#TRUSTED 9f0ec90262fa7b7b6465f58974e004b67a36432ada667cd975e31621da9dfa5160b06a360e8219872a431fd4a57e41d04257e7f7011e87e06a2c4a31a89abf93c717518e0a1ae19c22f2326bce6ff1b2a1b500f56ab58cd7815c0aff5f3eca25021f1e14db6eaf9d05e1bc772b59594150a3e9e4b6503553695aec8ddb67a5c7b367a240f5cedb207d49bc6a14478274be8d582ce8077b01119d69e8379c0276fefff03eeda5ee672916b24316f8fa378c8a956856b649d6bb35f905a5eb461180904cfcaa4a4dde24b5d8f8682f4cb4eba0b6d9901aad0191e4fbf2f8b28ec6f39908c9a494ad04e5b89d93a8406282ce8faa08a6acb5ab89360ed0ccab9ff9019606937e0b5423a7e865754f79b10fc3e0af445a72b428abf72991b9be359a1fd18f7a1a0599f01be01bee7191d52d6402d6fdea441d8319c10953c8653d9ca5930dcc9ba7314e4601620e91ca6f4f37dd068d7e51b148233c9848569941eb4c28f7f1598367a95bc2afedbbc06ac740eb619f7a218818444af7e062b9adf96e09cff55d0f8b2ec13dcfde8a98304b2c4a0a89368fbe4e6c05177689c26474de7dd02cdfcf90cac9e18a5965d547a2a176ac4554a9ee7349aa3aedbdfddee3a0d5acf13c08d1b4a50cfef9282660c1e40c615541c22d715d4e19795b0c99a83baf9f3f5fb978bbf2e3517822461d734902b3b1b19b43748da22a5553f102df #TRUST-RSA-SHA256 0d839e692871e80019c51664f89a1bdf2b2a1d59bea3c3e19a60b0a0267174950987d32cc3d9fa282e88839f13524b2a863be34ffb0940c922a2c5ae98f1d10fd898b1b29eeae002f16a0f5ab5d90905de0626b2b57a669dfe4a05889cb75c39d699bf6b2086386b81e83963dc78114765948ed912eaf51f46aa5cc2d9048f653df835f6d5da88a8e53cf101844e528b9b062aac3fc744b39f732c038e24d85df6f391f31161351dd4fa34b39de914d11e493081677bf49cb407724cc121e121a914ba3fa433f01958cd16b0ce3978dad6b1ef94029379b644d8f9710093ffb14afa2c635629aa2d869228b9142d87fd778ba76036057d8b5863a02f3e2890664db366afe41212e9d839af537041446d1a010de5495289dc8ae867b63866bd77fc4eff6ab5a1a2339179db5e8efaff7a686a9ac9beed2216cbe285f6d91ad5f203786c52c85c0a544d5a21f46b4094f4880dd86a700ca5c6eef0eb2da77443c75efcda9a2616a42b39934a401db21d1133d56d6cb91a962c721ff622f74199a68507a4f85afc116227a0433eba98bca6bc15906a3f1e52516a70be131f002789c67e92c5435224910d9396f96e7446a49d3f0083cae247b70f67e95141479ce45656fe93651bd4025b6f7d68e0b21f371ac340d45cf0aae3237469876f5c853566e1e26982b0eee93ac0d9034699a921628b78d5bc81546ac1551eb08eec66d8 # # (C) Tenable Network Security, Inc. # include("compat.inc"); if (description) { script_id(122501); script_version("1.35"); script_name(english:"SSH Rate Limited Device"); script_summary(english:"Attempts to login to remote device and determine if SSH connections are rate limited."); script_set_attribute(attribute:"plugin_modification_date", value:"2026/04/27"); script_set_attribute(attribute:"synopsis", value: "The remote host is a SSH rate limited networking device that may cause intermittent authentication failures throughout the scan."); script_set_attribute(attribute:"description", value: "The remote host is a device that may rate limit connections, potentially causing intermittent authentication failures in other plugins. Local checks will be enabled in this plugin where possible."); script_set_attribute(attribute:"solution", value:"n/a"); script_set_attribute(attribute:"risk_factor",value:"None"); script_set_attribute(attribute:"plugin_publication_date", value:"2019/02/28"); script_set_attribute(attribute:"plugin_type",value:"local"); script_end_attributes(); script_category(ACT_GATHER_INFO); script_family(english:"Misc."); script_copyright(english:"This script is Copyright (C) 2019-2026 and is owned by Tenable, Inc. or an Affiliate thereof."); script_dependencies("ssh_settings.nasl", "clrtxt_proto_settings.nasl", "ping_host.nasl"); exit(0); } include("datetime.inc"); include("string.inc"); include("byte_func.inc"); include("ssh_func.inc"); include("ssh_lib.inc"); include("ssh_get_info2.inc"); include("agent.inc"); include("ssh_rate_limit.inc"); include("telnet_func.inc"); include("junos.inc"); include("structured_data.inc"); var FLATLINE_TEST = !isnull(get_kb_item("flatline/TEST")); # should