DCE/RPC and MSRPC Services Enumeration Reporting

# SPDX-FileCopyrightText: 2017 Greenbone AG
# Some text descriptions might be excerpted from (a) referenced
# source(s), and are Copyright (C) by the respective right holder(s).
#
# SPDX-License-Identifier: GPL-2.0-only

if(description)
{
  script_oid("1.3.6.1.4.1.25623.1.0.10736");
  script_version("2025-11-26T05:40:08+0000");
  script_tag(name:"last_modification", value:"2025-11-26 05:40:08 +0000 (Wed, 26 Nov 2025)");
  script_tag(name:"creation_date", value:"2017-01-12 15:08:04 +0100 (Thu, 12 Jan 2017)");
  script_tag(name:"cvss_base", value:"5.0");
  script_tag(name:"cvss_base_vector", value:"AV:N/AC:L/Au:N/C:P/I:N/A:N");

  script_tag(name:"qod_type", value:"remote_banner");

  script_tag(name:"solution_type", value:"Mitigation");

  script_name("DCE/RPC and MSRPC Services Enumeration Reporting");

  script_category(ACT_GATHER_INFO);

  script_family("Windows");
  script_copyright("Copyright (C) 2017 Greenbone AG");
  script_dependencies("dcetest.nasl");
  script_require_ports("Services/epmap", 135);
  script_mandatory_keys("dcetest/enumerated");

  script_add_preference(name:"Report local DCE services", type:"checkbox", value:"no", id:1);

  script_tag(name:"summary", value:"Distributed Computing Environment / Remote Procedure Calls
  (DCE/RPC) or MSRPC based service enumeration reporting.");

  script_tag(name:"vuldetect", value:"Reports previously collected (via 'DCE/RPC and MSRPC Services
  Enumeration' OID: 1.3.6.1.4.1.25623.1.0.108044) DCE/RPC or MSRPC services.

  This VT is reporting a severity by default. If the scanned network is e.g. a private LAN / private
  WAN which contains systems not accessible to the public (access restricted) and it is accepted
  that the service is disclosing information to this network please set the 'Network type'
  configuration of the following VT to e.g. 'Private LAN' or 'Private WAN':

  Global variable settings (OID: 1.3.6.1.4.1.25623.1.0.12288)

  In this case a 'Log' level result is used instead.");

  script_tag(name:"insight", value:"DCE/RPC or MSRPC services running on the remote host can be
  enumerated by connecting on port 135 and doing the appropriate queries.");

  script_tag(name:"impact", value:"An attacker may use this information to gain more knowledge about
  the remote host and to conduct further attacks based on it.");

  script_tag(name:"affected", value:"All systems exposing / disclosing information via DCE/RPC or
  MSRPC services.");

  script_tag(name:"solution", value:"Filter incoming traffic to this ports.");

  exit(0);
}

include("port_service_func.inc");
include("network_func.inc");

port = service_get_port( default:135, proto:"epmap" );

if( ! get_kb_item( "dcetest/" + port + "/enumerated" ) )
  exit( 0 );

# nb: No need to use e.g. islocalhost() here as our scanner isn't supported on Windows and there
# should be no results on self scans.
if( net_setting_is_private_lan_or_wan() )
  use_log_message = TRUE;

all_tcp_ports = get_kb_list( "dcetest/" + port + "/enumerated/tcp/ports" );

if( ! isnull( all_tcp_ports ) ) {

  report += 'Here is the list of DCE/RPC or MSRPC services running on this host via the TCP protocol:\n\n';

  # Sort to not report changes on delta reports if just the order is different
  all_tcp_ports = sort( all_tcp_ports );

  foreach tcp_port( all_tcp_ports ) {

    tcp_reports = get_kb_list( "dcetest/" + port + "/enumerated/tcp/" + tcp_port + "/report" );

    if( ! isnull( tcp_reports ) ) {

      service_report = 'The following DCE/RPC or MSRPC services are running on this port:\n\n';
      report += "Port: " +  tcp_port + '/tcp\n\n';
      # Sort to not report changes on delta reports if just the order is different
      tcp_reports = sort( tcp_reports );

      foreach tcp_report( tcp_reports ) {
        report += tcp_report + '\n';
        service_report += tcp_report + '\n';
      }

      if( get_port_state( tcp_port ) )
        log_message( port:tcp_port, proto:"tcp", data:service_report );
    }
  }
}

all_udp_ports = get_kb_list( "dcetest/" + port + "/enumerated/udp/ports" );

if( ! isnull( all_udp_ports ) ) {

  report += 'Here is the list of DCE/RPC or MSRPC services running on this host via the UDP protocol:\n\n';

  # Sort to not report changes on delta reports if just the order is different
  all_udp_ports = sort( all_udp_ports );

  foreach udp_port( all_udp_ports ) {

    udp_reports = get_kb_list( "dcetest/" + port + "/enumerated/udp/" + udp_port + "/report" );

    if( ! isnull( udp_reports ) ) {

      service_report = 'The following DCE/RPC or MSRPC services are running on this port:\n\n';
      report += "Port: " +  udp_port + '/udp\n\n';
      # Sort to not report changes on delta reports if just the order is different
      udp_reports = sort( udp_reports );

      foreach udp_report( udp_reports ) {
        report += udp_report + '\n';
        service_report += tcp_report + '\n';
      }

      if( get_udp_port_state( udp_port ) )
        log_message( port:udp_port, proto:"udp", data:service_report );
    }
  }
}

noport_reports = get_kb_list( "dcetest/" + port + "/enumerated/noport/report" );

if( ! isnull( noport_reports ) ) {

  reportLocal = script_get_preference( "Report local DCE services", id:1 );

  if( reportLocal == "yes" ) {

    report += 'Here is the list of DCE/RPC or MSRPC services running on this host locally:\n\n';

    # Sort to not report changes on delta reports if just the order is different
    noport_reports = sort( noport_reports );

    foreach noport_report( noport_reports ) {
      report += noport_report + '\n';
    }
  } else {
    report += "Note: DCE/RPC or MSRPC services running on this host locally were identified. ";
    report += "Reporting this list is not enabled by default due to the possible large size of this list. ";
    report += "See the script preferences to enable this reporting.";
  }
}

if( use_log_message )
  log_message( port:port, data:report );
else
  security_message( port:port, data:report );

exit( 0 );