Enumerate IPv4 Interfaces via SSH

#TRUSTED 65a9024c6af899065779c54823d7bd2ff0e5981a64e93ac3263b5155ea62a73b200f5bcd82ddb8179f950df6395eacf59588ca9935c9b354120abf8fa59a1fdc502f9b11909218488dc4764e3d7ec49e2a3c418ecc17704dd99e52038b084d8ed226760e35f5388d3e2c86f7c7cfb052b9eabfba8140f17ef9ec6705b427ba6d909a770ae0270c2292d3e640d5e9f61e15d9efb065f976268399f733bd62928b277ba79bb8f0764a15ba3b5469c03c9712fdab132898050657f5301838bed53c4acbc55a96b6f99b6414006c8f5ef83ebd07fbc263bd14be8cfd3c41bed61dd92f8ffeb8a8ee3c56447f135b270dee52155d67c9b8d18fe012a09aa8dde7c8d96579e9c70f367f0613b757213d1f75922df5e423c03b4df5d516edba10fced3dbb0698fd0cb49c78fc700afa50be80d22f99093be2c2bd2e6b0a16ed5de6699072c5a9f31a4f3f79c7e3d6bd524f6c826aa7b42ce550a27a038ccbaf860047ea09089019b3e28cb744aebc44b3e2bfc7a6a844b18853b8c57eae80cd69a8759691814a3fab1663a6e24163eafb5628767fd248daac7a6dc81aca5e7d84cdaaeca0b93c41f51877db02383c8bc614fa524360c201304df870243891707e3d088d550727bbc7cf6f812d3673f2561ddd1a61e1d0d43c5d17eaa9a8d004e1aa8944cb24a787a52fc955c0a7d1401b3d80951a7a5fc5cbd8dabbee733b6340d542cf
#TRUST-RSA-SHA256 853984a5663b5ea7f0d3f1619300ca5efca7c8928a424c798c843cfecccf70625c0a782f18c29eaeb305d2515b60ea7d5fd16b4d76f6348738d802473d335574d1f72eee2bfc04bf75ebf1c09e0b6cb6d6eb16268852fadf4733435b6c5be987cbf60722c588351e4919284769b112945c2257dee5dc8245a845779a14f829c81b4c0272fb70d45b3c05d386b0831ee18ab3e9edbf6ffdb6b1d9df1f81c91ca1d996ac4a084714e09ee8776e18a46f19fd1023cdadfbd02a31f29b02557d2ec804ac4e134d67f5cb20631db50250ea869860d2b51ae8b276f7233707bcb53048db12911ad8512dae52957a243c48e2d2f504e5b3b37c703471096857e469488273a20e855fe4c185bc141f9aa9e478a68d6c3cfac5c9e9d36ef6e8a91fa3c138b532b98504991a3bafa36acc5af793f504d41b73098ba071b938a69bd240c7d8a43e9eadc15d353d16ba1519dea785fa2f9ffed8a0d6bb5651bdc521c61330096553aaabb92aa2ec2eb93182bf6197a3654d4006d8c31464b521bc27d2c0bd94b9d632f5fb344e5296bea2023f83e2c2f3df1d684e1656719abee5771b1b22aee755490f5e24cd6e874713a3e149be17e3548fd8573b37fa631204c5f2af5c283e5650315cdf10a4b6af2a7a15e4e4aa8e81578b2461d3a3fe6d778be92ac6a6623e05e6955334b5851e0847c486ac658d00694caf15ef7c856f7cb1732f00dc
##
# (C) Tenable, Inc.
##

include("compat.inc");

if (description)
{
 script_id(25203);
 script_version("1.21");
 script_set_attribute(attribute:"plugin_modification_date", value:"2025/09/24");

 script_name(english:"Enumerate IPv4 Interfaces via SSH");

 script_set_attribute(attribute:"synopsis", value:
"Nessus was able to enumerate the IPv4 interfaces on the remote host.");
 script_set_attribute(attribute:"description", value:
"Nessus was able to enumerate the network interfaces configured with
IPv4 addresses by connecting to the remote host via SSH using the
supplied credentials.");
 script_set_attribute(attribute:"solution", value:
"Disable any unused IPv4 interfaces.");
 script_set_attribute(attribute:"risk_factor", value:"None");

 script_set_attribute(attribute:"plugin_publication_date", value:"2007/05/11");

 script_set_attribute(attribute:"plugin_type", value:"local");
 script_set_attribute(attribute:"agent", value:"unix");
 script_end_attributes();

 script_category(ACT_GATHER_INFO);
 script_family(english:"General");

 script_copyright(english:"This script is Copyright (C) 2007-2025 Tenable Network Security, Inc.");

 script_dependencies("ssh_get_info.nasl");

