db2-das-info NSE Script

local nmap = require "nmap"
local shortport = require "shortport"
local stdnse = require "stdnse"
local string = require "string"

description = [[
Connects to the IBM DB2 Administration Server (DAS) on TCP or UDP port 523 and
exports the server profile.  No authentication is required for this request.

The script will also set the port product and version if a version scan is
requested.
]]

-- rev 1.1 (2010-01-28)

---
-- @output
-- PORT    STATE SERVICE VERSION
-- 523/tcp open  ibm-db2 IBM DB2 Database Server 9.07.0
-- | db2-das-info: DB2 Administration Server Settings
-- | ;DB2 Server Database Access Profile
-- | ;Use BINARY file transfer
-- | ;Comment lines start with a ";"
-- | ;Other lines must be one of the following two types:
-- | ;Type A: [section_name]
-- | ;Type B: keyword=value
-- |
-- | [File_Description]
-- | Application=DB2/LINUX 9.7.0
-- | Platform=18
-- | File_Content=DB2 Server Definitions
-- | File_Type=CommonServer
-- | File_Format_Version=1.0
-- | DB2System=MYBIGDATABASESERVER
-- | ServerType=DB2LINUX
-- |
-- | [adminst>dasusr1]
-- | NodeType=1
-- | DB2Comm=TCPIP
-- | Authentication=SERVER
-- | HostName=MYBIGDATABASESERVER
-- | PortNumber=523
-- | IpAddress=127.0.1.1
-- |
-- | [inst>db2inst1]
-- | NodeType=1
-- | DB2Comm=TCPIP
-- | Authentication=SERVER
-- | HostName=MYBIGDATABASESERVER
-- | ServiceName=db2c_db2inst1
-- | PortNumber=50000
-- | IpAddress=127.0.1.1
-- | QuietMode=No
-- | TMDatabase=1ST_CONN
-- |
-- | [db>db2inst1:TOOLSDB]
-- | DBAlias=TOOLSDB
-- | DBName=TOOLSDB
-- | Drive=/home/db2inst1
-- | Dir_entry_type=INDIRECT
-- |_Authentication=NOTSPEC

author = {"Patrik Karlsson", "Tom Sellers"}

license = "Same as Nmap--See https://nmap.org/book/man-legal.html"

categories = {"safe", "discovery", "version"}


--- Research Notes:
--
-- Little documentation on the protocol used to communicate with the IBM DB2 Admin Server
-- service exists.  The packets and methods here were developed based on data captured
-- in the wild.  Interviews with knowledgeable individuals indicates that the following
-- information can be used to recreate the traffic.
--
-- Requirements:
--   IBM DB2 Administrative Server (DAS) version >= 7.x instance, typically on port 523 tcp or udp
--   IBM DB2 Control Center (Java application, workings on Linux, Windows, etc)
--
-- Steps to reproduce:
--   Ensure network connectivity from test host to DB2 DAS instance on 523
--   In the Control Center, right click on All Systems and click Add
--   Enter the DB2 server IP or hostname in the System Name field and click OK
--   Start packet capture
--   Under All Systems right click on your DB2 server, choose export profile, enter file location, click OK
--   Stop packet capture
--
--   Details on how to reproduce these steps with the CLI are welcome.

portrule = shortport.version_port_or_service({523}, nil,
                                            {"tcp","udp"},
                                            {"open", "open|filtered"})

--- Extracts the server profile from an already parsed db2 packet
--
-- This function assumes that the data contains the server profile and does
-- no attempts to verify whether it does or not. The response from the function
-- is simply a substring starting at offset 37.
--
-- @param data string containing the "info" section as parsed by parse_db2_packet
-- @return string containing the complete server profile
function extract_server_profile(data)

  local server_profile_offset = 37

  if server_profile_offset > data:len() then
    return
  end

  return data:sub(server_profile_offset)

end

--- Does *very* basic parsing of a DB2 packet
--
-- Due to the limited documentation of the protocol this function is guesswork
-- The section called info is essentially the data part of the db2das data response
-- The length of this section is found at offset 158 in the db2das.data section
--
--
-- @param packet table as returned from read_db2_packet
-- @return table with parsed data
function parse_db2_packet(packet)

