurco <gmazzurco89@gmail.com>
|
|
-- * added multitag support to share credential easier across
|
|
-- scripts
|
|
--
|
|
|
|
local coroutine = require "coroutine"
|
|
local io = require "io"
|
|
local ipOps = require "ipOps"
|
|
local nmap = require "nmap"
|
|
local stdnse = require "stdnse"
|
|
local stringaux = require "stringaux"
|
|
local table = require "table"
|
|
local tableaux = require "tableaux"
|
|
_ENV = stdnse.module("creds", stdnse.seeall)
|
|
|
|
|
|
--- Table mapping the different account states to their number
|
|
--
|
|
-- Also available is the <code>StateMsg</code> table, used to map these numbers
|
|
-- to a description.
|
|
-- @class table
|
|
-- @name State
|
|
-- @field LOCKED Account is locked
|
|
-- @field VALID Valid credentials
|
|
-- @field DISABLED Account is disabled
|
|
-- @field CHANGEPW Valid credentials, password must be changed at next logon
|
|
-- @field PARAM Credentials passed to script during Nmap execution
|
|
-- @field EXPIRED Valid credentials, account expired
|
|
-- @field TIME_RESTRICTED Valid credentials, account cannot log in at current time
|
|
-- @field HOST_RESTRICTED Valid credentials, account cannot log in from current host
|
|
-- @field LOCKED_VALID Valid credentials, account locked
|
|
-- @field DISABLED_VALID Valid credentials, account disabled
|
|
-- @field HASHED Hashed valid or invalid credentials
|
|
State = {
|
|
LOCKED = 1,
|
|
VALID = 2,
|
|
DISABLED = 4,
|
|
CHANGEPW = 8,
|
|
PARAM = 16,
|
|
EXPIRED = 32,
|
|
TIME_RESTRICTED = 64,
|
|
HOST_RESTRICTED = 128,
|
|
LOCKED_VALID = 256,
|
|
DISABLED_VALID = 512,
|
|
HASHED = 1024,
|
|
}
|
|
|
|
StateMsg = {
|
|
[State.LOCKED] = 'Account is locked',
|
|
[State.VALID] = 'Valid credentials',
|
|
[State.DISABLED] = 'Account is disabled',
|
|
[State.CHANGEPW] = 'Valid credentials, password must be changed at next logon',
|
|
[State.PARAM] = 'Credentials passed to script during Nmap execution',
|
|
[State.EXPIRED] = 'Valid credentials, account expired',
|
|
[State.TIME_RESTRICTED] = 'Valid credentials, account cannot log in at current time',
|
|
[State.HOST_RESTRICTED] = 'Valid credentials, account cannot log in from current host',
|
|
[State.LOCKED_VALID] = 'Valid credentials, account locked',
|
|
[State.DISABLED_VALID] = 'Valid credentials, account disabled',
|
|
[State.HASHED] = 'Hashed valid or invalid credentials',
|
|
}
|
|
|
|
|
|
ALL_DATA = {}
|
|
|
|
-- The RegStorage class
|
|
RegStorage = {
|
|
|
|
--- Creates a new RegStorage instance
|
|
--
|
|
-- @return a new instance
|
|
-- @name RegStorage.new
|
|
new = function(self)
|
|
local o = {}
|
|
setmetatable(o, self)
|
|
self.__index = self
|
|
o.filter = {}
|
|
return o
|
|
end,
|
|
|
|
--- Add credentials to storage
|
|
--
|
|
-- @param tags a table containing tags associated with the credentials
|
|
-- @param host host table, name or ip
|
|
-- @param port number containing the port of the service
|
|
-- @param service the name of the service
|
|
-- @param user the name of the user
|
|
-- @param pass the password of the user
|
|
-- @param state of the account
|
|
-- @name RegStorage.add
|
|
add = function( self, tags, host, port, service, user, pass, state )
|
|
local cred = {
|
|
tags = tags,
|
|
host = host,
