[Openvas-commits] r11543 - in trunk/openvas-plugins: . scripts

scm-commit@wald.intevation.org scm-commit at wald.intevation.org
Thu Sep 1 14:04:16 CEST 2011


Author: mime
Date: 2011-09-01 14:04:12 +0200 (Thu, 01 Sep 2011)
New Revision: 11543

Added:
   trunk/openvas-plugins/scripts/gb_netsaro_49390.nasl
   trunk/openvas-plugins/scripts/gb_research_display_49395.nasl
Modified:
   trunk/openvas-plugins/ChangeLog
   trunk/openvas-plugins/scripts/filezilla_server_port_cmd_dos.nasl
   trunk/openvas-plugins/scripts/find_service2.nasl
   trunk/openvas-plugins/scripts/gb_dokuwiki_detect.nasl
Log:
Added new plugins. Added new Banner submitted by Matthew Coene. Make sure it is realy a dokuwiki. Close soc and reopen a new one before testing if the ftpd is up.

Modified: trunk/openvas-plugins/ChangeLog
===================================================================
--- trunk/openvas-plugins/ChangeLog	2011-09-01 09:32:45 UTC (rev 11542)
+++ trunk/openvas-plugins/ChangeLog	2011-09-01 12:04:12 UTC (rev 11543)
@@ -1,3 +1,16 @@
+2011-09-01  Michael Meyer <michael.meyer at greenbone.net>
+
+	* scripts/gb_netsaro_49390.nasl,
+	scripts/gb_research_display_49395.nasl:
+	Added new plugins.
+
+	* scripts/gb_dokuwiki_detect.nasl:
+	Make sure it is realy a dokuwiki.
+
+	* scripts/filezilla_server_port_cmd_dos.nasl:
+	Close soc and reopen a new one before testing if the ftpd is
+	up.
+
 2011-08-31  Veerendra G.G <veerendragg at secpod.com>
 
 	* scripts/secpod_vmware_vfabric_tc_server_security_bypass_vuln.nasl,

Modified: trunk/openvas-plugins/scripts/filezilla_server_port_cmd_dos.nasl
===================================================================
--- trunk/openvas-plugins/scripts/filezilla_server_port_cmd_dos.nasl	2011-09-01 09:32:45 UTC (rev 11542)
+++ trunk/openvas-plugins/scripts/filezilla_server_port_cmd_dos.nasl	2011-09-01 12:04:12 UTC (rev 11543)
@@ -115,8 +115,13 @@
 ###step 3: attack succeeded?###
 ###############################
 
-is_alive = ftp_recv_line(socket:soc);
+close(soc);
 
+sleep(5);
+
+soc1 = open_sock_tcp(port);
+is_alive = ftp_recv_line(socket:soc1);
+
 if (!is_alive) {
   report = desc + report;
   security_warning(data:report, port:port);
@@ -124,4 +129,4 @@
 
 #end of exploit, closing open socket
 
-close(soc);
+close(soc1);

Modified: trunk/openvas-plugins/scripts/find_service2.nasl
===================================================================
--- trunk/openvas-plugins/scripts/find_service2.nasl	2011-09-01 09:32:45 UTC (rev 11542)
+++ trunk/openvas-plugins/scripts/find_service2.nasl	2011-09-01 12:04:12 UTC (rev 11543)
@@ -167,6 +167,40 @@
 
