Apache Zookeeper Server Detection

#TRUSTED 7b489016dc7eb8f9d4a24f645fc12e46116d8715df40bd148163e4cd7940b361051de41f835f4f72c796fde0109f38510cc3aaa4672ca9f6696641c51fbf528bf781017bf09308b7dac05cc9fbfcf4e9e7e4030034e4ab97c175b881448522b7ef04d507db8eada3d6df7f02c695ddc2255b9f43247d121ec24b7419264954c74519460fb0506a98b47509f6ca6e11ae690bfac88b2f8bd938b73a6e13668484f77cf8b79bb0aad17e0d0ec8dd7ff50b34b0cc6afbcde28dfff077cbfca2fff961fa6c11422f9ba94cadf2f66603386fd20c28728a0e094f20c78f52ae2e89685d48b7eae2068eb0df9780a70f4aa53dd9b921d568d64c83ffef1b8578c1db9b5ad39de8286d34936d71cd0593f96ac0bc2453c39e25477416f72c2d5b5a41b7a648616b17bc93186d85c69b8c85224f238c7c32e9d7d3a3711440292db27315161da0812af36104d30def2cb382a60aac45791e36a08911810106ac47abf7b7f940ff526ca1ea81c9893b83c1cb569892b1380b88a4e6cd207984cf474fb2cd4bcd01270d8e659a19ff89ceff41b4b36d57badb0f5e61cc1508e9d30bf262b654642ac2ffd5305dea9c77a205914dd922a8ed8520ac61e9f1a06f673e3601374001a8bcaf542a45464fb811b0fe35aed669d2fb61902a47dc0582628acf76bb94c0b476a07f8c3260da1c6ea592042fdc38064cbb27463bc59ff05c64e5c245
#TRUST-RSA-SHA256 94073a0f09138f105c5c0073b33aec702f2d1cf6c5fd36866daf24357b6a9c763f3b3206ba924b98158eb4cb7a8497b4bd183dba50912be641f6f3d249bb6bf51aeae012156b6dca09a6013a58f20c3a19415a4d99ed106b5e9ee970ff7b4ba62c75f94cecf8d0ce5118753c3bc8e3c5a43d25c44f21b971431c043784ab869042c8894f78e17afd09481879af88abd0777ad714afca0c7543d34a89b063b8996662decd8a026b97b1fc47afbeeb6e92be0ffe127a7e29430d24fe68da8a0368f770a83e14b052376c3666433c9337ff3a11251c536ecf0670ce0c3f659ab2a943afebe3bf1127e971a72ed5111ad184e418d3bb4fa2c2128d9866c36df656586862c503013acc9bd7a262f30cc0d888029e41e075977085c473b47716b4ad49841e18e1042c0e90e1803419ec0cd69c0bdaffa419e6cf741210b3f55bd002262e412f78e902499a5514421f5a8a0453e5f88ba1295886da499a9895313290f5ec17c3028e866b9be4f6f04e05182aa66146373bc01e34f8d210e3cc397410098b91dfa1c516413d02f6861e623de1c82eca922f94a58faa792980823d16bef08ef42f3c339fb2d62b095c0869554ef8c23c3a83f5682c3bd092ef5382cc3972a9982776223930b3cb6d57d192d2141d670ca2155a546850420b29130d961410d71766b996aa654ea1ffdc611d957ef7e3c75f28d5665340cffda7f6c7b61841
#
# (C) Tenable Network Security, Inc.
#

include("compat.inc");

if (description)
{
  script_id(110267);
  script_version("1.21");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/05/21");
  script_xref(name:"IAVT", value:"0001-T-0536");

  script_name(english:"Apache Zookeeper Server Detection");

  script_set_attribute(attribute:"synopsis", value:
"An Apache Zookeeper server is listening on the remote host.");
  script_set_attribute(attribute:"description", value:
"The remote host is running an Apache Zookeeper server.");
  script_set_attribute(attribute:"see_also", value:"https://zookeeper.apache.org/");
  script_set_attribute(attribute:"solution", value:
"n/a");
  script_set_attribute(attribute:"agent", value:"all");
  script_set_attribute(attribute:"risk_factor", value:"None");

  script_set_attribute(attribute:"plugin_publication_date", value:"2018/05/31");

  script_set_attribute(attribute:"plugin_type", value:"combined");
  script_set_attribute(attribute:"asset_inventory", value:"True");
  script_set_attribute(attribute:"asset_inventory_category", value:"software_enumeration");
  script_set_attribute(attribute:"cpe", value:"cpe:/a:apache:zookeeper");
  script_set_attribute(attribute:"thorough_tests", value:"true");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Service detection");

