Lucene search

K

broadcast-xdmcp-discover NSE Script

🗓️ 26 Jan 2012 19:19:35Reported by Patrik KarlssonType 
nmap
 nmap
🔗 nmap.org👁 98 Views

Discovers XDMCP servers on LAN, marking accessible ones with "Willing

Show more
Related
Code
ReporterTitlePublishedViews
Family
Nmap
vnc-info NSE Script
14 Aug 201015:13
nmap
Nmap
broadcast-dns-service-discovery NSE Script
2 Nov 201017:22
nmap
Nmap
broadcast-pc-anywhere NSE Script
18 Dec 201109:33
nmap
Nmap
broadcast-wsdd-discover NSE Script
10 Nov 201022:35
nmap
Nmap
daytime NSE Script
6 Nov 200802:52
nmap
Nmap
deluge-rpc-brute NSE Script
18 Sep 201717:10
nmap
Nmap
dict-info NSE Script
14 May 201221:37
nmap
Nmap
quake3-info NSE Script
21 Sep 201122:49
nmap
Nmap
rpcap-brute NSE Script
2 Mar 201212:39
nmap
Nmap
rusers NSE Script
14 Mar 201616:03
nmap
Rows per page
local os = require "os"
local stdnse = require "stdnse"
local table = require "table"
local xdmcp = require "xdmcp"

description = [[
Discovers servers running the X Display Manager Control Protocol (XDMCP) by
sending a XDMCP broadcast request to the LAN. Display managers allowing access
are marked using the keyword Willing in the result.
]]

---
-- @usage
-- nmap --script broadcast-xdmcp-discover
--
-- @output
-- Pre-scan script results:
-- | broadcast-xdmcp-discover:
-- |_  192.168.2.162 - Willing
--
-- @args broadcast-xdmcp-discover.timeout socket timeout (default: 5s)

author = "Patrik Karlsson"
license = "Same as Nmap--See https://nmap.org/book/man-legal.html"
categories = {"broadcast", "safe"}


prerule = function() return true end

local arg_timeout = stdnse.parse_timespec(stdnse.get_script_args(SCRIPT_NAME .. ".timeout"))

action = function()

  local host, port = { ip = "255.255.255.255" }, { number = 177, protocol = "udp" }
  local options = { timeout = 1 }
  local helper = xdmcp.Helper:new(host, port, options)
  local status = helper:connect()

  local req = xdmcp.Packet[xdmcp.OpCode.BCAST_QUERY]:new(nil)
  local status, err = helper:send(req)
  if ( not(status) ) then
    return false, err
  end

  local timeout = arg_timeout or 5
  local start = os.time()
  local result = {}
  repeat

    local status, response = helper:recv()
    if ( not(status) and response ~= "TIMEOUT" ) then
      break
    elseif ( status ) then
      local status, _, _, rhost = helper.socket:get_info()
      if ( response.header.opcode == xdmcp.OpCode.WILLING ) then
        result[rhost] = true
      else
        result[rhost] = false
      end
    end

  until( os.time() - start > timeout )

  local output = {}
  for ip, res in pairs(result) do
    if ( res ) then
      table.insert(output, ("%s - Willing"):format(ip))
    else
      table.insert(output, ("%s - Unwilling"):format(ip))
    end
  end
  return stdnse.format_output(true, output)
end

Transform Your Security Services

Elevate your offerings with Vulners' advanced Vulnerability Intelligence. Contact us for a demo and discover the difference comprehensive, actionable intelligence can make in your security strategy.

Book a live demo
26 Jan 2012 19:35Current
9.2High risk
Vulners AI Score9.2
EPSS0.973
98
.json
Report