9.8 High
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
10 High
CVSS2
Access Vector
NETWORK
Access Complexity
LOW
Authentication
NONE
Confidentiality Impact
COMPLETE
Integrity Impact
COMPLETE
Availability Impact
COMPLETE
AV:N/AC:L/Au:N/C:C/I:C/A:C
0.973 High
EPSS
Percentile
99.8%
Spiders a site’s images looking for interesting exif data embedded in .jpg files. Displays the make and model of the camera, the date the photo was taken, and the embedded geotag information.
the url to start spidering. This is a URL relative to the scanned host eg. /default.html (default: /)
See the documentation for the slaxml library.
See the documentation for the httpspider library.
See the documentation for the http library.
See the documentation for the smbauth library.
nmap --script http-exif-spider -p80,443 <host>
PORT STATE SERVICE REASON
80/tcp open http syn-ack
| http-exif-spider:
| http://www.javaop.com/Nationalmuseum.jpg
| Make: Canon
| Model: Canon PowerShot S100\xB4
| Date: 2003:03:29 13:35:40
| http://www.javaop.com/topleft.jpg
|_ GPS: 49.941250,-97.206189 - https://maps.google.com/maps?q=49.94125,-97.20618863493
description = [[
Spiders a site's images looking for interesting exif data embedded in
.jpg files. Displays the make and model of the camera, the date the photo was
taken, and the embedded geotag information.
]]
---
-- @usage
-- nmap --script http-exif-spider -p80,443 <host>
--
-- @output
-- PORT STATE SERVICE REASON
-- 80/tcp open http syn-ack
-- | http-exif-spider:
-- | http://www.javaop.com/Nationalmuseum.jpg
-- | Make: Canon
-- | Model: Canon PowerShot S100\xB4
-- | Date: 2003:03:29 13:35:40
-- | http://www.javaop.com/topleft.jpg
-- |_ GPS: 49.941250,-97.206189 - https://maps.google.com/maps?q=49.94125,-97.20618863493
--
-- @args http-exif-spider.url the url to start spidering. This is a URL
-- relative to the scanned host eg. /default.html (default: /)
author = "Ron Bowes"
license = "Same as Nmap--See https://nmap.org/book/man-legal.html"
categories = {"intrusive"}
local shortport = require 'shortport'
local stdnse = require 'stdnse'
local httpspider = require 'httpspider'
local string = require 'string'
local table = require 'table'
-- These definitions are copied/pasted/reformatted from the jhead-2.96 sourcecode
-- (the code is effectively public domain, but credit where credit's due!)
TAG_INTEROP_INDEX = 0x0001
TAG_INTEROP_VERSION = 0x0002
TAG_IMAGE_WIDTH = 0x0100
TAG_IMAGE_LENGTH = 0x0101
TAG_BITS_PER_SAMPLE = 0x0102