|
|
port = port,
|
|
service = service,
|
|
user = user,
|
|
pass = pass,
|
|
state = state
|
|
}
|
|
nmap.registry.creds = nmap.registry.creds or {}
|
|
table.insert( nmap.registry.creds, cred )
|
|
end,
|
|
|
|
--- Sets the storage filter
|
|
--
|
|
-- @param host table containing the host
|
|
-- @param port table containing the port
|
|
-- @param state table containing the account state
|
|
-- @name RegStorage.setFilter
|
|
setFilter = function( self, host, port, state )
|
|
self.filter.host = host
|
|
self.filter.port = port
|
|
self.filter.state = state
|
|
end,
|
|
|
|
--- Returns a credential iterator matching the selected filters
|
|
--
|
|
-- @return a credential iterator
|
|
-- @name RegStorage.getAll
|
|
getAll = function( self )
|
|
local function get_next()
|
|
local host, port = self.filter.host, self.filter.port
|
|
|
|
if ( not(nmap.registry.creds) ) then return end
|
|
|
|
for _, v in pairs(nmap.registry.creds) do
|
|
local h = ( v.host.ip or v.host )
|
|
if ( not(host) and not(port) ) then
|
|
if ( not(self.filter.state) or ( v.state == self.filter.state ) ) then
|
|
coroutine.yield(v)
|
|
end
|
|
elseif ( not(host) and ( port == v.port ) ) then
|
|
if ( not(self.filter.state) or ( v.state == self.filter.state ) ) then
|
|
coroutine.yield(v)
|
|
end
|
|
elseif ( ( host and ( h == host or h == host.ip ) ) and not(port) ) then
|
|
if ( not(self.filter.state) or ( v.state == self.filter.state ) ) then
|
|
coroutine.yield(v)
|
|
end
|
|
elseif ( ( host and ( h == host or h == host.ip ) ) and port.number == v.port ) then
|
|
if ( not(self.filter.state) or ( v.state == (self.filter.state & v.state) ) ) then
|
|
coroutine.yield(v)
|
|
end
|
|
end
|
|
end
|
|
end
|
|
return coroutine.wrap(get_next)
|
|
end,
|
|
|
|
}
|
|
|
|
Account = {
|
|
--- Creates a new instance of the Account class
|
|
--
|
|
-- @param username containing the user's name
|
|
-- @param password containing the user's password
|
|
-- @param state A <code>creds.State</code> account state
|
|
-- @return A new <code>creds.Account</code> object
|
|
-- @name Account.new
|
|
new = function(self, username, password, state)
|
|
local o = { username = username, password = password, state = StateMsg[state] or state }
|
|
setmetatable(o, self)
|
|
self.__index = self
|
|
return o
|
|
end,
|
|
|
|
--- Converts an account object to a printable script
|
|
--
|
|
-- @return string representation of object
|
|
-- @name Account.__tostring
|
|
__tostring = function( self )
|
|
return (
|
|
(self.username and self.username .. ":" or "") ..
|
|
(self.password ~= "" and self.password or "<empty>") ..
|
|
(self.state and " - " .. self.state or "")
|
|
)
|
|
end,
|
|
|
|
--- Less-than operation for sorting
|
|
--
|
|
-- Lexicographic comparison by user, pass, and state
|
|
-- @name Account.__lt
|
|
__lt = function (a, b)
|
|
if a.user and b.user and a.user >= b.user then
|
|
return false
|
|
elseif a.pass and b.pass and a.pass >= b.pass then
|
|
return false
|
|
elseif a.state and b.state and a.state >= b.state then
|
|
return false
|
|
end
|
|
return true
|
|
end,
|
|
}
|
|
|
|
|
|
-- Return a function suitable for use as a __pairs metamethod
|
|
-- which will cause the table to yield its values sorted by key.