  script_copyright(english:"This script is Copyright (C) 2018-2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("find_service2.nasl", "process_on_port.nasl", "ssh_get_info.nasl");
  script_require_ports("Services/unknown", 2181);

  exit(0);
}

include('ssh_func.inc');
include('telnet_func.inc');
include('lists.inc');
include('install_func.inc');
include('debug.inc');
include('local_detection_nix.inc');

service_name = "Apache Zookeeper";
protocol = "zookeeper";

ports = make_list(2181);

if (thorough_tests && !get_kb_item("global_settings/disable_service_discovery"))
{
  additional_ports = get_kb_list("Services/unknown");
  if (!isnull(additional_ports))
    ports = make_list(ports, additional_ports);
}

ports = list_uniq(ports);
port = branch(ports);

if (!get_port_state(port))
  audit(AUDIT_PORT_CLOSED, port);

if (get_kb_item('debug_TESTING') == 1)
  response = 'Zookeeper version: 3.1.0,';
else
{
  socket = open_sock_tcp(port);
  if (!socket)
    audit(AUDIT_SOCK_FAIL, port);

  send(socket:socket, data:"stat");
  response = recv(socket:socket, length:2048);
  close(socket);
}
if (empty_or_null(response))
  audit(AUDIT_NOT_DETECT, service_name, port);

match = pregmatch(pattern:"Zookeeper version: ([0-9.]+)[-,]", string:response);
if (empty_or_null(match) || empty_or_null(match[1]))
  audit(AUDIT_NOT_DETECT, service_name, port);

dbg::log(msg:'stat match: ' + obj_rep(match));

version = match[1];

register_service(port:port, ipproto:"tcp", proto:"zookeeper");
replace_kb_item(name:"zookeeper/" + port + "/version", value:version);

enable_ssh_wrappers();

uname = get_kb_item("Host/uname");
proto = get_kb_item("HostLevelChecks/proto");
cmdline = base64_decode(str:get_kb_item("Host/Listeners/tcp/"+port+"/cmdline"));

if (('Linux' >< uname || 'AIX' >< uname) && proto && cmdline)
{
  dbg::log(msg:'Going to try to open ssh connection on port: ' + port);
  if (proto == 'local')
  {
    info_t = INFO_LOCAL;
  }
  else if (proto == 'ssh')
  {
    sock_g = ssh_open_connection();
    if (sock_g) info_t = INFO_SSH;
  }
  if (info_t)
  {
    dbg::log(msg:'ssh connection opened on port: ' + port);
    dbg::log(msg:'cmdline: ' + cmdline);
    match = pregmatch(pattern:"(?<=-cp\x00)([^\x00]+)", string:cmdline);
    if(match && match[1])
    {
      class_paths = split(match[1], sep:':', keep:FALSE);
      dbg::log(msg:'class_paths: ' + obj_rep(class_paths));
      match = collib::filter(f:function ()
          {return _FCT_ANON_ARGS[0] =~ "/.*?zookeeper[^/]*\.jar$";}, class_paths);
      dbg::log(msg:'match after filter: ' + obj_rep(match));
      if (match && max_index(match) == 1)
      {
        jar_path = dirname(match[0]);
        dbg::log(msg:'jar_path: ' + obj_rep(jar_path));
        template = 'cd \'$1$\' && pwd';
        res = ldnix::run_cmd_template_wrapper(template:template, args:[jar_path]);
        dbg::log(msg:'res: ' + obj_rep(res));
        if (res)
          jar_path = res;
      }
    }
    conf_path = pregmatch(pattern:"([^\x00]+?zoo\.cfg)",string:cmdline);
    if (conf_path && conf_path[1])
    {
      dbg::log(msg:'conf_path: ' + obj_rep(conf_path));
      template = 'cat \'$1$\'';
      res = ldnix::run_cmd_template_wrapper(template:template, args:[conf_path[1]]);
    }
    dbg::log(msg:'res from conf_path: ' + obj_rep(res));
    if (res)
    {
      match = pregmatch(pattern:"(?m)^\s*?clientPort=([0-9]+)", string:res, icase:TRUE);
      if (match && match[1] && match[1] == port)
      {
        dbg::log(msg:'match of clientPort: ' + obj_rep(match));
        config = res;
      }
    }
  }

  if (sock_g)
    ssh_close_connection();
}

if (jar_path && config)
{
  register_install(
    vendor:"Apache",
    product:"Zookeeper",
    app_name:service_name,
    port:port,
    path:jar_path,
    version:version,
    extra_no_report:{'config': config},
    cpe: "cpe:/a:apache:zookeeper"
  );
  report_installs(app_name:service_name);
}
else
{
  info = '\n  Version : ' + version + '\n';
  security_report_v4(severity:SECURITY_NOTE, port:port, extra:info);
}