TAG_COMPRESSION = 0x0103
TAG_PHOTOMETRIC_INTERP = 0x0106
TAG_FILL_ORDER = 0x010A
TAG_DOCUMENT_NAME = 0x010D
TAG_IMAGE_DESCRIPTION = 0x010E
TAG_MAKE = 0x010F
TAG_MODEL = 0x0110
TAG_SRIP_OFFSET = 0x0111
TAG_ORIENTATION = 0x0112
TAG_SAMPLES_PER_PIXEL = 0x0115
TAG_ROWS_PER_STRIP = 0x0116
TAG_STRIP_BYTE_COUNTS = 0x0117
TAG_X_RESOLUTION = 0x011A
TAG_Y_RESOLUTION = 0x011B
TAG_PLANAR_CONFIGURATION = 0x011C
TAG_RESOLUTION_UNIT = 0x0128
TAG_TRANSFER_FUNCTION = 0x012D
TAG_SOFTWARE = 0x0131
TAG_DATETIME = 0x0132
TAG_ARTIST = 0x013B
TAG_WHITE_POINT = 0x013E
TAG_PRIMARY_CHROMATICITIES = 0x013F
TAG_TRANSFER_RANGE = 0x0156
TAG_JPEG_PROC = 0x0200
TAG_THUMBNAIL_OFFSET = 0x0201
TAG_THUMBNAIL_LENGTH = 0x0202
TAG_Y_CB_CR_COEFFICIENTS = 0x0211
TAG_Y_CB_CR_SUB_SAMPLING = 0x0212
TAG_Y_CB_CR_POSITIONING = 0x0213
TAG_REFERENCE_BLACK_WHITE = 0x0214
TAG_RELATED_IMAGE_WIDTH = 0x1001
TAG_RELATED_IMAGE_LENGTH = 0x1002
TAG_CFA_REPEAT_PATTERN_DIM = 0x828D
TAG_CFA_PATTERN1 = 0x828E
TAG_BATTERY_LEVEL = 0x828F
TAG_COPYRIGHT = 0x8298
TAG_EXPOSURETIME = 0x829A
TAG_FNUMBER = 0x829D
TAG_IPTC_NAA = 0x83BB
TAG_EXIF_OFFSET = 0x8769
TAG_INTER_COLOR_PROFILE = 0x8773
TAG_EXPOSURE_PROGRAM = 0x8822
TAG_SPECTRAL_SENSITIVITY = 0x8824
TAG_GPSINFO = 0x8825
TAG_ISO_EQUIVALENT = 0x8827
TAG_OECF = 0x8828
TAG_EXIF_VERSION = 0x9000
TAG_DATETIME_ORIGINAL = 0x9003
TAG_DATETIME_DIGITIZED = 0x9004
TAG_COMPONENTS_CONFIG = 0x9101
TAG_CPRS_BITS_PER_PIXEL = 0x9102
TAG_SHUTTERSPEED = 0x9201
TAG_APERTURE = 0x9202
TAG_BRIGHTNESS_VALUE = 0x9203
TAG_EXPOSURE_BIAS = 0x9204
TAG_MAXAPERTURE = 0x9205
TAG_SUBJECT_DISTANCE = 0x9206
TAG_METERING_MODE = 0x9207
TAG_LIGHT_SOURCE = 0x9208
TAG_FLASH = 0x9209
TAG_FOCALLENGTH = 0x920A
TAG_SUBJECTAREA = 0x9214
TAG_MAKER_NOTE = 0x927C
TAG_USERCOMMENT = 0x9286
TAG_SUBSEC_TIME = 0x9290
TAG_SUBSEC_TIME_ORIG = 0x9291
TAG_SUBSEC_TIME_DIG = 0x9292
TAG_WINXP_TITLE = 0x9c9b
TAG_WINXP_COMMENT = 0x9c9c
TAG_WINXP_AUTHOR = 0x9c9d
TAG_WINXP_KEYWORDS = 0x9c9e
TAG_WINXP_SUBJECT = 0x9c9f
TAG_FLASH_PIX_VERSION = 0xA000
TAG_COLOR_SPACE = 0xA001
TAG_PIXEL_X_DIMENSION = 0xA002
TAG_PIXEL_Y_DIMENSION = 0xA003
TAG_RELATED_AUDIO_FILE = 0xA004
TAG_INTEROP_OFFSET = 0xA005
TAG_FLASH_ENERGY = 0xA20B
TAG_SPATIAL_FREQ_RESP = 0xA20C
TAG_FOCAL_PLANE_XRES = 0xA20E
TAG_FOCAL_PLANE_YRES = 0xA20F
TAG_FOCAL_PLANE_UNITS = 0xA210
TAG_SUBJECT_LOCATION = 0xA214
TAG_EXPOSURE_INDEX = 0xA215
TAG_SENSING_METHOD = 0xA217
TAG_FILE_SOURCE = 0xA300
TAG_SCENE_TYPE = 0xA301
TAG_CFA_PATTERN = 0xA302