not be included in agent. disable here to be sure. if(agent()) exit(0,"This plugin is disabled on Nessus Agents."); start_time = gettimeofday(); enable_ssh_wrappers(); if(islocalhost()) info_t = INFO_LOCAL; else info_t = INFO_SSH; # Check if port(s) are open; doing manual because port scanner # have yet to run at this point in the scan. # Build list of ssh_ports to try, preferred port should be first in list var ssh_ports = make_list(22); var pref_port = get_kb_item('Secret/SSH/PreferredPort'); var srl_socket = NULL; var srl_at_least_one_port_open = FALSE; if (pref_port) ssh_ports = make_list(pref_port, ssh_ports); dbg::detailed_log( src:SCRIPT_NAME, lvl:2, msg:"Port list to attempt connections to : " + obj_rep(ssh_ports) ); foreach var port (list_uniq(ssh_ports)) { dbg::detailed_log(src:SCRIPT_NAME, lvl:2, msg:"Connecting to port "+port+"."); if (!FLATLINE_TEST) srl_socket = open_sock_tcp(port, timeout:3); else srl_socket = get_kb_item('flatline/srl_socket'); if (srl_socket) { dbg::detailed_log( src:SCRIPT_NAME, lvl:2, msg:"Connection successfull on port "+port+". Not checking others."); close(srl_socket); srl_at_least_one_port_open = TRUE; break; } else { dbg::detailed_log(src:SCRIPT_NAME, lvl:2, msg:"Unable to connect to port "+port+"."); } } if (!srl_at_least_one_port_open) { dbg::detailed_log( src:SCRIPT_NAME, lvl:2, msg:"Unable to connect to at least one port. Exiting."); audit(AUDIT_NOT_LISTEN, 'Target', 'specified by policy for SSH','any'); } var session = new("sshlib::session"); # disable compression sshlib::KEX_SUPPORTED_NAME_LISTS["compression_algorithms_server_to_client"] = "none"; sshlib::KEX_SUPPORTED_NAME_LISTS["compression_algorithms_client_to_server"] = "none"; # login with placeholder value for channel. new_channel is passed by reference so it will be # picked up later in plugin. var channel = session.get_channel(); var login_res = sshlib::try_ssh_kb_settings_login( session : session, accept_none_auth : TRUE, rate_limit : TRUE, new_channel : channel, force_none_auth : TRUE, no_reuse : TRUE ); # Only report authentication success/failure if we succeeded, otherwise ssh_get_info2.nasl will check again # and is the authoritative source of info for non-rate-limited devices if (login_res) { var reporter = new structured_data_authentication_status_information(); sshlib::report_auth_try(reporter:reporter); delete reporter; } if(!login_res) { dbg::detailed_log(src:SCRIPT_NAME, lvl:1, msg:'Login via sshlib::try_ssh_kb_settings_login has failed.'); # Removing the auth methods detected so that the next plugins can start fresh. var methods = get_kb_list(sshlib::SSH_LIB_KB_PREFIX + "*/supported_login_methods"); for (var key in methods) rm_kb_item(name:key); # Remove the failure so that plugins down the chain can verify after service detection rm_kb_item(name:sshlib::SSH_LIB_KB_PREFIX + "try_ssh_kb_settings_login_failed"); session.close_connection(); audit(AUDIT_FN_FAIL, 'sshlib::try_ssh_kb_settings_login'); } # determine authentication type from try_ssh_kb_settings_login var sonicwall_none = get_kb_item(sshlib::SSH_LIB_KB_PREFIX + "sonicwall/none"); var sonicwall_password = get_kb_item(sshlib::SSH_LIB_KB_PREFIX + "sonicwall/passwordauth"); var junos_auth = get_kb_item(sshlib::SSH_LIB_KB_PREFIX + "junos/auth"); var juniper_ssr_auth = get_kb_item(sshlib::SSH_LIB_KB_PREFIX + "JuniperSSR/auth"); var omniswitch_auth = get_kb_item(sshlib::SSH_LIB_KB_PREFIX + "omniswitch/auth"); var prisma_ion_auth = get_kb_item(sshlib::SSH_LIB_KB_PREFIX + "prisma_ion/auth"); if(!sonicwall_none && !sonicwall_password && !junos_auth && !omniswitch_auth && !juniper_ssr_auth && !prisma_ion_auth) { session.close_connection(); exit(0,"Device is not identified as a connection limited system."); } # sh shell handler set in