942 lines
39 KiB
Lua
942 lines
39 KiB
Lua
local nmap = require "nmap"
|
|
local shortport = require "shortport"
|
|
local sslcert = require "sslcert"
|
|
local stdnse = require "stdnse"
|
|
local string = require "string"
|
|
local math = require "math"
|
|
local table = require "table"
|
|
local tls = require "tls"
|
|
local vulns = require "vulns"
|
|
local have_ssl, openssl = pcall(require, "openssl")
|
|
|
|
description = [[
|
|
Weak ephemeral Diffie-Hellman parameter detection for SSL/TLS services.
|
|
|
|
This script simulates SSL/TLS handshakes using ciphersuites that have ephemeral
|
|
Diffie-Hellman as the key exchange algorithm.
|
|
|
|
Diffie-Hellman MODP group parameters are extracted and analyzed for vulnerability
|
|
to Logjam (CVE 2015-4000) and other weaknesses.
|
|
|
|
Opportunistic STARTTLS sessions are established on services that support them.
|
|
]]
|
|
|
|
---
|
|
-- @usage
|
|
-- nmap --script ssl-dh-params <target>
|
|
--
|
|
-- @output
|
|
-- Host script results:
|
|
-- | ssl-dh-params:
|
|
-- | VULNERABLE:
|
|
-- | Transport Layer Security (TLS) Protocol DHE_EXPORT Ciphers Downgrade MitM (Logjam)
|
|
-- | State: VULNERABLE
|
|
-- | IDs: BID:74733 CVE:CVE-2015-4000
|
|
-- | The Transport Layer Security (TLS) protocol contains a flaw that is triggered
|
|
-- | when handling Diffie-Hellman key exchanges defined with the DHE_EXPORT cipher.
|
|
-- | This may allow a man-in-the-middle attacker to downgrade the security of a TLS
|
|
-- | session to 512-bit export-grade cryptography, which is significantly weaker,
|
|
-- | allowing the attacker to more easily break the encryption and monitor or tamper
|
|
-- | with the encrypted stream.
|
|
-- | Disclosure date: 2015-5-19
|
|
-- | Check results:
|
|
-- | EXPORT-GRADE DH GROUP 1
|
|
-- | Ciphersuite: TLS_DHE_RSA_EXPORT_WITH_DES40_CBC_SHA
|
|
-- | Modulus Type: Non-safe prime
|
|
-- | Modulus Source: sun.security.provider/512-bit DSA group with 160-bit prime order subgroup
|
|
-- | Modulus Length: 512 bits
|
|
-- | Generator Length: 512 bits
|
|
-- | Public Key Length: 512 bits
|
|
-- | References:
|
|
-- | https://weakdh.org
|
|
-- | https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-4000
|
|
-- | https://www.securityfocus.com/bid/74733
|
|
-- |
|
|
-- | Diffie-Hellman Key Exchange Insufficient Diffie-Hellman Group Strength
|
|
-- | State: VULNERABLE
|
|
-- | Transport Layer Security (TLS) services that use Diffie-Hellman groups of
|
|
-- | insuffficient strength, especially those using one of a few commonly shared
|
|
-- | groups, may be susceptible to passive eavesdropping attacks.
|
|
-- | Check results:
|
|
-- | WEAK DH GROUP 1
|
|
-- | Ciphersuite: TLS_DHE_RSA_WITH_3DES_EDE_CBC_SHA
|
|
-- | Modulus Type: Safe prime
|
|
-- | Modulus Source: Unknown/Custom-generated
|
|
-- | Modulus Length: 512 bits
|
|
-- | Generator Length: 8 bits
|
|
-- | Public Key Length: 512 bits
|
|
-- | References:
|
|
-- | https://weakdh.org
|
|
-- |
|
|
-- | Diffie-Hellman Key Exchange Potentially Unsafe Group Parameters
|
|
-- | State: VULNERABLE
|
|
-- | This TLS service appears to be using a modulus that is not a safe prime and does
|
|
-- | not correspond to any well-known DSA group for Diffie-Hellman key exchange.
|
|
-- | These parameters MAY be secure if:
|
|
-- | - They were generated according to the procedure described in FIPS 186-4 for
|
|
-- | DSA Domain Parameter Generation, or
|
|
-- | - The generator g generates a subgroup of large prime order
|
|
-- | Additional testing may be required to verify the security of these parameters.
|
|
-- | Check results:
|
|
-- | NON-SAFE DH GROUP 1
|
|
-- | Cipher Suite: TLS_DHE_RSA_WITH_3DES_EDE_CBC_SHA
|
|
-- | Modulus Type: Non-safe prime
|
|
-- | Modulus Source: Unknown/Custom-generated
|
|
-- | Modulus Length: 1024 bits
|
|
-- | Generator Length: 1024 bits
|
|
-- | Public Key Length: 1024 bits
|
|
-- | References:
|
|
-- |_ https://weakdh.org
|
|
|
|
author = "Jacob Gajek"
|
|
license = "Same as Nmap--See https://nmap.org/book/man-legal.html"
|
|
categories = {"vuln", "safe"}
|
|
dependencies = {"https-redirect"}
|
|
|
|
-- Anonymous Diffie-Hellman key exchange variants
|
|
local DH_anon_ALGORITHMS = {
|
|
["DH_anon_EXPORT"] = 1,
|
|
["DH_anon"] = 1
|
|
}
|
|
|
|
-- Full-strength ephemeral Diffie-Hellman key exchange variants
|
|
local DHE_ALGORITHMS = {
|
|
["DHE_RSA"] = 1,
|
|
["DHE_DSS"] = 1,
|
|
["DHE_PSK"] = 1
|
|
}
|
|
|
|
-- Export-grade ephemeral Diffie-Hellman key exchange variants
|
|
local DHE_ALGORITHMS_EXPORT = {
|
|
["DHE_RSA_EXPORT"] = 1,
|
|
["DHE_DSS_EXPORT"] = 1,
|
|
["DHE_DSS_EXPORT1024"] = 1
|
|
}
|
|
|
|
local fromhex = stdnse.fromhex
|
|
|
|
-- Common Diffie-Hellman groups
|
|
--
|
|
-- The primes from weakdh.org were harvested by:
|
|
-- 1) Scanning the IPv4 space
|
|
-- 2) Scanning Alexa Top 1 million (seen >100 times)
|
|
--
|
|
-- The list from weakdh.org overlaps the original script source code, therefore those were removed.
|
|
-- The primes were not searchable on Google (hope for source code match) - they may belong to closed
|
|
-- source software. If someone happens to find/match it, send a pull request.