  local info_length_offset = 158
  local info_offset = 160
  local version_offset = 97
  local response = {}

  if packet.header.data_len < info_length_offset then
    stdnse.debug1("packet too short to be DB2 response...")
    return
  end

  local len = string.unpack(">I2", packet.data, info_length_offset)
  response.version = string.unpack("z", packet.data, version_offset)
  response.info_length = len - 4
  response.info = packet.data:sub(info_offset, info_offset + response.info_length - (info_offset-info_length_offset))

  if(nmap.debugging() > 3)  then
    stdnse.debug1("version: %s", response.version)
    stdnse.debug1("info_length: %d", response.info_length)
    stdnse.debug1("response.info:len(): %d", response.info:len())
  end

  return response

end

--- Reads a DB2 packet from the socket
--
-- Due to the limited documentation of the protocol this function is guesswork
-- The first 41 bytes of the db2das response are considered to be the header
-- The bytes following the header are considered to be the data
--
-- Offset 38 of the header contains an integer with the length of the data section
-- The length of the data section can unfortunately be of either endianness
-- There's
--
-- @param socket connected to the server
-- @return table with header and data
function read_db2_packet(socket)

  local packet = {}
  local header_len = 41
  local total_len = 0
  local buf

  local DATA_LENGTH_OFFSET = 38
  local ENDIANESS_OFFSET = 23

  local catch = function()
    stdnse.debug1("ERROR communicating with DB2 server")
    socket:close()
  end

  local try = nmap.new_try(catch)
  packet.header = {}

  buf = try( socket:receive_bytes(header_len) )

  packet.header.raw = buf:sub(1, header_len)

  if packet.header.raw:sub(1, 10) == "\x00\x00\x00\x00\x44\x42\x32\x44\x41\x53" then

    stdnse.debug1("Got DB2DAS packet")

    local endian = string.unpack( "c2", packet.header.raw, ENDIANESS_OFFSET )

    if endian == "9z" then
      packet.header.data_len = string.unpack("<I4", packet.header.raw, DATA_LENGTH_OFFSET )
    else
      packet.header.data_len = string.unpack(">I4", packet.header.raw, DATA_LENGTH_OFFSET )
    end

    total_len = header_len + packet.header.data_len

    if(nmap.debugging() > 3) then
      stdnse.debug1("data_len: %d", packet.header.data_len)
      stdnse.debug1("buf_len: %d", buf:len())
      stdnse.debug1("total_len: %d", total_len)
    end

    -- do we have all data as specified by data_len?
    while total_len > buf:len() do
      -- if not read additional bytes
      if(nmap.debugging() > 3)  then
        stdnse.debug1("Reading %d additional bytes", total_len - buf:len())
      end
      local tmp = try( socket:receive_bytes( total_len - buf:len() ) )
      if(nmap.debugging() > 3)  then
        stdnse.debug1("Read %d bytes", tmp:len())
      end
      buf = buf .. tmp
    end

    packet.data = buf:sub(header_len + 1)

  else
    stdnse.debug1("Unknown packet, aborting ...")
    return
  end

  return packet

end

--- Sends a db2 packet table over the wire
--
-- @param socket already connected to the server
-- @param packet table as returned from <code>create_das_packet</code>
--
function send_db2_packet( socket, packet )

  local catch = function()
    stdnse.debug1("ERROR communicating with DB2 server")
    socket:close()
  end

  local try = nmap.new_try(catch)

  local buf = packet.header.raw .. packet.data

  try( socket:send(buf) )

end

--- Creates a db2 packet table using the magic byte and data
--
-- The function returns a db2 packet table:
-- packet.header - contains header specific values
-- packet.header.raw - contains the complete un-parsed header (string)
-- packet.header.data_len - contains the length of the data block
-- packet.data - contains the complete un-parsed data block (string)
--
-- @param magic byte containing a value of unknown function (could be type)
-- @param data string containing the db2 packet data
-- @return table as described above
--
function create_das_packet( magic, data )

  local packet = {}
  local data_len = data:len()

  packet.header = {}

  packet.header.raw = "\x00\x00\x00\x00\x44\x42\x32\x44\x41\x53\x20\x20\x20\x20\x20\x20"
  .. "\x01\x04\x00\x00\x00\x10\x39\x7a\x00\x05\x00\x00\x00\x00\x00\x00"
  .. "\x00\x00\x00\x00"
  .. string.pack("<B I2", magic, data_len)
  .. "\x00\x00"

  packet.header.data_len = data_len
  packet.data = data

  return packet
end

action = function(host, port)