try_ssh_kb_settings_login() var sh = channel.shell_handler; var timediff; # sonicwall device if(sonicwall_password || sonicwall_none) { var report_no_command_sw; report_no_command_sw = "The remote host has been identified as a SonicWall or other" + '\n' + "networking device that may be rate limiting SSH connections." + '\n'; report_no_command_sw += "As a result there may be intermittent authentication failures" + '\n' + "reported for this device." + '\n\n'; report_no_command_sw += "Attempts to run commands to gather more information on" + '\n' + "the device have failed." + '\n'; # run commands on sonicwall device using sh shell handler 'raw' commands for limited shell handling functionality # sonicwall devices only have one login mode unlike junos which has a shell mode and cli mode var cmd_out = get_kb_item('flatline/sonic_sh_run_command'); if(empty_or_null(cmd_out)) { cmd_out = sh.run_command(channel:channel, command:"show device", raw:TRUE, cmd_timeout_min:60, sonicwall:TRUE); if(!check_command_output(data_buf:cmd_out)) cmd_out = sh.run_command(channel :channel, command :"show version", raw :TRUE, cmd_timeout_min :60, sonicwall :TRUE); } if(!check_command_output(data_buf:cmd_out)) { # if failed to run commands exit without setting KB items - something went wrong. # legacy library will attempt to authenticate and run commands in ssh_get_info.nasl if(empty_or_null(cmd_out)) { dbg::detailed_log(src:SCRIPT_NAME, lvl:1, msg:'Failed to run commands on SonicWall device: no data received after opening shell.'); } else { dbg::detailed_log( src:SCRIPT_NAME, lvl:1, msg:'Failed to run commands on SonicWall device.', msg_details:{"Response":{"lvl":1, "value":cmd_out}}); } session.close_connection(); security_report_v4( port : session.port, severity : SECURITY_NOTE, extra : report_no_command_sw ); exit(0); } var os_name = "SonicOS"; var up_time = "unknown"; var edition = "unknown"; var os_line, model_line, match; var uptime_line; var sonic_router = FALSE; # sonicwall < 6 if("Firmware Version: SonicOS" >< cmd_out) { set_kb_item(name:"Host/SonicOS/show_device", value:cmd_out); write_compliance_kb_sonicwall(command:"show device", result:cmd_out); os_line = pgrep(pattern:"^Firmware Version:", string:cmd_out); if (os_line) { os_line = chomp(os_line); match = pregmatch(pattern:"^Firmware Version: SonicOS ((Enhanced|Standard) [0-9][^ ]+)", string:os_line); if (!isnull(match)) os_name += " " + match[1]; } model_line = pgrep(pattern:"^Model:", string:cmd_out); if (model_line) { model_line = chomp(model_line); match = pregmatch(pattern:"^Model: (.+)", string:model_line); if (!isnull(match)) os_name += " on a SonicWALL " + match[1]; } # Collect time of last reboot. if ("Up Time:" >< cmd_out) { foreach var line (split(cmd_out, keep:FALSE)) { if (preg(pattern:"^Up Time: [0-9]", string:line)) { up_time = line; break; } } } } # sonicwall 6 and 7 else if('firmware-version "SonicOS' >< cmd_out) { if ('SonicOSX' >< cmd_out) os_name = 'SonicOSX'; set_kb_item(name:"Host/SonicOS/show_version", value:cmd_out); write_compliance_kb_sonicwall(command:"show version", result:cmd_out); os_line = pgrep(pattern:'^firmware-version "', string:cmd_out); if (os_line) { os_line = chomp(os_line); var pattern = '^firmware-version "SonicOSX? ((Enhanced |Standard )?[0-9.]+(?:-[a-zA-Z0-9]+)?)'; match = pregmatch(pattern:pattern, string:os_line); if (!isnull(match)) os_name += " " + match[1]; } model_line = pgrep(pattern:'^model "', string:cmd_out); if (model_line) { model_line = chomp(model_line); match = pregmatch(pattern:'^model "(.