 exit(0);
}

include("cisco_host_ip_enum.inc");
include("juniper_host_ip_enum.inc");
include("palo_alto_host_ip_enum.inc");
include('fortigate_host_ip_enum.inc');
include('arista_eos_func.inc');

var uname = get_kb_item("Host/uname");
var ifconfig = get_kb_item("Host/ifconfig");
var is_cisco = !isnull(get_kb_list("Host/Cisco/*"));
var is_juniper = !isnull(get_kb_list("Host/Juniper/*"));
var is_palo_alto = !isnull(get_kb_list("Host/Palo_Alto/*"));
var is_fortigate = !isnull(get_kb_list('Host/Fortigate/*'));
var is_arista_eos_ios = !isnull(get_kb_list('Host/Arista/EOS/*'));
var is_extreme_networks_slx_os = !isnull(get_kb_item('Host/ExtremeNetworks/SLXOS'));

if (empty_or_null(uname) && empty_or_null(ifconfig) && !is_cisco && !is_juniper && !is_palo_alto && !is_fortigate && !is_arista_eos_ios && !is_extreme_networks_slx_os)
  exit(1, 'No Host/uname, Host/ifconfig, or supported vendor KB items (Cisco, Juniper, Palo Alto, Fortigate, Arista EOS, Extreme Networks SLXOS) found on the host.');

var hostname = NULL;
var ifaces, dev, netstat, line, lines, inet, match, addr, aliased, ip_array, ip_addr, dev_ip_count, netstat_pat, ifconfig_regex, iface_name;
ifaces = NULL;
dev    = NULL;
dev_ip_count = make_array();

# HP-UX
if ('HP-UX' >< uname)
{
  netstat = get_kb_item_or_exit("Host/netstat-ian");
  lines = split(netstat, keep:FALSE);
  netstat_pat = "^([^\s]+)\s+[0-9]+\s+[^\s]+\s+([0-9.]+)(?:\s+[0-9]+)+";
  foreach line (lines)
  {
    match = pregmatch(pattern:netstat_pat, string:line);
    if (isnull(match)) continue; # next

    iface_name = match[1];
    ip_addr = match[2];

    if (isnull(dev_ip_count[iface_name])) dev_ip_count[iface_name] = 1;
    else dev_ip_count[iface_name]++;

    ifaces += strcat(' - ',  ip_addr, ' (on interface ', iface_name, ')\n');

    set_kb_item(name:"Host/iface/id", value:iface_name);
    set_kb_item(name:"Host/iface/"+iface_name+"/ipv4", value:ip_addr);
    set_kb_item(name:"Host/ifconfig/IP4Addrs", value: ip_addr);
  }

  # look for virtual interfaces
  # e.g. eth0:1
  foreach iface_name (keys(dev_ip_count))
  {
    match = pregmatch(pattern:"((\S+):\S+)", string:iface_name);
    if (!isnull(match))
    {
      # eth0:1 (virtual)
      set_kb_item(name:"Host/iface/"+match[1]+"/virtual", value:TRUE);

      # eth0 (aliased)
      set_kb_item(name:"Host/iface/"+match[2]+"/aliased", value:TRUE);
    }
  }
}
else if(is_cisco)
{
  ip_array = cisco_host_ip_enum::get_ip_array();
  for(iface_name in ip_array)
  {
    foreach(ip_addr in ip_array[iface_name])
    {
      if (isnull(dev_ip_count[iface_name])) dev_ip_count[iface_name] = 1;
      else dev_ip_count[iface_name]++;

      ifaces += strcat(' - ', ip_addr, ' (on interface ', iface_name, ')\n');

      set_kb_item(name:"Host/iface/id", value:iface_name);
      set_kb_item(name:"Host/iface/"+iface_name+"/ipv4", value:ip_addr);
      set_kb_item(name:"Host/ifconfig/IP4Addrs", value: ip_addr);
    }
  }
}
else if(is_juniper)
{
  ip_array = juniper_host_ip_enum::get_ip_array();

  for(iface_name in ip_array)
  {
    foreach(ip_addr in ip_array[iface_name])
    {
      if (isnull(dev_ip_count[iface_name])) dev_ip_count[iface_name] = 1;
      else dev_ip_count[iface_name]++;

      ifaces += strcat(' - ', ip_addr, ' (on interface ', iface_name, ')\n');

      set_kb_item(name:"Host/iface/id", value:iface_name);
      set_kb_item(name:"Host/iface/"+iface_name+"/ipv4", value:ip_addr);
      set_kb_item(name:"Host/ifconfig/IP4Addrs", value: ip_addr);
    }
  }
}
else if(is_palo_alto)
{
  ip_array = palo_alto_host_ip_enum::get_ip_array();

  for(iface_name in ip_array)
  {
    ip_addr = ip_array[iface_name];
    ifaces += strcat(' - ', ip_addr, ' (on interface ', iface_name, ')\n');

