IBM DB2 Administration Server Detection

##
# (C) Tenable, Inc.
##

include("compat.inc");

if (description)
{
  script_id(22016);
  script_version("1.31");
  script_set_attribute(attribute:"plugin_modification_date", value:"2024/07/04");

  script_name(english:"IBM DB2 Administration Server Detection");

  script_set_attribute(attribute:"synopsis", value:
"An IBM DB2 Administration Server is listening on the remote host.");
  script_set_attribute(attribute:"description", value:
"The remote host is running an IBM DB2 Administration Server. DB2 is an
enterprise relational database management system, and the
Administration Server is used by DB2 to administer databases across a
network.");
  script_set_attribute(attribute:"see_also", value:"https://www.ibm.com/analytics/us/en/db2/");
  script_set_attribute(attribute:"solution", value:
"n/a");
  script_set_attribute(attribute:"risk_factor", value:"None");

  script_set_attribute(attribute:"plugin_publication_date", value:"2006/07/10");

  script_set_attribute(attribute:"plugin_type", value:"remote");
  script_set_attribute(attribute:"asset_inventory", value:"True");
  script_set_attribute(attribute:"asset_inventory_category", value:"software_enumeration");
  script_set_attribute(attribute:"cpe", value:"cpe:/a:ibm:db2");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Databases");

  script_copyright(english:"This script is Copyright (C) 2006-2024 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("find_service1.nasl");
  script_require_ports("Services/unknown", 523);

  exit(0);
}

include("byte_func.inc");
include('http.inc');
include('webapp_func.inc');

if (thorough_tests && ! get_kb_item("global_settings/disable_service_discovery") ) {
  var port = get_unknown_svc(523);
  if ( ! port ) exit(0);
}
else port = 523;
if (!get_tcp_port_state(port)) exit(0);

var extra = make_array();
var cpe = 'cpe:/a:ibm:db2';
var version = UNKNOWN_VER;
var app = 'DB2 Server';
var product ='DB2';

var platforms;
# Platform info.
platforms[4]  = "AIX";
platforms[5]  = "Windows, x86";
platforms[18] = "Linux, x86, 2.6 kernel";
platforms[20] = "AIX";
platforms[23] = "Windows, x86_64";
platforms[30] = "Linux, x86_64, 2.6 kernel";

global_var platform, soc;

function db2_send_recv(blob1, blob2)
{
  local_var iter, len, res1, res2;

  if (isnull(blob1) || isnull(blob2)) return NULL;

  # nb: the last 4 bytes of blob1 usually but not always represent
  #     the length of blob2.
  send(socket:soc, data:blob1);
  send(socket:soc, data:blob2);

  res1 = recv(socket:soc, length:41, min:41);
  # If it looks like DB2...
  if (
    strlen(res1) == 41 &&
    stridx(res1, raw_string(0, 0, 0, 0, "DB2DAS")) == 0
  )
  {
    if (isnull(platform)) platform = getbyte(blob:res1, pos:0x19);

    # nb: there's got to be a better way to figure out the byte order...
    if (substr_at_offset(str:res1, blob:'9z', offset:0x16))
      set_byte_order(BYTE_ORDER_LITTLE_ENDIAN);
    else if (substr_at_offset(str:res1, blob:'z9', offset:0x16))
      set_byte_order(BYTE_ORDER_BIG_ENDIAN);
    else
      return NULL;  # unexpected response

    len = getdword(blob:res1, pos:0x25);
    res2 = recv(socket:soc, length:len, min:len);
    if (strlen(res2) == len) return res2;
  }
  return NULL;
}