|
|
local DHE_PRIMES = {
|
|
[fromhex([[
|
|
D4BCD524 06F69B35 994B88DE 5DB89682 C8157F62 D8F33633 EE5772F1 1F05AB22
|
|
D6B5145B 9F241E5A CC31FF09 0A4BC711 48976F76 795094E7 1E790352 9F5A824B
|
|
]])] = "mod_ssl 2.0.x/512-bit MODP group with safe prime modulus",
|
|
|
|
[fromhex([[
|
|
E6969D3D 495BE32C 7CF180C3 BDD4798E 91B78182 51BB055E 2A206490 4A79A770
|
|
FA15A259 CBD523A6 A6EF09C4 3048D5A2 2F971F3C 20129B48 000E6EDD 061CBC05
|
|
3E371D79 4E5327DF 611EBBBE 1BAC9B5C 6044CF02 3D76E05E EA9BAD99 1B13A63C
|
|
974E9EF1 839EB5DB 125136F7 262E56A8 871538DF D823C650 5085E21F 0DD5C86B
|
|
]])] = "mod_ssl 2.0.x/1024-bit MODP group with safe prime modulus",
|
|
|
|
[fromhex([[
|
|
9FDB8B8A 004544F0 045F1737 D0BA2E0B 274CDF1A 9F588218 FB435316 A16E3741
|
|
71FD19D8 D8F37C39 BF863FD6 0E3E3006 80A3030C 6E4C3757 D08F70E6 AA871033
|
|
]])] = "mod_ssl 2.2.x/512-bit MODP group with safe prime modulus",
|
|
|
|
[fromhex([[
|
|
D67DE440 CBBBDC19 36D693D3 4AFD0AD5 0C84D239 A45F520B B88174CB 98BCE951
|
|
849F912E 639C72FB 13B4B4D7 177E16D5 5AC179BA 420B2A29 FE324A46 7A635E81
|
|
FF590137 7BEDDCFD 33168A46 1AAD3B72 DAE88600 78045B07 A7DBCA78 74087D15
|
|
10EA9FCC 9DDD3305 07DD62DB 88AEAA74 7DE0F4D6 E2BD68B0 E7393E0F 24218EB3
|
|
]])] = "mod_ssl 2.2.x/1024-bit MODP group with safe prime modulus",
|
|
|
|
[fromhex([[
|
|
BBBC2DCA D8467490 7C43FCF5 80E9CFDB D958A3F5 68B42D4B 08EED4EB 0FB3504C
|
|
6C030276 E710800C 5CCBBAA8 922614C5 BEECA565 A5FDF1D2 87A2BC04 9BE67780
|
|
60E91A92 A757E304 8F68B076 F7D36CC8 F29BA5DF 81DC2CA7 25ECE662 70CC9A50
|
|
35D8CECE EF9EA027 4A63AB1E 58FAFD49 88D0F65D 146757DA 071DF045 CFE16B9B
|
|
]])] = "nginx/1024-bit MODP group with safe prime modulus",
|
|
|
|
[fromhex([[
|
|
FCA682CE 8E12CABA 26EFCCF7 110E526D B078B05E DECBCD1E B4A208F3 AE1617AE
|
|
01F35B91 A47E6DF6 3413C5E1 2ED0899B CD132ACD 50D99151 BDC43EE7 37592E17
|
|
]])] = "sun.security.provider/512-bit DSA group with 160-bit prime order subgroup",
|
|
|
|
[fromhex([[
|
|
E9E64259 9D355F37 C97FFD35 67120B8E 25C9CD43 E927B3A9 670FBEC5 D8901419
|
|
22D2C3B3 AD248009 3799869D 1E846AAB 49FAB0AD 26D2CE6A 22219D47 0BCE7D77
|
|
7D4A21FB E9C270B5 7F607002 F3CEF839 3694CF45 EE3688C1 1A8C56AB 127A3DAF
|
|
]])] = "sun.security.provider/768-bit DSA group with 160-bit prime order subgroup",
|
|
|
|
[fromhex([[
|
|
FD7F5381 1D751229 52DF4A9C 2EECE4E7 F611B752 3CEF4400 C31E3F80 B6512669
|
|
455D4022 51FB593D 8D58FABF C5F5BA30 F6CB9B55 6CD7813B 801D346F F26660B7
|
|
6B9950A5 A49F9FE8 047B1022 C24FBBA9 D7FEB7C6 1BF83B57 E7C6A8A6 150F04FB
|
|
83F6D3C5 1EC30235 54135A16 9132F675 F3AE2B61 D72AEFF2 2203199D D14801C7
|
|
]])] = "sun.security.provider/1024-bit DSA group with 160-bit prime order subgroup",
|
|
|
|
[fromhex([[
|
|
DA583C16 D9852289 D0E4AF75 6F4CCA92 DD4BE533 B804FB0F ED94EF9C 8A4403ED
|
|
574650D3 6999DB29 D776276B A2D3D412 E218F4DD 1E084CF6 D8003E7C 4774E833
|
|
]])] = "openssl/512-bit MODP group with safe prime modulus",
|
|
|
|
[fromhex([[
|
|
97F64261 CAB505DD 2828E13F 1D68B6D3 DBD0F313 047F40E8 56DA58CB 13B8A1BF
|
|
2B783A4C 6D59D5F9 2AFC6CFF 3D693F78 B23D4F31 60A9502E 3EFAF7AB 5E1AD5A6
|
|
5E554313 828DA83B 9FF2D941 DEE95689 FADAEA09 36ADDF19 71FE635B 20AF4703
|
|
64603C2D E059F54B 650AD8FA 0CF70121 C74799D7 587132BE 9B999BB9 B787E8AB
|
|
]])] = "openssl/1024-bit MODP group with safe prime modulus",
|
|
|
|
[fromhex([[
|
|
ED928935 824555CB 3BFBA276 5A690461 BF21F3AB 53D2CD21 DAFF7819 1152F10E
|
|
C1E255BD 686F6800 53B9226A 2FE49A34 1F65CC59 328ABDB1 DB49EDDF A71266C3
|
|
FD210470 18F07FD6 F7585119 72827B22 A934181D 2FCB21CF 6D92AE43 B6A829C7
|
|
27A3CB00 C5F2E5FB 0AA45985 A2BDAD45 F0B3ADF9 E08135EE D983B3CC AEEAEB66
|
|
E6A95766 B9F128A5 3F2280D7 0BA6F671 939B810E F85A90E6 CCCA6F66 5F7AC010
|
|
1A1EF0FC 2DB6080C 6228B0EC DB8928EE 0CA83D65 94691669 533C5360 13B02BA7
|
|
D48287AD 1C729E41 35FCC27C E951DE61 85FC199B 76600F33 F86BB3CA 520E29C3
|
|
07E89016 CCCC0019 B6ADC3A4 308B33A1 AFD88C8D 9D01DBA4 C4DD7F0B BD6F38C3
|
|
]])] = "openssl/2048-bit MODP group with safe prime modulus",
|
|
|
|
[fromhex([[
|
|
AED037C3 BDF33FA2 EEDC4390 B70A2089 7B770175 E9B92EB2 0F8061CC D4B5A591
|
|
723C7934 FDA9F9F3 274490F8 50647283 5BE05927 1C4F2C03 5A4EE756 A36613F1
|
|
382DBD47 4DE8A4A0 322122E8 C730A83C 3E4800EE BD6F8548 A5181711 BA545231
|
|
C843FAC4 175FFAF8 49C440DB 446D8462 C1C3451B 49EFA829 F5C48A4C 7BAC7F64
|
|
7EE00015 1AA9ED81 101B36AB 5C39AAFF EC54A3F8 F97C1B7B F406DCB4 2DC092A5
|
|
BAA06259 EFEB3FAB 12B42698 2E8F3EF4 B3F7B4C3 302A24C8 AA4213D8 45035CE4
|
|
A8ADD31F 816616F1 9E21A5C9 5080597F 8980AD6B 814E3585 5B79E684 4491527D
|
|
552B72B7 C78D8D6B 993A736F 8486B305 88B8F1B8 7E89668A 8BD3F13D DC517D4B
|
|
]])] = "openssl/2048-bit MODP group with safe prime modulus",
