Network Block Device Info Script #609

mogigoma · 2016-12-11T06:05:14Z

Knocking out one from the Script Ideas article on the wiki: https://secwiki.org/w/Nmap/Script_Ideas#nbd-info.

The server software isn't all that stable, but I've got a decently reliable test server at nmap.kolybabi.com that you're welcome to test against.

% NMAPDIR=. ./nmap -p 10807,10808,10809 --script nbd-info nmap.kolybabi.com 
PORT      STATE SERVICE REASON
10807/tcp open  unknown syn-ack
| nbd-info: 
|   Protocol: 
|     The server software appears to support fixed newstyle negotiation, but not on this port.
|     Negotiation: oldstyle
|     SSL/TLS Wrapped: false
|   Exported Block Devices: 
|     (default): 
|_      Size: 1048576 bytes
10808/tcp open  unknown syn-ack
| nbd-info: 
|   Protocol: 
|     The server software appears to support fixed newstyle negotiation, but not on this port.
|     Negotiation: oldstyle
|     SSL/TLS Wrapped: false
|   Exported Block Devices: 
|     (default): 
|_      Size: 1048576 bytes
10809/tcp open  nbd     syn-ack
| nbd-info: 
|   Protocol: 
|     Negotiation: fixed newstyle
|     SSL/TLS Wrapped: false
|   Exported Block Devices: 
|     foo: 
|       Size: 1048576 bytes
|       Transmission Flags: 
|         READ_ONLY
|         SEND_FUA
|         SEND_FLUSH
|     bar: 
|       Size: 1048576 bytes
|       Transmission Flags: 
|         ROTATIONAL
|_        READ_ONLY

… fixed bugs it found.

dmiller-nmap

Looking good! Thanks for the test server, that is really helpful. Probably you'll want to strip any references to it before publishing, though. Just a few things to fix.

dmiller-nmap · 2017-01-26T23:58:59Z

nselib/nbd.lua

+    self.protocol = {ssl_tls = (proto == "ssl")}
+
+    if #rep ~= 8 then
+      stdnse.debug1("Failed to receive first 64 bits of magic from server: %s", rep)


I get this message a lot for ports 10807 and 10808, and it looks like it's sending more than just the magic first:

NSOCK INFO [0.9450s] nsock_trace_handler_callback(): Callback: READ SUCCESS for EID 42 [138.197.130.253:10807] (24 bytes): NBDMAGIC..B....S........ NSE: TCP 72.14.177.105:49524 < 138.197.130.253:10807 | 00000000: 4e 42 44 4d 41 47 49 43 00 00 42 02 81 86 12 53 NBDMAGIC B S 00000010: 00 00 00 00 00 10 00 00 NSE: [nbd-info 138.197.130.253:10807] Failed to receive first 64 bits of magic from server: NBDMAGIC

Your analysis was correct, the issue was getting sent extra data. I instituted a receive buffer in the protocol object to handle varying sizes of initial receives.

dmiller-nmap · 2017-01-27T00:02:44Z

nselib/nbd.lua

+      if not status then
+	stdnse.debug1("Failed to receive zero pad from server while attaching to export: %s", err)
+	self:close()
+	return false


Super-minor nitpick, but these 3 lines are tabs instead of spaces for indentation. A couple other places have this, too.

Sorry about that, it's what I get for using a default config and 'smart' indentation. Fixed all tabs in new files.

dmiller-nmap · 2017-01-27T00:06:36Z

scripts/nbd-info.nse

+categories = {"discovery", "intrusive"}
+
+-- XXX-MAK: The expanded port range is for testing against nmap.kolybabi.com.
+portrule = shortport.version_port_or_service({10807, 10808, 10809}, "nbd", "tcp")


What should the port numbers be for this? Do we have good service probe matches that can identify NBD?