 }
 
+#0x00:  94 00 00 00 F4 FF FF FF 01 00 00 00 FF FF FF FF    ................
+#0x10:  00 00 00 00 A5 00 00 00 00 00 00 00 04 00 00 00    ................
+#0x20:  3E F9 E6 B9 9B FE 6B 7C 2D 69 87 74 0B F3 10 66    >.....k|-i.t...f
+#0x30:  87 C2 A8 59 A6 18 B4 BD AE BF 7A 5A 3A F4 23 AC    ...Y......zZ:.#.
+#0x40:  F6 E4 FC DE 59 80 0C 9F 05 DD BC E5 7E DE 7D 19    ....Y.......~.}.
+#0x50:  DC 7D 34 2F EC 2D 63 5D 2F 4E 35 26 DD 7C C3 AB    .}4/.-c]/N5&.|..
+#0x60:  AC 13 28 D3 B3 A5 BA F0 FD D6 FA 22 BF 4D F2 4D    ..(........".M.M
+#0x70:  A6 70 08 98 0E 7D 82 59 D7 F3 87 3B 9E C7 C5 95    .p...}.Y...;....
+#0x80:  06 54 61 43 ED F9 57 BB 50 25 1A B6 A6 61 CE BD    .TaC..W.P%...a..
+#0x90:  C1 29 69 76 D5 30 10 CC 60 40 48 EF 8D E0 AC 76    .)iv.0..`@H....v
+#0xA0:  FF FE FF FE FF FF FB FF CE BE AC AD FF FF 5B FF    ..............[.
+#0xB0:  FF FF FD FF
+# # submitted by Matthew Coene <mcoene at Bacardi.com> 26.08.11
+
+if(raw_string(
+0x94,0x00,0x00,0x00,0xF4,0xFF,0xFF,0xFF,0x01,0x00,0x00,0x00,0xFF,0xFF,0xFF,0xFF,
+0x00,0x00,0x00,0x00,0xA5,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x04,0x00,0x00,0x00,
+0x3E,0xF9,0xE6,0xB9,0x9B,0xFE,0x6B,0x7C,0x2D,0x69,0x87,0x74,0x0B,0xF3,0x10,0x66,
+0x87,0xC2,0xA8,0x59,0xA6,0x18,0xB4,0xBD,0xAE,0xBF,0x7A,0x5A,0x3A,0xF4,0x23,0xAC,
+0xF6,0xE4,0xFC,0xDE,0x59,0x80,0x0C,0x9F,0x05,0xDD,0xBC,0xE5,0x7E,0xDE,0x7D,0x19,
+0xDC,0x7D,0x34,0x2F,0xEC,0x2D,0x63,0x5D,0x2F,0x4E,0x35,0x26,0xDD,0x7C,0xC3,0xAB,
+0xAC,0x13,0x28,0xD3,0xB3,0xA5,0xBA,0xF0,0xFD,0xD6,0xFA,0x22,0xBF,0x4D,0xF2,0x4D,
+0xA6,0x70,0x08,0x98,0x0E,0x7D,0x82,0x59,0xD7,0xF3,0x87,0x3B,0x9E,0xC7,0xC5,0x95,
+0x06,0x54,0x61,0x43,0xED,0xF9,0x57,0xBB,0x50,0x25,0x1A,0xB6,0xA6,0x61,0xCE,0xBD,
+0xC1,0x29,0x69,0x76,0xD5,0x30,0x10,0xCC,0x60,0x40,0x48,0xEF,0x8D,0xE0,0xAC,0x76,
+0xFF,0xFE,0xFF,0xFE,0xFF,0xFF,0xFB,0xFF,0xCE,0xBE,0xAC,0xAD,0xFF,0xFF,0x5B,0xFF,
+0xFF,0xFF,0xFD,0xF9) >< buf && (port == 2800 || port == 2500 || port == 2501 || port == 2502 || port == 2503 || port == 2506 || port == 2505 || port == 2600 || port == 2801 || port == 2900)) {
+
+  register_service(port:port, proto:"CCure");
+  security_note(port:port, data:"A Ccure security management solution is running on this port");
+  exit(0);
+
+}
+
 # [root at f00dikator new_nasl_mods]# telnet 10.10.10.7 7110
 # Trying 10.10.10.7...
 # Connected to 10.10.10.7.

