ID SYMANTEC_GHOST_LOCATE_DETECT.NASL Type nessus Reporter This script is Copyright (C) 2007-2019 and is owned by Tenable, Inc. or an Affiliate thereof. Modified 2019-11-02T00:00:00
Description
The remote host is running the
#
# (C) Tenable Network Security, Inc.
#
include("compat.inc");
if (description)
{
script_id(25490);
script_version ("1.11");
script_cvs_date("Date: 2019/11/22");
script_name(english:"Symantec Ghost Solution Locate Server Detection");
script_set_attribute(attribute:"synopsis", value:
"An OS deployment server is running on the remote port." );
script_set_attribute(attribute:"description", value:
"The remote host is running the 'locate' service of Symantec Ghost
solution, an OS deployment and management solution.
This service is used by clients to discover management servers or to
test if the main server is alive." );
script_set_attribute(attribute:"risk_factor", value:"None" );
script_set_attribute(attribute:"solution", value:"n/a" );
script_set_attribute(attribute:"plugin_publication_date", value: "2007/06/13");
script_set_attribute(attribute:"plugin_type", value:"remote");
script_set_attribute(attribute:"cpe",value:"cpe:/a:symantec:ghost_solutions_suite");
script_set_attribute(attribute:"asset_inventory", value:"True");
script_end_attributes();
script_summary(english:"Determine if a remote host is running Symantec Ghost Solution Status Service");
script_category(ACT_GATHER_INFO);
script_family(english:"Service detection");
script_copyright(english:"This script is Copyright (C) 2007-2019 and is owned by Tenable, Inc. or an Affiliate thereof.");
script_require_ports(1345);
exit(0);
}
include ("byte_func.inc");
global_var __stream, __stream_pos, __stream_length, __stream_idx, _data_type;
STRING_CODE = 0x33;
STRUCT_CODE = 0x22;
LIST_CODE = 0x21;
BLOB_CODE = 0x20;
UINT_CODE = 0x0B;
SINT_CODE = 0x09;
INT_CODE = 0x08;
VOID_CODE = 0x00;
END_CODE = 0x02;
_data_type = NULL;
_data_type["Name"] = LIST_CODE;
_data_type["Uuid"] = BLOB_CODE;
_data_type["Sequence"] = INT_CODE;
_data_type["Idle"] = VOID_CODE;
_data_type["Platform"] = STRING_CODE;
_data_type["Version"] = INT_CODE;
_data_type["Build"] = INT_CODE;
_data_type["IPADDRESS"] = INT_CODE;
_data_type["SUBNETMASK"] = INT_CODE;
_data_type["ProductVersion"] = STRING_CODE;
function mklist()
{
local_var ret;
local_var i, l;
l = max_index (_FCT_ANON_ARGS);
if (NASL_LEVEL >= 3000)
ret = fill_list(length:l, value:0);
else
ret = NULL;
for (i=0 ; i<l ; i++)
ret[i] = _FCT_ANON_ARGS[i];
return ret;
}
function mkipaddr()
{
local_var ip;
local_var str;
ip = _FCT_ANON_ARGS[0];
str = split(ip, sep:'.', keep:FALSE);
return
(int(str[0]) << 24) +
(int(str[1]) << 16) +
(int(str[2]) << 8) +
int(str[3]) ;
}
function stream_init(data)
{
__stream = data;
__stream_pos = 0;
__stream_length = strlen(data);
__stream_idx = 1;
}
function stream_getByte()
{
if (__stream_pos >= __stream_length)
exit(0);
return ord(__stream[__stream_pos++]);
}
function stream_putByte()
{
local_var l;
l = _FCT_ANON_ARGS[0];
__stream += mkbyte(l);
}
function stream_putData()
{
local_var d;
d = _FCT_ANON_ARGS[0];
__stream += d;
}
function putUTF8Number()
{
local_var l;
l = _FCT_ANON_ARGS[0];
if (l <= 0x7F)
stream_putByte(l);
else
{
if (l > 0x7FF)
{
if (l > 0xFFFF)
{
if (l > 0x1FFFFF)
{
if (l > 0x3FFFFFF)
{
stream_putByte( ((l >>> 30) & 0x01) + 0xFC );
stream_putByte( ((l >>> 24) & 0x3F) + 0x80 );
}
else
stream_putByte( ((l >>> 24) & 0x03) + 0xF8 );
stream_putByte( ((l >>> 18) & 0x3F) + 0x80 );
}
else
stream_putByte( ((l >>> 18) & 0x07) + 0xF0 );
stream_putByte( ((l >>> 12) & 0x3F) + 0x80 );
}
else
stream_putByte( ((l >>> 12) & 0x0F) + 0xE0 );
stream_putByte( ((l >>> 6) & 0x3F) + 0x80 );
}
else
stream_putByte( ((l >>> 6) & 0x1F) + 0xC0 );
stream_putByte( (l & 0x3F) + 0x80 );
}
}
function getUTF8Number()
{
local_var num, b;
b = stream_getByte();
if (b & 0x80)
{
num = stream_getByte() & 0x3F;
if (b & 0x20)
{
num = (num << 6) + (stream_getByte() & 0x3F);
if (b & 0x10)
{
num = (num << 6) + (stream_getByte() & 0x3F);
if (b >= f5 && b <= 0xf7)
{
if (b == 0xf6)
num = ((b & 0x01) << 18) + num;
}
else if (b >= 0xf8 && b <= 0xfd)
{
num = (num << 6) + (stream_getByte() & 0x3F);
if (b >= 0xfc && b <= 0xfd)
{
num = (num << 6) + (stream_getByte() & 0x3F);
num = num + ((b & 0x03) << 30);
}
else
num = ((b & 0x03) << 24) + num;
}
else
num = ((b & 0x07) << 18) + num;
}
else
num = ((b & 0x0F) << 12) + num;
}
else
num = ((b & 0x1F) << 6) + num;
}
else
num = b & 0x7F;
return num;
}
function findDataType(data)
{
return _data_type[data];
}
function putNumber()
{
local_var l;
l = _FCT_ANON_ARGS[0];
putUTF8Number(l);
}
function putSInt(i)
{
if (i < 0)
{
putNumber(UINT_CODE);
i -= 0x80000000;
}
else
putNumber(SINT_CODE);
putUTF8Number(i);
}
function putIndex()
{
putNumber(0x24);
putNumber(0x02);
putNumber(0x02);
putSInt(i:__stream_idx++);
}
function putIndexEnd(idx)
{
putNumber(0x0C);
putNumber(idx);
}
function putSBlob(b)
{
putNumber(BLOB_CODE);
putNumber(strlen(b));
stream_putData(b);
}
function putSString(s)
{
local_var idx;
idx = __stream_idx;
putIndex();
putNumber(STRING_CODE);
putNumber(strlen(s));
stream_putData(s);
putIndexEnd(idx:idx);
}
function putSList(l)
{
local_var type, elem;
putNumber(LIST_CODE);
putNumber(0);
putNumber(0);
foreach elem (l)
{
type = elem[0];
if (type == STRING_CODE)
putSString(s:elem[1]);
else if (type == INT_CODE)
putSInt(i:elem[1]);
else if (type == BLOB_CODE)
putSBlob(b:elem[1]);
else if (type == LIST_CODE)
putSList(l:elem[1]);
else if (type == STRUCT_CODE)
putSStruct(s:elem[1]);
}
putNumber(END_CODE);
}
function putSStruct(s)
{
local_var type, elem;
putNumber(STRUCT_CODE);
putNumber(0x01);
putNumber(0x00);
foreach elem (s)
{
type = findDataType(data:elem[0]);
if (type == VOID_CODE)
{
putNumber(0x0C);
putNumber(0x01);
}
putSString(s:elem[0]);
if (type == STRING_CODE)
putSString(s:elem[1]);
else if (type == INT_CODE)
putSInt(i:elem[1]);
else if (type == BLOB_CODE)
putSBlob(b:elem[1]);
else if (type == LIST_CODE)
putSList(l:elem[1]);
else if (type == STRUCT_CODE)
putSStruct(s:elem[1]);
}
putNumber(END_CODE);
}
### Main Code ###
port = 1345;
if (! get_udp_port_state(port)) exit(0, "UDP port "+port+" is not open.");
soc = open_sock_udp(port);
if (!soc)
exit(0);
stream_init(data:"");
l = NULL;
l[0] = mklist(BLOB_CODE, "AAAAAA");
s = NULL;
s[0] = mklist("Name", l);
s[1] = mklist("Uuid", "BBBBBBBBBBBBBBBB");
s[2] = mklist("Sequence", 185212261);
s[3] = mklist("Idle");
s[4] = mklist("Platform", "Win2k");
s[5] = mklist("Version", 720896);
s[6] = mklist("Build", 67068);
s[7] = mklist("IPADDRESS", mkipaddr(compat::this_host()));
s[8] = mklist("SUBNETMASK", 0xFFFFFF00);
s[9] = mklist("ProductVersion", "110.01.153");
putSString(s:"Status");
putSStruct(s:s);
set_byte_order(BYTE_ORDER_LITTLE_ENDIAN);
send(socket:soc, data:__stream);
buf = recv(socket:soc, length:4096);
if ("Locate_Error" >< buf)
security_note(port:port, protocol:"udp");
