376 lines
9.9 KiB
Lua
376 lines
9.9 KiB
Lua
local nmap = require "nmap"
|
|
local shortport = require "shortport"
|
|
local stdnse = require "stdnse"
|
|
local string = require "string"
|
|
local ipOps = require "ipOps"
|
|
local tableaux = require "tableaux"
|
|
|
|
description = [[
|
|
Extracts information from Ubiquiti networking devices.
|
|
|
|
This script leverages Ubiquiti's Discovery Service which is enabled by default
|
|
on many products. It will attempt to leverage version 1 of the protocol first
|
|
and, if that fails, attempt version 2.
|
|
]]
|
|
|
|
author = {"Tom Sellers"}
|
|
|
|
license = "Same as Nmap--See https://nmap.org/book/man-legal.html"
|
|
|
|
categories = {"default", "discovery", "version", "safe"}
|
|
|
|
---
|
|
-- @usage
|
|
-- nmap -sU -p 10001 --script ubiquiti-discovery.nse <target>
|
|
--
|
|
---
|
|
-- @output
|
|
-- PORT STATE SERVICE VERSION
|
|
-- 10001/udp open ubiquiti-discovery Ubiquiti Discovery Service (v1 protocol, ER-X software ver. v1.10.7)
|
|
-- | ubiquiti-discovery:
|
|
-- | protocol: v1
|
|
-- | uptime_seconds: 113144
|
|
-- | uptime: 1 days 07:25:44
|
|
-- | hostname: ubnt-router
|
|
-- | product: ER-X
|
|
-- | firmware: EdgeRouter.ER-e50.v1.10.7.5127989.181001.1227
|
|
-- | version: v1.10.7
|
|
-- | interface_to_ip:
|
|
-- | 80:2a:a8:ae:f1:63:
|
|
-- | 192.168.0.1
|
|
-- | 172.25.16.1
|
|
-- | 80:2a:a8:ae:f1:5e:
|
|
-- | 55.55.55.10
|
|
-- | 55.55.55.11
|
|
-- | 55.55.55.12
|
|
-- | mac_addresses:
|
|
-- | 80:2a:a8:ae:f1:63
|
|
-- |_ 80:2a:a8:ae:f1:5e
|
|
--
|
|
-- PORT STATE SERVICE REASON VERSION
|
|
-- 10001/udp open ubiquiti-discovery udp-response Ubiquiti Discovery Service (v2 protocol, UCK-v2 software ver. 5.9.29)
|
|
-- | ubiquiti-discovery:
|
|
-- | protocol: v2
|
|
-- | firmware: UCK.mtk7623.v0.12.0.29a26c9.181001.1444
|
|
-- | version: 5.9.29
|
|
-- | model: UCK-v2
|
|
-- | config_status: managed/adopted
|
|
-- | interface_to_ip:
|
|
-- | 78:8a:20:21:ae:7b:
|
|
-- | 192.168.0.30
|
|
-- | mac_addresses:
|
|
-- |_ 78:8a:20:21:ae:7b
|
|
--
|
|
--@xmloutput
|
|
-- <elem key="protocol">v1</elem>
|
|
-- <elem key="uptime_seconds">113144</elem>
|
|
-- <elem key="uptime">1 days 07:25:44</elem>
|
|
-- <elem key="hostname">ubnt-router</elem>
|
|
-- <elem key="product">ER-X</elem>
|
|
-- <elem key="firmware">EdgeRouter.ER-e50.v1.10.7.5127989.181001.1227</elem>
|
|
-- <elem key="version">v1.10.7</elem>
|
|
-- <table key="interface_to_ip">
|
|
-- <table key="80:2a:a8:ae:f1:63">
|
|
-- <elem>192.168.0.1</elem>
|
|
-- <elem>172.25.16.1</elem>
|
|
-- </table>
|
|
-- <table key="80:2a:a8:ae:f1:5e">
|
|
-- <elem>55.55.55.10</elem>
|
|
-- <elem>55.55.55.11</elem>
|
|
-- <elem>55.55.55.12</elem>
|
|
-- </table>
|
|
-- </table>
|
|
-- <table key="mac_addresses">
|
|
-- <elem>80:2a:a8:ae:f1:63</elem>
|
|
-- <elem>80:2a:a8:ae:f1:5e</elem>
|
|
-- </table>
|
|
--
|
|
-- <elem key="protocol">v2</elem>
|
|
-- <elem key="version">5.9.29</elem>
|
|
-- <elem key="model">UCK-v2</elem>
|
|
-- <elem key="config_status">managed/adopted</elem>
|
|
-- <table key="interface_to_ip">
|
|
-- <table key="78:8a:20:21:ae:7b">
|
|
-- <elem>192.168.0.30</elem>
|
|
-- </table>
|
|
-- </table>
|
|
-- <table key="mac_addresses">
|
|
-- <elem>78:8a:20:21:ae:7b</elem>
|
|
-- </table>
|
|
--
|
|
|
|
|
|
portrule = shortport.port_or_service(10001, "ubiquiti-discovery", "udp", {"open", "open|filtered"})
|
|
|
|
local PROBE_V1 = string.pack("BB I2",
|
|
0x01, 0x00, -- version, command
|
|
0x00, 0x00 -- length
|
|
)
|
|
|
|
local PROBE_V2 = string.pack("BB I2",
|
|
0x02, 0x08, -- version, command
|
|
0x00, 0x00 -- length
|
|
)
|
|
---
|
|