+)"', string:model_line); if (!isnull(match)) os_name += " on a SonicWALL " + match[1]; } # Collect time of last reboot. if (cmd_out && 'system-uptime "' >< cmd_out) { foreach line (split(cmd_out, keep:FALSE)) { if (preg(pattern:'^system-uptime "', string:line)) { up_time = line - 'system-uptime "' - '"'; break; } } } } # SonicOS Router else if ('SONiC Software Version' >< cmd_out) { set_kb_item(name:"Host/SonicOS/show_version", value:cmd_out); os_line = pgrep(pattern:"^SONiC Software Version", string:cmd_out); if (os_line) { os_line = chomp(os_line); pattern = "Software\sVersion:\sSONiC\-OS\-([\d\.]+)[\s|-]?([\w]+|)"; match = pregmatch(pattern:pattern, string:os_line); if (!isnull(match) && !isnull(match[1])) { if (!isnull(match[2])) edition = str_replace(string:match[2], find:"_", replace:" "); os_name += " " + match[1] + " " + edition; sonic_router = TRUE; } } model_line = pgrep(pattern:'^HwSKU', string:cmd_out); if (model_line) { model_line = chomp(model_line); match = pregmatch(pattern:"HwSKU:\s([\w-]+)", string:model_line); if (!isnull(match)) os_name += " on " + match[1]; } # Collect time of last reboot uptime_line = pgrep(pattern:"^Uptime", string:cmd_out); if (uptime_line) { uptime_line = chomp(uptime_line); pattern = "\sup\s+([\d]+\s\w+|\d+\:\d\d)\,\s+"; match = pregmatch(pattern:pattern, string:uptime_line); if (!empty_or_null(match) && !isnull(match[1])) up_time = match[1]; } } else { if (!empty_or_null(cmd_out)) report_no_command_sw += '\nThe output from "show device" or "show version":\n' + cmd_out; # report and exit that sonicwall detected but commands failed to run session.close_connection(); security_report_v4( port : session.port, severity : SECURITY_NOTE, extra : report_no_command_sw ); exit(0); } # if we reach here sonicwall commands were successful set_kb_item(name:"Host/OS/showver", value:os_name); set_kb_item(name:"Host/OS/showver/Confidence", value:100); set_kb_item(name:"Host/last_reboot", value:up_time); set_kb_item(name:"Host/OS/ratelimited_sonicwall", value:TRUE); if (sonic_router) set_kb_item(name:"Host/OS/showver/Type", value:"router"); else set_kb_item(name:"Host/OS/showver/Type", value:"firewall"); # set sshlib support level indicating local checks are not available set_support_level_na(); var enable_sonicwall_compliance, report_compliance; if (strlen(get_preference("SonicWALL SonicOS Compliance Checks[file]:Policy file #1 :")) > 0) { enable_sonicwall_compliance = TRUE; # run commands for compliance checks - will be cached in KB. # run "show tech-support-report" command first and cache in KB so # other related commands can use that data. # This is a very long command output so increasing timeout. var tech_support_command = "show tech-support-report"; cmd_out = sh.run_command(channel:channel, command:tech_support_command, raw:TRUE, cmd_timeout_min:90, inactivity_timeout_min:75, sonicwall:TRUE); if(check_command_output(data_buf:cmd_out)) { write_compliance_kb_sonicwall(command:tech_support_command ,result:cmd_out); } else cmd_out = "NA"; run_sonicwall_commands_compliance(session:session, channel:channel, tsr_result: cmd_out); } report = "The remote host has has been identified as a SonicWall or other" + '\n' + "networking device that may be rate limiting SSH connections." + '\n'; report += "As a result there may be intermittent authentication failures" + '\n' + "reported for this device." + '\n\n'; report += "Although local, credentialed checks for SonicOS are not available," + '\n'; if(enable_sonicwall_compliance) report_compliance = " and Policy Compliance plugins."; else report_compliance = "."; report += "Nessus has managed to run commands in support of " + '\n' + "OS fingerprinting" + report_compliance + '\n\n'; report += 'Device information : ' + os_name + '\n'; timediff = timeofday_diff(start:start_time, end:gettimeofday()); report += '\nRuntime : ' + timediff + ' seconds\n'; # close and report session.close_connection(); security_report_v4( port : session.port, severity : SECURITY_NOTE, extra : report ); exit(0); } # Junos device # Note: the only escalation Junos devices support is 'su'. # Priv escalation is not supported in this plugin or the legacy ssh library. # If we encounter an insufficient priv message, report in plugin output and debug logs. else if(junos_auth) { var priv_error = FALSE; var in_shell_mode, k, cmd, raw_cmd, kb, output, login_buf; report = '\nThe remote host has has been identified as a Juniper Junos' + '\ndevice that may be SSH rate limited.