{"id": "SYMANTEC_GHOST_LOCATE_DETECT.NASL", "bulletinFamily": "scanner", "title": "Symantec Ghost Solution Locate Server Detection", "description": "The remote host is running the ", "published": "2007-06-13T00:00:00", "modified": "2019-11-02T00:00:00", "cvss": {"score": 0.0, "vector": "NONE"}, "href": "https://www.tenable.com/plugins/nessus/25490", "reporter": "This script is Copyright (C) 2007-2019 and is owned by Tenable, Inc. or an Affiliate thereof.", "references": [], "cvelist": [], "type": "nessus", "lastseen": "2019-11-23T13:00:03", "history": [{"bulletin": {"bulletinFamily": "scanner", "cpe": ["cpe:/a:symantec:ghost_solutions_suite"], "cvelist": [], "cvss": {"score": 0.0, "vector": "NONE"}, "description": "The remote host is running the ", "edition": 6, "enchantments": {"dependencies": {"modified": "2019-11-03T12:30:14", "references": []}, "score": {"modified": "2019-11-03T12:30:14", "value": -0.1, "vector": "NONE"}}, "hash": "ab3d3a80b60ea48c4381b324373c815e6a41ea0ce5798801f0e921ff34fbb2ac", "hashmap": [{"hash": "1f6b4eab13fd8bdbbfb3e0c06013378e", "key": "title"}, {"hash": "79e8cc590dcc6937f4da81a3a8e1170b", "key": "description"}, {"hash": "de8ba5c8209bf4b17c226dd8f0f3816b", "key": "sourceData"}, {"hash": "abcf9266f425f12dda38f529cd4a94bc", "key": "modified"}, {"hash": "d41d8cd98f00b204e9800998ecf8427e", "key": "references"}, {"hash": "b6bb6e87c49273664b08b5039cd37f22", "key": "reporter"}, {"hash": "538e733a21a0302e23efa5ac5962f921", "key": "href"}, {"hash": "aae58c9f5058bd96822d4da9d9e50b26", "key": "published"}, {"hash": "a3d3c73c01505d0383b007174b5bb5ac", "key": "naslFamily"}, {"hash": "d41d8cd98f00b204e9800998ecf8427e", "key": "cvelist"}, {"hash": "8cd4821cb504d25572038ed182587d85", "key": "cvss"}, {"hash": "bbdaea376f500d25f6b0c1050311dd07", "key": "bulletinFamily"}, {"hash": "a84f937b2c010f86efe7ce7c36fbb566", "key": "cpe"}, {"hash": "5e0bd03bec244039678f2b955a2595aa", "key": "type"}, {"hash": "7908b8997139cf07cc59428fc2a89703", "key": "pluginID"}], "history": [], "href": "https://www.tenable.com/plugins/nessus/25490", "id": "SYMANTEC_GHOST_LOCATE_DETECT.NASL", "lastseen": "2019-11-03T12:30:14", "modified": "2019-11-02T00:00:00", "naslFamily": "Service detection", "objectVersion": "1.3", "pluginID": "25490", "published": "2007-06-13T00:00:00", "references": [], "reporter": "This script is Copyright (C) 2007-2019 Tenable Network Security, Inc.", "sourceData": "#\n# (C) Tenable Network Security, Inc.\n#\n\n\ninclude(\"compat.inc\");\n\nif (description)\n{\n script_id(25490);\n script_version (\"1.10\");\n script_cvs_date(\"Date: 2019/03/06 18:38:55\");\n script_name(english:\"Symantec Ghost Solution Locate Server Detection\");\n script_set_attribute(attribute:\"synopsis\", value:\n\"An OS deployment server is running on the remote port.\" );\n script_set_attribute(attribute:\"description\", value:\n\"The remote host is running the 'locate' service of Symantec Ghost\nsolution, an OS deployment and management solution. \n\nThis service is used by clients to discover management servers or to\ntest if the main server is alive.\" );\n script_set_attribute(attribute:\"risk_factor\", value:\"None\" );\n script_set_attribute(attribute:\"solution\", value:\"n/a\" );\n script_set_attribute(attribute:\"plugin_publication_date\", value: \"2007/06/13\");\nscript_set_attribute(attribute:\"plugin_type\", value:\"remote\");\nscript_set_attribute(attribute:\"cpe\",value:\"cpe:/a:symantec:ghost_solutions_suite\");\nscript_end_attributes();\n\n script_summary(english:\"Determine if a remote host is running Symantec Ghost Solution Status Service\");\n script_category(ACT_GATHER_INFO);\n script_family(english:\"Service detection\");\n script_copyright(english:\"This script is Copyright (C) 2007-2019 Tenable Network Security, Inc.\");\n script_require_ports(1345);\n exit(0);\n}\n\n\ninclude (\"byte_func.inc\");\n\n\nglobal_var __stream, __stream_pos, __stream_length, __stream_idx, _data_type;\n\n\nSTRING_CODE = 0x33;\nSTRUCT_CODE = 0x22;\nLIST_CODE = 0x21;\nBLOB_CODE = 0x20;\nUINT_CODE = 0x0B;\nSINT_CODE = 0x09;\nINT_CODE = 0x08;\nVOID_CODE = 0x00;\nEND_CODE = 0x02;\n\n\n_data_type = NULL;\n_data_type[\"Name\"] = LIST_CODE;\n_data_type[\"Uuid\"] = BLOB_CODE;\n_data_type[\"Sequence\"] = INT_CODE;\n_data_type[\"Idle\"] = VOID_CODE;\n_data_type[\"Platform\"] = STRING_CODE;\n_data_type[\"Version\"] = INT_CODE;\n_data_type[\"Build\"] = INT_CODE;\n_data_type[\"IPADDRESS\"] = INT_CODE;\n_data_type[\"SUBNETMASK\"] = INT_CODE;\n_data_type[\"ProductVersion\"] = STRING_CODE;\n\n\n\nfunction mklist()\n{\n local_var ret;\n local_var i, l;\n\n l = max_index (_FCT_ANON_ARGS);\n\n if (NASL_LEVEL >= 3000)\n ret = fill_list(length:l, value:0);\n else\n ret = NULL;\n\n for (i=0 ; i<l ; i++)\n ret[i] = _FCT_ANON_ARGS[i];\n\n return ret;\n}\n\n\nfunction mkipaddr()\n{\n local_var ip;\n local_var str;\n\n ip = _FCT_ANON_ARGS[0];\n str = split(ip, sep:'.', keep:FALSE);\n return \n\t(int(str[0]) << 24) +\n\t(int(str[1]) << 16) +\n\t(int(str[2]) << 8) +\n\tint(str[3]) ; \n}\n\n\nfunction stream_init(data)\n{\n __stream = data;\n __stream_pos = 0;\n __stream_length = strlen(data);\n __stream_idx = 1;\n}\n\n\nfunction stream_getByte()\n{\n if (__stream_pos >= __stream_length)\n exit(0);\n\n return ord(__stream[__stream_pos++]);\n}\n\n\nfunction stream_putByte()\n{\n local_var l;\n l = _FCT_ANON_ARGS[0];\n\n __stream += mkbyte(l);\n}\n\n\nfunction stream_putData()\n{\n local_var d;\n d = _FCT_ANON_ARGS[0];\n\n __stream += d;\n}\n\n\nfunction putUTF8Number()\n{\n local_var l;\n l = _FCT_ANON_ARGS[0];\n\n if (l <= 0x7F)\n stream_putByte(l);\n else\n {\n if (l > 0x7FF)\n {\n if (l > 0xFFFF)\n {\n if (l > 0x1FFFFF)\n {\n if (l > 0x3FFFFFF)\n {\n stream_putByte( ((l >>> 30) & 0x01) + 0xFC );\n stream_putByte( ((l >>> 24) & 0x3F) + 0x80 );\n }\n else\n stream_putByte( ((l >>> 24) & 0x03) + 0xF8 );\n\n stream_putByte( ((l >>> 18) & 0x3F) + 0x80 );\n }\n else\n stream_putByte( ((l >>> 18) & 0x07) + 0xF0 );\n\n stream_putByte( ((l >>> 12) & 0x3F) + 0x80 );\n }\n else\n stream_putByte( ((l >>> 12) & 0x0F) + 0xE0 );\n\n stream_putByte( ((l >>> 6) & 0x3F) + 0x80 );\n }\n else\n stream_putByte( ((l >>> 6) & 0x1F) + 0xC0 );\n\n stream_putByte( (l & 0x3F) + 0x80 );\n }\n}\n\n\nfunction getUTF8Number()\n{\n local_var num, b;\n\n b = stream_getByte();\n\n if (b & 0x80)\n {\n num = stream_getByte() & 0x3F;\n\n if (b & 0x20)\n {\n num = (num << 6) + (stream_getByte() & 0x3F);\n\n if (b & 0x10)\n {\n num = (num << 6) + (stream_getByte() & 0x3F);\n\n if (b >= f5 && b <= 0xf7)\n {\n if (b == 0xf6)\n num = ((b & 0x01) << 18) + num; \n }\n else if (b >= 0xf8 && b <= 0xfd)\n {\n num = (num << 6) + (stream_getByte() & 0x3F);\n\n if (b >= 0xfc && b <= 0xfd)\n {\n num = (num << 6) + (stream_getByte() & 0x3F);\n\n num = num + ((b & 0x03) << 30);\n }\n else\n num = ((b & 0x03) << 24) + num;\n }\n else\n num = ((b & 0x07) << 18) + num;\n }\n else\n num = ((b & 0x0F) << 12) + num;\n }\n else\n num = ((b & 0x1F) << 6) + num;\n }\n else\n num = b & 0x7F;\n\n return num;\n}\n\n\nfunction findDataType(data)\n{\n return _data_type[data];\n}\n\n\nfunction putNumber()\n{\n local_var l;\n l = _FCT_ANON_ARGS[0];\n\n putUTF8Number(l);\n}\n\n\nfunction putSInt(i)\n{\n if (i < 0)\n {\n putNumber(UINT_CODE);\n i -= 0x80000000;\n }\n else\n putNumber(SINT_CODE);\n\n putUTF8Number(i);\n}\n\n\nfunction putIndex()\n{\n putNumber(0x24);\n putNumber(0x02);\n putNumber(0x02);\n putSInt(i:__stream_idx++);\n}\n\n\nfunction putIndexEnd(idx)\n{\n putNumber(0x0C);\n putNumber(idx);\n}\n\n\nfunction putSBlob(b)\n{\n putNumber(BLOB_CODE);\n putNumber(strlen(b));\n stream_putData(b);\n}\n\n\nfunction putSString(s)\n{\n local_var idx;\n\n idx = __stream_idx;\n\n putIndex();\n\n putNumber(STRING_CODE);\n putNumber(strlen(s));\n stream_putData(s);\n\n putIndexEnd(idx:idx);\n}\n\n\nfunction putSList(l)\n{\n local_var type, elem;\n\n putNumber(LIST_CODE);\n putNumber(0);\n putNumber(0);\n\n foreach elem (l)\n {\n type = elem[0];\n\n if (type == STRING_CODE)\n putSString(s:elem[1]);\n else if (type == INT_CODE)\n putSInt(i:elem[1]);\n else if (type == BLOB_CODE)\n putSBlob(b:elem[1]);\n else if (type == LIST_CODE)\n putSList(l:elem[1]);\n else if (type == STRUCT_CODE)\n putSStruct(s:elem[1]);\n }\n\n putNumber(END_CODE);\n}\n\n\nfunction putSStruct(s)\n{\n local_var type, elem;\n\n putNumber(STRUCT_CODE);\n putNumber(0x01);\n putNumber(0x00);\n\n foreach elem (s)\n {\n type = findDataType(data:elem[0]);\n\n if (type == VOID_CODE)\n {\n putNumber(0x0C);\n putNumber(0x01);\n }\n\n putSString(s:elem[0]);\n\n if (type == STRING_CODE)\n putSString(s:elem[1]);\n else if (type == INT_CODE)\n putSInt(i:elem[1]);\n else if (type == BLOB_CODE)\n putSBlob(b:elem[1]);\n else if (type == LIST_CODE)\n putSList(l:elem[1]);\n else if (type == STRUCT_CODE)\n putSStruct(s:elem[1]);\n }\n\n putNumber(END_CODE);\n}\n\n\n\n### Main Code ###\n\n\nport = 1345;\n\nif (! get_udp_port_state(port)) exit(0, \"UDP port \"+port+\" is not open.