-- Converts uptime seconds into a human readable string
|
|
--
|
|
-- E.g. "86518" -> "1 days 00:01:58"
|
|
--
|
|
-- @param uptime number of seconds of uptime
|
|
-- @return formatted uptime string (days, hours, minutes, seconds)
|
|
local function uptime_str(uptime)
|
|
if not uptime then
|
|
return nil
|
|
end
|
|
|
|
local d = uptime // 86400
|
|
local h = uptime // 3600 % 24
|
|
local m = uptime // 60 % 60
|
|
local s = uptime % 60
|
|
|
|
return string.format("%d days %02d:%02d:%02d", d, h, m, s)
|
|
end
|
|
|
|
---
|
|
-- Parses the full payload of a discovery response
|
|
--
|
|
-- There are different fields for v1 and v2 of the protocol but as far as I can
|
|
-- tell they don't conflict so we should be safe parsing them both with the same
|
|
-- code as long as we sanity check the version and cmd.
|
|
--
|
|
-- @param payload containing response
|
|
-- @return output_table containing results or nil
|
|
local function parse_discovery_response(response)
|
|
|
|
local info = stdnse.output_table()
|
|
local unique_macs = {}
|
|
local mac_ip_table = {}
|
|
|
|
if #response < 4 then
|
|
return nil
|
|
end
|
|
|
|
-- Verify header and cmd
|
|
if response:byte(1) == 0x01 then
|
|
if response:byte(2) ~= 0x00 then
|
|
return nil
|
|
end
|
|
info.protocol = "v1"
|
|
elseif response:byte(1) == 0x02 then
|
|
-- Known values for cmd are 6,9, and 11
|
|
if response:byte(2) ~= 0x06 and response:byte(2) ~= 0x09
|
|
and response:byte(2) ~= 0x0b then
|
|
|
|
return nil
|
|
end
|
|
info.protocol = "v2"
|
|
else
|
|
return nil
|
|
end
|
|
|
|
local config_len = string.unpack(">I2", response, 3)
|
|
|
|
-- Do the lengths check out?
|
|
if ( not ( #response == config_len + 4) ) then
|
|
return nil
|
|
end
|
|
|
|
-- Response looks legit, start extraction
|
|
local config_data = string.sub(response, 5, #response)
|
|
|
|
local tlv_type, tlv_len, tlv_value, pos
|
|
local mac, mac_raw, ip, ip_raw
|
|
pos = 1
|
|
|
|
while pos <= #config_data - 2 do
|
|
tlv_type = config_data:byte(pos)
|
|
tlv_len = string.unpack(">I2", config_data, pos +1)
|
|
pos = pos + 3
|
|
|
|
-- Sanity check that TLV len isn't larger than the data we have left.
|
|
-- Has been observed in the wild against protocols just similar enough to
|
|
-- make it here.
|
|
if tlv_len > (#config_data - pos + 1) then
|
|
return nil
|
|
end
|
|
|
|
tlv_value = config_data:sub(pos, pos + tlv_len - 1)
|
|
|
|
-- MAC address
|
|
if tlv_type == 0x01 then
|
|
mac_raw = tlv_value:sub(1, 6)
|
|
mac = stdnse.format_mac(mac_raw)
|
|
unique_macs[mac] = true
|
|
|
|
-- MAC and IP address
|
|
elseif tlv_type == 0x02 then
|
|
mac_raw = tlv_value:sub(1, 6)
|
|
mac = stdnse.format_mac(mac_raw)
|
|
unique_macs[mac] = true
|
|
|
|
ip_raw = tlv_value:sub(7, tlv_len)
|
|
ip = ipOps.str_to_ip(ip_raw)
|
|
if mac_ip_table[mac] == nil then
|
|
mac_ip_table[mac] = {}
|
|
end
|
|
mac_ip_table[mac][ip] = true
|
|
|
|
elseif tlv_type == 0x03 then
|
|
info.firmware = tlv_value
|
|
|
|
local human_version = tlv_value:match("%.(v%d+%.%d+%.%d+)")
|
|
if human_version then
|
|
info.version = human_version
|
|
end
|
|
|
|
elseif tlv_type == 0x0a then
|
|
if tlv_len == 4 then
|
|
local uptime_raw = string.unpack(">I4", tlv_value)
|
|
info.uptime_seconds = uptime_raw
|
|
info.uptime = uptime_str(uptime_raw)
|
|
end
|
|
|
|
elseif tlv_type == 0x0b then
|
|
info.hostname = tlv_value
|
|
|
|
elseif tlv_type == 0x0c then
|
|
info.product = tlv_value
|
|
|
|
elseif tlv_type == 0x0d then
|
|
info.essid = tlv_value
|
|
|
|
elseif tlv_type == 0x0f then
|
|
-- value also includes bit shifted flag for http vs https but we
|
|
-- are ignoring it here.