  -- create the socket used for our connection
  local socket = nmap.new_socket()

  -- set a reasonable timeout value
  socket:set_timeout(10000)

  -- do some exception handling / cleanup
  local catch = function()
    stdnse.debug1("ERROR communicating with " .. host.ip .. " on port " .. port.number)
    socket:close()
  end

  local try = nmap.new_try(catch)


  try(socket:connect(host, port))

  local query

  -- ************************************************************************************
  -- Transaction block 1
  -- ************************************************************************************
  local data = "\x00\x00\x00\x0d\x00\x00\x00\x0c\x00\x00\x00\x4a\x00"

  --try(socket:send(query))
  local db2packet = create_das_packet(0x02, data)

  send_db2_packet( socket, db2packet )
  read_db2_packet( socket )

  -- ************************************************************************************
  -- Transaction block 2
  -- ************************************************************************************
  data = "\x00\x00\x00\x2c\x00\x00\x00"
  .. "\x0c\x00\x00\x00\x08\x59\xe7\x1f\x4b\x79\xf0\x90\x72\x85\xe0\x8f"
  .. "\x3e\x38\x45\x38\xe3\xe5\x12\xc4\x3b\xe9\x7d\xe2\xf5\xf0\x78\xcc"
  .. "\x81\x6f\x87\x5f\x91"

  db2packet = create_das_packet(0x05, data)

  send_db2_packet( socket, db2packet )
  read_db2_packet( socket )

  -- ************************************************************************************
  -- Transaction block 3
  -- ************************************************************************************
  data = "\x00\x00\x00\x0d\x00\x00\x00\x0c\x00\x00\x00\x4a\x01\x00\x00\x00"
  .. "\x10\x00\x00\x00\x0c\x00\x00\x00\x4c\xff\xff\xff\xff\x00\x00\x00"
  .. "\x20\x00\x00\x00\x0c\x00\x00\x00\x04\x00\x00\x04\xb8\x64\x62\x32"
  .. "\x64\x61\x73\x4b\x6e\x6f\x77\x6e\x44\x73\x63\x76\x00\x00\x00\x00"
  .. "\x20\x00\x00\x00\x0c\x00\x00\x00\x04\x00\x00\x04\xb8\x64\x62\x32"
  .. "\x4b\x6e\x6f\x77\x6e\x44\x73\x63\x76\x53\x72\x76\x00"

  db2packet = create_das_packet(0x0a, data)
  send_db2_packet( socket, db2packet )
  read_db2_packet( socket )

  -- ************************************************************************************
  -- Transaction block 4
  -- ************************************************************************************
  data = "\x00\x00\x00\x0d\x00\x00\x00\x0c\x00\x00\x00\x4a\x01\x00\x00\x00"
  .. "\x20\x00\x00\x00\x0c\x00\x00\x00\x08\x00\x00\x00\x00\x00\x00\x03"
  .. "\x48\x00\x00\x00\x00\x4a\xfb\x42\x90\x00\x00\x24\x93\x00\x00\x00"
  .. "\x10\x00\x00\x00\x0c\x00\x00\x00\x4c\xff\xff\xff\xff\x00\x00\x00"
  .. "\x10\x00\x00\x00\x0c\x00\x00\x00\x4c\xff\xff\xff\xff\x00\x00\x00"
  .. "\x20\x00\x00\x00\x0c\x00\x00\x00\x04\x00\x00\x04\xb8\x64\x62\x32"
  .. "\x4b\x6e\x6f\x77\x6e\x44\x73\x63\x76\x53\x72\x76\x00\x00\x00\x00"
  .. "\x20\x00\x00\x00\x0c\x00\x00\x00\x04\x00\x00\x04\xb8\x64\x62\x32"
  .. "\x64\x61\x73\x4b\x6e\x6f\x77\x6e\x44\x73\x63\x76\x00\x00\x00\x00"
  .. "\x0c\x00\x00\x00\x0c\x00\x00\x00\x04\x00\x00\x00\x10\x00\x00\x00"
  .. "\x0c\x00\x00\x00\x4c\xff\xff\xff\xff\x00\x00\x00\x10\x00\x00\x00"
  .. "\x0c\x00\x00\x00\x4c\xff\xff\xff\xff\x00\x00\x00\x11\x00\x00\x00"
  .. "\x0c\x00\x00\x00\x04\x00\x00\x04\xb8\x00"