TAG_CUSTOM_RENDERED = 0xA401
TAG_EXPOSURE_MODE = 0xA402
TAG_WHITEBALANCE = 0xA403
TAG_DIGITALZOOMRATIO = 0xA404
TAG_FOCALLENGTH_35MM = 0xA405
TAG_SCENE_CAPTURE_TYPE = 0xA406
TAG_GAIN_CONTROL = 0xA407
TAG_CONTRAST = 0xA408
TAG_SATURATION = 0xA409
TAG_SHARPNESS = 0xA40A
TAG_DISTANCE_RANGE = 0xA40C
TAG_IMAGE_UNIQUE_ID = 0xA420
TagTable = {}
TagTable[TAG_INTEROP_INDEX] = "InteropIndex"
TagTable[TAG_INTEROP_VERSION] = "InteropVersion"
TagTable[TAG_IMAGE_WIDTH] = "ImageWidth"
TagTable[TAG_IMAGE_LENGTH] = "ImageLength"
TagTable[TAG_BITS_PER_SAMPLE] = "BitsPerSample"
TagTable[TAG_COMPRESSION] = "Compression"
TagTable[TAG_PHOTOMETRIC_INTERP] = "PhotometricInterpretation"
TagTable[TAG_FILL_ORDER] = "FillOrder"
TagTable[TAG_DOCUMENT_NAME] = "DocumentName"
TagTable[TAG_IMAGE_DESCRIPTION] = "ImageDescription"
TagTable[TAG_MAKE] = "Make"
TagTable[TAG_MODEL] = "Model"
TagTable[TAG_SRIP_OFFSET] = "StripOffsets"
TagTable[TAG_ORIENTATION] = "Orientation"
TagTable[TAG_SAMPLES_PER_PIXEL] = "SamplesPerPixel"
TagTable[TAG_ROWS_PER_STRIP] = "RowsPerStrip"
TagTable[TAG_STRIP_BYTE_COUNTS] = "StripByteCounts"
TagTable[TAG_X_RESOLUTION] = "XResolution"
TagTable[TAG_Y_RESOLUTION] = "YResolution"
TagTable[TAG_PLANAR_CONFIGURATION] = "PlanarConfiguration"
TagTable[TAG_RESOLUTION_UNIT] = "ResolutionUnit"
TagTable[TAG_TRANSFER_FUNCTION] = "TransferFunction"
TagTable[TAG_SOFTWARE] = "Software"
TagTable[TAG_DATETIME] = "DateTime"
TagTable[TAG_ARTIST] = "Artist"
TagTable[TAG_WHITE_POINT] = "WhitePoint"
TagTable[TAG_PRIMARY_CHROMATICITIES]= "PrimaryChromaticities"
TagTable[TAG_TRANSFER_RANGE] = "TransferRange"
TagTable[TAG_JPEG_PROC] = "JPEGProc"
TagTable[TAG_THUMBNAIL_OFFSET] = "ThumbnailOffset"
TagTable[TAG_THUMBNAIL_LENGTH] = "ThumbnailLength"
TagTable[TAG_Y_CB_CR_COEFFICIENTS] = "YCbCrCoefficients"
TagTable[TAG_Y_CB_CR_SUB_SAMPLING] = "YCbCrSubSampling"
TagTable[TAG_Y_CB_CR_POSITIONING] = "YCbCrPositioning"
TagTable[TAG_REFERENCE_BLACK_WHITE] = "ReferenceBlackWhite"
TagTable[TAG_RELATED_IMAGE_WIDTH] = "RelatedImageWidth"
TagTable[TAG_RELATED_IMAGE_LENGTH] = "RelatedImageLength"
TagTable[TAG_CFA_REPEAT_PATTERN_DIM]= "CFARepeatPatternDim"
TagTable[TAG_CFA_PATTERN1] = "CFAPattern"
TagTable[TAG_BATTERY_LEVEL] = "BatteryLevel"
TagTable[TAG_COPYRIGHT] = "Copyright"
TagTable[TAG_EXPOSURETIME] = "ExposureTime"
TagTable[TAG_FNUMBER] = "FNumber"
TagTable[TAG_IPTC_NAA] = "IPTC/NAA"
TagTable[TAG_EXIF_OFFSET] = "ExifOffset"
TagTable[TAG_INTER_COLOR_PROFILE] = "InterColorProfile"