|
|
|
|
[fromhex([[
|
|
FEEAD19D BEAF90F6 1CFCA106 5D69DB08 839A2A2B 6AEF2488 ABD7531F BB3E462E
|
|
7DCECEFB CEDCBBBD F56549EE 95153056 8188C3D9 7294166B 6AABA0AA 5CC8555F
|
|
9125503A 180E9032 4C7F39C6 A3452F31 42EE72AB 7DFFC74C 528DB6DA 76D9C644
|
|
F55D083E 9CDE74F7 E742413B 69476617 D2670F2B F6D59FFC D7C3BDDE ED41E2BD
|
|
2CCDD9E6 12F1056C AB88C441 D7F9BA74 651ED1A8 4D407A27 D71895F7 77AB6C77
|
|
63CC00E6 F1C30B2F E7944692 7E74BC73 B8431B53 011AF5AD 1515E63D C1DE83CC
|
|
802ECE7D FC71FBDF 179F8E41 D7F1B43E BA75D5A9 C3B11D4F 1B0B5A09 88A9AACB
|
|
CCC10512 26DC8410 E41693EC 8591E31E E2F5AFDF AEDE122D 1277FC27 0BE4D25C
|
|
1137A58B E961EAC9 F27D4C71 E2391904 DD6AB27B ECE5BD6C 64C79B14 6C2D208C
|
|
D63A4B74 F8DAE638 DBE2C880 6BA10773 8A8DF5CF E214A4B7 3D03C912 75FBA572
|
|
8146CE5F EC01775B 74481ADF 86F4854D 65F5DA4B B67F882A 60CE0BCA 0ACD157A
|
|
A377F10B 091AD0B5 68893039 ECA33CDC B61BA8C9 E32A87A2 F5D8B7FD 26734D2F
|
|
09679235 2D70ADE9 F4A51D84 88BC57D3 2A638E0B 14D6693F 6776FFFB 355FEDF6
|
|
52201FA7 0CB8DB34 FB549490 951A701E 04AD49D6 71B74D08 9CAA8C0E 5E833A21
|
|
291D6978 F918F25D 5C769BDB E4BB72A8 4A1AFE6A 0BBAD18D 3EACC7B4 54AF408D
|
|
4F1CCB23 B9AE576F DAE2D1A6 8F43D275 741DB19E EDC3B81B 5E56964F 5F8C3363
|
|
]])] = "openssl/4096-bit MODP group with safe prime modulus",
|
|
|
|
[fromhex([[
|
|
FFFFFFFF FFFFFFFF C90FDAA2 2168C234 C4C6628B 80DC1CD1 29024E08 8A67CC74
|
|
020BBEA6 3B139B22 514A0879 8E3404DD EF9519B3 CD3A431B 302B0A6D F25F1437
|
|
4FE1356D 6D51C245 E485B576 625E7EC6 F44C42E9 A63A3620 FFFFFFFF FFFFFFFF
|
|
]])] = "RFC2409/Oakley Group 1",
|
|
|
|
[fromhex([[
|
|
FFFFFFFF FFFFFFFF C90FDAA2 2168C234 C4C6628B 80DC1CD1 29024E08 8A67CC74
|
|
020BBEA6 3B139B22 514A0879 8E3404DD EF9519B3 CD3A431B 302B0A6D F25F1437
|
|
4FE1356D 6D51C245 E485B576 625E7EC6 F44C42E9 A637ED6B 0BFF5CB6 F406B7ED
|
|
EE386BFB 5A899FA5 AE9F2411 7C4B1FE6 49286651 ECE65381 FFFFFFFF FFFFFFFF
|
|
]])] = "RFC2409/Oakley Group 2",
|
|
|
|
[fromhex([[
|
|
FFFFFFFF FFFFFFFF C90FDAA2 2168C234 C4C6628B 80DC1CD1 29024E08 8A67CC74
|
|
020BBEA6 3B139B22 514A0879 8E3404DD EF9519B3 CD3A431B 302B0A6D F25F1437
|
|
4FE1356D 6D51C245 E485B576 625E7EC6 F44C42E9 A637ED6B 0BFF5CB6 F406B7ED
|
|
EE386BFB 5A899FA5 AE9F2411 7C4B1FE6 49286651 ECE45B3D C2007CB8 A163BF05
|
|
98DA4836 1C55D39A 69163FA8 FD24CF5F 83655D23 DCA3AD96 1C62F356 208552BB
|
|
9ED52907 7096966D 670C354E 4ABC9804 F1746C08 CA237327 FFFFFFFF FFFFFFFF
|
|
]])] = "RFC3526/Oakley Group 5",
|
|
|
|
[fromhex([[
|
|
FFFFFFFF FFFFFFFF C90FDAA2 2168C234 C4C6628B 80DC1CD1 29024E08 8A67CC74
|
|
020BBEA6 3B139B22 514A0879 8E3404DD EF9519B3 CD3A431B 302B0A6D F25F1437
|
|
4FE1356D 6D51C245 E485B576 625E7EC6 F44C42E9 A637ED6B 0BFF5CB6 F406B7ED
|
|
EE386BFB 5A899FA5 AE9F2411 7C4B1FE6 49286651 ECE45B3D C2007CB8 A163BF05
|
|
98DA4836 1C55D39A 69163FA8 FD24CF5F 83655D23 DCA3AD96 1C62F356 208552BB
|
|
9ED52907 7096966D 670C354E 4ABC9804 F1746C08 CA18217C 32905E46 2E36CE3B
|
|
E39E772C 180E8603 9B2783A2 EC07A28F B5C55DF0 6F4C52C9 DE2BCBF6 95581718
|
|
3995497C EA956AE5 15D22618 98FA0510 15728E5A 8AACAA68 FFFFFFFF FFFFFFFF
|
|
]])] = "RFC3526/Oakley Group 14",
|
|
|
|
[fromhex([[
|
|
FFFFFFFF FFFFFFFF C90FDAA2 2168C234 C4C6628B 80DC1CD1 29024E08 8A67CC74
|
|
020BBEA6 3B139B22 514A0879 8E3404DD EF9519B3 CD3A431B 302B0A6D F25F1437
|
|
4FE1356D 6D51C245 E485B576 625E7EC6 F44C42E9 A637ED6B 0BFF5CB6 F406B7ED
|
|
EE386BFB 5A899FA5 AE9F2411 7C4B1FE6 49286651 ECE45B3D C2007CB8 A163BF05
|
|
98DA4836 1C55D39A 69163FA8 FD24CF5F 83655D23 DCA3AD96 1C62F356 208552BB
|
|
9ED52907 7096966D 670C354E 4ABC9804 F1746C08 CA18217C 32905E46 2E36CE3B
|
|
E39E772C 180E8603 9B2783A2 EC07A28F B5C55DF0 6F4C52C9 DE2BCBF6 95581718
|
|
3995497C EA956AE5 15D22618 98FA0510 15728E5A 8AAAC42D AD33170D 04507A33
|
|
A85521AB DF1CBA64 ECFB8504 58DBEF0A 8AEA7157 5D060C7D B3970F85 A6E1E4C7
|
|
ABF5AE8C DB0933D7 1E8C94E0 4A25619D CEE3D226 1AD2EE6B F12FFA06 D98A0864
|
|
D8760273 3EC86A64 521F2B18 177B200C BBE11757 7A615D6C 770988C0 BAD946E2
|
|
08E24FA0 74E5AB31 43DB5BFC E0FD108E 4B82D120 A93AD2CA FFFFFFFF FFFFFFFF
|
|
]])] = "RFC3526/Oakley Group 15",
|
|
|
|
[fromhex([[
|
|
FFFFFFFF FFFFFFFF C90FDAA2 2168C234 C4C6628B 80DC1CD1 29024E08 8A67CC74
|
|
020BBEA6 3B139B22 514A0879 8E3404DD EF9519B3 CD3A431B 302B0A6D F25F1437
|
|
4FE1356D 6D51C245 E485B576 625E7EC6 F44C42E9 A637ED6B 0BFF5CB6 F406B7ED
|
|
EE386BFB 5A899FA5 AE9F2411 7C4B1FE6 49286651 ECE45B3D C2007CB8 A163BF05
|
|
98DA4836 1C55D39A 69163FA8 FD24CF5F 83655D23 DCA3AD96 1C62F356 208552BB
|
|
9ED52907 7096966D 670C354E 4ABC9804 F1746C08 CA18217C 32905E46 2E36CE3B
|
|
E39E772C 180E8603 9B2783A2 EC07A28F B5C55DF0 6F4C52C9 DE2BCBF6 95581718
|
|