\n'; report += 'As a result there may be intermittent authentication failures' + '\nreported for this device.\n'; # We need to close the session using the shell handler before we can run exec commands # Commands run in exec mode to avoid cleaning up the command outputs dbg::detailed_log(src:SCRIPT_NAME, lvl:3, msg:'Closing previous channel to allow exec commands to open their own.'); if (!FLATLINE_TEST && !isnull(channel)) channel.close(); var commands_ssh_get_info = make_array( 'version', 'show version detail', 'last', 'show chassis routing-engine', 'config', 'show configuration | display set', 'interface', 'show interface' ); var cmd_results = make_array(); if(get_kb_item("Host/Juniper/JUNOS/shell")) in_shell_mode = TRUE; # run commands to enable local checks foreach k (keys(commands_ssh_get_info)) { cmd = commands_ssh_get_info[k]; raw_cmd = cmd; kb = str_replace(string:cmd, find:" ", replace:"_"); kb = str_replace(string:kb, find:"/", replace:""); kb = "Host/Juniper/JUNOS/Config/" + kb; cmd += " | no-more"; cmd = junos_format_cmd(cmd: cmd, flag: in_shell_mode); dbg::detailed_log( src:SCRIPT_NAME, lvl:2, msg:'Running the following command.', msg_details:{ "Command": {"lvl":2, "value":cmd}, "In shell mode?": {"lvl":2, "value":in_shell_mode}}); output = get_kb_item('flatline/junos_sh_run_command/' + k); if(empty_or_null(output)) output = session.run_exec_command(command:cmd); #output may be different with FIPS mode enabled if(k == 'version' && 'Invalid argument' >< output) { dbg::detailed_log( src:SCRIPT_NAME, lvl:3, msg:'The command failed with the following response. Retrying with local.', msg_details:{ "Command": {"lvl":3, "value":cmd}, "Response": {"lvl":3, "value":output}}); cmd = 'show version local detail | no-more'; cmd = junos_format_cmd(cmd: cmd, flag: in_shell_mode); dbg::detailed_log( src:SCRIPT_NAME, lvl:3, msg:'Running the following command.', msg_details:{"Command": {"lvl":3, "value":cmd}}); output = get_kb_item('flatline/junos_sh_run_command/fips'); if(empty_or_null(output)) output = session.run_exec_command(command:cmd); } if("/* ACCESS-DENIED */" >< output) { dbg::detailed_log( src:SCRIPT_NAME, lvl:1, msg:'The command failed with the following response due to user privilege error.', msg_details:{ "Command": {"lvl":1, "value":cmd}, "Response": {"lvl":1, "value":output}}); output = FALSE; priv_error = TRUE; } else if(!check_command_output_junos(data_buf:output)) { dbg::detailed_log( src:SCRIPT_NAME, lvl:1, msg:'The command failed with the following response.', msg_details:{ "Command": {"lvl":1, "value":cmd}, "Response": {"lvl":1, "value":output}}); output = FALSE; } if(output) { set_kb_item(name:"Secret/"+kb, value:output); write_compliance_kb_junos(command:raw_cmd, result:output); } cmd_results[k] = output; sleep(1); } var version = cmd_results["version"]; var last = cmd_results["last"]; var config = cmd_results["config"]; var interface = cmd_results["interface"]; # try to retrieve the list of installed packages if(in_shell_mode) { var pkginfo_cmd = "/usr/sbin/pkg_info -a"; dbg::detailed_log( src:SCRIPT_NAME, lvl:2, msg:'Running the following command (in shell mode).', msg_details:{"Command": {"lvl":2, "value":pkginfo_cmd}}); var buf = session.run_exec_command(command: pkginfo_cmd); var pkg_info_success = TRUE; if (!buf) { if ("no packages installed" >< session.cmd_error) buf = ' '; else { report += 'Command \''+pkginfo_cmd+'\'failed to produce any results.'; pkg_info_success = FALSE; } } if (pkg_info_success) { buf = str_replace(find:'\t', replace:" ", string:buf); replace_kb_item(name:"Host/JunOS/pkg_info", value:buf); } } var set_last_reboot, last_reboot_value; var os_ver = ""; # Parse the version from the 'show version detail' output if(!empty_or_null(version)) { # Match "JUNOS Software Release [18.4R2-S7.4]" or "JUNOS EX Software Suite [18.4R2-S7.4]" # or just "Junos: 21.2R3-S3.5" for models like srx1500 os_ver = pregmatch(pattern:"JUNOS\s+(?:EX\s+)?Software\s+(?:Release|Suite)\s+\[([^\]]+)\]", string:version); if (empty_or_null(os_ver)) os_ver = pregmatch(pattern:"Junos: (\d[^\s]+)", string:version); if (!empty_or_null(os_ver) && !isnull(os_ver[1])) os_ver = " Version " + os_ver[1]; } # Get time of last reboot. if (last) { foreach line (split(last, keep:FALSE)) { match = pregmatch(pattern:"Start time[ \t]+(.+)$", string:line); if (match) { set_last_reboot = TRUE; last_reboot_value = match[1]; break; } } } if (config) { kb = "Secret/Host/Juniper/JUNOS/config/show_configuration_|_display_set"; replace_kb_item(name:kb, value:config); } get_junos_mac_addrs(session:session, channel:channel, cmd_result:interface); if(version && ("Hostname" >< version || "JUNOS" >< version)) { set_kb_item(name:"Host/Juniper/show_ver", value:version); set_kb_item(name:"Host/OS/ratelimited_junos", value:TRUE); report += '\nLocal security checks have been enabled for Juniper Junos.\n'; # if local checks are enabled run commands for junos_command_kb_item in junos_kb_cmd_func.inc dbg::detailed_log(src:SCRIPT_NAME, lvl:2, msg:"Junos local checks are enabled. Running commands used by junos_command_kb_item()."); run_junos_command_kb_item(session:session, shell:in_shell_mode); # set sshlib service level for junos local checks sshlib::enable_local_checks(); replace_kb_item(name:'debug/Host/local_checks_enabled_source/plugins/Misc/s/ssh_rate_limiting.nasl', value: 539); replace_kb_item(name:"Host/OS/showver", value:"Juniper Junos" + os_ver); replace_kb_item(name:"Host/OS/showver/Confidence", value:100); replace_kb_item(name:"Host/OS/showver/Type", value:"embedded"); if(set_last_reboot) { replace_kb_item(name:"Host/last_reboot", value:last_reboot_value); } } else { login_buf = tolower(get_kb_item(sshlib::SSH_LIB_KB_PREFIX + "junos_prompt")); # Making sure the device is really a Junos before disabling local checks if (!empty_or_null(login_buf) && login_buf =~ "junos\s+\d+\.[\d\w\.]+") { set_support_level_na(); set_kb_item(name:"Host/OS/ratelimited_junos", value:TRUE); set_kb_item(name:"Host/OS/ratelimited_junos_error", value:TRUE); } timediff = timeofday_diff(start:start_time, end:gettimeofday()); report += '\nJunos device detected, however, some commands failed to run\n' + 'so local checks are not enabled.\n'; if(priv_error) report += '\nAuthentication successful, however, some commands' + '\nfailed to run due to insufficient user privileges.\n'; report += '\nRuntime : ' + timediff + ' seconds\n'; session.close_connection(); security_report_v4( port : session.port, severity : SECURITY_NOTE, extra : report ); exit(0); } if(priv_error) { report += '\nAuthentication successful and local checks enabled, however, some' + '\ncommands failed to run due to insufficient user privileges.\n'; } timediff = timeofday_diff(start:start_time, end:gettimeofday()); report += '\nRuntime : ' + timediff + ' seconds\n'; # close and report session.close_connection(); security_report_v4( port : session.port, severity : SECURITY_NOTE, extra : report ); exit(0); } else if (juniper_ssr_auth) { report = '\nThe remote host has has been identified as a Juniper SSR' + '\ndevice that may be SSH rate limited.