\");\n\nsoc = open_sock_udp(port);\nif (!soc)\n exit(0);\n\n\nstream_init(data:\"\");\n\nl = NULL;\nl[0] = mklist(BLOB_CODE, \"AAAAAA\");\n\ns = NULL;\ns[0] = mklist(\"Name\", l);\ns[1] = mklist(\"Uuid\", \"BBBBBBBBBBBBBBBB\");\ns[2] = mklist(\"Sequence\", 185212261);\ns[3] = mklist(\"Idle\");\ns[4] = mklist(\"Platform\", \"Win2k\");\ns[5] = mklist(\"Version\", 720896);\ns[6] = mklist(\"Build\", 67068);\ns[7] = mklist(\"IPADDRESS\", mkipaddr(compat::this_host()));\ns[8] = mklist(\"SUBNETMASK\", 0xFFFFFF00);\ns[9] = mklist(\"ProductVersion\", \"110.01.153\");\n\n\nputSString(s:\"Status\");\nputSStruct(s:s);\n\nset_byte_order(BYTE_ORDER_LITTLE_ENDIAN);\n\n\nsend(socket:soc, data:__stream);\nbuf = recv(socket:soc, length:4096);\n\nif (\"Locate_Error\" >< buf)\n security_note(port:port, protocol:\"udp\");\n", "title": "Symantec Ghost Solution Locate Server Detection", "type": "nessus", "viewCount": 0}, "differentElements": ["reporter", "sourceData"], "edition": 6, "lastseen": "2019-11-03T12:30:14"}, {"bulletin": {"bulletinFamily": "scanner", "cpe": ["cpe:/a:symantec:ghost_solutions_suite"], "cvelist": [], "cvss": {"score": 0.0, "vector": "NONE"}, "description": "The remote host is running the 'locate' service of Symantec Ghost solution, an OS deployment and management solution. \n\nThis service is used by clients to discover management servers or to test if the main server is alive.", "edition": 2, "enchantments": {"score": {"value": 5.0, "vector": "NONE"}}, "hash": "a8dae2c1b49035858d541ef75e3c141e0c14a0c6b3e645c19e3186c64c377da1", "hashmap": [{"hash": "1f6b4eab13fd8bdbbfb3e0c06013378e", "key": "title"}, {"hash": "6f50e94f1944b6dc38c3d6ea53a20b38", "key": "href"}, {"hash": "d41d8cd98f00b204e9800998ecf8427e", "key": "references"}, {"hash": "9cf00d658b687f030ebe173a0528c567", "key": "reporter"}, {"hash": "61c0d2a8b0ce283baff1b49e96cffd10", "key": "description"}, {"hash": "aae58c9f5058bd96822d4da9d9e50b26", "key": "published"}, {"hash": "a3d3c73c01505d0383b007174b5bb5ac", "key": "naslFamily"}, {"hash": "d41d8cd98f00b204e9800998ecf8427e", "key": "cvelist"}, {"hash": "8cd4821cb504d25572038ed182587d85", "key": "cvss"}, {"hash": "bbdaea376f500d25f6b0c1050311dd07", "key": "bulletinFamily"}, {"hash": "e26d9d4b647c69ca79ae7c8790a66112", "key": "sourceData"}, {"hash": "a84f937b2c010f86efe7ce7c36fbb566", "key": "cpe"}, {"hash": "5e0bd03bec244039678f2b955a2595aa", "key": "type"}, {"hash": "3ff4afbf9eedf98937c2e5c5cf13456f", "key": "modified"}, {"hash": "7908b8997139cf07cc59428fc2a89703", "key": "pluginID"}], "history": [], "href": "https://www.tenable.com/plugins/index.php?view=single&id=25490", "id": "SYMANTEC_GHOST_LOCATE_DETECT.NASL", "lastseen": "2017-10-29T13:42:05", "modified": "2012-08-01T00:00:00", "naslFamily": "Service detection", "objectVersion": "1.3", "pluginID": "25490", "published": "2007-06-13T00:00:00", "references": [], "reporter": "Tenable", "sourceData": "#\n# (C) Tenable Network Security, Inc.\n#\n\n\ninclude(\"compat.inc\");\n\nif (description)\n{\n script_id(25490);\n script_version (\"$Revision: 1.9 $\");\n script_cvs_date(\"$Date: 2012/08/01 21:10:57 $\");\n script_name(english:\"Symantec Ghost Solution Locate Server Detection\");\n script_set_attribute(attribute:\"synopsis\", value:\n\"An OS deployment server is running on the remote port.\" );\n script_set_attribute(attribute:\"description\", value:\n\"The remote host is running the 'locate' service of Symantec Ghost\nsolution, an OS deployment and management solution. \n\nThis service is used by clients to discover management servers or to\ntest if the main server is alive.\" );\n script_set_attribute(attribute:\"risk_factor\", value:\"None\" );\n script_set_attribute(attribute:\"solution\", value:\"n/a\" );\n script_set_attribute(attribute:\"plugin_publication_date\", value: \"2007/06/13\");\nscript_set_attribute(attribute:\"plugin_type\", value:\"remote\");\nscript_set_attribute(attribute:\"cpe\",value:\"cpe:/a:symantec:ghost_solutions_suite\");\nscript_end_attributes();\n\n script_summary(english:\"Determine if a remote host is running Symantec Ghost Solution Status Service\");\n script_category(ACT_GATHER_INFO);\n script_family(english:\"Service detection\");\n script_copyright(english:\"This script is Copyright (C) 2007-2012 Tenable Network Security, Inc.\");\n script_require_ports(1345);\n exit(0);\n}\n\n\ninclude (\"byte_func.inc\");\n\n\nglobal_var __stream, __stream_pos, __stream_length, __stream_idx, _data_type;\n\n\nSTRING_CODE = 0x33;\nSTRUCT_CODE = 0x22;\nLIST_CODE = 0x21;\nBLOB_CODE = 0x20;\nUINT_CODE = 0x0B;\nSINT_CODE = 0x09;\nINT_CODE = 0x08;\nVOID_CODE = 0x00;\nEND_CODE = 0x02;\n\n\n_data_type = NULL;\n_data_type[\"Name\"] = LIST_CODE;\n_data_type[\"Uuid\"] = BLOB_CODE;\n_data_type[\"Sequence\"] = INT_CODE;\n_data_type[\"Idle\"] = VOID_CODE;\n_data_type[\"Platform\"] = STRING_CODE;\n_data_type[\"Version\"] = INT_CODE;\n_data_type[\"Build\"] = INT_CODE;\n_data_type[\"IPADDRESS\"] = INT_CODE;\n_data_type[\"SUBNETMASK\"] = INT_CODE;\n_data_type[\"ProductVersion\"] = STRING_CODE;\n\n\n\nfunction mklist()\n{\n local_var ret;\n local_var i, l;\n\n l = max_index (_FCT_ANON_ARGS);\n\n if (NASL_LEVEL >= 3000)\n ret = fill_list(length:l, value:0);\n else\n ret = NULL;\n\n for (i=0 ; i<l ; i++)\n ret[i] = _FCT_ANON_ARGS[i];\n\n return ret;\n}\n\n\nfunction mkipaddr()\n{\n local_var ip;\n local_var str;\n\n ip = _FCT_ANON_ARGS[0];\n str = split(ip, sep:'.', keep:FALSE);\n return \n\t(int(str[0]) << 24) +\n\t(int(str[1]) << 16) +\n\t(int(str[2]) << 8) +\n\tint(str[3]) ; \n}\n\n\nfunction stream_init(data)\n{\n __stream = data;\n __stream_pos = 0;\n __stream_length = strlen(data);\n __stream_idx = 1;\n}\n\n\nfunction stream_getByte()\n{\n if (__stream_pos >= __stream_length)\n exit(0);\n\n return ord(__stream[__stream_pos++]);\n}\n\n\nfunction stream_putByte()\n{\n local_var l;\n l = _FCT_ANON_ARGS[0];\n\n __stream += mkbyte(l);\n}\n\n\nfunction stream_putData()\n{\n local_var d;\n d = _FCT_ANON_ARGS[0];\n\n __stream += d;\n}\n\n\nfunction putUTF8Number()\n{\n local_var l;\n l = _FCT_ANON_ARGS[0];\n\n if (l <= 0x7F)\n stream_putByte(l);\n else\n {\n if (l > 0x7FF)\n {\n if (l > 0xFFFF)\n {\n if (l > 0x1FFFFF)\n {\n if (l > 0x3FFFFFF)\n {\n stream_putByte( ((l >>> 30) & 0x01) + 0xFC );\n stream_putByte( ((l >>> 24) & 0x3F) + 0x80 );\n }\n else\n stream_putByte( ((l >>> 24) & 0x03) + 0xF8 );\n\n stream_putByte( ((l >>> 18) & 0x3F) + 0x80 );\n }\n else\n stream_putByte( ((l >>> 18) & 0x07) + 0xF0 );\n\n stream_putByte( ((l >>> 12) & 0x3F) + 0x80 );\n }\n else\n stream_putByte( ((l >>> 12) & 0x0F) + 0xE0 );\n\n stream_putByte( ((l >>> 6) & 0x3F) + 0x80 );\n }\n else\n stream_putByte( ((l >>> 6) & 0x1F) + 0xC0 );\n\n stream_putByte( (l & 0x3F) + 0x80 );\n }\n}\n\n\nfunction getUTF8Number()\n{\n local_var num, b;\n\n b = stream_getByte();\n\n if (b & 0x80)\n {\n num = stream_getByte() & 0x3F;\n\n if (b & 0x20)\n {\n num = (num << 6) + (stream_getByte() & 0x3F);\n\n if (b & 0x10)\n {\n num = (num << 6) + (stream_getByte() & 0x3F);\n\n if (b >= f5 && b <= 0xf7)\n {\n if (b == 0xf6)\n num = ((b & 0x01) << 18) + num; \n }\n else if (b >= 0xf8 && b <= 0xfd)\n {\n num = (num << 6) + (stream_getByte() & 0x3F);\n\n if (b >= 0xfc && b <= 0xfd)\n {\n num = (num << 6) + (stream_getByte() & 0x3F);\n\n num = num + ((b & 0x03) << 30);\n }\n else\n num = ((b & 0x03) << 24) + num;\n }\n else\n num = ((b & 0x07) << 18) + num;\n }\n else\n num = ((b & 0x0F) << 12) + num;\n }\n else\n num = ((b & 0x1F) << 6) + num;\n }\n else\n num = b & 0x7F;\n\n return num;\n}\n\n\nfunction findDataType(data)\n{\n return _data_type[data];\n}\n\n\nfunction putNumber()\n{\n local_var l;\n l = _FCT_ANON_ARGS[0];\n\n putUTF8Number(l);\n}\n\n\nfunction putSInt(i)\n{\n if (i < 0)\n {\n putNumber(UINT_CODE);\n i -= 0x80000000;\n }\n else\n putNumber(SINT_CODE);\n\n putUTF8Number(i);\n}\n\n\nfunction putIndex()\n{\n putNumber(0x24);\n putNumber(0x02);\n putNumber(0x02);\n putSInt(i:__stream_idx++);\n}\n\n\nfunction