1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
|
description = [[
Attempts to discover Canon devices (Printers/Scanners) supporting the
BJNP protocol by sending BJNP Discover requests to the network
broadcast address for both ports associated with the protocol.
The script then attempts to retrieve the model, version and some additional
information for all discovered devices.
]]
---
-- @usage
-- nmap --script broadcast-bjnp-discover
--
-- @output
-- | broadcast-bjnp-discover:
-- | 192.168.0.10
-- | Printer
-- | Manufacturer: Canon
-- | Model: MG5200 series
-- | Description: Canon MG5200 series
-- | Firmware version: 1.050
-- | Command: BJL,BJRaster3,BSCCe,NCCe,IVEC,IVECPLI
-- | Scanner
-- | Manufacturer: Canon
-- | Model: MG5200 series
-- | Description: Canon MG5200 series
-- |_ Command: MultiPass 2.1,IVEC
--
-- @args broadcast-bjnp-discover.timeout specifies the amount of seconds to sniff
-- the network interface. (default 30s)
author = "Patrik Karlsson"
license = "Same as Nmap--See https://nmap.org/book/man-legal.html"
categories = {"safe", "broadcast"}
local bjnp = require("bjnp")
local stdnse = require("stdnse")
local coroutine = require("coroutine")
local nmap = require("nmap")
local table = require("table")
local printer_port = { number = 8611, protocol = "udp"}
local scanner_port = { number = 8612, protocol = "udp"}
local arg_timeout = stdnse.parse_timespec(stdnse.get_script_args(SCRIPT_NAME .. ".timeout"))
prerule = function()
if ( nmap.address_family() ~= 'inet' ) then
stdnse.debug1("is IPv4 compatible only.")
return false
end
return true
end
local function identifyDevices(devices, devtype)
local result
local port = ( "printers" == devtype and printer_port or scanner_port )
for _, ip in ipairs(devices or {}) do
local helper = bjnp.Helper:new({ ip = ip }, port)
if ( helper:connect() ) then
local status, attrs
if ( "printers" == devtype ) then
status, attrs = helper:getPrinterIdentity()
end
if ( "scanners" == devtype ) then
status, attrs = helper:getScannerIdentity()
end
if ( status ) then
result = result or {}
result[ip] = attrs
end
end
helper:close()
end
return result
end
local function identifyScanners(scanners)
return identifyDevices(scanners, "scanners")
end
local function identifyPrinters(printers)
return identifyDevices(printers, "printers")
end
local function getKeys(devices)
local dupes = {}
local function iter()
for k, _ in pairs(devices) do
for k2, _ in pairs(devices[k]) do
if ( not(dupes[k2]) ) then
dupes[k2] = true
coroutine.yield(k2)
end
end
end
coroutine.yield(nil)
end
return coroutine.wrap(iter)
end
local function getPrinters(devices)
local condvar = nmap.condvar(devices)
local helper = bjnp.Helper:new( { ip = "255.255.255.255" }, printer_port, { bcast = true, timeout = arg_timeout } )
if ( not(helper:connect()) ) then
condvar "signal"
return
end
local status, printers = helper:discoverPrinter()
helper:close()
if ( status ) then
devices["printers"] = identifyPrinters(printers)
end
condvar "signal"
end
local function getScanners(devices)
local condvar = nmap.condvar(devices)
local helper = bjnp.Helper:new( { ip = "255.255.255.255" }, scanner_port, { bcast = true, timeout = arg_timeout } )
if ( not(helper:connect()) ) then
condvar "signal"
return
end
local status, scanners = helper:discoverScanner()
helper:close()
if ( status ) then
devices["scanners"] = identifyScanners(scanners)
end
condvar "signal"
end
action = function()
arg_timeout = ( arg_timeout and arg_timeout * 1000 or 5000)
local devices, result, threads = {}, {}, {}
local condvar = nmap.condvar(devices)
local co = stdnse.new_thread(getPrinters, devices)
threads[co] = true
co = stdnse.new_thread(getScanners, devices)
threads[co] = true
while(next(threads)) do
for t in pairs(threads) do
threads[t] = ( coroutine.status(t) ~= "dead" ) and true or nil
end
if ( next(threads) ) then
condvar "wait"
end
end
for ip in getKeys(devices) do
local result_part = {}
local printer = ( devices["printers"] and devices["printers"][ip] )
local scanner = ( devices["scanners"] and devices["scanners"][ip] )
if ( printer ) then
printer.name = "Printer"
table.insert(result_part, printer)
end
if ( scanner ) then
scanner.name = "Scanner"
table.insert(result_part, scanner)
end
if ( #result_part > 0 ) then
result_part.name = ip
table.insert(result, result_part)
end
end
if ( result ) then
return stdnse.format_output(true, result)
end
end
|