\n' + 'As a result there may be intermittent authentication failures' + '\nreported for this device.\n'; var in_PCLI = FALSE; var logged_as_PCLI = FALSE; if (get_kb_item(sshlib::SSH_LIB_KB_PREFIX + "JuniperSSR/is_PCLI")) { in_PCLI = TRUE; logged_as_PCLI = TRUE; } var kb_prefix = 'Host/JuniperSSR/'; var commands = [ { cmd : 'show system version', require_PCLI : TRUE, kb : kb_prefix + 'show_system_version', cmd_rgx : "\s*Router\s+Node\s+Version\s+(Status\s+)?Build Date\s+Package" }, # The following cmd_rgx matches column headers 'Admin Status', 'Operational Status', 'Provisional Status', 'Redundancy Status', 'MAC Address' which may be truncated { cmd : 'show device-interface summary', require_PCLI : TRUE, kb : kb_prefix + 'show_device_interface_summary', cmd_rgx : "\s*Admin.+Oper.+Prov.+Red.+MAC|Keyword argument 'router' is required|No device interfaces to display" } ]; var command_successful = FALSE; var failed_cmds = []; var cmd_output; for (var cmd_info of commands) { if (!in_PCLI && cmd_info.require_PCLI) { dbg::detailed_log( lvl:2, msg:'Could not run the command as the user is not in PCLI mode.', msg_details:{ 'Command':{lvl:2, value:cmd_info.cmd} } ); continue; } if (logged_as_PCLI && !cmd_info.require_PCLI) { dbg::detailed_log( lvl:2, msg:'Could not run the command as the non-escalated user is already in PCLI mode.', msg_details:{ 'Command':{lvl:2, value:cmd_info.cmd} } ); continue; } if (!FLATLINE_TEST) cmd_output = sh.run_command(command:cmd_info.cmd, channel:channel, cmd_timeout_min:60, raw:TRUE); else cmd_output = get_kb_item('flatline/' + cmd_info.kb); if (cmd_info.cmd_rgx && cmd_output !~ cmd_info.cmd_rgx) { dbg::detailed_log( lvl:1, msg:'The command produced unexpected results.', msg_details:{ 'Command':{lvl:1, value:cmd_info.cmd}, 'Data':{lvl:3, value:cmd_output} } ); append_element(var:failed_cmds, value:cmd_info.cmd); continue; } command_successful = TRUE; set_kb_item(name:cmd_info.kb, value:cmd_output); } if (command_successful && empty(failed_cmds)) { report += '\nLocal checks have been enabled for the Juniper SSR device.\n'; report += '\nOS Security Patch Assessment is available for Juniper SSR devices.\n'; sshlib::enable_local_checks(); replace_kb_item(name:'debug/Host/local_checks_enabled_source/plugins/Misc/s/ssh_rate_limiting.nasl', value: 683); } else { # Set support level to prevent other plugin from trying to run other commands. sshlib::set_support_level(level:sshlib::SSH_LIB_LOCAL_CHECKS_ERROR); set_kb_item(name:kb_prefix + 'error', value:TRUE); report += '\nWe are able to identify the remote host as a Juniper SSR device, but encountered an error.'+ '\nOS Security Patch Assessment is NOT available.\n'; if (!empty(failed_cmds)) { report += '\nThe following commands produced unexpected results:\n - '; report += join(failed_cmds, sep:'\n - '); report += '\n'; } } if (!FLATLINE_TEST && logged_as_PCLI) sh.run_command(command:'quit', channel:channel, cmd_timeout_min:60, raw:TRUE); else if (!FLATLINE_TEST) { if (in_PCLI) sh.run_command(command:'quit', channel:channel, cmd_timeout_min:60, raw:TRUE); sh.run_command(command:'exit', channel:channel, cmd_timeout_min:60, raw:TRUE); } session.close_connection(); set_kb_item(name:'Host/OS/show_system_version', value:'Juniper SSR'); set_kb_item(name:'Host/OS/show_system_version/Confidence', value:100); set_kb_item(name:'Host/OS/show_system_version/Type', value:'router'); set_kb_item(name:"Host/OS/ratelimited_JuniperSSR", value:TRUE); timediff = timeofday_diff(start:start_time, end:gettimeofday()); report += '\nRuntime : ' + timediff + ' seconds\n'; security_report_v4( port : session.port, severity : SECURITY_NOTE, extra : report ); exit(0); } #Alcatel-Lucent OmniSwitch else if(omniswitch_auth) { report = '\nThe remote host has been identified as an Alcatel-Lucent' + '\nOmniSwitch device that may be SSH rate limited.