# Try to get some interesting information.
#
# - level (ie, version).
soc = open_sock_tcp(port);
if (soc)
{
  platform = NULL;
  var level = NULL;
  var req_1, req_2, res;

  req_1 = raw_string(
    0x00, 0x00, 0x00, 0x00, 0x44, 0x42, 0x32, 0x44, 
    0x41, 0x53, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 
    0x01, 0x04, 0x00, 0x00, 0x00, 0x10, 0x39, 0x7a, 
    0x00, 0x01, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 
    0x00, 0x00, 0x00, 0x00, 0x01, 0x0c, 0x00, 0x00, 
    0x00
  );
  req_2 = raw_string(
    0x00, 0x00, 0x00, 0x0c, 0x00, 0x00, 0x00, 
    0x0c, 0x00, 0x00, 0x00, 0x04
  );
  res = db2_send_recv(blob1:req_1, blob2:req_2);
  close(soc);
  if (isnull(res)) exit(0);

  if (strlen(res) > 0xeb)
  {
    set_byte_order(BYTE_ORDER_BIG_ENDIAN);
    level = getword(blob:res, pos:0xb5) + "." +
            getword(blob:res, pos:0xc5) + "." + 
            getword(blob:res, pos:0xd5) + "." +
            getword(blob:res, pos:0xe5);
  }
}
# - server's Database Access Profile.
soc = open_sock_tcp(port);
if (soc)
{
  req_1 = raw_string(
    0x00, 0x00, 0x00, 0x00, 0x44, 0x42, 0x32, 0x44, 
    0x41, 0x53, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 
    0x01, 0x04, 0x00, 0x00, 0x00, 0x10, 0x39, 0x7a, 
    0x00, 0x05, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 
    0x00, 0x00, 0x00, 0x00, 0x02, 0x0d, 0x00, 0x00, 
    0x00
  );
  req_2 = raw_string(
    0x00, 0x00, 0x00, 0x0d, 0x00, 0x00, 0x00, 0x0c, 
    0x00, 0x00, 0x00, 0x4a, 0x00
  );
  res = db2_send_recv(blob1:req_1, blob2:req_2);

  if (strlen(res))
  {
    req_1 = raw_string(
      0x00, 0x00, 0x00, 0x00, 0x44, 0x42, 0x32, 0x44, 
      0x41, 0x53, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 
      0x01, 0x04, 0x00, 0x00, 0x00, 0x10, 0x39, 0x7a, 
      0x00, 0x05, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 
      0x00, 0x00, 0x00, 0x00, 0x05, 0x2c, 0x00, 0x00, 
      0x00
    );
    req_2 = raw_string(
      0x00, 0x00, 0x00, 0x2c, 0x00, 0x00, 0x00, 0x0c, 
      0x00, 0x00, 0x00, 0x08, 0x5e, 0x00, 0x4d, 0x66, 
      0xca, 0x5c, 0xea, 0x0a, 0xb7, 0x92, 0xcc, 0x5b, 
      0x15, 0x32, 0x19, 0x0d, 0x75, 0x4c, 0xbc, 0xf8, 
      0xdf, 0x02, 0x95, 0x8a, 0xe2, 0xb1, 0xed, 0xe1, 
      0x24, 0x6d, 0xfe, 0xee 
    );
    res = db2_send_recv(blob1:req_1, blob2:req_2);
  }

  if (strlen(res))
  {
    req_1 = raw_string(
      0x00, 0x00, 0x00, 0x00, 0x44, 0x42, 0x32, 0x44, 
      0x41, 0x53, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 
      0x01, 0x04, 0x00, 0x00, 0x00, 0x10, 0x39, 0x7a, 
      0x00, 0x05, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 
      0x00, 0x00, 0x00, 0x00, 0x03, 0x34, 0x00, 0x00, 
      0x00
    );
    req_2 = raw_string(
      0x00, 0x00, 0x00, 0x0c, 0x00, 0x00, 0x00, 0x0c, 
      0x00, 0x00, 0x00, 0x08, 0x00, 0x00, 0x00, 0x0c, 
      0x00, 0x00, 0x00, 0x0c, 0x00, 0x00, 0x00, 0x08, 
      0x00, 0x00, 0x00, 0x0c, 0x00, 0x00, 0x00, 0x0c, 
      0x00, 0x00, 0x00, 0x08, 0x00, 0x00, 0x00, 0x10, 
      0x00, 0x00, 0x00, 0x0c, 0x00, 0x00, 0x00, 0x4c, 
      0x00, 0x00, 0x04, 0xb8
    );
    res = db2_send_recv(blob1:req_1, blob2:req_2);
  }