TagTable[TAG_EXPOSURE_PROGRAM] = "ExposureProgram"
TagTable[TAG_SPECTRAL_SENSITIVITY] = "SpectralSensitivity"
TagTable[TAG_GPSINFO] = "GPS Dir offset"
TagTable[TAG_ISO_EQUIVALENT] = "ISOSpeedRatings"
TagTable[TAG_OECF] = "OECF"
TagTable[TAG_EXIF_VERSION] = "ExifVersion"
TagTable[TAG_DATETIME_ORIGINAL] = "DateTimeOriginal"
TagTable[TAG_DATETIME_DIGITIZED] = "DateTimeDigitized"
TagTable[TAG_COMPONENTS_CONFIG] = "ComponentsConfiguration"
TagTable[TAG_CPRS_BITS_PER_PIXEL] = "CompressedBitsPerPixel"
TagTable[TAG_SHUTTERSPEED] = "ShutterSpeedValue"
TagTable[TAG_APERTURE] = "ApertureValue"
TagTable[TAG_BRIGHTNESS_VALUE] = "BrightnessValue"
TagTable[TAG_EXPOSURE_BIAS] = "ExposureBiasValue"
TagTable[TAG_MAXAPERTURE] = "MaxApertureValue"
TagTable[TAG_SUBJECT_DISTANCE] = "SubjectDistance"
TagTable[TAG_METERING_MODE] = "MeteringMode"
TagTable[TAG_LIGHT_SOURCE] = "LightSource"
TagTable[TAG_FLASH] = "Flash"
TagTable[TAG_FOCALLENGTH] = "FocalLength"
TagTable[TAG_MAKER_NOTE] = "MakerNote"
TagTable[TAG_USERCOMMENT] = "UserComment"
TagTable[TAG_SUBSEC_TIME] = "SubSecTime"
TagTable[TAG_SUBSEC_TIME_ORIG] = "SubSecTimeOriginal"
TagTable[TAG_SUBSEC_TIME_DIG] = "SubSecTimeDigitized"
TagTable[TAG_WINXP_TITLE] = "Windows-XP Title"
TagTable[TAG_WINXP_COMMENT] = "Windows-XP comment"
TagTable[TAG_WINXP_AUTHOR] = "Windows-XP author"
TagTable[TAG_WINXP_KEYWORDS] = "Windows-XP keywords"
TagTable[TAG_WINXP_SUBJECT] = "Windows-XP subject"
TagTable[TAG_FLASH_PIX_VERSION] = "FlashPixVersion"
TagTable[TAG_COLOR_SPACE] = "ColorSpace"
TagTable[TAG_PIXEL_X_DIMENSION] = "ExifImageWidth"
TagTable[TAG_PIXEL_Y_DIMENSION] = "ExifImageLength"
TagTable[TAG_RELATED_AUDIO_FILE] = "RelatedAudioFile"
TagTable[TAG_INTEROP_OFFSET] = "InteroperabilityOffset"
TagTable[TAG_FLASH_ENERGY] = "FlashEnergy"
TagTable[TAG_SPATIAL_FREQ_RESP] = "SpatialFrequencyResponse"
TagTable[TAG_FOCAL_PLANE_XRES] = "FocalPlaneXResolution"
TagTable[TAG_FOCAL_PLANE_YRES] = "FocalPlaneYResolution"
TagTable[TAG_FOCAL_PLANE_UNITS] = "FocalPlaneResolutionUnit"
TagTable[TAG_SUBJECT_LOCATION] = "SubjectLocation"
TagTable[TAG_EXPOSURE_INDEX] = "ExposureIndex"
TagTable[TAG_SENSING_METHOD] = "SensingMethod"
TagTable[TAG_FILE_SOURCE] = "FileSource"
TagTable[TAG_SCENE_TYPE] = "SceneType"
TagTable[TAG_CFA_PATTERN] = "CFA Pattern"
TagTable[TAG_CUSTOM_RENDERED] = "CustomRendered"
TagTable[TAG_EXPOSURE_MODE] = "ExposureMode"
TagTable[TAG_WHITEBALANCE] = "WhiteBalance"