putIndexEnd(idx)\n{\n putNumber(0x0C);\n putNumber(idx);\n}\n\n\nfunction putSBlob(b)\n{\n putNumber(BLOB_CODE);\n putNumber(strlen(b));\n stream_putData(b);\n}\n\n\nfunction putSString(s)\n{\n local_var idx;\n\n idx = __stream_idx;\n\n putIndex();\n\n putNumber(STRING_CODE);\n putNumber(strlen(s));\n stream_putData(s);\n\n putIndexEnd(idx:idx);\n}\n\n\nfunction putSList(l)\n{\n local_var type, elem;\n\n putNumber(LIST_CODE);\n putNumber(0);\n putNumber(0);\n\n foreach elem (l)\n {\n type = elem[0];\n\n if (type == STRING_CODE)\n putSString(s:elem[1]);\n else if (type == INT_CODE)\n putSInt(i:elem[1]);\n else if (type == BLOB_CODE)\n putSBlob(b:elem[1]);\n else if (type == LIST_CODE)\n putSList(l:elem[1]);\n else if (type == STRUCT_CODE)\n putSStruct(s:elem[1]);\n }\n\n putNumber(END_CODE);\n}\n\n\nfunction putSStruct(s)\n{\n local_var type, elem;\n\n putNumber(STRUCT_CODE);\n putNumber(0x01);\n putNumber(0x00);\n\n foreach elem (s)\n {\n type = findDataType(data:elem[0]);\n\n if (type == VOID_CODE)\n {\n putNumber(0x0C);\n putNumber(0x01);\n }\n\n putSString(s:elem[0]);\n\n if (type == STRING_CODE)\n putSString(s:elem[1]);\n else if (type == INT_CODE)\n putSInt(i:elem[1]);\n else if (type == BLOB_CODE)\n putSBlob(b:elem[1]);\n else if (type == LIST_CODE)\n putSList(l:elem[1]);\n else if (type == STRUCT_CODE)\n putSStruct(s:elem[1]);\n }\n\n putNumber(END_CODE);\n}\n\n\n\n### Main Code ###\n\n\nport = 1345;\n\nif (! get_udp_port_state(port)) exit(0, \"UDP port \"+port+\" is not open.\");\n\nsoc = open_sock_udp(port);\nif (!soc)\n exit(0);\n\n\nstream_init(data:\"\");\n\nl = NULL;\nl[0] = mklist(BLOB_CODE, \"AAAAAA\");\n\ns = NULL;\ns[0] = mklist(\"Name\", l);\ns[1] = mklist(\"Uuid\", \"BBBBBBBBBBBBBBBB\");\ns[2] = mklist(\"Sequence\", 185212261);\ns[3] = mklist(\"Idle\");\ns[4] = mklist(\"Platform\", \"Win2k\");\ns[5] = mklist(\"Version\", 720896);\ns[6] = mklist(\"Build\", 67068);\ns[7] = mklist(\"IPADDRESS\", mkipaddr(this_host()));\ns[8] = mklist(\"SUBNETMASK\", 0xFFFFFF00);\ns[9] = mklist(\"ProductVersion\", \"110.01.153\");\n\n\nputSString(s:\"Status\");\nputSStruct(s:s);\n\nset_byte_order(BYTE_ORDER_LITTLE_ENDIAN);\n\n\nsend(socket:soc, data:__stream);\nbuf = recv(socket:soc, length:4096);\n\nif (\"Locate_Error\" >< buf)\n security_note(port:port, protocol:\"udp\");\n", "title": "Symantec Ghost Solution Locate Server Detection", "type": "nessus", "viewCount": 0}, "differentElements": ["description"], "edition": 2, "lastseen": "2017-10-29T13:42:05"}, {"bulletin": {"bulletinFamily": "scanner", "cpe": ["cpe:/a:symantec:ghost_solutions_suite"], "cvelist": [], "cvss": {"score": 0.0, "vector": "NONE"}, "description": "The remote host is running the 'locate' service of Symantec Ghost\nsolution, an OS deployment and management solution. \n\nThis service is used by clients to discover management servers or to\ntest if the main server is alive.", "edition": 3, "enchantments": {"dependencies": {"modified": "2019-01-16T20:07:21", "references": []}, "score": {"value": 5.0, "vector": "NONE"}}, "hash": "82a46c9f2554bfcac235a244c692a74652885b96fba5b7becc4e80a3bfb29cda", "hashmap": [{"hash": "1f6b4eab13fd8bdbbfb3e0c06013378e", "key": "title"}, {"hash": "6f50e94f1944b6dc38c3d6ea53a20b38", "key": "href"}, {"hash": "d41d8cd98f00b204e9800998ecf8427e", "key": "references"}, {"hash": "9cf00d658b687f030ebe173a0528c567", "key": "reporter"}, {"hash": "e46ced52107c12d75bc609ad7d16f0d8", "key": "description"}, {"hash": "aae58c9f5058bd96822d4da9d9e50b26", "key": "published"}, {"hash": "a3d3c73c01505d0383b007174b5bb5ac", "key": "naslFamily"}, {"hash": "d41d8cd98f00b204e9800998ecf8427e", "key": "cvelist"}, {"hash": "8cd4821cb504d25572038ed182587d85", "key": "cvss"}, {"hash": "bbdaea376f500d25f6b0c1050311dd07", "key": "bulletinFamily"}, {"hash": "e26d9d4b647c69ca79ae7c8790a66112", "key": "sourceData"}, {"hash": "a84f937b2c010f86efe7ce7c36fbb566", "key": "cpe"}, {"hash": "5e0bd03bec244039678f2b955a2595aa", "key": "type"}, {"hash": "3ff4afbf9eedf98937c2e5c5cf13456f", "key": "modified"}, {"hash": "7908b8997139cf07cc59428fc2a89703", "key": "pluginID"}], "history": [], "href": "https://www.tenable.com/plugins/index.php?view=single&id=25490", "id": "SYMANTEC_GHOST_LOCATE_DETECT.NASL", "lastseen": "2019-01-16T20:07:21", "modified": "2012-08-01T00:00:00", "naslFamily": "Service detection", "objectVersion": "1.3", "pluginID": "25490", "published": "2007-06-13T00:00:00", "references": [], "reporter": "Tenable", "sourceData": "#\n# (C) Tenable Network Security, Inc.\n#\n\n\ninclude(\"compat.inc\");\n\nif (description)\n{\n script_id(25490);\n script_version (\"$Revision: 1.9 $\");\n script_cvs_date(\"$Date: 2012/08/01 21:10:57 $\");\n script_name(english:\"Symantec Ghost Solution Locate Server Detection\");\n script_set_attribute(attribute:\"synopsis\", value:\n\"An OS deployment server is running on the remote port.\" );\n script_set_attribute(attribute:\"description\", value:\n\"The remote host is running the 'locate' service of Symantec Ghost\nsolution, an OS deployment and management solution. \n\nThis service is used by clients to discover management servers or to\ntest if the main server is alive.\" );\n script_set_attribute(attribute:\"risk_factor\", value:\"None\" );\n script_set_attribute(attribute:\"solution\", value:\"n/a\" );\n script_set_attribute(attribute:\"plugin_publication_date\", value: \"2007/06/13\");\nscript_set_attribute(attribute:\"plugin_type\", value:\"remote\");\nscript_set_attribute(attribute:\"cpe\",value:\"cpe:/a:symantec:ghost_solutions_suite\");\nscript_end_attributes();\n\n script_summary(english:\"Determine if a remote host is running Symantec Ghost Solution Status Service\");\n script_category(ACT_GATHER_INFO);\n script_family(english:\"Service detection\");\n script_copyright(english:\"This script is Copyright (C) 2007-2012 Tenable Network Security, Inc.\");\n script_require_ports(1345);\n exit(0);\n}\n\n\ninclude (\"byte_func.inc\");\n\n\nglobal_var __stream, __stream_pos, __stream_length, __stream_idx, _data_type;\n\n\nSTRING_CODE = 0x33;\nSTRUCT_CODE = 0x22;\nLIST_CODE = 0x21;\nBLOB_CODE = 0x20;\nUINT_CODE = 0x0B;\nSINT_CODE = 0x09;\nINT_CODE = 0x08;\nVOID_CODE = 0x00;\nEND_CODE = 0x02;\n\n\n_data_type = NULL;\n_data_type[\"Name\"] = LIST_CODE;\n_data_type[\"Uuid\"] = BLOB_CODE;\n_data_type[\"Sequence\"] = INT_CODE;\n_data_type[\"Idle\"] = VOID_CODE;\n_data_type[\"Platform\"] = STRING_CODE;\n_data_type[\"Version\"] = INT_CODE;\n_data_type[\"Build\"] = INT_CODE;\n_data_type[\"IPADDRESS\"] = INT_CODE;\n_data_type[\"SUBNETMASK\"] = INT_CODE;\n_data_type[\"ProductVersion\"] = STRING_CODE;\n\n\n\nfunction mklist()\n{\n local_var ret;\n local_var i, l;\n\n l = max_index (_FCT_ANON_ARGS);\n\n if (NASL_LEVEL >= 3000)\n ret = fill_list(length:l, value:0);\n else\n ret = NULL;\n\n for (i=0 ; i<l ; i++)\n ret[i] = _FCT_ANON_ARGS[i];\n\n return ret;\n}\n\n\nfunction mkipaddr()\n{\n local_var ip;\n local_var str;\n\n ip = _FCT_ANON_ARGS[0];\n str = split(ip, sep:'.', keep:FALSE);\n return \n\t(int(str[0]) << 24) +\n\t(int(str[1]) << 16) +\n\t(int(str[2]) << 8) +\n\tint(str[3]) ; \n}\n\n\nfunction stream_init(data)\n{\n __stream = data;\n __stream_pos = 0;\n __stream_length = strlen(data);\n __stream_idx = 1;\n}\n\n\nfunction stream_getByte()\n{\n if (__stream_pos >= __stream_length)\n exit(0);\n\n return ord(__stream[__stream_pos++]);\n}\n\n\nfunction stream_putByte()\n{\n local_var l;\n l = _FCT_ANON_ARGS[0];\n\n __stream += mkbyte(l);\n}\n\n\nfunction stream_putData()\n{\n local_var d;\n d = _FCT_ANON_ARGS[0];\n\n __stream += d;\n}\n\n\nfunction putUTF8Number()\n{\n local_var l;\n l = _FCT_ANON_ARGS[0];\n\n if (l <= 0x7F)\n stream_putByte(l);\n else\n {\n if (l > 0x7FF)\n {\n if (l > 0xFFFF)\n {\n if (l > 0x1FFFFF)\n {\n if (l > 0x3FFFFFF)\n {\n stream_putByte( ((l >>> 30) & 0x01) + 0xFC );\n stream_putByte( ((l >>> 24) & 0x3F) + 0x80 );\n }\n else\n stream_putByte( ((l >>> 24) & 0x03) + 0xF8 );\n\n stream_putByte( ((l >>> 18) & 0x3F) + 0x80 );\n }\n else\n stream_putByte( ((l >>> 18) & 0x07) + 0xF0 );\n\n stream_putByte( ((l >>> 12) & 0x3F) + 0x80 );\n }\n else\n stream_putByte( ((l >>> 12) & 0x0F) + 0xE0 );\n\n stream_putByte( ((l >>> 6) & 0x3F) + 0x80 );\n }\n else\n stream_putByte( ((l >>> 6) & 0x1F) + 0xC0 );\n\n stream_putByte( (l & 0x3F) + 0x80 );\n }\n}\n\n\nfunction getUTF8Number()\n{\n local_var num, b;\n\n b = stream_getByte();\n\n if (b & 0x80)\n {\n num = stream_getByte() & 0x3F;\n\n if (b & 0x20)\n {\n num = (num << 6) + (stream_getByte() & 0x3F);\n\n if (b & 0x10)\n {\n num = (num << 6) + (stream_getByte() & 0x3F);\n\n if (b >= f5 && b <= 0xf7)\n {\n if (b == 0xf6)\n num = ((b & 0x01) << 18) + num; \n }\n else if (b >= 0xf8 && b <= 0xfd)\n {\n num = (num << 6) + (stream_getByte() & 0x3F);\n\n if (b >= 0xfc && b <= 0xfd)\n {\n num = (num << 6) + (stream_getByte() & 0x3F);\n\n num = num + ((b & 0x03) << 30);\n }\n else\n num = ((b & 0x03) << 24) + num;\n }\n else\n num = ((b & 0x07) << 18) + num;\n }\n else\n num = ((b & 0x0F) << 12) + num;\n }\n else\n num = ((b & 0x1F) << 6) + num;\n }\n else\n num = b & 0x7F;\n\n return num;\n}\n\n\nfunction findDataType(data)\n{\n return _data_type[data];\n}\n\n\nfunction putNumber()\n{\n local_var l;\n l = _FCT_ANON_ARGS[0];\n\n putUTF8Number(l);\n}\n\n\nfunction putSInt(i)\n{\n if (i < 0)\n {\n putNumber(UINT_CODE);\n i -= 0x80000000;\n }\n else\n putNumber(SINT_CODE);\n\n putUTF8Number(i);\n}\n\n\nfunction putIndex()\n{\n putNumber(0x24);\n putNumber(0x02);\n putNumber(0x02);\n putSInt(i:__stream_idx++);\n}\n\n\nfunction putIndexEnd(idx)\n{\n putNumber(0x0C);\n putNumber(idx);\n}\n\n\nfunction putSBlob(b)\n{\n putNumber(BLOB_CODE);\n putNumber(strlen(b));\n stream_putData(b);\n}\n\n\nfunction putSString(s)\n{\n local_var idx;\n\n idx = __stream_idx;\n\n putIndex();\n\n putNumber(STRING_CODE);\n putNumber(strlen(s));\n stream_putData(s);\n\n putIndexEnd(idx:idx);\n}\n\n\nfunction putSList(l)\n{\n local_var type, elem;\n\n putNumber(LIST_CODE);\n putNumber(0);\n putNumber(0);\n\n foreach elem (l)\n {\n type = elem[0];\n\n if (type == STRING_CODE)\n putSString(s:elem[1]);\n else if (type == INT_CODE)\n putSInt(i:elem[1]);\n else if (type == BLOB_CODE)\n putSBlob(b:elem[1]);\n else if (type == LIST_CODE)\n putSList(l:elem[1]);\n else if (type == STRUCT_CODE)\n putSStruct(s:elem[1]);\n }\n\n putNumber(END_CODE);\n}\n\n\nfunction putSStruct(s)\n{\n local_var type, elem;\n\n putNumber(STRUCT_CODE);\n putNumber(0x01);\n putNumber(0x00);\n\n foreach elem (s)\n {\n type = findDataType(data:elem[0]);\n\n if (type == VOID_CODE)\n {\n putNumber(0x0C);\n putNumber(0x01);\n }\n\n putSString(s:elem[0]);\n\n if (type == STRING_CODE)\n putSString(s:elem[1]);\n else if (type == INT_CODE)\n putSInt(i:elem[1]);\n else if (type == BLOB_CODE)\n putSBlob(b:elem[1]);\n else if (type == LIST_CODE)\n putSList(l:elem[1]);\n else if (type == STRUCT_CODE)\n putSStruct(s:elem[1]);\n }\n\n putNumber(END_CODE);\n}\n\n\n\n### Main Code ###\n\n\nport = 1345;\n\nif (! get_udp_port_state(port)) exit(0, \"UDP port \"+port+\" is not open.\");\n\nsoc = open_sock_udp(port);\nif (!soc)\n exit(0);\n\n\nstream_init(data:\"\");\n\nl = NULL;\nl[0] = mklist(BLOB_CODE, \"AAAAAA\");\n\ns = NULL;\ns[0] = mklist(\"Name\", l);\ns[1] = mklist(\"Uuid\", \"BBBBBBBBBBBBBBBB\");\ns[2] = mklist(\"Sequence\", 185212261);\ns[3] = mklist(\"Idle\");\ns[4] = mklist(\"Platform\", \"Win2k\");\ns[5] = mklist(\"Version\", 720896);\ns[6] = mklist(\"Build\", 67068);\ns[7] = mklist(\"IPADDRESS\", mkipaddr(this_host()));\ns[8] = mklist(\"SUBNETMASK\", 0xFFFFFF00);\ns[9] = mklist(\"ProductVersion\", \"110.01.153\");\n\n\nputSString(s:\"Status\");\nputSStruct(s:s);\n\nset_byte_order(BYTE_ORDER_LITTLE_ENDIAN);\n\n\nsend(socket:soc, data:__stream);\nbuf = recv(socket:soc, length:4096);\n\nif (\"Locate_Error\" >< buf)\n security_note(port:port, protocol:\"udp\");\n", "title": "Symantec Ghost Solution Locate Server Detection", "type": "nessus", "viewCount": 0}, "differentElements": ["description"], "edition": 3, "lastseen": "2019-01-16T20:07:21"}, {"bulletin": {"bulletinFamily": "scanner", "cpe": [], "cvelist": [], "cvss": {"score": 0.0, "vector": "NONE"}, "description": "The remote host is running the 'locate' service of Symantec Ghost solution, an OS deployment and management solution. \n\nThis service is used by clients to discover management servers or to test if the main server is alive.", "edition": 1, "enchantments": {}, "hash": "6f4ed23f8d2fdb29d763166489d219f5cbadf7624c943ae0a38b4dd384927003", "hashmap": [{"hash": "1f6b4eab13fd8bdbbfb3e0c06013378e", "key": "title"}, {"hash": "6f50e94f1944b6dc38c3d6ea53a20b38", "key": "href"}, {"hash": "d41d8cd98f00b204e9800998ecf8427e", "key": "references"}, {"hash": "9cf00d658b687f030ebe173a0528c567", "key": "reporter"}, {"hash": "61c0d2a8b0ce283baff1b49e96cffd10", "key": "description"}, {"hash": "aae58c9f5058bd96822d4da9d9e50b26", "key": "published"}, {"hash": "a3d3c73c01505d0383b007174b5bb5ac", "key": "naslFamily"}, {"hash": "d41d8cd98f00b204e9800998ecf8427e", "key": "cvelist"}, {"hash": "8cd4821cb504d25572038ed182587d85", "key": "cvss"}, {"hash": "bbdaea376f500d25f6b0c1050311dd07", "key": "bulletinFamily"}, {"hash": "e26d9d4b647c69ca79ae7c8790a66112", "key": "sourceData"}, {"hash": "5e0bd03bec244039678f2b955a2595aa", "key": "type"}, {"hash": "3ff4afbf9eedf98937c2e5c5cf13456f", "key": "modified"}, {"hash": "7908b8997139cf07cc59428fc2a89703", "key": "pluginID"}, {"hash": "d41d8cd98f00b204e9800998ecf8427e", "key": "cpe"}], "history": [], "href": "https://www.tenable.com/plugins/index.php?view=single&id=25490", "id": "SYMANTEC_GHOST_LOCATE_DETECT.NASL", "lastseen": "2016-09-26T17:25:42", "modified": "2012-08-01T00:00:00", "naslFamily": "Service detection", "objectVersion": "1.2", "pluginID": "25490", "published": "2007-06-13T00:00:00", "references": [], "reporter": "Tenable", "sourceData": "#\n# (C) Tenable Network Security, Inc.\n#\n\n\ninclude(\"compat.inc\");\n\nif (description)\n{\n script_id(25490);\n script_version (\"$Revision: 1.9 $\");\n script_cvs_date(\"$Date: 2012/08/01 21:10:57 $\");\n script_name(english:\"Symantec Ghost Solution Locate Server Detection\");\n script_set_attribute(attribute:\"synopsis\", value:\n\"An OS deployment server is running on the remote port.\" );\n script_set_attribute(attribute:\"description\", value:\n\"The remote host is running the 'locate' service of Symantec Ghost\nsolution, an OS deployment and management solution. \n\nThis service is used by clients to discover management servers or to\ntest if the main server is alive.\" );\n script_set_attribute(attribute:\"risk_factor\", value:\"None\" );\n script_set_attribute(attribute:\"solution\", value:\"n/a\" );\n script_set_attribute(attribute:\"plugin_publication_date\", value: \"2007/06/13\");\nscript_set_attribute(attribute:\"plugin_type\", value:\"remote\");\nscript_set_attribute(attribute:\"cpe\",value:\"cpe:/a:symantec:ghost_solutions_suite\");\nscript_end_attributes();\n\n script_summary(english:\"Determine if a remote host is running Symantec Ghost Solution Status Service\");\n script_category(ACT_GATHER_INFO);\n script_family(english:\"Service detection\");\n script_copyright(english:\"This script is Copyright (C) 2007-2012 Tenable Network Security, Inc.