  if (strlen(res))
  {
    req_1 = raw_string(
      0x00, 0x00, 0x00, 0x00, 0x44, 0x42, 0x32, 0x44, 
      0x41, 0x53, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 
      0x01, 0x04, 0x00, 0x00, 0x00, 0x10, 0x39, 0x7a, 
      0x00, 0x05, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 
      0x00, 0x00, 0x00, 0x00, 0x0a, 0x5d, 0x00, 0x00, 
      0x00
    );
    req_2 = raw_string(
      0x00, 0x00, 0x00, 0x0d, 0x00, 0x00, 0x00, 0x0c, 
      0x00, 0x00, 0x00, 0x4a, 0x01, 0x00, 0x00, 0x00, 
      0x10, 0x00, 0x00, 0x00, 0x0c, 0x00, 0x00, 0x00, 
      0x4c, 0xff, 0xff, 0xff, 0xff, 0x00, 0x00, 0x00, 
      0x20, 0x00, 0x00, 0x00, 0x0c, 0x00, 0x00, 0x00, 
      0x04, 0x00, 0x00, 0x04, 0xb8, 0x64, 0x62, 0x32, 
      0x64, 0x61, 0x73, 0x4b, 0x6e, 0x6f, 0x77, 0x6e, 
      0x44, 0x73, 0x63, 0x76, 0x00, 0x00, 0x00, 0x00, 
      0x20, 0x00, 0x00, 0x00, 0x0c, 0x00, 0x00, 0x00, 
      0x04, 0x00, 0x00, 0x04, 0xb8, 0x64, 0x62, 0x32, 
      0x4b, 0x6e, 0x6f, 0x77, 0x6e, 0x44, 0x73, 0x63, 
      0x76, 0x53, 0x72, 0x76, 0x00
    );
    res = db2_send_recv(blob1:req_1, blob2:req_2);
  }

