Lucene search

K
nmapPatrik KarlssonNMAP:NCP-SERVERINFO.NSE
HistoryMay 28, 2011 - 9:01 a.m.

ncp-serverinfo NSE Script

2011-05-2809:01:31
Patrik Karlsson
nmap.org
122

9.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

10 High

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:N/AC:L/Au:N/C:C/I:C/A:C

0.973 High

EPSS

Percentile

99.8%

Retrieves eDirectory server information (OS version, server name, mounts, etc.) from the Novell NetWare Core Protocol (NCP) service.

Example Usage

nmap -sV -sC <target>

Script Output

PORT    STATE SERVICE
524/tcp open  ncp
| ncp-serverinfo:
|   Server name: LINUX-L84T
|   Tree Name: IIT-LABTREE
|   OS Version: 5.70 (rev 7)
|   Product version: 6.50 (rev 7)
|   OS Language ID: 4
|   Addresses
|     10.0.200.33 524/udp
|     10.0.200.33 524/tcp
|   Mounts
|     SYS
|     ADMIN
|_    _ADMIN

Requires


local ncp = require "ncp"
local shortport = require "shortport"
local stdnse = require "stdnse"

description = [[
Retrieves eDirectory server information (OS version, server name,
mounts, etc.) from the Novell NetWare Core Protocol (NCP) service.
]]

---
--
--@output
-- PORT    STATE SERVICE
-- 524/tcp open  ncp
-- | ncp-serverinfo:
-- |   Server name: LINUX-L84T
-- |   Tree Name: IIT-LABTREE
-- |   OS Version: 5.70 (rev 7)
-- |   Product version: 6.50 (rev 7)
-- |   OS Language ID: 4
-- |   Addresses
-- |     10.0.200.33 524/udp
-- |     10.0.200.33 524/tcp
-- |   Mounts
-- |     SYS
-- |     ADMIN
-- |_    _ADMIN

-- Version 0.1
-- Created 04/26/2011 - v0.1 - created by Patrik Karlsson

author = "Patrik Karlsson"
license = "Same as Nmap--See https://nmap.org/book/man-legal.html"
categories = {"default", "discovery", "safe"}


portrule = shortport.port_or_service(524, "ncp", "tcp")

action = function(host, port)
  local helper = ncp.Helper:new(host,port)

  local status, resp = helper:connect()
  if ( not(status) ) then return stdnse.format_output(false, resp) end

  status, resp = helper:getServerInfo()
  if ( not(status) ) then return stdnse.format_output(false, resp) end

  helper:close()

  return stdnse.format_output(true, resp)
end

9.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

10 High

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:N/AC:L/Au:N/C:C/I:C/A:C

0.973 High

EPSS

Percentile

99.8%

Related for NMAP:NCP-SERVERINFO.NSE