1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
|
local mysql = require "mysql"
local nmap = require "nmap"
local stdnse = require "stdnse"
local table = require "table"
description = [[
Connects to a MySQL server and prints information such as the protocol and
version numbers, thread ID, status, capabilities, and the password salt.
If service detection is performed and the server appears to be blocking
our host or is blocked because of too many connections, then this script
isn't run (see the portrule).
]]
---
-- @output
-- 3306/tcp open mysql
-- | mysql-info:
-- | Protocol: 10
-- | Version: 5.0.51a-3ubuntu5.1
-- | Thread ID: 7
-- | Capabilities flags: 40968
-- | Some Capabilities: ConnectWithDatabase, SupportsTransactions, Support41Auth
-- | Status: Autocommit
-- |_ Salt: bYyt\NQ/4V6IN+*3`imj
--
--@xmloutput
-- <elem key="Protocol">10</elem>
-- <elem key="Version">5.0.51a-3ubuntu5.1</elem>
-- <elem key="Thread ID">7</elem>
-- <elem key="Capabilities flags">40968</elem>
-- <table key="Some Capabilities">
-- <elem>ConnectWithDatabase</elem>
-- <elem>SupportsTransactions</elem>
-- <elem>Support41Auth</elem>
-- </table>
-- <elem key="Status">Autocommit</elem>
-- <elem key="Salt">bYyt\NQ/4V6IN+*3`imj</elem>
-- Many thanks to jah (jah@zadkiel.plus.com) for testing and enhancements
author = "Kris Katterjohn"
license = "Same as Nmap--See https://nmap.org/book/man-legal.html"
categories = { "default", "discovery", "safe" }
--- Converts a number to a string description of the capabilities
--@param num Start of the capabilities data
--@return table containing the names of the capabilities offered
local bitset = function(num, lookup)
local caps = {}
for k, v in pairs(lookup) do
if num & v > 0 then
caps[#caps+1] = k
end
end
return caps
end
portrule = function(host, port)
local extra = port.version.extrainfo
return (port.number == 3306 or port.service == "mysql")
and port.protocol == "tcp"
and port.state == "open"
and not (extra ~= nil
and (extra:match("[Uu]nauthorized")
or extra:match("[Tt]oo many connection")))
end
action = function(host, port)
local output = stdnse.output_table()
local socket = nmap.new_socket()
local status, err = socket:connect(host, port)
if not status then
stdnse.debug1("error connecting: %s", err)
return nil
end
local status, info = mysql.receiveGreeting(socket)
if not status then
stdnse.debug1("MySQL error: %s", info)
output["MySQL Error"] = info
if nmap.verbosity() > 1 then
return output
else
return nil
end
end
output["Protocol"] = info.proto
output["Version"] = info.version
output["Thread ID"] = info.threadid
if info.proto == 10 then
output["Capabilities flags"] = info.capabilities
local caps = bitset(info.capabilities, mysql.Capabilities)
if info.extcapabilities then
local extcaps = bitset(info.extcapabilities, mysql.ExtCapabilities)
for i, c in ipairs(extcaps) do
caps[#caps+1] = c
end
end
if #caps > 0 then
setmetatable(caps, {
__tostring = function (self)
return table.concat(self, ", ")
end
})
output["Some Capabilities"] = caps
end
if info.status == 2 then
output["Status"] = "Autocommit"
else
output["Status"] = info.status
end
output["Salt"] = info.salt
output["Auth Plugin Name"] = info.auth_plugin_name
end
return output
end
|
