1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
|
local ftp = require "ftp"
local shortport = require "shortport"
local stdnse = require "stdnse"
description = [[
Sends FTP SYST and STAT commands and returns the result.
The canonical SYST response of "UNIX Type: L8" is stripped or ignored, since it
is meaningless. Typical FTP response codes (215 for SYST and 211 for STAT) are
also hidden.
References:
* https://cr.yp.to/ftp/syst.html
]]
author = "Daniel Miller"
license = "Same as Nmap--See https://nmap.org/book/man-legal.html"
categories = {"default", "discovery", "safe"}
---
-- @output
-- | ftp-syst:
-- | SYST: UNIX MikroTik 6.34.3
-- | STAT:
-- | Enver Curri FTP server (MikroTik 6.34.3) status:
-- | Logged in as
-- | TYPE: ASCII; STRUcture: File; transfer MODE: Stream
-- | No data connection
-- |_End of status
--
-- | ftp-syst:
-- | STAT:
-- | FTP server status:
-- | Connected to 192.0.2.13
-- | Logged in as ftp
-- | TYPE: ASCII
-- | No session bandwidth limit
-- | Session timeout in seconds is 300
-- | Control connection is plain text
-- | Data connections will be plain text
-- | At session startup, client count was 1
-- | vsFTPd 2.0.5 - secure, fast, stable
-- |_End of status
--
-- | ftp-syst:
-- | SYST: Version: Linux 2.6.26.8-rt16
-- | STAT:
-- | HES_CPE FTP server status:
-- | ftpd (GNU inetutils) 1.4.1
-- | Connected to 72.14.177.105
-- | Waiting for user name
-- | TYPE: ASCII, FORM: Nonprint; STRUcture: File; transfer MODE: Stream
-- | No data connection
-- |_End of status
--
-- @xmloutput
-- <elem key="SYST">Version: Linux 3.10.73</elem>
-- <elem key="STAT">
-- FRITZ!Box7490 FTP server status:
-- Connected to 72.14.177.105
-- Waiting for user name
-- TYPE: ASCII, FORM: Nonprint; STRUcture: File; transfer MODE: Stream
-- No data connection
-- End of status</elem>
portrule = shortport.port_or_service({21,990}, {"ftp","ftps"})
local function do_syst(socket, buffer)
end
action = function(host, port)
local socket, code, message, buffer = ftp.connect(host, port)
if not socket then
stdnse.debug1("Couldn't connect: %s", code or message)
return nil
end
if code and code ~= 220 then
stdnse.debug1("banner code %d %q.", code, message)
return nil
end
-- SYST
local auth_done = false
local syst = nil
repeat
if not socket:send("SYST\r\n") then
return nil
end
code, message = ftp.read_reply(buffer)
if not code then
stdnse.debug1("SYST error: %s", message)
break
end
if code == 215 then
local stripped = message:gsub("^UNIX Type: L8 *", "")
if stripped ~= "" then
syst = stripped
end
break
elseif code < 300 then
syst = ("%d %s"):format(code, message)
break
elseif not auth_done and -- we haven't tried logging in yet
( code == 503 -- Command SYST not accepted during Connected
or code == 521 -- Not logged in - Secure authentication required
or (code % 100) // 10 == 3 -- x3x codes are auth-related
) then
-- Try logging in
local status, code, message = ftp.auth(socket, buffer, "anonymous", "IEUser@")
if status then
auth_done = true
end
else
stdnse.debug1("SYST error: %d %s", code, message)
break
end
until not auth_done
-- STAT
if not socket:send("STAT\r\n") then
if syst then
return {SYST=syst}
else
return nil
end
end
local out = stdnse.output_table()
out.SYST = syst
local code, stat = ftp.read_reply(buffer)
if code then
if code == 211 then
out.STAT = "\n" .. stat
elseif code < 300 then
out.STAT = ("%d\n%s"):format(code, stat)
end
end
ftp.close(socket)
if #out > 0 then
return out
end
end
|