  if (strlen(res))
  {
    req_1 = raw_string(
      0x00, 0x00, 0x00, 0x00, 0x44, 0x42, 0x32, 0x44, 
      0x41, 0x53, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 
      0x01, 0x04, 0x00, 0x00, 0x00, 0x10, 0x39, 0x7a, 
      0x00, 0x05, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 
      0x00, 0x00, 0x00, 0x00, 0x06, 0xca, 0x00, 0x00, 
      0x00
    );
    var myip = split(compat::this_host(), sep:".", keep:FALSE);
    req_2 = raw_string(
      0x00, 0x00, 0x00, 0x0d, 0x00, 0x00, 0x00, 0x0c, 
      0x00, 0x00, 0x00, 0x4a, 0x01, 0x00, 0x00, 0x00, 
      0x20, 0x00, 0x00, 0x00, 0x0c, 0x00, 0x00, 0x00, 
      0x08, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x03, 
      0xa8, 0x00, 0x00, 0x00, 0x00, 0x44, 0xae, 0xb3, 
      0xd5, 
            int(myip[0]), int(myip[1]), int(myip[2]), int(myip[3]),
                                    0x00, 0x00, 0x00, 
      0x10, 0x00, 0x00, 0x00, 0x0c, 0x00, 0x00, 0x00, 
      0x4c, 0xff, 0xff, 0xff, 0xff, 0x00, 0x00, 0x00, 
      0x10, 0x00, 0x00, 0x00, 0x0c, 0x00, 0x00, 0x00, 
      0x4c, 0xff, 0xff, 0xff, 0xff, 0x00, 0x00, 0x00, 
      0x20, 0x00, 0x00, 0x00, 0x0c, 0x00, 0x00, 0x00, 
      0x04, 0x00, 0x00, 0x04, 0xb8, 0x64, 0x62, 0x32, 
      0x4b, 0x6e, 0x6f, 0x77, 0x6e, 0x44, 0x73, 0x63, 
      0x76, 0x53, 0x72, 0x76, 0x00, 0x00, 0x00, 0x00, 
      0x20, 0x00, 0x00, 0x00, 0x0c, 0x00, 0x00, 0x00, 
      0x04, 0x00, 0x00, 0x04, 0xb8, 0x64, 0x62, 0x32, 
      0x64, 0x61, 0x73, 0x4b, 0x6e, 0x6f, 0x77, 0x6e, 
      0x44, 0x73, 0x63, 0x76, 0x00, 0x00, 0x00, 0x00, 
      0x0c, 0x00, 0x00, 0x00, 0x0c, 0x00, 0x00, 0x00, 
      0x04, 0x00, 0x00, 0x00, 0x10, 0x00, 0x00, 0x00, 
      0x0c, 0x00, 0x00, 0x00, 0x4c, 0xff, 0xff, 0xff, 
      0xff, 0x00, 0x00, 0x00, 0x10, 0x00, 0x00, 0x00, 
      0x0c, 0x00, 0x00, 0x00, 0x4c, 0xff, 0xff, 0xff, 
      0xff, 0x00, 0x00, 0x00, 0x11, 0x00, 0x00, 0x00, 
      0x0c, 0x00, 0x00, 0x00, 0x04, 0x00, 0x00, 0x04, 
      0xb8, 0x00, 0x00, 0x00, 0x00, 0x00, 0x44, 0x42, 
      0x32, 0x44, 0x41, 0x53, 0x20, 0x20, 0x20, 0x20, 
      0x20, 0x20, 0x01, 0x04, 0x00, 0x00, 0x00, 0x10, 
      0x39, 0x7a, 0x00, 0x05, 0x00, 0x00, 0x00, 0x00, 
      0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x07, 0xa4, 
      0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x20, 0x00, 
      0x00, 0x00, 0x0c, 0x00, 0x00, 0x00, 0x04, 0x00, 
      0x00, 0x04, 0xb8, 0x64, 0x62, 0x32, 0x64, 0x61, 
      0x73, 0x4b, 0x6e, 0x6f, 0x77, 0x6e, 0x44, 0x73, 
      0x63, 0x76, 0x00, 0x00, 0x00, 0x00, 0x20, 0x00, 
      0x00, 0x00, 0x0c, 0x00, 0x00, 0x00, 0x04, 0x00, 
      0x00, 0x04, 0xb8, 0x64, 0x62, 0x32, 0x4b, 0x6e, 
      0x6f, 0x77, 0x6e, 0x44, 0x73, 0x63, 0x76, 0x53, 
      0x72, 0x76, 0x00, 0x00, 0x00, 0x00, 0x10, 0x00, 
      0x00, 0x00, 0x0c, 0x00, 0x00, 0x00, 0x4c, 0x00, 
      0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x10, 0x00, 
      0x00, 0x00, 0x0c, 0x00, 0x00, 0x00, 0x4c, 0x00, 
      0x00, 0x00, 0x01, 0x00, 0x00, 0x00, 0x10, 0x00, 
      0x00, 0x00, 0x0c, 0x00, 0x00, 0x00, 0x4c, 0x00, 
      0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x0c, 0x00, 
      0x00, 0x00, 0x0c, 0x00, 0x00, 0x00, 0x08, 0x00, 
      0x00, 0x00, 0x10, 0x00, 0x00, 0x00, 0x0c, 0x00, 
      0x00, 0x00, 0x4c, 0x00, 0x00, 0x00, 0x01, 0x00, 
      0x00, 0x00, 0x18, 0x00, 0x00, 0x00, 0x0c, 0x00, 
      0x00, 0x00, 0x08, 0x00, 0x00, 0x00, 0x0c, 0x00, 
      0x00, 0x00, 0x0c, 0x00, 0x00, 0x00, 0x18 
    );
    res = db2_send_recv(blob1:req_1, blob2:req_2);
  }
  close(soc);
}