TagTable[TAG_DIGITALZOOMRATIO] = "DigitalZoomRatio"
TagTable[TAG_FOCALLENGTH_35MM] = "FocalLengthIn35mmFilm"
TagTable[TAG_SUBJECTAREA] = "SubjectArea"
TagTable[TAG_SCENE_CAPTURE_TYPE] = "SceneCaptureType"
TagTable[TAG_GAIN_CONTROL] = "GainControl"
TagTable[TAG_CONTRAST] = "Contrast"
TagTable[TAG_SATURATION] = "Saturation"
TagTable[TAG_SHARPNESS] = "Sharpness"
TagTable[TAG_DISTANCE_RANGE] = "SubjectDistanceRange"
TagTable[TAG_IMAGE_UNIQUE_ID] = "ImageUniqueId"
GPS_TAG_VERSIONID = 0X00
GPS_TAG_LATITUDEREF = 0X01
GPS_TAG_LATITUDE = 0X02
GPS_TAG_LONGITUDEREF = 0X03
GPS_TAG_LONGITUDE = 0X04
GPS_TAG_ALTITUDEREF = 0X05
GPS_TAG_ALTITUDE = 0X06
GPS_TAG_TIMESTAMP = 0X07
GPS_TAG_SATELLITES = 0X08
GPS_TAG_STATUS = 0X09
GPS_TAG_MEASUREMODE = 0X0A
GPS_TAG_DOP = 0X0B
GPS_TAG_SPEEDREF = 0X0C
GPS_TAG_SPEED = 0X0D
GPS_TAG_TRACKREF = 0X0E
GPS_TAG_TRACK = 0X0F
GPS_TAG_IMGDIRECTIONREF = 0X10
GPS_TAG_IMGDIRECTION = 0X11
GPS_TAG_MAPDATUM = 0X12
GPS_TAG_DESTLATITUDEREF = 0X13
GPS_TAG_DESTLATITUDE = 0X14
GPS_TAG_DESTLONGITUDEREF = 0X15
GPS_TAG_DESTLONGITUDE = 0X16
GPS_TAG_DESTBEARINGREF = 0X17
GPS_TAG_DESTBEARING = 0X18
GPS_TAG_DESTDISTANCEREF = 0X19
GPS_TAG_DESTDISTANCE = 0X1A
GPS_TAG_PROCESSINGMETHOD = 0X1B
GPS_TAG_AREAINFORMATION = 0X1C
GPS_TAG_DATESTAMP = 0X1D
GPS_TAG_DIFFERENTIAL = 0X1E
GpsTagTable = {}
GpsTagTable[GPS_TAG_VERSIONID] = "VersionID"
GpsTagTable[GPS_TAG_LATITUDEREF] = "LatitudeRef"
GpsTagTable[GPS_TAG_LATITUDE] = "Latitude"
GpsTagTable[GPS_TAG_LONGITUDEREF] = "LongitudeRef"
GpsTagTable[GPS_TAG_LONGITUDE] = "Longitude"
GpsTagTable[GPS_TAG_ALTITUDEREF] = "AltitudeRef"
GpsTagTable[GPS_TAG_ALTITUDE] = "Altitude"
GpsTagTable[GPS_TAG_TIMESTAMP] = "Timestamp"
GpsTagTable[GPS_TAG_SATELLITES] = "Satellites"
GpsTagTable[GPS_TAG_STATUS] = "Status"
GpsTagTable[GPS_TAG_MEASUREMODE] = "MeasureMode"
GpsTagTable[GPS_TAG_DOP] = "Dop"
GpsTagTable[GPS_TAG_SPEEDREF] = "SpeedRef"
GpsTagTable[GPS_TAG_SPEED] = "Speed"
GpsTagTable[GPS_TAG_TRACKREF] = "TrafRef"
GpsTagTable[GPS_TAG_TRACK] = "Track"
GpsTagTable[GPS_TAG_IMGDIRECTIONREF] = "ImgDirectionRef"
GpsTagTable[GPS_TAG_IMGDIRECTION] = "ImgDirection"
GpsTagTable[GPS_TAG_MAPDATUM] = "MapDatum"
GpsTagTable[GPS_TAG_DESTLATITUDEREF] = "DestLatitudeRef"
GpsTagTable[GPS_TAG_DESTLATITUDE] = "DestLatitude"
GpsTagTable[GPS_TAG_DESTLONGITUDEREF]= "DestLongitudeRef"
GpsTagTable[GPS_TAG_DESTLONGITUDE] = "DestLongitude"
GpsTagTable[GPS_TAG_DESTBEARINGREF] = "DestBearingref"
GpsTagTable[GPS_TAG_DESTBEARING] = "DestBearing"