3995497C EA956AE5 15D22618 98FA0510 15728E5A 8AAAC42D AD33170D 04507A33
|
|
A85521AB DF1CBA64 ECFB8504 58DBEF0A 8AEA7157 5D060C7D B3970F85 A6E1E4C7
|
|
ABF5AE8C DB0933D7 1E8C94E0 4A25619D CEE3D226 1AD2EE6B F12FFA06 D98A0864
|
|
D8760273 3EC86A64 521F2B18 177B200C BBE11757 7A615D6C 770988C0 BAD946E2
|
|
08E24FA0 74E5AB31 43DB5BFC E0FD108E 4B82D120 A9210801 1A723C12 A787E6D7
|
|
88719A10 BDBA5B26 99C32718 6AF4E23C 1A946834 B6150BDA 2583E9CA 2AD44CE8
|
|
DBBBC2DB 04DE8EF9 2E8EFC14 1FBECAA6 287C5947 4E6BC05D 99B2964F A090C3A2
|
|
233BA186 515BE7ED 1F612970 CEE2D7AF B81BDD76 2170481C D0069127 D5B05AA9
|
|
93B4EA98 8D8FDDC1 86FFB7DC 90A6C08F 4DF435C9 34063199 FFFFFFFF FFFFFFFF
|
|
]])] = "RFC3526/Oakley Group 16",
|
|
|
|
[fromhex([[
|
|
B10B8F96 A080E01D DE92DE5E AE5D54EC 52C99FBC FB06A3C6 9A6A9DCA 52D23B61
|
|
6073E286 75A23D18 9838EF1E 2EE652C0 13ECB4AE A9061123 24975C3C D49B83BF
|
|
ACCBDD7D 90C4BD70 98488E9C 219A7372 4EFFD6FA E5644738 FAA31A4F F55BCCC0
|
|
A151AF5F 0DC8B4BD 45BF37DF 365C1A65 E68CFDA7 6D4DA708 DF1FB2BC 2E4A4371
|
|
]])] = "RFC5114/1024-bit DSA group with 160-bit prime order subgroup",
|
|
|
|
[fromhex([[
|
|
AD107E1E 9123A9D0 D660FAA7 9559C51F A20D64E5 683B9FD1 B54B1597 B61D0A75
|
|
E6FA141D F95A56DB AF9A3C40 7BA1DF15 EB3D688A 309C180E 1DE6B85A 1274A0A6
|
|
6D3F8152 AD6AC212 9037C9ED EFDA4DF8 D91E8FEF 55B7394B 7AD5B7D0 B6C12207
|
|
C9F98D11 ED34DBF6 C6BA0B2C 8BBC27BE 6A00E0A0 B9C49708 B3BF8A31 70918836
|
|
81286130 BC8985DB 1602E714 415D9330 278273C7 DE31EFDC 7310F712 1FD5A074
|
|
15987D9A DC0A486D CDF93ACC 44328387 315D75E1 98C641A4 80CD86A1 B9E587E8
|
|
BE60E69C C928B2B9 C52172E4 13042E9B 23F10B0E 16E79763 C9B53DCF 4BA80A29
|
|
E3FB73C1 6B8E75B9 7EF363E2 FFA31F71 CF9DE538 4E71B81C 0AC4DFFE 0C10E64F
|
|
]])] = "RFC5114/2048-bit DSA group with 224-bit prime order subgroup",
|
|
|
|
[fromhex([[
|
|
87A8E61D B4B6663C FFBBD19C 65195999 8CEEF608 660DD0F2 5D2CEED4 435E3B00
|
|
E00DF8F1 D61957D4 FAF7DF45 61B2AA30 16C3D911 34096FAA 3BF4296D 830E9A7C
|
|
209E0C64 97517ABD 5A8A9D30 6BCF67ED 91F9E672 5B4758C0 22E0B1EF 4275BF7B
|
|
6C5BFC11 D45F9088 B941F54E B1E59BB8 BC39A0BF 12307F5C 4FDB70C5 81B23F76
|
|
B63ACAE1 CAA6B790 2D525267 35488A0E F13C6D9A 51BFA4AB 3AD83477 96524D8E
|
|
F6A167B5 A41825D9 67E144E5 14056425 1CCACB83 E6B486F6 B3CA3F79 71506026
|
|
C0B857F6 89962856 DED4010A BD0BE621 C3A3960A 54E710C3 75F26375 D7014103
|
|
A4B54330 C198AF12 6116D227 6E11715F 693877FA D7EF09CA DB094AE9 1E1A1597
|
|
]])] = "RFC5114/2048-bit DSA group with 256-bit prime order subgroup",
|
|
|
|
[fromhex([[
|
|
D6C094AD 57F5374F 68D58C7B 096872D9 45CEE1F8 2664E059 4421E1D5 E3C8E98B
|
|
C3F0A6AF 8F92F19E 3FEF9337 B99B9C93 A055D55A 96E42573 4005A68E D47040FD
|
|
F00A5593 6EBA4B93 F64CBA1A 004E4513 611C9B21 7438A703 A2060C20 38D0CFAA
|
|
FFBBA48F B9DAC4B2 450DC58C B0320A03 17E2A31B 44A02787 C657FB0C 0CBEC11D
|
|
]])] = "weakdh.org/1024-bit MODP group with non-safe prime modulus",
|
|
|
|
[fromhex([[
|
|
C9BBF5F7 74A8297B 0F97CDDA 3A3468C7 117B6BF7 99A13D9F 1F5DAC48 7B2241FE
|
|
95EFB13C 2855DFD2 F898B3F9 9188E24E DF326DD6 8C76CC85 53728351 2D46F195
|
|
3129C693 364D8C71 202EABB3 EBC85C1D F53907FB D0B7EB49 0AD0BC99 28968680
|
|
0C46AB04 BF7CDD9A D425E6FB 25592EB6 258A0655 D75E93B2 671746AE 349E721B
|
|
]])] = "weakdh.org/1024-bit MODP group with safe prime modulus",
|
|
|
|
[fromhex([[
|
|
829FEBFC E3EE0434 862D3364 A62BDE7B 65F0C74A 3A53B555 291414FC AE5E86D7
|
|
34B16DBD CC952B1C 5EB443B1 54B3B466 62E811E1 1D8BC731 34018A5E A7B5B6A9
|
|
720D84BC 28B74822 C5AF24C9 04E5BB5A DABF8FF2 A5ED7B45 6688D6CA B82F8AF0
|
|
188A456C 3ED62D2F EACF6BD3 FD47337D 884DFA09 F0A3D696 75E35806 E3AE9593
|
|
]])] = "weakdh.org/1024-bit MODP group with safe prime modulus",
|
|
|
|
[fromhex([[
|
|
92402435 C3A12E44 D3730D8E 78CADFA7 8E2F5B51 A956BFF4 DB8E5652 3E9695E6
|
|
3E32506C FEB912F2 A77D22E7 1BB54C86 80893B82 AD1BCF33 7F7F7796 D3FB9681
|
|
81D9BA1F 7034ABFB 1F97B310 4CF3203F 663E8199 0B7E090F 6C4C5EE1 A0E57EC1
|
|
74D3E84A D9E72E6A C7DA6AEA 12DF297C 131854FB F21AC4E8 79C23BBC 60B4F753
|
|
]])] = "weakdh.org/1024-bit MODP group with safe prime modulus",
|
|
|
|
[fromhex([[
|
|
A9A34811 446C7B69 A29FF999 7C2181EC FAAAD139 CCDE2455 755D42F4 2E700AFD
|
|
86779D54 8A7C07CA 5DE42332 61117D0A 5773F245 9C331AF1 A1B08EF8 360A14DE
|
|
4046F274 62DA36AA 47D9FDE2 92B8815D 598C3A9C 546E7ED3 95D22EC3 9119F5B9
|
|
22CC41B3 0AF220FF 47BDE1B8 8334AD29 81DDC5ED 923F11C3 DDD3B22C 949DC41B
|
|
]])] = "weakdh.org/1024-bit MODP group with safe prime modulus",
|
|
|
|
[fromhex([[
|
|
CA6B8564 6DC21765 7605DACF E801FAD7 59845383 4AF126C8 CC765E0F 81014F24
|
|
93546AB7 DDE5C677 C32D5B06 05B1BBFA 4C5DBFA3 253ADB33 205B7D8C 67DF98C4
|
|
BCE81C78 13F9FC26 15F1C332 F953AB39 CE8B7FE7 E3951FB7 3131407F 4D5489B6