Modified: trunk/openvas-plugins/scripts/gb_dokuwiki_detect.nasl
===================================================================
--- trunk/openvas-plugins/scripts/gb_dokuwiki_detect.nasl	2011-09-01 09:32:45 UTC (rev 11542)
+++ trunk/openvas-plugins/scripts/gb_dokuwiki_detect.nasl	2011-09-01 12:04:12 UTC (rev 11543)
@@ -64,6 +64,11 @@
 
 foreach dir (make_list("/dokuwiki", cgi_dirs()))
 {
+
+  req = http_get(item:string(dir + "/feed.php"), port:dokuwikiPort);
+  rcv = http_keepalive_send_recv(port:dokuwikiPort, data:req,bodyonly:0);
+  if("dokuwiki" >!< tolower(rcv))continue;
+
   sndReq = http_get(item:string(dir + "/VERSION"), port:dokuwikiPort);
   rcvRes = http_keepalive_send_recv(port:dokuwikiPort, data:sndReq, bodyonly:1);
   if (rcvRes != NULL)

Added: trunk/openvas-plugins/scripts/gb_netsaro_49390.nasl
===================================================================
--- trunk/openvas-plugins/scripts/gb_netsaro_49390.nasl	2011-09-01 09:32:45 UTC (rev 11542)
+++ trunk/openvas-plugins/scripts/gb_netsaro_49390.nasl	2011-09-01 12:04:12 UTC (rev 11543)
@@ -0,0 +1,93 @@
+###############################################################################
+# OpenVAS Vulnerability Test
+# $Id$
+#
+# NetSaro Enterprise Messenger Cross Site Scripting and HTML Injection Vulnerabilities
+#
+# Authors:
+# Michael Meyer <michael.meyer at greenbone.net>
+#
+# Copyright:
+# Copyright (c) 2011 Greenbone Networks GmbH
+#
+# This program is free software; you can redistribute it and/or modify
+# it under the terms of the GNU General Public License version 2
+# (or any later version), as published by the Free Software Foundation.
+#
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with this program; if not, write to the Free Software
+# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
+###############################################################################
+
+if (description)
+{
+ script_id(103236);
+ script_bugtraq_id(49390);
+ script_version ("1.0-$Revision$");
+
+ script_name("NetSaro Enterprise Messenger Cross Site Scripting and HTML Injection Vulnerabilities");
+
+desc = "Overview:
+NetSaro Enterprise Messenger is prone to multiple cross-site
+scripting and HTML-injection vulnerabilities because it fails to
+properly sanitize user-supplied input before using it in dynamically
+generated content.
+
+Successful exploits will allow attacker-supplied HTML and script
+code to run in the context of the affected browser, potentially
+allowing the attacker to steal cookie-based authentication
+credentials or to control how the site is rendered to the user.
+Other attacks are also possible.
+
+NetSaro Enterprise Messenger 2.0 is vulnerable; other versions may
+also be affected.
+
+References:
+http://www.securityfocus.com/bid/49390
+http://www.netsaro.com/";
+
+ script_tag(name:"risk_factor", value:"Medium");
+ script_description(desc);
+ script_summary("Determine if installed NetSaro Enterprise Messenger is vulnerable");
+ script_category(ACT_ATTACK);
+ script_family("Web application abuses");
+ script_copyright("This script is Copyright (C) 2011 Greenbone Networks GmbH");
+ script_dependencies("find_service.nes", "http_version.nasl");
+ script_require_ports("Services/www", 4990);
+ exit(0);
+}
+
+include("http_func.inc");
+include("host_details.inc");
+include("http_keepalive.inc");
+include("global_settings.inc");
+   
+port = get_http_port(default:4990);
+if(!get_port_state(port))exit(0);
+
+sndReq = http_get(item:"/", port:port);
+rcvRes = http_keepalive_send_recv(port:port, data:sndReq);
+
+if("<title>NetSaro Administration Console</title>" >!< rcvRes)exit(0);
+
+req = string("POST /login.nsp HTTP/1.1\r\n",
+	     "Host: ", get_host_name(),"\r\n",
+	     "Content-Type: application/x-www-form-urlencoded\r\n",
+	     "Content-Length: 131\r\n",
+	     "\r\n",
+	     "username=%22%3E%3C%2Fscript%3E%3Cscript%3Ealert%28%22openvas-xss-test%22%29%3C%2Fscript%3E&password=&login=Log+In&postback=postback\r\n",
+	     "\r\n");
+
+rcvRes = http_keepalive_send_recv(port:port, data:req);
+
+if('"></script><script>alert("openvas-xss-test")</script>"' >< rcvRes)  {
+
+  security_warning(port:port);
+  exit(0);
+
+}  