GpsTagTable[GPS_TAG_DESTDISTANCEREF] = "DestDistanceRef"
GpsTagTable[GPS_TAG_DESTDISTANCE] = "DestDistance"
GpsTagTable[GPS_TAG_PROCESSINGMETHOD]= "ProcessingMethod"
GpsTagTable[GPS_TAG_AREAINFORMATION] = "AreaInformation"
GpsTagTable[GPS_TAG_DATESTAMP] = "Datestamp"
GpsTagTable[GPS_TAG_DIFFERENTIAL] = "Differential"
FMT_BYTE = 1
FMT_STRING = 2
FMT_USHORT = 3
FMT_ULONG = 4
FMT_URATIONAL = 5
FMT_SBYTE = 6
FMT_UNDEFINED = 7
FMT_SSHORT = 8
FMT_SLONG = 9
FMT_SRATIONAL = 10
FMT_SINGLE = 11
FMT_DOUBLE = 12
bytes_per_format = {0,1,1,2,4,8,1,1,2,4,8,4,8}
portrule = shortport.http
---Unpack a rational number from exif. In exif, a rational number is stored
--as a pair of integers - the numerator and the denominator.
--
--@return the new position, and the value.
local function unpack_rational(endian, data, pos)
local v1, v2
v1, v2, pos = string.unpack(endian .. "I4I4", data, pos)
return pos, v1 / v2
end
local function process_gps(data, pos, endian, result)
local value, num_entries
local latitude, latitude_ref, longitude, longitude_ref
-- The first entry in the gps section is a 16-bit size
num_entries, pos = string.unpack(endian .. "I2", data, pos)
-- Loop through the entries to find the fun stuff
for i=1, num_entries do
local tag, format, components, value
tag, format, components, value, pos = string.unpack(endian .. "I2 I2 I4 I4", data, pos)
if(tag == GPS_TAG_LATITUDE or tag == GPS_TAG_LONGITUDE) then
local dummy, gps, h, m, s
dummy, h = unpack_rational(endian, data, value + 8)
dummy, m = unpack_rational(endian, data, dummy)
dummy, s = unpack_rational(endian, data, dummy)
gps = h + (m / 60) + (s / 60 / 60)
if(tag == GPS_TAG_LATITUDE) then
latitude = gps
else
longitude = gps
end
elseif(tag == GPS_TAG_LATITUDEREF) then
-- Get the first byte in the latitude reference as a character
latitude_ref = string.char(value >> 24)
elseif(tag == GPS_TAG_LONGITUDEREF) then
-- Get the first byte in the longitude reference as a character
longitude_ref = string.char(value >> 24)
end
end
if(latitude and longitude) then
-- Normalize the N/S/E/W to positive and negative
if(latitude_ref == 'S') then
latitude = -latitude
end
if(longitude_ref == 'W') then
longitude = -longitude
end
table.insert(result, string.format("GPS: %f,%f - https://maps.google.com/maps?q=%s,%s", latitude, longitude, latitude, longitude))
end
return true, result
end
---Parse the exif data section and return a table. This has only been tested
--in a .jpeg file, but should work for .tiff as well.
