blob: 92efaad714d3688a5057ce1d6ae160761e8815e1 (
plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
|
local nmap = require "nmap"
local shortport = require "shortport"
local stdnse = require "stdnse"
local string = require "string"
local upnp = require "upnp"
description = [[
Attempts to extract system information from the UPnP service.
]]
---
-- @usage
-- nmap -sU -p 1900 --script=upnp-info <target>
-- @output
-- | upnp-info: System/1.0 UPnP/1.0 IGD/1.0
-- |_ Location: http://192.168.1.1:80/UPnP/IGD.xml
--
-- @args upnp-info.override Controls whether we override the IP address information
-- returned by the UPNP service for the location of the XML
-- file that describes the device. Defaults to true for
-- unicast hosts.
-- 2010-10-05 - add prerule support <patrik@cqure.net>
-- 2010-10-10 - add newtarget support <patrik@cqure.net>
-- 2010-10-29 - factored out all of the code to upnp.lua <patrik@cqure.net>
author = "Thomas Buchanan"
license = "Same as Nmap--See https://nmap.org/book/man-legal.html"
categories = {"default", "discovery", "safe"}
---
-- Runs on UDP port 1900
portrule = shortport.portnumber(1900, "udp", {"open", "open|filtered"})
---
-- Sends UPnP discovery packet to host,
-- and extracts service information from results
action = function(host, port)
local override = stdnse.get_script_args("upnp-info.override")
local helper = upnp.Helper:new( host, port )
if ( override ~= nil ) and ( string.lower(override) == "false" ) then
helper:setOverride( false )
else
helper:setOverride( true )
end
local status, result = helper:queryServices()
if ( status ) then
nmap.set_port_state(host, port, "open")
return stdnse.format_output(true, result)
end
end
|