Property changes on: trunk/openvas-plugins/scripts/gb_netsaro_49390.nasl
___________________________________________________________________
Name: svn:keywords
   + Id Revision

Added: trunk/openvas-plugins/scripts/gb_research_display_49395.nasl
===================================================================
--- trunk/openvas-plugins/scripts/gb_research_display_49395.nasl	2011-09-01 09:32:45 UTC (rev 11542)
+++ trunk/openvas-plugins/scripts/gb_research_display_49395.nasl	2011-09-01 12:04:12 UTC (rev 11543)
@@ -0,0 +1,84 @@
+###############################################################################
+# OpenVAS Vulnerability Test
+# $Id$
+#
+# 'research_display.php' SQL Injection Vulnerability
+#
+# Authors:
+# Michael Meyer <michael.meyer at greenbone.net>
+#
+# Copyright:
+# Copyright (c) 2011 Greenbone Networks GmbH
+#
+# This program is free software; you can redistribute it and/or modify
+# it under the terms of the GNU General Public License version 2
+# (or any later version), as published by the Free Software Foundation.
+#
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with this program; if not, write to the Free Software
+# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
+###############################################################################
+
+if (description)
+{
+ script_id(103235);
+ script_bugtraq_id(49395);
+ script_version ("1.0-$Revision$");
+
+ script_name("'research_display.php' SQL Injection Vulnerability");
+
+desc = "Overview:
+research_display.php is prone to an SQL-injection vulnerability because it
+fails to sufficiently sanitize user-supplied data before using it in
+an SQL query.
+
+Exploiting this issue could allow an attacker to compromise the
+application, access or modify data, or exploit latent vulnerabilities
+in the underlying database.
+
+References:
+http://www.securityfocus.com/bid/49395";
+
+ script_tag(name:"risk_factor", value:"Medium");
+ script_description(desc);
+ script_summary("Determine if research_display.php is prone to an SQL-injection vulnerability");
+ script_category(ACT_ATTACK);
+ script_family("Web application abuses");
+ script_copyright("This script is Copyright (C) 2011 Greenbone Networks GmbH");
+ script_dependencies("find_service.nes", "http_version.nasl");
+ script_require_ports("Services/www", 80);
+ script_exclude_keys("Settings/disable_cgi_scanning");
+ exit(0);
+}
+
+include("http_func.inc");
+include("host_details.inc");
+include("http_keepalive.inc");
+include("global_settings.inc");
+   
+port = get_http_port(default:80);
+if(!get_port_state(port))exit(0);
+
+if(!can_host_php(port:port))exit(0);
+
+dirs = make_list(cgi_dirs());
+
+foreach dir (dirs) {
+   
+  url = string(dir, "/research_display.php?ID=-null+UNiON+ALL+SELECT+null,null,null,0x4f70656e5641532d53514c2d496e6a656374696f6e2d54657374,null,null,null"); 
+
+  if(http_vuln_check(port:port, url:url,pattern:"OpenVAS-SQL-Injection-Test")) {
+     
+    security_warning(port:port);
+    exit(0);
+
+  }
+}
+
+exit(0);
+


Property changes on: trunk/openvas-plugins/scripts/gb_research_display_49395.nasl
___________________________________________________________________
Name: svn:keywords
   + Id Revision



More information about the Openvas-commits mailing list