    set_kb_item(name:"Host/iface/id", value:iface_name);
    set_kb_item(name:"Host/iface/"+iface_name+"/ipv4", value:ip_addr);
    set_kb_item(name:"Host/ifconfig/IP4Addrs", value: ip_addr);
  }
}
else if (is_fortigate)
{
  ip_array = fortigate_host_ip_enum::get_ip_array(ip_ver:'ipv4');
  for (iface_name in ip_array)
  {
    foreach (ip_addr in ip_array[iface_name])
    {
      if (isnull(dev_ip_count[iface_name])) dev_ip_count[iface_name] = 1;
      else dev_ip_count[iface_name]++;

      ifaces += strcat(' - ', ip_addr, ' (on interface ', iface_name, ')\n');

      set_kb_item(name:'Host/iface/id', value:iface_name);
      set_kb_item(name:strcat('Host/iface/', iface_name, '/ipv4'), value:ip_addr);
      set_kb_item(name:'Host/ifconfig/IP4Addrs', value: ip_addr);
    }
  }
}
else if (is_arista_eos_ios)
{
  ip_array = arista_host_ip_enum::get_ip_array(ip_ver:'ipv4');
  for (iface_name in ip_array)
  {
    foreach (ip_addr in ip_array[iface_name])
    {
      if (isnull(dev_ip_count[iface_name]))
        dev_ip_count[iface_name] = 1;
      else
        dev_ip_count[iface_name]++;

      ifaces += strcat(' - ', ip_addr, ' (on interface ', iface_name, ')\n');

      set_kb_item(name:'Host/iface/id', value:iface_name);
      set_kb_item(name:strcat('Host/iface/', iface_name, '/ipv4'), value:ip_addr);
      set_kb_item(name:'Host/ifconfig/IP4Addrs', value: ip_addr);
    }
  }
}
else if (is_extreme_networks_slx_os)
{
  var addresses = deserialize(get_kb_item('/tmp/Host/ExtremeNetworks/SLXOS/ipv4_addresses'));

  if (typeof_ex(addresses) != 'array')
    addresses = {};
  
  var management_ip = get_kb_item('Host/ExtremeNetworks/SLXOS/management_ip');
  if (!empty_or_null(management_ip))
    addresses['Management'] = management_ip;
  
  for (var iface in addresses)
  {
    ifaces += strcat(' - ', addresses[iface], ' (on interface ', iface, ')\n');

    set_kb_item(name:'Host/iface/id', value:iface);
    set_kb_item(name:'Host/iface/'+iface+'/ipv4', value:addresses[iface]);
    set_kb_item(name:'Host/ifconfig/IP4Addrs', value: addresses[iface]);
  }
}
else
{
  ifconfig = get_kb_item_or_exit("Host/ifconfig");
  inet = egrep(pattern:"inet[^6]", string:ifconfig);
  if ( isnull(inet) ) exit(0, 'No IPv4 addresses found.');

  lines = split(ifconfig, keep:FALSE);

  ifconfig_regex = "^(\d+: )?([a-z\-]+[\-a-z0-9]+(:[0-9]+)?)[: ].*";
  line = NULL;
  foreach line ( lines )
  {
    if ( line =~ ifconfig_regex )
    {
      dev = ereg_replace(pattern:ifconfig_regex, replace:"\2", string:line);
      if ( dev == line )
        dev = NULL;
      # ip count
      if (!isnull(dev)) dev_ip_count[dev] = 0;
    }

    if  ( "inet" >< line && "inet6" >!< line )
    {
      addr = ereg_replace(pattern:".*inet( addr:)? ?([0-9.]+).*", string:line, replace:"\2");
      if ( !empty_or_null(addr) && addr != line )
      {
        ifaces += ' - ' + addr;
        set_kb_item(name:"Host/ifconfig/IP4Addrs", value: addr);

        if ( !empty_or_null(dev) )
        {
          ifaces += ' (on interface ' + dev + ')';
          dev_ip_count[dev]++;
          # for reporting
          set_kb_item(name:"Host/iface/"+dev+"/ipv4", value: addr);
          set_kb_item(name:"Host/iface/id", value:dev);
        }

        ifaces += '\n';
      }
    }
  }
}


# if a device has more than one ip, it is aliased
foreach dev (keys(dev_ip_count))
{
  aliased = dev_ip_count[dev] > 1;
  if (aliased)
    set_kb_item(name:"Host/iface/"+dev+"/aliased", value:TRUE);
}

if ( strlen(ifaces) )
{
 security_note(port:0, extra:'\nThe following IPv4 addresses are set on the remote host :\n\n' + ifaces);
}
else exit(1, 'Unable to parse any IPv4 addresses.');