|
|
B17C6875 9A2EAF8B 195A8DE8 0A165E4E B7520774 B167A00F A5629FDC 5A9A25F3
|
|
]])] = "weakdh.org/1024-bit MODP group with safe prime modulus",
|
|
|
|
[fromhex([[
|
|
EB373E94 AB618DF8 20D233ED 93E3EBCB 319BDAC2 0994C1DF 003986A7 9FAFFF76
|
|
54151CC9 E0641314 92698B47 496F5FDC FAF12892 679D8BC3 1580D7D4 1CD83F81
|
|
529C7951 3D58EC67 2E0E87FC D008C137 E3E5861A B2D3A02F 4D372CEE 4F220FEB
|
|
2C9039AC 997664A7 EBB75444 6AA69EB3 E0EF3C60 F91C2639 2B54EC35 A970A7BB
|
|
]])] = "weakdh.org/1024-bit MODP group with safe prime modulus",
|
|
|
|
[fromhex([[
|
|
80A68ADC 5327E05C AAD07C44 64B8ADEA 908432AF 9651B237 F47A7A8B F84D568F
|
|
DFDAFAB0 6621C0C4 28450F1C 55F7D4A8 ECE383F2 7D6055AD DF60C4B8 37DCC1E3
|
|
B8374E37 99517929 39FDC3BB B4285112 C8B4A9F6 FCE4DD53 AA23F99E 2647C394
|
|
CE4D8BB8 2E773F41 EB786CE8 4CD0C3DD 4C31D755 D1CF9E9B 70C45EE2 8ECDABAB
|
|
]])] = "weakdh.org/1024-bit MODP group with safe prime modulus",
|
|
|
|
[fromhex([[
|
|
C0EB5F3A 4CB30A9F FE3786E8 4C038141 69B52030 5AD49F54 EFD8CAAC 31A69B29
|
|
73CC9F57 B4B8F80D 2C5FB68B 3913B617 2042D2E5 BD53381A 5E597696 C9E97BD6
|
|
488DB339 5581320D DD4AF9CD E4A4EBE2 9118C688 28E5B392 89C26728 0B4FDC25
|
|
10C288B2 174D77EE 0AAD9C1E 17EA5ED3 7CF971B6 B19A8711 8E529826 591CA14B
|
|
]])] = "weakdh.org/1024-bit MODP group with safe prime modulus",
|
|
|
|
[fromhex([[
|
|
8FC0E1E2 0574D6AB 3C76DDEA 64524C20 76446B67 98E5B6BD 2614F966 9A5061D6
|
|
99034DB4 819780EC 8EE28A4E 66B5C4E0 A634E47B F9C981A5 EC4908EE 1B83A410
|
|
813165AC 0AB6BDCF D3257188 AC49399D 541C16F2 960F9D64 B9C51EC0 85AD0BB4
|
|
FE389013 18F0CD61 65D4B1B3 1C723953 B83217F8 B3EBF870 8160E82D 7911754B
|
|
]])] = "weakdh.org/1024-bit MODP group with safe prime modulus",
|
|
|
|
-- haproxy, postfix, and IronPort params courtesy Frank Bergmann
|
|
[fromhex([[
|
|
EC86F870 A03316EC 051A7359 CD1F8BF8 29E4D2CF 52DDC224 8DB5389A FB5CA4E4
|
|
B2DACE66 5074A685 4D4B1D30 B82BF310 E9A72D05 71E781DF 8B59523B 5F430B68
|
|
F1DB07BE 086B1B23 EE4DCC9E 0E43A01E DF438CEC BEBE90B4 5154B92F 7B64764E
|
|
5DD42EAE C29EAE51 4359C777 9C503C0E ED73045F F14C762A D8F8CFFC 3440D1B4
|
|
42618466 423904F8 68B262D7 55ED1B74 7591E0C5 69C1315C DB7B442E CE84580D
|
|
1E660CC8 449EFD40 08675DFB A7768F00 1187E993 F97DC4BC 745520D4 4A412F43
|
|
421AC1F2 97174927 376B2F88 7E1CA0A1 899227D9 565A71C1 56377E3A 9D05E7EE
|
|
5D8F8217 BCE9C293 3082F9F4 C9AE49DB D054B4D9 754DFA06 B8D63841 B71F77F3
|
|
]])] = "haproxy 1.5 builtin",
|
|
|
|
[fromhex([[
|
|
B0FEB4CF D45507E7 CC88590D 1726C50C A54A9223 8178DA88 AA4C1306 BF5D2F9E
|
|
BC96B851 009D0C0D 75ADFD3B B17E714F 3F915414 44B83025 1CEBDF72 9C4CF189
|
|
0D683F94 8EA4FB76 8918B291 16900199 668C5381 4E273D99 E75A7AAF D5ECE27E
|
|
FAED0118 C2782559 065C39F6 CD4954AF C1B1EA4A F953D0DF 6DAFD493 E7BAAE9B
|
|
]])] = "postfix builtin",
|
|
|
|
[fromhex([[
|
|
F8D5CCE8 7A3961B5 F5CBC834 40C51856 E0E6FA6D 5AB28310 78C86762 1CA46CA8
|
|
7D7FA3B1 AF75B834 3C699374 D36920F2 E39A653D E8F0725A A6E2D297 7537558C
|
|
E27E784F 4B549BEF B558927B A30C8BD8 1DACDCAE 93027B5D CE1BC176 70AF7DEC
|
|
E81149AB D7D632D9 B80A6397 CEBCC7A9 619CCF38 288EA3D5 23287743 B04E6FB3
|
|
]])] = "IronPort SMTPD builtin",
|
|
}
|
|
|
|
|
|
-- DSA parameters
|
|
local DSA_PARAMS = {
|
|
-- sun.security.provider/512-bit DSA group with 160-bit prime order subgroup
|
|
[fromhex([[
|
|
FCA682CE 8E12CABA 26EFCCF7 110E526D B078B05E DECBCD1E B4A208F3 AE1617AE
|
|
01F35B91 A47E6DF6 3413C5E1 2ED0899B CD132ACD 50D99151 BDC43EE7 37592E17
|
|
]])] =
|
|
|
|
fromhex([[
|
|
678471B2 7A9CF44E E91A49C5 147DB1A9 AAF244F0 5A434D64 86931D2D 14271B9E
|
|
35030B71 FD73DA17 9069B32E 2935630E 1C206235 4D0DA20A 6C416E50 BE794CA4
|
|
]]),
|
|
|
|
-- sun.security.provider/768-bit DSA group with 160-bit prime order subgroup
|
|
[fromhex([[
|
|
E9E64259 9D355F37 C97FFD35 67120B8E 25C9CD43 E927B3A9 670FBEC5 D8901419
|
|
22D2C3B3 AD248009 3799869D 1E846AAB 49FAB0AD 26D2CE6A 22219D47 0BCE7D77
|
|
7D4A21FB E9C270B5 7F607002 F3CEF839 3694CF45 EE3688C1 1A8C56AB 127A3DAF
|
|
]])] =
|
|
|
|
fromhex([[
|
|
30470AD5 A005FB14 CE2D9DCD 87E38BC7 D1B1C5FA CBAECBE9 5F190AA7 A31D23C4
|
|
DBBCBE06 17454440 1A5B2C02 0965D8C2 BD2171D3 66844577 1F74BA08 4D2029D8
|
|
3C1C1585 47F3A9F1 A2715BE2 3D51AE4D 3E5A1F6A 7064F316 933A346D 3F529252
|
|
]]),
|
|
|
|
-- sun.security.provider/1024-bit DSA group with 160-bit prime order subgroup
|
|
[fromhex([[
|
|
FD7F5381 1D751229 52DF4A9C 2EECE4E7 F611B752 3CEF4400 C31E3F80 B6512669
|
|
455D4022 51FB593D 8D58FABF C5F5BA30 F6CB9B55 6CD7813B 801D346F F26660B7
|
|
6B9950A5 A49F9FE8 047B1022 C24FBBA9 D7FEB7C6 1BF83B57 E7C6A8A6 150F04FB
|
|
83F6D3C5 1EC30235 54135A16 9132F675 F3AE2B61 D72AEFF2 2203199D D14801C7
|
|
]])] =
|
|
|
|
fromhex([[