|
|
local function sorted_pairs (sortby)
|
|
return function (t)
|
|
local order = tableaux.keys(t)
|
|
table.sort(order, sortby)
|
|
return coroutine.wrap(function()
|
|
for i,k in ipairs(order) do
|
|
coroutine.yield(k, t[k])
|
|
end
|
|
end)
|
|
end
|
|
end
|
|
|
|
-- The credentials class
|
|
Credentials = {
|
|
|
|
--- Creates a new instance of the Credentials class
|
|
-- @param tags a table containing tags associated with the credentials
|
|
-- @param host table as received by the scripts action method
|
|
-- @param port table as received by the scripts action method
|
|
-- @name Credentials.new
|
|
new = function(self, tags, host, port)
|
|
local o = {}
|
|
setmetatable(o, self)
|
|
self.__index = self
|
|
o.storage = RegStorage:new()
|
|
o.storage:setFilter(host, port)
|
|
o.host = host
|
|
o.port = ( port and port.number ) and port.number
|
|
o.service = ( port and port.service ) and port.service
|
|
if ( type(tags) ~= "table" ) then tags = {tags} end
|
|
o.tags = tags
|
|
return o
|
|
end,
|
|
|
|
--- Add a discovered credential
|
|
--
|
|
-- @param user the name of the user
|
|
-- @param pass the password of the user
|
|
-- @param state of the account
|
|
-- @name Credentials.add
|
|
add = function( self, user, pass, state )
|
|
local pass = ( pass and #pass > 0 ) and pass or "<empty>"
|
|
assert( self.host, "No host supplied" )
|
|
assert( self.port, "No port supplied" )
|
|
assert( state, "No state supplied")
|
|
assert( self.tags, "No tags supplied")
|
|
|
|
-- there are cases where we will only get a user or password
|
|
-- so as long we have one of them, we're good
|
|
if ( user or pass ) then
|
|
self.storage:add( self.tags, self.host, self.port, self.service, user, pass, state )
|
|
end
|
|
end,
|
|
|
|
--- Returns a credential iterator
|
|
--
|
|
-- @see State
|
|
-- @param state mask containing values from the <code>State</code> table
|
|
-- @return credential iterator, returning a credential each time it's
|
|
-- called. Unless filtered by the state mask all credentials
|
|
-- for the host, port match are iterated over.
|
|
-- The credential table has the following fields:
|
|
-- <code>host</code> - table as received by the action function
|
|
-- <code>port</code> - number containing the port number
|
|
-- <code>user</code> - string containing the user name
|
|
-- <code>pass</code> - string containing the user password
|
|
-- <code>state</code> - a state number
|
|
-- <code>service</code> - string containing the name of the service
|
|
-- <code>tags</code> - table containing tags associated with
|
|
-- the credential
|
|
-- @name Credentials.getCredentials
|
|
getCredentials = function(self, state)
|
|
local function next_credential()
|
|
if ( state ) then
|
|
self.storage:setFilter(self.host, { number=self.port, service = self.service }, state)
|
|
end
|
|
|
|
for cred in self.storage:getAll() do
|
|
if ( self.tags == ALL_DATA ) then
|
|
coroutine.yield(cred)
|
|
end
|
|
for _,stag in pairs(self.tags) do
|
|
for _,ctag in pairs(cred.tags) do
|
|
if(stag == ctag) then
|
|
coroutine.yield(cred)
|
|
end
|
|
end
|
|
end
|
|
end
|
|
|
|
if ( state and State.PARAM == (state & State.PARAM) ) then
|
|
local creds_global = stdnse.get_script_args('creds.global')
|
|
local creds_service
|
|
local creds_params
|
|
|
|
if ( self.service ) then
|
|
creds_service = stdnse.get_script_args('creds.' .. self.service )
|
|
end
|
|
|
|
if ( creds_service ) then creds_params = creds_service end
|
|
if ( creds_global and creds_service ) then
|
|
creds_params = creds_params .. ',' .. creds_global
|
|
elseif ( creds_global ) then
|
|
creds_params = creds_global
|
|
end
|
|
|
|