\");\n script_require_ports(1345);\n exit(0);\n}\n\n\ninclude (\"byte_func.inc\");\n\n\nglobal_var __stream, __stream_pos, __stream_length, __stream_idx, _data_type;\n\n\nSTRING_CODE = 0x33;\nSTRUCT_CODE = 0x22;\nLIST_CODE = 0x21;\nBLOB_CODE = 0x20;\nUINT_CODE = 0x0B;\nSINT_CODE = 0x09;\nINT_CODE = 0x08;\nVOID_CODE = 0x00;\nEND_CODE = 0x02;\n\n\n_data_type = NULL;\n_data_type[\"Name\"] = LIST_CODE;\n_data_type[\"Uuid\"] = BLOB_CODE;\n_data_type[\"Sequence\"] = INT_CODE;\n_data_type[\"Idle\"] = VOID_CODE;\n_data_type[\"Platform\"] = STRING_CODE;\n_data_type[\"Version\"] = INT_CODE;\n_data_type[\"Build\"] = INT_CODE;\n_data_type[\"IPADDRESS\"] = INT_CODE;\n_data_type[\"SUBNETMASK\"] = INT_CODE;\n_data_type[\"ProductVersion\"] = STRING_CODE;\n\n\n\nfunction mklist()\n{\n local_var ret;\n local_var i, l;\n\n l = max_index (_FCT_ANON_ARGS);\n\n if (NASL_LEVEL >= 3000)\n ret = fill_list(length:l, value:0);\n else\n ret = NULL;\n\n for (i=0 ; i<l ; i++)\n ret[i] = _FCT_ANON_ARGS[i];\n\n return ret;\n}\n\n\nfunction mkipaddr()\n{\n local_var ip;\n local_var str;\n\n ip = _FCT_ANON_ARGS[0];\n str = split(ip, sep:'.', keep:FALSE);\n return \n\t(int(str[0]) << 24) +\n\t(int(str[1]) << 16) +\n\t(int(str[2]) << 8) +\n\tint(str[3]) ; \n}\n\n\nfunction stream_init(data)\n{\n __stream = data;\n __stream_pos = 0;\n __stream_length = strlen(data);\n __stream_idx = 1;\n}\n\n\nfunction stream_getByte()\n{\n if (__stream_pos >= __stream_length)\n exit(0);\n\n return ord(__stream[__stream_pos++]);\n}\n\n\nfunction stream_putByte()\n{\n local_var l;\n l = _FCT_ANON_ARGS[0];\n\n __stream += mkbyte(l);\n}\n\n\nfunction stream_putData()\n{\n local_var d;\n d = _FCT_ANON_ARGS[0];\n\n __stream += d;\n}\n\n\nfunction putUTF8Number()\n{\n local_var l;\n l = _FCT_ANON_ARGS[0];\n\n if (l <= 0x7F)\n stream_putByte(l);\n else\n {\n if (l > 0x7FF)\n {\n if (l > 0xFFFF)\n {\n if (l > 0x1FFFFF)\n {\n if (l > 0x3FFFFFF)\n {\n stream_putByte( ((l >>> 30) & 0x01) + 0xFC );\n stream_putByte( ((l >>> 24) & 0x3F) + 0x80 );\n }\n else\n stream_putByte( ((l >>> 24) & 0x03) + 0xF8 );\n\n stream_putByte( ((l >>> 18) & 0x3F) + 0x80 );\n }\n else\n stream_putByte( ((l >>> 18) & 0x07) + 0xF0 );\n\n stream_putByte( ((l >>> 12) & 0x3F) + 0x80 );\n }\n else\n stream_putByte( ((l >>> 12) & 0x0F) + 0xE0 );\n\n stream_putByte( ((l >>> 6) & 0x3F) + 0x80 );\n }\n else\n stream_putByte( ((l >>> 6) & 0x1F) + 0xC0 );\n\n stream_putByte( (l & 0x3F) + 0x80 );\n }\n}\n\n\nfunction getUTF8Number()\n{\n local_var num, b;\n\n b = stream_getByte();\n\n if (b & 0x80)\n {\n num = stream_getByte() & 0x3F;\n\n if (b & 0x20)\n {\n num = (num << 6) + (stream_getByte() & 0x3F);\n\n if (b & 0x10)\n {\n num = (num << 6) + (stream_getByte() & 0x3F);\n\n if (b >= f5 && b <= 0xf7)\n {\n if (b == 0xf6)\n num = ((b & 0x01) << 18) + num; \n }\n else if (b >= 0xf8 && b <= 0xfd)\n {\n num = (num << 6) + (stream_getByte() & 0x3F);\n\n if (b >= 0xfc && b <= 0xfd)\n {\n num = (num << 6) + (stream_getByte() & 0x3F);\n\n num = num + ((b & 0x03) << 30);\n }\n else\n num = ((b & 0x03) << 24) + num;\n }\n else\n num = ((b & 0x07) << 18) + num;\n }\n else\n num = ((b & 0x0F) << 12) + num;\n }\n else\n num = ((b & 0x1F) << 6) + num;\n }\n else\n num = b & 0x7F;\n\n return num;\n}\n\n\nfunction findDataType(data)\n{\n return _data_type[data];\n}\n\n\nfunction putNumber()\n{\n local_var l;\n l = _FCT_ANON_ARGS[0];\n\n putUTF8Number(l);\n}\n\n\nfunction putSInt(i)\n{\n if (i < 0)\n {\n putNumber(UINT_CODE);\n i -= 0x80000000;\n }\n else\n putNumber(SINT_CODE);\n\n putUTF8Number(i);\n}\n\n\nfunction putIndex()\n{\n putNumber(0x24);\n putNumber(0x02);\n putNumber(0x02);\n putSInt(i:__stream_idx++);\n}\n\n\nfunction putIndexEnd(idx)\n{\n putNumber(0x0C);\n putNumber(idx);\n}\n\n\nfunction putSBlob(b)\n{\n putNumber(BLOB_CODE);\n putNumber(strlen(b));\n stream_putData(b);\n}\n\n\nfunction putSString(s)\n{\n local_var idx;\n\n idx = __stream_idx;\n\n putIndex();\n\n putNumber(STRING_CODE);\n putNumber(strlen(s));\n stream_putData(s);\n\n putIndexEnd(idx:idx);\n}\n\n\nfunction putSList(l)\n{\n local_var type, elem;\n\n putNumber(LIST_CODE);\n putNumber(0);\n putNumber(0);\n\n foreach elem (l)\n {\n type = elem[0];\n\n if (type == STRING_CODE)\n putSString(s:elem[1]);\n else if (type == INT_CODE)\n putSInt(i:elem[1]);\n else if (type == BLOB_CODE)\n putSBlob(b:elem[1]);\n else if (type == LIST_CODE)\n putSList(l:elem[1]);\n else if (type == STRUCT_CODE)\n putSStruct(s:elem[1]);\n }\n\n putNumber(END_CODE);\n}\n\n\nfunction putSStruct(s)\n{\n local_var type, elem;\n\n putNumber(STRUCT_CODE);\n putNumber(0x01);\n putNumber(0x00);\n\n foreach elem (s)\n {\n type = findDataType(data:elem[0]);\n\n if (type == VOID_CODE)\n {\n putNumber(0x0C);\n putNumber(0x01);\n }\n\n putSString(s:elem[0]);\n\n if (type == STRING_CODE)\n putSString(s:elem[1]);\n else if (type == INT_CODE)\n putSInt(i:elem[1]);\n else if (type == BLOB_CODE)\n putSBlob(b:elem[1]);\n else if (type == LIST_CODE)\n putSList(l:elem[1]);\n else if (type == STRUCT_CODE)\n putSStruct(s:elem[1]);\n }\n\n putNumber(END_CODE);\n}\n\n\n\n### Main Code ###\n\n\nport = 1345;\n\nif (! get_udp_port_state(port)) exit(0, \"UDP port \"+port+\" is not open.\");\n\nsoc = open_sock_udp(port);\nif (!soc)\n exit(0);\n\n\nstream_init(data:\"\");\n\nl = NULL;\nl[0] = mklist(BLOB_CODE, \"AAAAAA\");\n\ns = NULL;\ns[0] = mklist(\"Name\", l);\ns[1] = mklist(\"Uuid\", \"BBBBBBBBBBBBBBBB\");\ns[2] = mklist(\"Sequence\", 185212261);\ns[3] = mklist(\"Idle\");\ns[4] = mklist(\"Platform\", \"Win2k\");\ns[5] = mklist(\"Version\", 720896);\ns[6] = mklist(\"Build\", 67068);\ns[7] = mklist(\"IPADDRESS\", mkipaddr(this_host()));\ns[8] = mklist(\"SUBNETMASK\", 0xFFFFFF00);\ns[9] = mklist(\"ProductVersion\", \"110.01.153\");\n\n\nputSString(s:\"Status\");\nputSStruct(s:s);\n\nset_byte_order(BYTE_ORDER_LITTLE_ENDIAN);\n\n\nsend(socket:soc, data:__stream);\nbuf = recv(socket:soc, length:4096);\n\nif (\"Locate_Error\" >< buf)\n security_note(port:port, protocol:\"udp\");\n", "title": "Symantec Ghost Solution Locate Server Detection", "type": "nessus", "viewCount": 0}, "differentElements": ["cpe"], "edition": 1, "lastseen": "2016-09-26T17:25:42"}, {"bulletin": {"bulletinFamily": "scanner", "cpe": ["cpe:/a:symantec:ghost_solutions_suite"], "cvelist": [], "cvss": {"score": 0.0, "vector": "NONE"}, "description": "The remote host is running the ", "edition": 5, "enchantments": {"dependencies": {"modified": "2019-10-28T21:34:05", "references": []}, "score": {"modified": "2019-10-28T21:34:05", "value": -0.1, "vector": "NONE"}}, "hash": "5aa5ab2842d9e25d83a841670c15c705c2518e8021ebe8b2d717a25d6e78d196", "hashmap": [{"hash": "1f6b4eab13fd8bdbbfb3e0c06013378e", "key": "title"}, {"hash": "79e8cc590dcc6937f4da81a3a8e1170b", "key": "description"}, {"hash": "de8ba5c8209bf4b17c226dd8f0f3816b", "key": "sourceData"}, {"hash": "d41d8cd98f00b204e9800998ecf8427e", "key": "references"}, {"hash": "b6bb6e87c49273664b08b5039cd37f22", "key": "reporter"}, {"hash": "538e733a21a0302e23efa5ac5962f921", "key": "href"}, {"hash": "aae58c9f5058bd96822d4da9d9e50b26", "key": "published"}, {"hash": "a3d3c73c01505d0383b007174b5bb5ac", "key": "naslFamily"}, {"hash": "d41d8cd98f00b204e9800998ecf8427e", "key": "cvelist"}, {"hash": "8cd4821cb504d25572038ed182587d85", "key": "cvss"}, {"hash": "bbdaea376f500d25f6b0c1050311dd07", "key": "bulletinFamily"}, {"hash": "a84f937b2c010f86efe7ce7c36fbb566", "key": "cpe"}, {"hash": "5e0bd03bec244039678f2b955a2595aa", "key": "type"}, {"hash": "0bafb6325bcaf483a25404f785191cc5", "key": "modified"}, {"hash": "7908b8997139cf07cc59428fc2a89703", "key": "pluginID"}], "history": [], "href": "https://www.tenable.com/plugins/nessus/25490", "id": "SYMANTEC_GHOST_LOCATE_DETECT.NASL", "lastseen": "2019-10-28T21:34:05", "modified": "2019-10-02T00:00:00", "naslFamily": "Service detection", "objectVersion": "1.3", "pluginID": "25490", "published": "2007-06-13T00:00:00", "references": [], "reporter": "This script is Copyright (C) 2007-2019 Tenable Network Security, Inc.", "sourceData": "#\n# (C) Tenable Network Security, Inc.\n#\n\n\ninclude(\"compat.inc\");\n\nif (description)\n{\n script_id(25490);\n script_version (\"1.10\");\n script_cvs_date(\"Date: 2019/03/06 18:38:55\");\n script_name(english:\"Symantec Ghost Solution Locate Server Detection\");\n script_set_attribute(attribute:\"synopsis\", value:\n\"An OS deployment server is running on the remote port.\" );\n script_set_attribute(attribute:\"description\", value:\n\"The remote host is running the 'locate' service of Symantec Ghost\nsolution, an OS deployment and management solution. \n\nThis service is used by clients to discover management servers or to\ntest if the main server is alive.