|
|
F7E1A085 D69B3DDE CBBCAB5C 36B857B9 7994AFBB FA3AEA82 F9574C0B 3D078267
|
|
5159578E BAD4594F E6710710 8180B449 167123E8 4C281613 B7CF0932 8CC8A6E1
|
|
3C167A8B 547C8D28 E0A3AE1E 2BB3A675 916EA37F 0BFA2135 62F1FB62 7A01243B
|
|
CCA4F1BE A8519089 A883DFE1 5AE59F06 928B665E 807B5525 64014C3B FECF492A
|
|
]]),
|
|
|
|
-- RFC5114/1024-bit DSA group with 160-bit prime order subgroup
|
|
[fromhex([[
|
|
B10B8F96 A080E01D DE92DE5E AE5D54EC 52C99FBC FB06A3C6 9A6A9DCA 52D23B61
|
|
6073E286 75A23D18 9838EF1E 2EE652C0 13ECB4AE A9061123 24975C3C D49B83BF
|
|
ACCBDD7D 90C4BD70 98488E9C 219A7372 4EFFD6FA E5644738 FAA31A4F F55BCCC0
|
|
A151AF5F 0DC8B4BD 45BF37DF 365C1A65 E68CFDA7 6D4DA708 DF1FB2BC 2E4A4371
|
|
]])] =
|
|
|
|
fromhex([[
|
|
A4D1CBD5 C3FD3412 6765A442 EFB99905 F8104DD2 58AC507F D6406CFF 14266D31
|
|
266FEA1E 5C41564B 777E690F 5504F213 160217B4 B01B886A 5E91547F 9E2749F4
|
|
D7FBD7D3 B9A92EE1 909D0D22 63F80A76 A6A24C08 7A091F53 1DBF0A01 69B6A28A
|
|
D662A4D1 8E73AFA3 2D779D59 18D08BC8 858F4DCE F97C2A24 855E6EEB 22B3B2E5
|
|
]]),
|
|
|
|
-- RFC5114/2048-bit DSA group with 224-bit prime order subgroup
|
|
[fromhex([[
|
|
AD107E1E 9123A9D0 D660FAA7 9559C51F A20D64E5 683B9FD1 B54B1597 B61D0A75
|
|
E6FA141D F95A56DB AF9A3C40 7BA1DF15 EB3D688A 309C180E 1DE6B85A 1274A0A6
|
|
6D3F8152 AD6AC212 9037C9ED EFDA4DF8 D91E8FEF 55B7394B 7AD5B7D0 B6C12207
|
|
C9F98D11 ED34DBF6 C6BA0B2C 8BBC27BE 6A00E0A0 B9C49708 B3BF8A31 70918836
|
|
81286130 BC8985DB 1602E714 415D9330 278273C7 DE31EFDC 7310F712 1FD5A074
|
|
15987D9A DC0A486D CDF93ACC 44328387 315D75E1 98C641A4 80CD86A1 B9E587E8
|
|
BE60E69C C928B2B9 C52172E4 13042E9B 23F10B0E 16E79763 C9B53DCF 4BA80A29
|
|
E3FB73C1 6B8E75B9 7EF363E2 FFA31F71 CF9DE538 4E71B81C 0AC4DFFE 0C10E64F
|
|
]])] =
|
|
|
|
fromhex([[
|
|
AC4032EF 4F2D9AE3 9DF30B5C 8FFDAC50 6CDEBE7B 89998CAF 74866A08 CFE4FFE3
|
|
A6824A4E 10B9A6F0 DD921F01 A70C4AFA AB739D77 00C29F52 C57DB17C 620A8652
|
|
BE5E9001 A8D66AD7 C1766910 1999024A F4D02727 5AC1348B B8A762D0 521BC98A
|
|
E2471504 22EA1ED4 09939D54 DA7460CD B5F6C6B2 50717CBE F180EB34 118E98D1
|
|
19529A45 D6F83456 6E3025E3 16A330EF BB77A86F 0C1AB15B 051AE3D4 28C8F8AC
|
|
B70A8137 150B8EEB 10E183ED D19963DD D9E263E4 770589EF 6AA21E7F 5F2FF381
|
|
B539CCE3 409D13CD 566AFBB4 8D6C0191 81E1BCFE 94B30269 EDFE72FE 9B6AA4BD
|
|
7B5A0F1C 71CFFF4C 19C418E1 F6EC0179 81BC087F 2A7065B3 84B890D3 191F2BFA
|
|
]]),
|
|
|
|
-- RFC5114/2048-bit DSA group with 256-bit prime order subgroup
|
|
[fromhex([[
|
|
87A8E61D B4B6663C FFBBD19C 65195999 8CEEF608 660DD0F2 5D2CEED4 435E3B00
|
|
E00DF8F1 D61957D4 FAF7DF45 61B2AA30 16C3D911 34096FAA 3BF4296D 830E9A7C
|
|
209E0C64 97517ABD 5A8A9D30 6BCF67ED 91F9E672 5B4758C0 22E0B1EF 4275BF7B
|
|
6C5BFC11 D45F9088 B941F54E B1E59BB8 BC39A0BF 12307F5C 4FDB70C5 81B23F76
|
|
B63ACAE1 CAA6B790 2D525267 35488A0E F13C6D9A 51BFA4AB 3AD83477 96524D8E
|
|
F6A167B5 A41825D9 67E144E5 14056425 1CCACB83 E6B486F6 B3CA3F79 71506026
|
|
C0B857F6 89962856 DED4010A BD0BE621 C3A3960A 54E710C3 75F26375 D7014103
|
|
A4B54330 C198AF12 6116D227 6E11715F 693877FA D7EF09CA DB094AE9 1E1A1597
|
|
]])] =
|
|
|
|
fromhex([[
|
|
3FB32C9B 73134D0B 2E775066 60EDBD48 4CA7B18F 21EF2054 07F4793A 1A0BA125
|
|
10DBC150 77BE463F FF4FED4A AC0BB555 BE3A6C1B 0C6B47B1 BC3773BF 7E8C6F62
|
|
901228F8 C28CBB18 A55AE313 41000A65 0196F931 C77A57F2 DDF463E5 E9EC144B
|
|
777DE62A AAB8A862 8AC376D2 82D6ED38 64E67982 428EBC83 1D14348F 6F2F9193
|
|
B5045AF2 767164E1 DFC967C1 FB3F2E55 A4BD1BFF E83B9C80 D052B985 D182EA0A
|
|
DB2A3B73 13D3FE14 C8484B1E 052588B9 B7D2BBD2 DF016199 ECD06E15 57CD0915
|
|
B3353BBB 64E0EC37 7FD02837 0DF92B52 C7891428 CDC67EB6 184B523D 1DB246C3
|
|
2F630784 90F00EF8 D647D148 D4795451 5E2327CF EF98C582 664B4C0F 6CC41659
|
|
]])
|
|
}
|
|
|
|
|
|
-- Add additional context (protocol) to debug output
|
|
local function ctx_log(level, protocol, fmt, ...)
|
|
return stdnse.debug(level, "(%s) " .. fmt, protocol, ...)
|
|
end
|
|
|
|
|
|
-- returns a function that yields a new tls record each time it is called
|
|
local function get_record_iter(sock)
|
|
local buffer = ""
|
|
local i = 1
|
|
local fragment
|
|
return function ()
|
|
local record
|
|
i, record = tls.record_read(buffer, i, fragment)
|
|
if record == nil then
|
|
local status, err
|
|
status, buffer, err = tls.record_buffer(sock, buffer, i)
|
|
if not status then
|
|
return nil, err
|
|
end
|
|
i, record = tls.record_read(buffer, i, fragment)
|
|
if record == nil then
|
|
return nil, "done"
|
|
end
|
|
end
|
|
fragment = record.fragment
|
|
return record
|
|
end
|
|
end
|
|
|
|
|
|
local function get_server_response(host, port, t)
|
|
local timeout = stdnse.get_timeout(host, 10000, 5000)
|
|
|
|
-- Create socket.