if ( not(creds_params) ) then return end
|
|
|
|
for _, cred in ipairs(stringaux.strsplit(",", creds_params)) do
|
|
-- if the credential contains a ':' we have a user + pass pair
|
|
-- if not, we only have a user with an empty password
|
|
local user, pass
|
|
if ( cred:match(":") ) then
|
|
user, pass = cred:match("^(.-):(.-)$")
|
|
else
|
|
user = cred:match("^(.*)$")
|
|
end
|
|
coroutine.yield( { host = self.host,
|
|
port = self.port,
|
|
user = user,
|
|
pass = pass,
|
|
state = State.PARAM,
|
|
service = self.service } )
|
|
end
|
|
end
|
|
end
|
|
return coroutine.wrap( next_credential )
|
|
end,
|
|
|
|
--- Returns a table of credentials
|
|
--
|
|
-- @return tbl table containing the discovered credentials
|
|
-- @name Credentials.getTable
|
|
getTable = function(self)
|
|
local result = {}
|
|
|
|
for v in self:getCredentials() do
|
|
local h = ( v.host.ip or v.host )
|
|
assert(type(h)=="string", "Could not determine a valid host")
|
|
local svc = ("%s/%s"):format(v.port,v.service)
|
|
|
|
result[h] = result[h] or {}
|
|
result[h][svc] = result[h][svc] or {}
|
|
table.insert( result[h][svc], Account:new(
|
|
v.user ~= "" and v.user or nil,
|
|
v.pass,
|
|
v.state
|
|
)
|
|
)
|
|
end
|
|
|
|
for _, host_tbl in pairs(result) do
|
|
for _, svc_tbl in pairs(host_tbl) do
|
|
-- sort the accounts
|
|
table.sort( svc_tbl )
|
|
end
|
|
-- sort the services
|
|
setmetatable(host_tbl, {
|
|
__pairs = sorted_pairs( function(a,b)
|
|
return tonumber(a:match("^(%d+)")) < tonumber(b:match("^(%d+)"))
|
|
end )
|
|
})
|
|
end
|
|
|
|
-- sort the IP addresses
|
|
setmetatable(result, {
|
|
__pairs = sorted_pairs( function(a, b)
|
|
return ipOps.compare_ip(a, "le", b)
|
|
end )
|
|
})
|
|
|
|
local _
|
|
if ( self.host and next(result) ) then
|
|
_, result = next(result)
|
|
end
|
|
if ( self.host and self.port and next(result) ) then
|
|
_, result = next(result)
|
|
end
|
|
return next(result) and result
|
|
end,
|
|
|
|
-- Saves credentials in the current object to file
|
|
-- @param filename string name of the file
|
|
-- @param fileformat string file format type, values = csv | verbose | plain (default)
|
|
-- @return status true on success, false on failure
|
|
-- @return err string containing the error if status is false
|
|
saveToFile = function(self, filename, fileformat)
|
|
|
|
if ( fileformat == 'csv' ) then
|
|
filename = filename .. '.csv'
|
|
else
|
|
filename = filename .. '.txt'
|
|
end
|
|
|
|
local f = io.open( filename, "w")
|
|
local output = nil
|
|
|
|
if ( not(f) ) then
|
|
return false, ("ERROR: Failed to open file (%s)"):format(filename)
|
|
end
|
|
|
|
for account in self:getCredentials() do
|
|
if ( fileformat == 'csv' ) then
|
|
output = "\"" .. account.user .. "\",\"" .. account.pass .. "\",\"" .. StateMsg[account.state] .. "\""
|
|
elseif ( fileformat == 'verbose') then
|
|
output = account.user .. ":" .. account.pass .. ":" .. StateMsg[account.state]
|
|
else
|
|
output = account.user .. ":" .. account.pass
|
|
end
|
|
if ( not(f:write( output .."\n" ) ) ) then
|
|
return false, ("ERROR: Failed to write file (%s)"):format(filename)
|
|
end
|
|
end
|
|
|
|
f:close()
|
|
return true
|
|
end,
|
|
|
|
--- Get credentials with optional host and port filter
|
|
-- If no filters are supplied all records are returned
|
|
--
|
|
-- @param host table or string containing the host to filter
|
|
-- @param port number containing the port to filter
|
|
-- @return table suitable from <code>stdnse.format_output</code>
|
|
-- @name Credentials.__tostring
|
|
__tostring = function(self)
|
|
local all = self:getTable()
|
|
if ( all ) then return tostring(all) end
|
|
end,
|
|
|
|
}
|
|
|
|
return _ENV;
|