1#@!#!123s

: / usr / share / nmap / scripts /
Filename : nrpe-enum.nse
back
local bin = require "bin"
local bit = require "bit"
local nmap = require "nmap"
local shortport = require "shortport"
local stdnse = require "stdnse"
local string = require "string"
local tab = require "tab"

-- -*- mode: lua -*-
-- vim: set filetype=lua :

description = [[
Queries Nagios Remote Plugin Executor (NRPE) daemons to obtain information such as load averages, process counts, logged in user information, etc.

This script attempts to execute the stock list of commands that are
enabled. User-supplied arguments are not supported.
]]

---
-- @usage
-- nmap --script nrpe-enum -p 5666 <host>
--
-- @args nrpe-enum.cmds A colon-separated list of commands to be executed.
--
-- @output
-- PORT     STATE SERVICE REASON
-- 5666/tcp open  nrpe    syn-ack
-- | nrpe-enum:
-- | Command             State     Response
-- | check_hda1          CRITICAL  NRPE: Command 'check_hda1' not defined
-- | check_load          OK        OK - load average: 1.00, 1.00, 1.00|load1=1.000;15.000;30.000;0; load5=1.000;10.000;25.000;0; load15=1.000;5.000;20.000;0;
-- | check_total_procs   OK        PROCS OK: 5 processes
-- | check_users         WARNING   USERS WARNING - 2 users currently logged in |users=2;0;10;0
-- |_check_zombie_procs  OK        PROCS OK: 0 processes with STATE = Z

author = "Mak Kolybabi"
license = "Same as Nmap--See http://nmap.org/book/man-legal.html"
categories = {"discovery", "intrusive"}


local NRPE_PROTOCOLS = {
	"ssl",
	"tcp"
}

local NRPE_STATES = {
	[0] = "OK",
	[1] = "WARNING",
	[2] ="CRITICAL",
	[3] = "UNKNOWN"
}

local NRPE_COMMANDS = {
	"check_hda1",
	"check_load",
	"check_total_procs",
	"check_users",
	"check_zombie_procs"
}