\" );\n script_set_attribute(attribute:\"risk_factor\", value:\"None\" );\n script_set_attribute(attribute:\"solution\", value:\"n/a\" );\n script_set_attribute(attribute:\"plugin_publication_date\", value: \"2007/06/13\");\nscript_set_attribute(attribute:\"plugin_type\", value:\"remote\");\nscript_set_attribute(attribute:\"cpe\",value:\"cpe:/a:symantec:ghost_solutions_suite\");\nscript_end_attributes();\n\n script_summary(english:\"Determine if a remote host is running Symantec Ghost Solution Status Service\");\n script_category(ACT_GATHER_INFO);\n script_family(english:\"Service detection\");\n script_copyright(english:\"This script is Copyright (C) 2007-2019 Tenable Network Security, Inc.\");\n script_require_ports(1345);\n exit(0);\n}\n\n\ninclude (\"byte_func.inc\");\n\n\nglobal_var __stream, __stream_pos, __stream_length, __stream_idx, _data_type;\n\n\nSTRING_CODE = 0x33;\nSTRUCT_CODE = 0x22;\nLIST_CODE = 0x21;\nBLOB_CODE = 0x20;\nUINT_CODE = 0x0B;\nSINT_CODE = 0x09;\nINT_CODE = 0x08;\nVOID_CODE = 0x00;\nEND_CODE = 0x02;\n\n\n_data_type = NULL;\n_data_type[\"Name\"] = LIST_CODE;\n_data_type[\"Uuid\"] = BLOB_CODE;\n_data_type[\"Sequence\"] = INT_CODE;\n_data_type[\"Idle\"] = VOID_CODE;\n_data_type[\"Platform\"] = STRING_CODE;\n_data_type[\"Version\"] = INT_CODE;\n_data_type[\"Build\"] = INT_CODE;\n_data_type[\"IPADDRESS\"] = INT_CODE;\n_data_type[\"SUBNETMASK\"] = INT_CODE;\n_data_type[\"ProductVersion\"] = STRING_CODE;\n\n\n\nfunction mklist()\n{\n local_var ret;\n local_var i, l;\n\n l = max_index (_FCT_ANON_ARGS);\n\n if (NASL_LEVEL >= 3000)\n ret = fill_list(length:l, value:0);\n else\n ret = NULL;\n\n for (i=0 ; i<l ; i++)\n ret[i] = _FCT_ANON_ARGS[i];\n\n return ret;\n}\n\n\nfunction mkipaddr()\n{\n local_var ip;\n local_var str;\n\n ip = _FCT_ANON_ARGS[0];\n str = split(ip, sep:'.', keep:FALSE);\n return \n\t(int(str[0]) << 24) +\n\t(int(str[1]) << 16) +\n\t(int(str[2]) << 8) +\n\tint(str[3]) ; \n}\n\n\nfunction stream_init(data)\n{\n __stream = data;\n __stream_pos = 0;\n __stream_length = strlen(data);\n __stream_idx = 1;\n}\n\n\nfunction stream_getByte()\n{\n if (__stream_pos >= __stream_length)\n exit(0);\n\n return ord(__stream[__stream_pos++]);\n}\n\n\nfunction stream_putByte()\n{\n local_var l;\n l = _FCT_ANON_ARGS[0];\n\n __stream += mkbyte(l);\n}\n\n\nfunction stream_putData()\n{\n local_var d;\n d = _FCT_ANON_ARGS[0];\n\n __stream += d;\n}\n\n\nfunction putUTF8Number()\n{\n local_var l;\n l = _FCT_ANON_ARGS[0];\n\n if (l <= 0x7F)\n stream_putByte(l);\n else\n {\n if (l > 0x7FF)\n {\n if (l > 0xFFFF)\n {\n if (l > 0x1FFFFF)\n {\n if (l > 0x3FFFFFF)\n {\n stream_putByte( ((l >>> 30) & 0x01) + 0xFC );\n stream_putByte( ((l >>> 24) & 0x3F) + 0x80 );\n }\n else\n stream_putByte( ((l >>> 24) & 0x03) + 0xF8 );\n\n stream_putByte( ((l >>> 18) & 0x3F) + 0x80 );\n }\n else\n stream_putByte( ((l >>> 18) & 0x07) + 0xF0 );\n\n stream_putByte( ((l >>> 12) & 0x3F) + 0x80 );\n }\n else\n stream_putByte( ((l >>> 12) & 0x0F) + 0xE0 );\n\n stream_putByte( ((l >>> 6) & 0x3F) + 0x80 );\n }\n else\n stream_putByte( ((l >>> 6) & 0x1F) + 0xC0 );\n\n stream_putByte( (l & 0x3F) + 0x80 );\n }\n}\n\n\nfunction getUTF8Number()\n{\n local_var num, b;\n\n b = stream_getByte();\n\n if (b & 0x80)\n {\n num = stream_getByte() & 0x3F;\n\n if (b & 0x20)\n {\n num = (num << 6) + (stream_getByte() & 0x3F);\n\n if (b & 0x10)\n {\n num = (num << 6) + (stream_getByte() & 0x3F);\n\n if (b >= f5 && b <= 0xf7)\n {\n if (b == 0xf6)\n num = ((b & 0x01) << 18) + num; \n }\n else if (b >= 0xf8 && b <= 0xfd)\n {\n num = (num << 6) + (stream_getByte() & 0x3F);\n\n if (b >= 0xfc && b <= 0xfd)\n {\n num = (num << 6) + (stream_getByte() & 0x3F);\n\n num = num + ((b & 0x03) << 30);\n }\n else\n num = ((b & 0x03) << 24) + num;\n }\n else\n num = ((b & 0x07) << 18) + num;\n }\n else\n num = ((b & 0x0F) << 12) + num;\n }\n else\n num = ((b & 0x1F) << 6) + num;\n }\n else\n num = b & 0x7F;\n\n return num;\n}\n\n\nfunction findDataType(data)\n{\n return _data_type[data];\n}\n\n\nfunction putNumber()\n{\n local_var l;\n l = _FCT_ANON_ARGS[0];\n\n putUTF8Number(l);\n}\n\n\nfunction putSInt(i)\n{\n if (i < 0)\n {\n putNumber(UINT_CODE);\n i -= 0x80000000;\n }\n else\n putNumber(SINT_CODE);\n\n putUTF8Number(i);\n}\n\n\nfunction putIndex()\n{\n putNumber(0x24);\n putNumber(0x02);\n putNumber(0x02);\n putSInt(i:__stream_idx++);\n}\n\n\nfunction putIndexEnd(idx)\n{\n putNumber(0x0C);\n putNumber(idx);\n}\n\n\nfunction putSBlob(b)\n{\n putNumber(BLOB_CODE);\n putNumber(strlen(b));\n stream_putData(b);\n}\n\n\nfunction putSString(s)\n{\n local_var idx;\n\n idx = __stream_idx;\n\n putIndex();\n\n putNumber(STRING_CODE);\n putNumber(strlen(s));\n stream_putData(s);\n\n putIndexEnd(idx:idx);\n}\n\n\nfunction putSList(l)\n{\n local_var type, elem;\n\n putNumber(LIST_CODE);\n putNumber(0);\n putNumber(0);\n\n foreach elem (l)\n {\n type = elem[0];\n\n if (type == STRING_CODE)\n putSString(s:elem[1]);\n else if (type == INT_CODE)\n putSInt(i:elem[1]);\n else if (type == BLOB_CODE)\n putSBlob(b:elem[1]);\n else if (type == LIST_CODE)\n putSList(l:elem[1]);\n else if (type == STRUCT_CODE)\n putSStruct(s:elem[1]);\n }\n\n putNumber(END_CODE);\n}\n\n\nfunction putSStruct(s)\n{\n local_var type, elem;\n\n putNumber(STRUCT_CODE);\n putNumber(0x01);\n putNumber(0x00);\n\n foreach elem (s)\n {\n type = findDataType(data:elem[0]);\n\n if (type == VOID_CODE)\n {\n putNumber(0x0C);\n putNumber(0x01);\n }\n\n putSString(s:elem[0]);\n\n if (type == STRING_CODE)\n putSString(s:elem[1]);\n else if (type == INT_CODE)\n putSInt(i:elem[1]);\n else if (type == BLOB_CODE)\n putSBlob(b:elem[1]);\n else if (type == LIST_CODE)\n putSList(l:elem[1]);\n else if (type == STRUCT_CODE)\n putSStruct(s:elem[1]);\n }\n\n putNumber(END_CODE);\n}\n\n\n\n### Main Code ###\n\n\nport = 1345;\n\nif (! get_udp_port_state(port)) exit(0, \"UDP port \"+port+\" is not open.\");\n\nsoc = open_sock_udp(port);\nif (!soc)\n exit(0);\n\n\nstream_init(data:\"\");\n\nl = NULL;\nl[0] = mklist(BLOB_CODE, \"AAAAAA\");\n\ns = NULL;\ns[0] = mklist(\"Name\", l);\ns[1] = mklist(\"Uuid\", \"BBBBBBBBBBBBBBBB\");\ns[2] = mklist(\"Sequence\", 185212261);\ns[3] = mklist(\"Idle\");\ns[4] = mklist(\"Platform\", \"Win2k\");\ns[5] = mklist(\"Version\", 720896);\ns[6] = mklist(\"Build\", 67068);\ns[7] = mklist(\"IPADDRESS\", mkipaddr(compat::this_host()));\ns[8] = mklist(\"SUBNETMASK\", 0xFFFFFF00);\ns[9] = mklist(\"ProductVersion\", \"110.01.153\");\n\n\nputSString(s:\"Status\");\nputSStruct(s:s);\n\nset_byte_order(BYTE_ORDER_LITTLE_ENDIAN);\n\n\nsend(socket:soc, data:__stream);\nbuf = recv(socket:soc, length:4096);\n\nif (\"Locate_Error\" >< buf)\n security_note(port:port, protocol:\"udp\");\n", "title": "Symantec Ghost Solution Locate Server Detection", "type": "nessus", "viewCount": 0}, "differentElements": ["modified"], "edition": 5, "lastseen": "2019-10-28T21:34:05"}], "edition": 7, "hashmap": [{"key": "bulletinFamily", "hash": "bbdaea376f500d25f6b0c1050311dd07"}, {"key": "cpe", "hash": "a84f937b2c010f86efe7ce7c36fbb566"}, {"key": "cvelist", "hash": "d41d8cd98f00b204e9800998ecf8427e"}, {"key": "cvss", "hash": "8cd4821cb504d25572038ed182587d85"}, {"key": "description", "hash": "79e8cc590dcc6937f4da81a3a8e1170b"}, {"key": "href", "hash": "538e733a21a0302e23efa5ac5962f921"}, {"key": "modified", "hash": "abcf9266f425f12dda38f529cd4a94bc"}, {"key": "naslFamily", "hash": "a3d3c73c01505d0383b007174b5bb5ac"}, {"key": "pluginID", "hash": "7908b8997139cf07cc59428fc2a89703"}, {"key": "published", "hash": "aae58c9f5058bd96822d4da9d9e50b26"}, {"key": "references", "hash": "d41d8cd98f00b204e9800998ecf8427e"}, {"key": "reporter", "hash": "6291b2fd97bfd0d98386af2859141dc6"}, {"key": "sourceData", "hash": "16fc031593e8b6a776702b7c1ee5ffbc"}, {"key": "title", "hash": "1f6b4eab13fd8bdbbfb3e0c06013378e"}, {"key": "type", "hash": "5e0bd03bec244039678f2b955a2595aa"}], "hash": "577557f5c3f91268a10eba3c5fd2cf616dec18198e6d85f3fdaff4d073911ab3", "viewCount": 0, "enchantments": {"dependencies": {"references": [], "modified": "2019-11-23T13:00:03"}, "score": {"value": -0.0, "vector": "NONE", "modified": "2019-11-23T13:00:03"}, "vulnersScore": -0.0}, "objectVersion": "1.3", "sourceData": "#\n# (C) Tenable Network Security, Inc.