  db2packet = create_das_packet(0x06, data)
  send_db2_packet( socket, db2packet )

  data =  "\x00\x00\x00\x20\x00\x00\x00\x0c\x00\x00\x00\x04\x00"
  .. "\x00\x04\xb8\x64\x62\x32\x64\x61\x73\x4b\x6e\x6f\x77\x6e\x44\x73"
  .. "\x63\x76\x00\x00\x00\x00\x20\x00\x00\x00\x0c\x00\x00\x00\x04\x00"
  .. "\x00\x04\xb8\x64\x62\x32\x4b\x6e\x6f\x77\x6e\x44\x73\x63\x76\x53"
  .. "\x72\x76\x00\x00\x00\x00\x10\x00\x00\x00\x0c\x00\x00\x00\x4c\x00"
  .. "\x00\x00\x00\x00\x00\x00\x10\x00\x00\x00\x0c\x00\x00\x00\x4c\x00"
  .. "\x00\x00\x01\x00\x00\x00\x10\x00\x00\x00\x0c\x00\x00\x00\x4c\x00"
  .. "\x00\x00\x00\x00\x00\x00\x0c\x00\x00\x00\x0c\x00\x00\x00\x08\x00"
  .. "\x00\x00\x10\x00\x00\x00\x0c\x00\x00\x00\x4c\x00\x00\x00\x01\x00"
  .. "\x00\x00\x18\x00\x00\x00\x0c\x00\x00\x00\x08\x00\x00\x00\x0c\x00"
  .. "\x00\x00\x0c\x00\x00\x00\x18"

  db2packet = create_das_packet(0x06, data)
  send_db2_packet( socket, db2packet )

  local packet = read_db2_packet( socket )
  local db2response = parse_db2_packet(packet)

  socket:close()

  -- The next block of code is essentially the version extraction code from db2-info.nse
  local server_version
  if string.sub(db2response.version,1,3) == "SQL" then
    local major_version = string.sub(db2response.version,4,5)

    -- strip the leading 0 from the major version, for consistency with
    -- nmap-service-probes results
    if string.sub(major_version,1,1) == "0" then
      major_version = string.sub(major_version,2)
    end
    local minor_version = string.sub(db2response.version,6,7)
    local hotfix = string.sub(db2response.version,8)
    server_version = major_version .. "." .. minor_version .. "." .. hotfix
  end

  -- Try to determine which of the two values (probe version vs script) has more
  -- precision.  A couple DB2 versions send DB2 UDB 7.1 vs SQL090204 (9.02.04)
  local _
  local current_count = 0
  if port.version.version ~= nil then
    _, current_count = string.gsub(port.version.version, "%.", ".")
  end

  local new_count = 0
  if server_version ~= nil then
    _, new_count = string.gsub(server_version, "%.", ".")
  end

  if current_count < new_count then
    port.version.version = server_version
  end

  local result = false

  local db2profile = extract_server_profile( db2response.info )

  if (db2profile ~= nil ) then
    result = "DB2 Administration Server Settings\r\n"
    .. extract_server_profile( db2response.info )

    -- Set port information
    port.version.name = "ibm-db2"
    port.version.product = "IBM DB2 Database Server"
    port.version.name_confidence = 10
    nmap.set_port_version(host, port)
    nmap.set_port_state(host, port, "open")
  end

  return result

end