Lucene search

K
nmapPatrik KarlssonNMAP:CITRIX-ENUM-SERVERS-XML.NSE
HistoryDec 14, 2009 - 7:30 a.m.

citrix-enum-servers-xml NSE Script

2009-12-1407:30:38
Patrik Karlsson
nmap.org
67

9.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

10 High

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:N/AC:L/Au:N/C:C/I:C/A:C

0.973 High

EPSS

Percentile

99.8%

Extracts the name of the server farm and member servers from Citrix XML service.

Script Arguments

slaxml.debug

See the documentation for the slaxml library.

http.host, http.max-body-size, http.max-cache-size, http.max-pipeline, http.pipeline, http.truncated-ok, http.useragent

See the documentation for the http library.

smbdomain, smbhash, smbnoguest, smbpassword, smbtype, smbusername

See the documentation for the smbauth library.

Example Usage

nmap --script=citrix-enum-servers-xml -p 80,443,8080 <host>

Script Output

PORT     STATE SERVICE    REASON
8080/tcp open  http-proxy syn-ack
| citrix-enum-servers-xml:
|   CITRIX-SRV01
|_  CITRIX-SRV01

Requires


local citrixxml = require "citrixxml"
local shortport = require "shortport"
local stdnse = require "stdnse"
local table = require "table"

description = [[
Extracts the name of the server farm and member servers from Citrix XML
service.
]]

---
-- @usage
-- nmap --script=citrix-enum-servers-xml -p 80,443,8080 <host>
--
-- @output
-- PORT     STATE SERVICE    REASON
-- 8080/tcp open  http-proxy syn-ack
-- | citrix-enum-servers-xml:
-- |   CITRIX-SRV01
-- |_  CITRIX-SRV01

-- Version 0.2

-- Created 11/26/2009 - v0.1 - created by Patrik Karlsson <[email protected]>
-- Revised 12/02/2009 - v0.2 - Use stdnse.format_ouput for output

author = "Patrik Karlsson"
license = "Same as Nmap--See https://nmap.org/book/man-legal.html"
categories = {"discovery", "safe"}


portrule = shortport.portnumber({8080,80,443}, "tcp")


action = function(host, port)

  local xmldata = citrixxml.request_server_data(host, port)
  local servers = citrixxml.parse_server_data_response(xmldata)
  local response = {}

  for _, srv in ipairs(servers) do
    table.insert(response, srv)
  end

  return stdnse.format_output(true, response)

end

9.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

10 High

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:N/AC:L/Au:N/C:C/I:C/A:C

0.973 High

EPSS

Percentile

99.8%

Related for NMAP:CITRIX-ENUM-SERVERS-XML.NSE