|
|
local status, sock, err
|
|
local starttls = sslcert.getPrepareTLSWithoutReconnect(port)
|
|
if starttls then
|
|
status, sock = starttls(host, port)
|
|
if not status then
|
|
ctx_log(1, t.protocol, "Can't connect: %s", sock)
|
|
return nil
|
|
end
|
|
else
|
|
sock = nmap.new_socket()
|
|
sock:set_timeout(timeout)
|
|
status, err = sock:connect(host, port)
|
|
if not status then
|
|
ctx_log(1, t.protocol, "Can't connect: %s", err)
|
|
sock:close()
|
|
return nil
|
|
end
|
|
end
|
|
|
|
sock:set_timeout(timeout)
|
|
|
|
-- Send request.
|
|
local req = tls.client_hello(t)
|
|
status, err = sock:send(req)
|
|
if not status then
|
|
ctx_log(1, t.protocol, "Can't send: %s", err)
|
|
sock:close()
|
|
return nil
|
|
end
|
|
|
|
-- Read response.
|
|
local get_next_record = get_record_iter(sock)
|
|
local records = {}
|
|
while true do
|
|
local record
|
|
record, err = get_next_record()
|
|
if not record then
|
|
ctx_log(1, t.protocol, "Couldn't read a TLS record: %s", err)
|
|
sock:close()
|
|
return records
|
|
end
|
|
-- Collect message bodies into one record per type
|
|
records[record.type] = records[record.type] or record
|
|
local done = false
|
|
for j = 1, #record.body do -- no ipairs because we append below
|
|
local b = record.body[j]
|
|
done = ((record.type == "alert" and b.level == "fatal") or
|
|
(record.type == "handshake" and b.type == "server_hello_done"))
|
|
table.insert(records[record.type].body, b)
|
|
end
|
|
if done then
|
|
sock:close()
|
|
return records
|
|
end
|
|
end
|
|
end
|
|
|
|
-- If protocol fails (i.e. no ciphers will ever succeed) then returns false
|
|
-- If no ciphers were supported, but the protocol is valid, then returns nil
|
|
-- else returns the cipher and dh params
|
|
local function get_dhe_params(host, port, protocol, ciphers)
|
|
local cipher, packed
|
|
local t = {}
|
|
local pos = 1
|
|
t.protocol = protocol
|
|
local tlsname = tls.servername(host)
|
|
t.extensions = {
|
|
server_name = tlsname and tls.EXTENSION_HELPERS["server_name"](tlsname),
|
|
}
|
|
|
|
-- Keep ClientHello record size below 255 bytes and the number of ciphersuites
|
|
-- to 64 or less in order to avoid implementation issues with some TLS servers
|
|
|
|
-- Get handshake record size with just one cipher
|
|
t.ciphers = { "TLS_NULL_WITH_NULL_NULL" }
|
|
local len = #tls.client_hello(t)
|
|
local room = math.floor(math.max(0, (255 - len) / 2))
|
|
|
|
local function next_chunk(t, ciphers, pos)
|
|
|
|
-- Compute number of ciphers to fit in next chunk
|
|
local last = math.min(#ciphers, pos + math.min(63, room))
|
|
t.ciphers = {}
|
|
|
|
for i = pos, last do
|
|
table.insert(t.ciphers, ciphers[i])
|
|
end
|
|
|
|
return last + 1
|
|
end
|
|
|
|
while pos <= #ciphers do
|
|
pos = next_chunk(t, ciphers, pos)
|
|
local records = get_server_response(host, port, t)
|
|
if not records then
|
|
stdnse.debug1("Connection failed")
|
|
return false
|
|
end
|
|
|
|
local alert = records.alert
|
|
if alert then
|
|
for j = 1, #alert.body do
|
|
ctx_log(2, protocol, "Received alert: %s", alert.body[j].description)
|
|
if alert["protocol"] ~= protocol then
|
|
ctx_log(1, protocol, "Protocol rejected.")
|
|
return false
|
|
end
|
|
end
|
|
end
|
|
|
|
-- Extract negotiated cipher suite and key exchange data
|
|
local handshake = records.handshake
|
|
if handshake then
|
|
for j = 1, #handshake.body do
|
|
if handshake.body[j].type == "server_hello" then
|
|
if handshake.body[j].protocol ~= protocol then
|
|
ctx_log(1, protocol, "Protocol rejected in server hello")
|
|
return false
|
|
end
|
|
cipher = handshake.body[j].cipher
|
|
elseif handshake.body[j].type == "server_key_exchange" then
|
|
packed = handshake.body[j].data
|
|
end
|
|
end
|
|
end
|
|
|
|
-- Only try next chunk if current chunk was rejected
|
|
if cipher and packed then
|
|
local info = tls.cipher_info(cipher)
|
|
local data = tls.KEX_ALGORITHMS[info.kex].server_key_exchange(packed, protocol)
|
|
return cipher, data.dhparams
|
|
end
|
|
end
|
|
|
|
return nil
|
|
end
|
|
|
|
|
|
local function get_dhe_ciphers()
|
|
local dh_anons = {}
|
|
local dhe_ciphers = {}
|
|
local dhe_exports = {}
|
|
|
|
for cipher, _ in pairs(tls.CIPHERS) do
|
|
local info = tls.cipher_info(cipher)
|
|
if DH_anon_ALGORITHMS[info.kex] then
|
|
dh_anons[#dh_anons + 1] = cipher
|
|
end
|
|
if DHE_ALGORITHMS[info.kex] then
|
|
dhe_ciphers[#dhe_ciphers + 1] = cipher
|
|
end
|
|
if DHE_ALGORITHMS_EXPORT[info.kex] then
|
|
dhe_exports[#dhe_exports + 1] = cipher
|
|
end
|
|
end
|
|
|
|
return dh_anons, dhe_ciphers, dhe_exports
|
|
end
|
|
|
|
local fields_order = {
|
|
"Cipher Suite",
|
|
"Modulus Type",
|
|
"Modulus Source",
|
|
"Modulus Length",
|
|
"Generator Length",
|
|
"Public Key Length",
|
|
}
|
|
local group_metatable = {
|
|
__tostring = function(g)
|
|
local out = {}
|
|
for i=1, #fields_order do
|
|
local k = fields_order[i]
|
|
if g[k] then
|
|
out[#out+1] = (" %s: %s"):format(k, g[k])
|
|
end
|
|
end
|
|
return table.concat(out, "\n")
|
|
end
|
|
}
|
|
|
|
local function check_dhgroup(anondh, logjam, weakdh, nosafe, cipher, dhparams)
|
|
local source = DHE_PRIMES[dhparams.p]
|
|
local length = #dhparams.p * 8
|
|
local genlen = #dhparams.g * 8
|
|
local pubkeylen = #dhparams.y * 8
|
|
local modulus = stdnse.tohex(dhparams.p)
|
|
local generator = stdnse.tohex(dhparams.g)
|
|
local pubkey = stdnse.tohex(dhparams.y)
|
|
local is_prime, is_safe
|
|
|
|
local group = {
|
|
["Cipher Suite"] = cipher,
|
|
["Modulus Source"] = source or "Unknown/Custom-generated",
|
|
["Modulus Length"] = length,
|
|
["Modulus"] = modulus,
|
|
["Generator Length"] = genlen,
|
|
["Generator"] = generator,
|
|
["Public Key Length"] = pubkeylen
|
|
}
|
|
setmetatable(group, group_metatable)
|
|
|
|
if have_ssl then
|
|
local bn = openssl.bignum_bin2bn(dhparams.p)
|
|
is_safe, is_prime = openssl.bignum_is_safe_prime(bn)
|
|
group["Modulus Type"] = (is_safe and "Safe prime") or
|
|
(is_prime and "Non-safe prime") or
|
|
"Composite"
|
|
end
|
|
|
|
if string.find(cipher, "DH_anon") then
|
|
anondh[#anondh + 1] = group
|
|
elseif string.find(cipher, "EXPORT") then
|
|
logjam[#logjam + 1] = group
|
|
elseif length <= 1024 then
|
|
weakdh[#weakdh + 1] = group
|
|
end
|
|
|
|
-- The use of non-safe primes requires carefully generated parameters
|
|
-- in order to be secure. Do some rudimentary validation checks here.