local CRC32_CONSTANTS = {
	0x00000000, 0x77073096, 0xEE0E612C, 0x990951BA, 0x076DC419, 0x706AF48F,
	0xE963A535, 0x9E6495A3, 0x0EDB8832, 0x79DCB8A4, 0xE0D5E91E, 0x97D2D988,
	0x09B64C2B, 0x7EB17CBD, 0xE7B82D07, 0x90BF1D91, 0x1DB71064, 0x6AB020F2,
	0xF3B97148, 0x84BE41DE, 0x1ADAD47D, 0x6DDDE4EB, 0xF4D4B551, 0x83D385C7,
	0x136C9856, 0x646BA8C0, 0xFD62F97A, 0x8A65C9EC, 0x14015C4F, 0x63066CD9,
	0xFA0F3D63, 0x8D080DF5, 0x3B6E20C8, 0x4C69105E, 0xD56041E4, 0xA2677172,
	0x3C03E4D1, 0x4B04D447, 0xD20D85FD, 0xA50AB56B, 0x35B5A8FA, 0x42B2986C,
	0xDBBBC9D6, 0xACBCF940, 0x32D86CE3, 0x45DF5C75, 0xDCD60DCF, 0xABD13D59,
	0x26D930AC, 0x51DE003A, 0xC8D75180, 0xBFD06116, 0x21B4F4B5, 0x56B3C423,
	0xCFBA9599, 0xB8BDA50F, 0x2802B89E, 0x5F058808, 0xC60CD9B2, 0xB10BE924,
	0x2F6F7C87, 0x58684C11, 0xC1611DAB, 0xB6662D3D, 0x76DC4190, 0x01DB7106,
	0x98D220BC, 0xEFD5102A, 0x71B18589, 0x06B6B51F, 0x9FBFE4A5, 0xE8B8D433,
	0x7807C9A2, 0x0F00F934, 0x9609A88E, 0xE10E9818, 0x7F6A0DBB, 0x086D3D2D,
	0x91646C97, 0xE6635C01, 0x6B6B51F4, 0x1C6C6162, 0x856530D8, 0xF262004E,
	0x6C0695ED, 0x1B01A57B, 0x8208F4C1, 0xF50FC457, 0x65B0D9C6, 0x12B7E950,
	0x8BBEB8EA, 0xFCB9887C, 0x62DD1DDF, 0x15DA2D49, 0x8CD37CF3, 0xFBD44C65,
	0x4DB26158, 0x3AB551CE, 0xA3BC0074, 0xD4BB30E2, 0x4ADFA541, 0x3DD895D7,
	0xA4D1C46D, 0xD3D6F4FB, 0x4369E96A, 0x346ED9FC, 0xAD678846, 0xDA60B8D0,
	0x44042D73, 0x33031DE5, 0xAA0A4C5F, 0xDD0D7CC9, 0x5005713C, 0x270241AA,
	0xBE0B1010, 0xC90C2086, 0x5768B525, 0x206F85B3, 0xB966D409, 0xCE61E49F,
	0x5EDEF90E, 0x29D9C998, 0xB0D09822, 0xC7D7A8B4, 0x59B33D17, 0x2EB40D81,
	0xB7BD5C3B, 0xC0BA6CAD, 0xEDB88320, 0x9ABFB3B6, 0x03B6E20C, 0x74B1D29A,
	0xEAD54739, 0x9DD277AF, 0x04DB2615, 0x73DC1683, 0xE3630B12, 0x94643B84,
	0x0D6D6A3E, 0x7A6A5AA8, 0xE40ECF0B, 0x9309FF9D, 0x0A00AE27, 0x7D079EB1,
	0xF00F9344, 0x8708A3D2, 0x1E01F268, 0x6906C2FE, 0xF762575D, 0x806567CB,
	0x196C3671, 0x6E6B06E7, 0xFED41B76, 0x89D32BE0, 0x10DA7A5A, 0x67DD4ACC,
	0xF9B9DF6F, 0x8EBEEFF9, 0x17B7BE43, 0x60B08ED5, 0xD6D6A3E8, 0xA1D1937E,
	0x38D8C2C4, 0x4FDFF252, 0xD1BB67F1, 0xA6BC5767, 0x3FB506DD, 0x48B2364B,
	0xD80D2BDA, 0xAF0A1B4C, 0x36034AF6, 0x41047A60, 0xDF60EFC3, 0xA867DF55,
	0x316E8EEF, 0x4669BE79, 0xCB61B38C, 0xBC66831A, 0x256FD2A0, 0x5268E236,
	0xCC0C7795, 0xBB0B4703, 0x220216B9, 0x5505262F, 0xC5BA3BBE, 0xB2BD0B28,
	0x2BB45A92, 0x5CB36A04, 0xC2D7FFA7, 0xB5D0CF31, 0x2CD99E8B, 0x5BDEAE1D,
	0x9B64C2B0, 0xEC63F226, 0x756AA39C, 0x026D930A, 0x9C0906A9, 0xEB0E363F,
	0x72076785, 0x05005713, 0x95BF4A82, 0xE2B87A14, 0x7BB12BAE, 0x0CB61B38,
	0x92D28E9B, 0xE5D5BE0D, 0x7CDCEFB7, 0x0BDBDF21, 0x86D3D2D4, 0xF1D4E242,
	0x68DDB3F8, 0x1FDA836E, 0x81BE16CD, 0xF6B9265B, 0x6FB077E1, 0x18B74777,
	0x88085AE6, 0xFF0F6A70, 0x66063BCA, 0x11010B5C, 0x8F659EFF, 0xF862AE69,
	0x616BFFD3, 0x166CCF45, 0xA00AE278, 0xD70DD2EE, 0x4E048354, 0x3903B3C2,
	0xA7672661, 0xD06016F7, 0x4969474D, 0x3E6E77DB, 0xAED16A4A, 0xD9D65ADC,
	0x40DF0B66, 0x37D83BF0, 0xA9BCAE53, 0xDEBB9EC5, 0x47B2CF7F, 0x30B5FFE9,
	0xBDBDF21C, 0xCABAC28A, 0x53B39330, 0x24B4A3A6, 0xBAD03605, 0xCDD70693,
	0x54DE5729, 0x23D967BF, 0xB3667A2E, 0xC4614AB8, 0x5D681B02, 0x2A6F2B94,
	0xB40BBE37, 0xC30C8EA1, 0x5A05DF1B, 0x2D02EF8D
}