|
|
if tlv_len == 4 then
|
|
tlv_value = string.unpack(">I4", tlv_value)
|
|
info.mgmt_port = tlv_value & 0xffff
|
|
end
|
|
|
|
-- model v1 protocol
|
|
elseif tlv_type == 0x14 then
|
|
info.model = tlv_value
|
|
|
|
-- model v2 protocol
|
|
elseif tlv_type == 0x15 then
|
|
info.model = tlv_value
|
|
|
|
elseif tlv_type == 0x16 then
|
|
info.version = tlv_value
|
|
|
|
elseif tlv_type == 0x17 then
|
|
local is_default
|
|
if tlv_len == 4 then
|
|
is_default = string.unpack("I4", tlv_value)
|
|
elseif tlv_len == 1 then
|
|
is_default = string.unpack("I1", tlv_value)
|
|
end
|
|
|
|
if is_default == 1 then
|
|
info.config_status = "default/unmanaged"
|
|
elseif is_default == 0 then
|
|
info.config_status = "managed/adopted"
|
|
end
|
|
|
|
else
|
|
|
|
-- Other known or observed values
|
|
-- Some have been seen in code but not observed to test while others have
|
|
-- been observed but we don't know how to decode them.
|
|
|
|
-- 0x06 - username
|
|
-- 0x07 - salt
|
|
-- 0x08 - random challenge
|
|
-- 0x09 - challenge
|
|
-- 0x0e - WMODE - state of config? length 1 value 03 value 02
|
|
-- 0x10 - length 2 value e4b2 value e8a5 e815
|
|
-- 0x12 - SEQ - lenth 4
|
|
-- 0x13 - Source Mac, unused?
|
|
-- 0x18 - length 4 and 4 nulls, or length 1 and 0xff
|
|
-- 0xff - length 2 value e835
|
|
|
|
stdnse.debug1("Unknown tag: %s - length: %d value: %s",
|
|
stdnse.tohex(tlv_type), tlv_len,
|
|
stdnse.tohex(tlv_value))
|
|
end
|
|
|
|
pos = pos + tlv_len
|
|
end
|
|
|
|
if next(mac_ip_table) ~= nil then
|
|
info.interface_to_ip = {}
|
|
for k, _ in pairs(mac_ip_table) do
|
|
info.interface_to_ip[k] = tableaux.keys(mac_ip_table[k])
|
|
end
|
|
end
|
|
|
|
if next(unique_macs) ~= nil then
|
|
info.mac_addresses = tableaux.keys(unique_macs)
|
|
end
|
|
|
|
return info
|
|
end
|
|
|
|
---
|
|
-- Send probe and handle housekeeping
|
|
--
|
|
-- @param host A host table for the target host
|
|
-- @param port A port table for the target port
|
|
-- @return (status, result) If status is true, result the target's response to
|
|
-- a probe. If status is false, result is an error message.
|
|
local function send_probe(host, port, probe)
|
|
|
|
local socket = nmap.new_socket()
|
|
socket:set_timeout(5000)
|
|
|
|
local try = nmap.new_try(function() socket:close() end)
|
|
|
|
try( socket:connect(host, port) )
|
|
try( socket:send(probe) )
|
|
|
|
local stat, resp = socket:receive_bytes(4)
|
|
socket:close()
|
|
|
|
return stat, resp
|
|
end
|
|
|
|
function action(host, port)
|
|
|
|
local status, response = send_probe(host, port, PROBE_V1)
|
|
|
|
if not status then
|
|
status, response = send_probe(host, port, PROBE_V2)
|
|
|
|
if not status then
|
|
return nil
|
|
end
|
|
end
|
|
|
|
nmap.set_port_state(host, port, "open")
|
|
|
|
local result = parse_discovery_response(response)
|
|
|
|
if not result then
|
|
return nil
|
|
end
|
|
|
|
port.version.name = "ubiquiti-discovery"
|
|
port.version.product = "Ubiquiti Discovery Service"
|
|
|
|
local extrainfo = result.protocol .. " protocol"
|
|
if result.product then
|
|
extrainfo = extrainfo .. ", " .. result.product
|
|
elseif result.model then
|
|
extrainfo = extrainfo .. ", " .. result.model
|
|
end
|
|
|
|
if result.version then
|
|
port.version.extrainfo = extrainfo .. " software ver. " .. result.version
|
|
end
|
|
|
|
port.version.ostype = "Linux"
|
|
nmap.set_port_version(host, port, "hardmatched")
|
|
|
|
return result
|
|
end
|