\n'; report += 'As a result there may be intermittent authentication failures' + '\nreported for this device.\n'; timediff = timeofday_diff(start:start_time, end:gettimeofday()); report += '\nRuntime : ' + timediff + ' seconds\n'; cmd = "show microcode"; dbg::detailed_log( src:SCRIPT_NAME, lvl:2, msg:'Running the following command.', msg_details:{"Command": {"lvl":2, "value":cmd}}); output = get_kb_item('flatline/omniswitch_sh_run_command/show_microcode'); if(!FLATLINE_TEST && empty_or_null(output)) output = sh.run_command(command:cmd, channel:channel, cmd_timeout_min:60, raw:TRUE); dbg::detailed_log( src:SCRIPT_NAME, lvl:3, msg:'The command returned with the following response.', msg_details:{ "Command": {"lvl":3, "value":cmd}, "Response": {"lvl":3, "value":output}}); if(output =~ "Package\s*Release\s*Size\s*Description") { report += '\nLocal checks have been enabled for an Alcatel-Lucent OmniSwitch.\n'; report += '\nOS Security Patch Assessment is not supported for Alcatel-Lucent OmniSwitch devices.\n'; set_kb_item(name:"Host/AOS/show_microcode", value:output); set_kb_item(name:"Host/OS/ratelimited_omniswitch", value:TRUE); } else { dbg::detailed_log( src:SCRIPT_NAME, lvl:1, msg:'The command failed with the following error.', msg_details:{ "Command": {"lvl":1, "value":cmd}, "Error": {"lvl":1, "value":session.cmd_error}}); report += 'However, running ' + serialize(cmd) + ' failed to produce expected results.'; } # close and report if(!FLATLINE_TEST) sh.run_command(command:"exit", channel:channel, cmd_timeout_min:60, raw:TRUE); session.close_connection(); security_report_v4( port : session.port, severity : SECURITY_NOTE, extra : report ); exit(0); } else if(prisma_ion_auth) { report = '\nThe remote host has has been identified as a SD-WAN Prisma ION' + '\ndevice that may be SSH rate limited.\n' + 'As a result there may be intermittent authentication failures' + '\nreported for this device.\n'; var dump_overview = get_kb_item(sshlib::SSH_LIB_KB_PREFIX + "prisma_ion/dump_overview"); var ion_version = pregmatch(string:dump_overview, pattern:"Software\s*:\s*([\.\d]+)(?:-b(\d+))?"); if(!empty_or_null(ion_version)) { if(!empty_or_null(ion_version[2])) { set_kb_item(name:'Host/PrismaION/build', value:ion_version[2]); } ion_version = ion_version[1]; set_kb_item(name:'Host/PrismaION/version', value:ion_version); } else ion_version = "unknown"; var ion_model = pregmatch(string:dump_overview, pattern:"Hardware Model\s*:\s+(.*)\r"); if(!empty_or_null(ion_model)) ion_model = ion_model[1]; else ion_model = ""; var ion_id = pregmatch(string:dump_overview, pattern:"Device ID\s*:\s+(.*)\r"); if(!empty_or_null(ion_id)) ion_id = ion_id[1]; else ion_id = ""; if(ion_version != 'unknown') { report += '\nLocal checks have been enabled for the Prisma ION device.\n'; sshlib::enable_local_checks(); report += '\nOS Security Patch Assessment is not available for Prisma ION devices.\n'; set_kb_item(name:'Host/OS/dump_overview', value:'Prisma ION'); set_kb_item(name:'Host/OS/dump_overview/Confidence', value:100); set_kb_item(name:'Host/OS/dump_overview/Type', value:'sd-wan'); set_kb_item(name:"Host/OS/ratelimited_PrismaION", value:TRUE); if(!empty_or_null(ion_model)) { set_kb_item(name:'Host/PrismaION/model', value:ion_model); } if(!empty_or_null(ion_id)) { set_kb_item(name:'Host/PrismaION/device_id', value:ion_id); } } else { sshlib::set_support_level(level:sshlib::SSH_LIB_LOCAL_CHECKS_ERROR); report += 'However, running \'dump overview\' failed to produce expected results.'; } session.close_connection(); security_report_v4( port : session.port, severity : SECURITY_NOTE, extra : report ); exit(0); } else { # should not reach session.close_connection(); exit(0,"Unable to determine if remote host is a rate limited device."); }

Query Builder