local function parse_exif(exif_data)
local sig, marker, size
local tag, format, components, byte_count, value, offset, dummy, data
local status, result
local tiff_header_1, first_offset
-- Initialize the result table
result = {}
-- Read the verify the EXIF header
local header, endian, pos = string.unpack(">c6 I2", exif_data, 1)
if(header ~= "Exif\0\0") then
return false, "Invalid EXIF header"
end
-- Check the endianness - it should only ever be big endian, but it doesn't
-- hurt to check
if(endian == 0x4d4d) then
endian = ">"
elseif(endian == 0x4949) then
endian = "<"
else
return false, "Unrecognized endianness entry"
end
-- Read the first tiff header and the offset to the first data entry (should be 8)
tiff_header_1, first_offset, pos = string.unpack(endian .. "I2 I4", exif_data, pos)
if(tiff_header_1 ~= 0x002A or first_offset ~= 0x00000008) then
return false, "Invalid tiff header"
end
-- Skip over the header, and go to the first offset (subtracting 1 because lua)
pos = first_offset + 8 - 1
-- The first 16-bit value is the number of entries
local num_entries, pos = string.unpack(endian .. "I2", exif_data, pos)
-- Loop through the entries
for i=1,num_entries do
-- Read the entry's header
tag, format, components, value, pos = string.unpack(endian .. "I2 I2 I4 I4", exif_data, pos)
-- Look at the tags we care about
if(tag == TAG_GPSINFO) then
-- If it's a GPSINFO tag, we need to parse the GPS structure
status, result = process_gps(exif_data, value + 8 - 1, endian, result)
if(not(status)) then
return false, result
end
else
value = string.unpack("z", exif_data, value + 8 - 1)
if (tag == TAG_MAKE) then
table.insert(result, string.format("Make: %s", value))
elseif(tag == TAG_MODEL) then
table.insert(result, string.format("Model: %s", value))
elseif(tag == TAG_DATETIME) then
table.insert(result, string.format("Date: %s", value))
end
end
end
return true, result
end
---Parse a jpeg and find the EXIF data section
local function parse_jpeg(s)
local pos, sig, marker, size, exif_data
-- Parse the jpeg header, make sure it's valid (we expect 0xFFD8)
sig, pos = string.unpack(">I2", s, pos)
if(sig ~= 0xFFD8) then
return false, "Unexpected signature"
end
-- Parse the sections to find the exif marker (0xffe1)
while(true) do
marker, size, pos = string.unpack(">I2I2", s, pos)
-- Check if we found the exif metadata section, break if we did
if(marker == 0xffe1) then
break
-- If the marker is nil, we're off the end of the image (and therefore, it wasn't found)
elseif(not(marker)) then
return false, "Could not found EXIF marker"
end
-- Go to the next section (we subtract 2 because of the 2-byte marker we read)
pos = pos + size - 2
end
exif_data, pos = string.unpack(string.format(">c%d", size), s, pos)
return parse_exif(exif_data)
end
function action(host, port)
local pattern = "%.jpg"
local images = {}
local results = {}
-- once we know the pattern we'll be searching for, we can set up the function
local whitelist = function(url)
return string.match(url.file, "%.jpg") or string.match(url.file, "%.jpeg")
end
local crawler = httpspider.Crawler:new( host, port, nil, { scriptname = SCRIPT_NAME, whitelist = { whitelist }} )
if ( not(crawler) ) then
return
end
while(true) do
-- Begin the crawler
local status, r = crawler:crawl()
-- Make sure there's no error
if ( not(status) ) then
if ( r.err ) then
return stdnse.format_output(false, r.reason)
else
break
end
end
-- Check if we got a response, and the response is a .jpg file
if r.response and r.response.body and r.response.status==200 and (string.match(r.url.path, ".jpg") or string.match(r.url.path, ".jpeg")) then
local status, result
stdnse.debug1("Attempting to read exif data from %s", r.url.raw)
status, result = parse_jpeg(r.response.body)
if(not(status)) then
stdnse.debug1("Couldn't read exif from %s: %s", r.url.raw, result)
else
-- If there are any exif results, add them to the result
if(result and #result > 0) then
result['name'] = r.url.raw
table.insert(results, result)
end
end
end
end
return stdnse.format_output(true, results)
end
9.8 High
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
10 High
CVSS2
Access Vector
NETWORK
Access Complexity
LOW
Authentication
NONE
Confidentiality Impact
COMPLETE
Integrity Impact
COMPLETE
Availability Impact
COMPLETE
AV:N/AC:L/Au:N/C:C/I:C/A:C
0.973 High
EPSS
Percentile
99.8%