|
|
if have_ssl and not is_safe and not DSA_PARAMS[dhparams.p] then
|
|
nosafe[#nosafe + 1] = group
|
|
elseif DSA_PARAMS[dhparams.p] and DSA_PARAMS[dhparams.p] ~= dhparams.g then
|
|
nosafe[#nosafe + 1] = group
|
|
end
|
|
end
|
|
|
|
|
|
portrule = function(host, port)
|
|
return shortport.ssl(host, port) or sslcert.getPrepareTLSWithoutReconnect(port)
|
|
end
|
|
|
|
local function format_check(t, label)
|
|
local out = {}
|
|
for i, v in ipairs(t) do
|
|
out[i] = string.format("%s %d\n%s", label, i, v)
|
|
end
|
|
return out
|
|
end
|
|
|
|
action = function(host, port)
|
|
local dh_anons, dhe_ciphers, dhe_exports = get_dhe_ciphers()
|
|
local cipher
|
|
local dhparams
|
|
local anondh = {}
|
|
local logjam = {}
|
|
local weakdh = {}
|
|
local nosafe = {}
|
|
local primes = {}
|
|
local anons = {}
|
|
|
|
local vuln_table_anondh = {
|
|
title = "Anonymous Diffie-Hellman Key Exchange MitM Vulnerability",
|
|
description = [[
|
|
Transport Layer Security (TLS) services that use anonymous
|
|
Diffie-Hellman key exchange only provide protection against passive
|
|
eavesdropping, and are vulnerable to active man-in-the-middle attacks
|
|
which could completely compromise the confidentiality and integrity
|
|
of any data exchanged over the resulting session.]],
|
|
state = vulns.STATE.NOT_VULN,
|
|
references = {
|
|
"https://www.ietf.org/rfc/rfc2246.txt"
|
|
}
|
|
}
|
|
|
|
local vuln_table_logjam = {
|
|
title = "Transport Layer Security (TLS) Protocol DHE_EXPORT Ciphers Downgrade MitM (Logjam)",
|
|
description = [[
|
|
The Transport Layer Security (TLS) protocol contains a flaw that is
|
|
triggered when handling Diffie-Hellman key exchanges defined with
|
|
the DHE_EXPORT cipher. This may allow a man-in-the-middle attacker
|
|
to downgrade the security of a TLS session to 512-bit export-grade
|
|
cryptography, which is significantly weaker, allowing the attacker
|
|
to more easily break the encryption and monitor or tamper with
|
|
the encrypted stream.]],
|
|
state = vulns.STATE.NOT_VULN,
|
|
IDS = {
|
|
CVE = 'CVE-2015-4000',
|
|
BID = '74733'
|
|
},
|
|
SCORES = {
|
|
CVSSv2 = '4.3'
|
|
},
|
|
dates = {
|
|
disclosure = {
|
|
year = 2015, month = 5, day = 19
|
|
}
|
|
},
|
|
references = {
|
|
"https://weakdh.org"
|
|
}
|
|
}
|
|
|
|
local vuln_table_weakdh = {
|
|
title = "Diffie-Hellman Key Exchange Insufficient Group Strength",
|
|
description = [[
|
|
Transport Layer Security (TLS) services that use Diffie-Hellman groups
|
|
of insufficient strength, especially those using one of a few commonly
|
|
shared groups, may be susceptible to passive eavesdropping attacks.]],
|
|
state = vulns.STATE.NOT_VULN,
|
|
references = {
|
|
"https://weakdh.org"
|
|
}
|
|
}
|
|
|
|
local vuln_table_nosafe = {
|
|
title = "Diffie-Hellman Key Exchange Incorrectly Generated Group Parameters",
|
|
description = [[
|
|
This TLS service appears to be using a modulus that is not a safe prime
|
|
and does not correspond to any well-known DSA group for Diffie-Hellman
|
|
key exchange.
|
|
These parameters MAY be secure if:
|
|
- They were generated according to the procedure described in
|
|
FIPS 186-4 for DSA Domain Parameter Generation, or
|
|
- The generator g generates a subgroup of large prime order
|
|
Additional testing may be required to verify the security of these
|
|
parameters.]],
|
|
state = vulns.STATE.NOT_VULN,
|
|
references = {
|
|
"https://weakdh.org"
|
|
}
|
|
}
|
|
|
|
for protocol in pairs(tls.PROTOCOLS) do
|
|
if protocol == "TLSv1.3" then
|
|
-- TLSv1.3 does not allow anonymous key exchange and only allows specific
|
|
-- DHE groups named in RFC 7919
|
|
goto NEXT_PROTOCOL
|
|
end
|
|
-- Try anonymous DH ciphersuites
|
|
cipher, dhparams = get_dhe_params(host, port, protocol, dh_anons)
|
|
-- Explicit test for false needed because nil just means no ciphers supported.
|
|
if cipher == false then goto NEXT_PROTOCOL end
|
|
if dhparams and not anons[dhparams.p] then
|
|
vuln_table_anondh.state = vulns.STATE.VULN
|
|
check_dhgroup(anondh, logjam, weakdh, nosafe, cipher, dhparams)
|
|
anons[dhparams.p] = 1
|
|
end
|
|
|
|
-- Try DHE_EXPORT ciphersuites
|
|
cipher, dhparams = get_dhe_params(host, port, protocol, dhe_exports)
|
|
if dhparams and not primes[dhparams.p] then
|
|
check_dhgroup(anondh, logjam, weakdh, nosafe, cipher, dhparams)
|
|
primes[dhparams.p] = 1
|
|
end
|
|
|
|
-- Try non-export DHE ciphersuites
|
|
cipher, dhparams = get_dhe_params(host, port, protocol, dhe_ciphers)
|
|
if dhparams and not primes[dhparams.p] then
|
|
check_dhgroup(anondh, logjam, weakdh, nosafe, cipher, dhparams)
|
|
primes[dhparams.p] = 1
|
|
end
|
|
::NEXT_PROTOCOL::
|
|
end
|
|
|
|
local report = vulns.Report:new(SCRIPT_NAME, host, port)
|
|
|
|
vuln_table_anondh.check_results = format_check(anondh, "ANONYMOUS DH GROUP")
|
|
vuln_table_logjam.check_results = format_check(logjam, "EXPORT-GRADE DH GROUP")
|
|
vuln_table_weakdh.check_results = format_check(weakdh, "WEAK DH GROUP")
|
|
vuln_table_nosafe.check_results = format_check(nosafe, "NON-SAFE GROUP")
|
|
|
|
if #anondh > 0 then
|
|
vuln_table_anondh.state = vulns.STATE.VULN
|
|
end
|
|
|
|
if #logjam > 0 then
|
|
vuln_table_logjam.state = vulns.STATE.VULN
|
|
end
|
|
|
|
if #weakdh > 0 then
|
|
vuln_table_weakdh.state = vulns.STATE.VULN
|
|
end
|
|
|
|
if #nosafe > 0 then
|
|
vuln_table_nosafe.state = vulns.STATE.LIKELY_VULN
|
|
end
|
|
|
|
return report:make_output(vuln_table_anondh, vuln_table_logjam, vuln_table_weakdh, vuln_table_nosafe)
|
|
end
|