There is an existing, working service probe. I have reverted the portrule to its non-debug form.

dmiller-nmap · 2017-01-27T00:13:04Z

scripts/nbd-info.nse

+      table.insert(tbl, "The server software appears to support fixed newstyle negotiation, but not on this port.")
+    end
+  end
+  table.insert(tbl, ("Negotiation: %s"):format(comm.protocol.negotiation))


Instead of inserting strings containing "key: value", make tbl a stdnse.output_table and set tbl[key] = value. I know it doesn't work with the "not on this port" thing, but maybe if you had a key like "newstyle negotiation supported:" and the value is "other port"? The other thing to try would be to use both integer (with table.insert) and string keys. I know NSE can handle that, but I don't know if it works via output_table.

Changed reporting method to attempt to address this. Properly, I hope.

dmiller-nmap · 2017-01-27T00:14:48Z

scripts/nbd-info.nse

+  for name, info in pairs(comm.exports) do
+    local exp = {}
+    if type(info.size) == "number" then
+      table.insert(exp, ("Size: %d bytes"):format(info.size))


Here again, if exp is an output_table, then you can insert keys and values instead of just strings.

Changed reporting method to attempt to address this. Properly, I hope.

dmiller-nmap · 2017-01-27T00:16:55Z

scripts/nbd-info.nse

+    output["Exported Block Devices"] = tbl
+  end
+
+  return output, stdnse.format_output(true, output)


stdnse.output_table should not be filtered through stdnse.format_output. Just return it directly.

mogigoma · 2017-02-02T05:52:34Z

All issues addressed. Please let me know if there is anything else I should do.

qiankehan · 2018-03-07T02:57:29Z

@dmiller-nmap Any more reviews on this patch?

mogigoma added 15 commits November 2, 2016 23:40

Initial handshaking attempt fails to receive data.

758b0c3

Fix reversed conditional.

c5e6fe9

Stuff.

9e2d4cd

nbd-info works for all except the fixed newstyle negotiation options.

aa05073

Correct typo.

8a12697

Remove unused methods.

10c145a

Add assertions to protecth attach().

78ef48c

Updated nmap-check to use Lua 5.3, to handling bitwise operators, and…

42acead

… fixed bugs it found.

Incorporates LIST command.

9c6c66d

Prepared script for submission.

2c8bdaf

Remove unused libraries.

301598b

Removed useless comments and direct socket access.

6072a94

Remove unused options.

b057b38

Commented library.

38831d0

Merge branch 'master' into nbd

fa6e4e4

dmiller-nmap requested changes Jan 27, 2017

View reviewed changes

mogigoma added 6 commits February 1, 2017 21:45

Remove tab indentation.

7bacac2

Revert portrule to its non-debug form.

8b507f0

Return stdnse.output_table() data structure directly.

d772735

Change reporting to use key:value as opposed to strings.

b9be652

Fix parsing issue caused by timing and varying initial message sizes.

d94f233

Mark functions as local wherever possible.

f02eb8e

nmap-bot closed this in 262d425 Mar 9, 2018

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Network Block Device Info Script #609

Network Block Device Info Script #609

mogigoma commented Dec 11, 2016 •

edited

dmiller-nmap left a comment

dmiller-nmap Jan 26, 2017

mogigoma Feb 2, 2017

dmiller-nmap Jan 27, 2017

mogigoma Feb 2, 2017

dmiller-nmap Jan 27, 2017

mogigoma Feb 2, 2017

dmiller-nmap Jan 27, 2017

mogigoma Feb 2, 2017

dmiller-nmap Jan 27, 2017

mogigoma Feb 2, 2017

dmiller-nmap Jan 27, 2017

mogigoma Feb 2, 2017

mogigoma commented Feb 2, 2017

qiankehan commented Mar 7, 2018

Network Block Device Info Script #609

Network Block Device Info Script #609

Conversation

mogigoma commented Dec 11, 2016 • edited

dmiller-nmap left a comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

mogigoma commented Feb 2, 2017

qiankehan commented Mar 7, 2018

mogigoma commented Dec 11, 2016 •

edited