127 lines
3.2 KiB
Lua
127 lines
3.2 KiB
Lua
local omp2 = require "omp2"
|
|
local shortport = require "shortport"
|
|
local stdnse = require "stdnse"
|
|
local tab = require "tab"
|
|
local table = require "table"
|
|
local target = require "target"
|
|
|
|
description = [[
|
|
Attempts to retrieve the list of target systems and networks from an OpenVAS Manager server.
|
|
|
|
The script authenticates on the manager using provided or previously cracked
|
|
credentials and gets the list of defined targets for each account.
|
|
|
|
These targets will be added to the scanning queue in case
|
|
<code>newtargets</code> global variable is set.
|
|
]]
|
|
|
|
---
|
|
-- @usage
|
|
-- nmap -p 9390 --script omp2-brute,omp2-enum-targets <target>
|
|
--
|
|
-- @usage
|
|
-- nmap -p 9390 --script omp2-enum-targets --script-args omp2.username=admin,omp2.password=secret <target>
|
|
--
|
|
-- @output
|
|
-- PORT STATE SERVICE
|
|
-- 9390/tcp open openvas
|
|
-- | omp2-enum-targets:
|
|
-- | Targets for account admin:
|
|
-- | TARGET HOSTS
|
|
-- | Sales network 192.168.20.0/24
|
|
-- | Production network 192.168.30.0/24
|
|
-- |_ Firewall 192.168.1.254
|
|
--
|
|
|
|
|
|
author = "Henri Doreau"
|
|
license = "Same as Nmap--See https://nmap.org/book/man-legal.html"
|
|
categories = {"discovery", "safe"}
|
|
dependencies = {"omp2-brute"}
|
|
|
|
|
|
|
|
|
|
portrule = shortport.port_or_service(9390, "openvas")
|
|
|
|
|
|
--- Return the list of targets defined for a given user
|
|
--
|
|
-- @param host the target host table
|
|
-- @param port the targeted OMP port
|
|
-- @param username the username to use to login
|
|
-- @param password the password to use to login
|
|
-- @return the list of targets for this user or nil
|
|
local function account_enum_targets(host, port, username, password)
|
|
local targets
|
|
local session = omp2.Session:new()
|
|
|
|
local status, err = session:connect(host, port)
|
|
|
|
if not status then
|
|
stdnse.debug1("connection failure (%s)", err)
|
|
return nil
|
|
end
|
|
|
|
if session:authenticate(username, password) then
|
|
targets = session:ls_targets()
|
|
else
|
|
stdnse.debug1("authentication failure (%s:%s)", username, password)
|
|
end
|
|
|
|
session:close()
|
|
|
|
return targets
|
|
end
|
|
|
|
--- Generate the output string representing the list of discovered targets
|
|
--
|
|
-- @param targets the list of targets as a name->hosts mapping
|
|
-- @return the array as a formatted string
|
|
local function report(targets)
|
|
local outtab = tab.new()
|
|
|
|
tab.add(outtab, 1, "TARGET")
|
|
tab.add(outtab, 2, "HOSTS")
|
|
tab.nextrow(outtab)
|
|
|
|
for name, hosts in pairs(targets) do
|
|
tab.addrow(outtab, name, hosts)
|
|
end
|
|
|
|
return tab.dump(outtab)
|
|
end
|
|
|
|
action = function(host, port)
|
|
local results = {}
|
|
local credentials = omp2.get_accounts(host)
|
|
|
|
if not credentials then
|
|
-- unable to authenticate on the server
|
|
return "No valid account available!"
|
|
end
|
|
|
|
for _, account in pairs(credentials) do
|
|
|
|
local username, password = account.username, account.password
|
|
|
|
local targets = account_enum_targets(host, port, username, password)
|
|
|
|
if targets ~= nil then
|
|
table.insert(results, "Targets for account " .. username .. ":")
|
|
table.insert(results, report(targets))
|
|
else
|
|
table.insert(results, "No targets found for account " .. username)
|
|
end
|
|
|
|
if target.ALLOW_NEW_TARGETS and targets ~= nil then
|
|
stdnse.debug1("adding new targets %s", table.concat(targets, ", "))
|
|
target.add(table.unpack(targets))
|
|
end
|
|
|
|
end
|
|
|
|
return stdnse.format_output(true, results)
|
|
end
|
|
|