\n#\n\n\ninclude(\"compat.inc\");\n\nif (description)\n{\n script_id(25490);\n script_version (\"1.11\");\n script_cvs_date(\"Date: 2019/11/22\");\n script_name(english:\"Symantec Ghost Solution Locate Server Detection\");\n script_set_attribute(attribute:\"synopsis\", value:\n\"An OS deployment server is running on the remote port.\" );\n script_set_attribute(attribute:\"description\", value:\n\"The remote host is running the 'locate' service of Symantec Ghost\nsolution, an OS deployment and management solution. \n\nThis service is used by clients to discover management servers or to\ntest if the main server is alive.\" );\n script_set_attribute(attribute:\"risk_factor\", value:\"None\" );\n script_set_attribute(attribute:\"solution\", value:\"n/a\" );\n script_set_attribute(attribute:\"plugin_publication_date\", value: \"2007/06/13\");\nscript_set_attribute(attribute:\"plugin_type\", value:\"remote\");\nscript_set_attribute(attribute:\"cpe\",value:\"cpe:/a:symantec:ghost_solutions_suite\");\nscript_set_attribute(attribute:\"asset_inventory\", value:\"True\");\nscript_end_attributes();\n\n script_summary(english:\"Determine if a remote host is running Symantec Ghost Solution Status Service\");\n script_category(ACT_GATHER_INFO);\n script_family(english:\"Service detection\");\n script_copyright(english:\"This script is Copyright (C) 2007-2019 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n script_require_ports(1345);\n exit(0);\n}\n\n\ninclude (\"byte_func.inc\");\n\n\nglobal_var __stream, __stream_pos, __stream_length, __stream_idx, _data_type;\n\n\nSTRING_CODE = 0x33;\nSTRUCT_CODE = 0x22;\nLIST_CODE = 0x21;\nBLOB_CODE = 0x20;\nUINT_CODE = 0x0B;\nSINT_CODE = 0x09;\nINT_CODE = 0x08;\nVOID_CODE = 0x00;\nEND_CODE = 0x02;\n\n\n_data_type = NULL;\n_data_type[\"Name\"] = LIST_CODE;\n_data_type[\"Uuid\"] = BLOB_CODE;\n_data_type[\"Sequence\"] = INT_CODE;\n_data_type[\"Idle\"] = VOID_CODE;\n_data_type[\"Platform\"] = STRING_CODE;\n_data_type[\"Version\"] = INT_CODE;\n_data_type[\"Build\"] = INT_CODE;\n_data_type[\"IPADDRESS\"] = INT_CODE;\n_data_type[\"SUBNETMASK\"] = INT_CODE;\n_data_type[\"ProductVersion\"] = STRING_CODE;\n\n\n\nfunction mklist()\n{\n local_var ret;\n local_var i, l;\n\n l = max_index (_FCT_ANON_ARGS);\n\n if (NASL_LEVEL >= 3000)\n ret = fill_list(length:l, value:0);\n else\n ret = NULL;\n\n for (i=0 ; i<l ; i++)\n ret[i] = _FCT_ANON_ARGS[i];\n\n return ret;\n}\n\n\nfunction mkipaddr()\n{\n local_var ip;\n local_var str;\n\n ip = _FCT_ANON_ARGS[0];\n str = split(ip, sep:'.', keep:FALSE);\n return \n\t(int(str[0]) << 24) +\n\t(int(str[1]) << 16) +\n\t(int(str[2]) << 8) +\n\tint(str[3]) ; \n}\n\n\nfunction stream_init(data)\n{\n __stream = data;\n __stream_pos = 0;\n __stream_length = strlen(data);\n __stream_idx = 1;\n}\n\n\nfunction stream_getByte()\n{\n if (__stream_pos >= __stream_length)\n exit(0);\n\n return ord(__stream[__stream_pos++]);\n}\n\n\nfunction stream_putByte()\n{\n local_var l;\n l = _FCT_ANON_ARGS[0];\n\n __stream += mkbyte(l);\n}\n\n\nfunction stream_putData()\n{\n local_var d;\n d = _FCT_ANON_ARGS[0];\n\n __stream += d;\n}\n\n\nfunction putUTF8Number()\n{\n local_var l;\n l = _FCT_ANON_ARGS[0];\n\n if (l <= 0x7F)\n stream_putByte(l);\n else\n {\n if (l > 0x7FF)\n {\n if (l > 0xFFFF)\n {\n if (l > 0x1FFFFF)\n {\n if (l > 0x3FFFFFF)\n {\n stream_putByte( ((l >>> 30) & 0x01) + 0xFC );\n stream_putByte( ((l >>> 24) & 0x3F) + 0x80 );\n }\n else\n stream_putByte( ((l >>> 24) & 0x03) + 0xF8 );\n\n stream_putByte( ((l >>> 18) & 0x3F) + 0x80 );\n }\n else\n stream_putByte( ((l >>> 18) & 0x07) + 0xF0 );\n\n stream_putByte( ((l >>> 12) & 0x3F) + 0x80 );\n }\n else\n stream_putByte( ((l >>> 12) & 0x0F) + 0xE0 );\n\n stream_putByte( ((l >>> 6) & 0x3F) + 0x80 );\n }\n else\n stream_putByte( ((l >>> 6) & 0x1F) + 0xC0 );\n\n stream_putByte( (l & 0x3F) + 0x80 );\n }\n}\n\n\nfunction getUTF8Number()\n{\n local_var num, b;\n\n b = stream_getByte();\n\n if (b & 0x80)\n {\n num = stream_getByte() & 0x3F;\n\n if (b & 0x20)\n {\n num = (num << 6) + (stream_getByte() & 0x3F);\n\n if (b & 0x10)\n {\n num = (num << 6) + (stream_getByte() & 0x3F);\n\n if (b >= f5 && b <= 0xf7)\n {\n if (b == 0xf6)\n num = ((b & 0x01) << 18) + num; \n }\n else if (b >= 0xf8 && b <= 0xfd)\n {\n num = (num << 6) + (stream_getByte() & 0x3F);\n\n if (b >= 0xfc && b <= 0xfd)\n {\n num = (num << 6) + (stream_getByte() & 0x3F);\n\n num = num + ((b & 0x03) << 30);\n }\n else\n num = ((b & 0x03) << 24) + num;\n }\n else\n num = ((b & 0x07) << 18) + num;\n }\n else\n num = ((b & 0x0F) << 12) + num;\n }\n else\n num = ((b & 0x1F) << 6) + num;\n }\n else\n num = b & 0x7F;\n\n return num;\n}\n\n\nfunction findDataType(data)\n{\n return _data_type[data];\n}\n\n\nfunction putNumber()\n{\n local_var l;\n l = _FCT_ANON_ARGS[0];\n\n putUTF8Number(l);\n}\n\n\nfunction putSInt(i)\n{\n if (i < 0)\n {\n putNumber(UINT_CODE);\n i -= 0x80000000;\n }\n else\n putNumber(SINT_CODE);\n\n putUTF8Number(i);\n}\n\n\nfunction putIndex()\n{\n putNumber(0x24);\n putNumber(0x02);\n putNumber(0x02);\n putSInt(i:__stream_idx++);\n}\n\n\nfunction putIndexEnd(idx)\n{\n putNumber(0x0C);\n putNumber(idx);\n}\n\n\nfunction putSBlob(b)\n{\n putNumber(BLOB_CODE);\n putNumber(strlen(b));\n stream_putData(b);\n}\n\n\nfunction putSString(s)\n{\n local_var idx;\n\n idx = __stream_idx;\n\n putIndex();\n\n putNumber(STRING_CODE);\n putNumber(strlen(s));\n stream_putData(s);\n\n putIndexEnd(idx:idx);\n}\n\n\nfunction putSList(l)\n{\n local_var type, elem;\n\n putNumber(LIST_CODE);\n putNumber(0);\n putNumber(0);\n\n foreach elem (l)\n {\n type = elem[0];\n\n if (type == STRING_CODE)\n putSString(s:elem[1]);\n else if (type == INT_CODE)\n putSInt(i:elem[1]);\n else if (type == BLOB_CODE)\n putSBlob(b:elem[1]);\n else if (type == LIST_CODE)\n putSList(l:elem[1]);\n else if (type == STRUCT_CODE)\n putSStruct(s:elem[1]);\n }\n\n putNumber(END_CODE);\n}\n\n\nfunction putSStruct(s)\n{\n local_var type, elem;\n\n putNumber(STRUCT_CODE);\n putNumber(0x01);\n putNumber(0x00);\n\n foreach elem (s)\n {\n type = findDataType(data:elem[0]);\n\n if (type == VOID_CODE)\n {\n putNumber(0x0C);\n putNumber(0x01);\n }\n\n putSString(s:elem[0]);\n\n if (type == STRING_CODE)\n putSString(s:elem[1]);\n else if (type == INT_CODE)\n putSInt(i:elem[1]);\n else if (type == BLOB_CODE)\n putSBlob(b:elem[1]);\n else if (type == LIST_CODE)\n putSList(l:elem[1]);\n else if (type == STRUCT_CODE)\n putSStruct(s:elem[1]);\n }\n\n putNumber(END_CODE);\n}\n\n\n\n### Main Code ###\n\n\nport = 1345;\n\nif (! get_udp_port_state(port)) exit(0, \"UDP port \"+port+\" is not open.\");\n\nsoc = open_sock_udp(port);\nif (!soc)\n exit(0);\n\n\nstream_init(data:\"\");\n\nl = NULL;\nl[0] = mklist(BLOB_CODE, \"AAAAAA\");\n\ns = NULL;\ns[0] = mklist(\"Name\", l);\ns[1] = mklist(\"Uuid\", \"BBBBBBBBBBBBBBBB\");\ns[2] = mklist(\"Sequence\", 185212261);\ns[3] = mklist(\"Idle\");\ns[4] = mklist(\"Platform\", \"Win2k\");\ns[5] = mklist(\"Version\", 720896);\ns[6] = mklist(\"Build\", 67068);\ns[7] = mklist(\"IPADDRESS\", mkipaddr(compat::this_host()));\ns[8] = mklist(\"SUBNETMASK\", 0xFFFFFF00);\ns[9] = mklist(\"ProductVersion\", \"110.01.153\");\n\n\nputSString(s:\"Status\");\nputSStruct(s:s);\n\nset_byte_order(BYTE_ORDER_LITTLE_ENDIAN);\n\n\nsend(socket:soc, data:__stream);\nbuf = recv(socket:soc, length:4096);\n\nif (\"Locate_Error\" >< buf)\n security_note(port:port, protocol:\"udp\");\n", "naslFamily": "Service detection", "pluginID": "25490", "cpe": ["cpe:/a:symantec:ghost_solutions_suite"], "scheme": null}