# If we got some info from the remote host...
if (
  !isnull(level) ||
  (
    strlen(res) >= 0xE7 &&
    "DB2 Server Database Access Profile" >< res
  )
)
{
  var info = "";

  # Differentiate between DB2 and DB2 Connect.
  var service_name = "db2das";
  var section, match, main_server_type, server_type;
  if ("[adminnode" >< res)
  {
    var server_types = make_array();
    section = NULL;
    foreach var line (split(res, keep:FALSE))
    {
      match = pregmatch(pattern:"^[ \t]*\[(.+)\][ \t]*$", string:line);
      if (!isnull(match)) section = match[1];

      if (!isnull(section) && "ServerType=" >< line)
      {
        match = pregmatch(pattern:"^[ \t]*ServerType[ \t]*=[ \t]*(.+)$", string:line);
        if (!isnull(match)) server_types[section] = match[1];
      }
    }

    main_server_type = server_types["File_Description"];
    if (main_server_type)
    {
      foreach section (keys(server_types))
      {
        if ("File_Description" >!< section)
        {
          server_type = server_types[section];
          if (server_type != main_server_type)
          {
            service_name = "db2das_connect";
            break;
          }
        }
      }
    }
  }

  # Register and report the service.
  register_service(port:port, ipproto:"tcp", proto:service_name);

  extra['Service Name'] = service_name;

  if (!isnull(platform)) 
  {
    replace_kb_item(name:"DB2/"+port+"/Platform", value:platform);
    if (isnull(platforms[platform]))
      info += "Platform : " + platform + '\n' +
              '           To help us better identify this platform, please send\n' +
              '           the platform number above along with details about the\n' +
              '           platform, including the operating system version and\n' +
              '           CPU architecture to [email protected].\n';
    else 
    {
      var platform_name = platforms[platform];
      replace_kb_item(name:"DB2/"+port+"/Platform_Name", value:platform_name);
      extra['Platform'] = platform_name;
    }
  }
  if (!isnull(level)) 
  {
    replace_kb_item(name:"DB2/"+port+"/plugin_22016_Level", value:level);
    var p86653_level = get_kb_item("DB2/"+port+"/Level");
    if (!empty_or_null(p86653_level))
    {
      replace_kb_item(name:"DB2/"+port+"/plugin_86653_Level", value:p86653_level);

      # keep Level with higher version determination
      if (ver_compare(ver:level, fix:p86653_level, strict:FALSE) == 1)
        replace_kb_item(name:"DB2/"+port+"/Level", value:level);
    }
    else
      replace_kb_item(name:"DB2/"+port+"/Level", value:level);

    version = level;
  }

  var profile = strstr(res, "DB2 Server Database Access Profile");
  if (profile) profile = profile - "DB2 Server Database Access Profile";
  if (profile)
  {
    info +=
      'Here is the Database Access Profile that Nessus was able to read\n' +
      'from the remote host :\n' +
      '\n' +
      str_replace(find:'\r\n', replace:'\n', string:profile);

      extra['Profile Info'] = info;
  }

  if (service_name == "db2das_connect")
  {
    app = "DB2 Connect Server";
    product = "DB2 Connect";
  }

  register_install(
    vendor    : 'IBM',
    product   : product,
    app_name  : app,
    path      : '/',
    port      : port,
    version   : version,
    webapp    : TRUE,
    extra     : extra,
    cpe       : cpe
  );

  report_installs(app_name:app, port:port);
}
else
{
  audit(AUDIT_WEB_APP_NOT_INST, app, port);
}