local crc32 = function(s)
	local crc = 0xFFFFFFFF
	for i = 1, #s do
		local p1 = s:byte(i)
		local p2 = bit.bxor(crc, p1)
		local p3 = bit.band(p2, 0xFF)
		local p4 = bit.band(p3)
		local p5 = CRC32_CONSTANTS[p4 + 1]
		local p6 = bit.rshift(crc, 8)

		crc = bit.bxor(p6, p5)
	end

	return bit.bxor(crc, 0xFFFFFFFF)
end

local nrpe_open = function(host, port)
	for _, proto in pairs(NRPE_PROTOCOLS) do
		local sock = nmap.new_socket()
		sock:set_timeout(2000)
		local status, err = sock:connect(host, port, proto)
		if status then
			NRPE_PROTOCOLS = {proto}
			return true, sock
		end

		stdnse.print_debug(2, "Can't connect using %s: %s", proto, err)
		sock:close()
	end

	return false, nil
end

local nrpe_write = function(cmd)
	-- Create request packet, before checksum.
	local pkt = ""
	pkt = pkt .. bin.pack(">S", 2)
	pkt = pkt .. bin.pack(">S", 1)
	pkt = pkt .. bin.pack(">I", 0)
	pkt = pkt .. bin.pack(">S", 0)
	pkt = pkt .. bin.pack("A", cmd)
	pkt = pkt .. string.char(0x00):rep(1024 - #cmd)
	pkt = pkt .. bin.pack(">S", 0)

	-- Calculate the checksum, and insert it into the packet.
	pkt = bin.pack(
		"A>IA",
		string.char(pkt:byte(1, 4)),
		crc32(pkt),
		string.char(pkt:byte(9, #pkt))
	)

	return pkt
end

local nrpe_read = function(pkt)
	local i
	local result = {}

	-- Parse packet.
	i, result.version = bin.unpack(">S", pkt, i)
	i, result.type = bin.unpack(">S", pkt, i)
	i, result.crc32 = bin.unpack(">I", pkt, i)
	i, result.state = bin.unpack(">S", pkt, i)
	i, result.data = bin.unpack("z", pkt, i)

	return result
end

local nrpe_check = function(host, port, cmd)
	-- Create connection.
	local status, sock = nrpe_open(host, port)
	if not status then
		return false, nil
	end

	-- Send query.
	local status, err = sock:send(nrpe_write(cmd))
	if not status then
		stdnse.print_debug(1, "Failed to send NRPE query for command %s: %s", cmd, err)
		sock:close()
		return false, nil
	end

	-- Receive response.
	local status, resp = sock:receive()
	if not status then
		stdnse.print_debug(1, "Can't read NRPE response: %s", resp)
		sock:close()
		return false, nil
	end

	sock:close()

	return true, nrpe_read(resp)
end

portrule = shortport.port_or_service(5666, "nrpe")

action = function(host, port)
	-- Get script arguments.
	local cmds = stdnse.get_script_args("nrpe-enum.cmds")
	if cmds then
		cmds = stdnse.strsplit(":", cmds)
	else
		cmds = NRPE_COMMANDS
	end

	-- Create results table.
	local results = tab.new()
	tab.addrow(
		results,
		"Command",
		"State",
		"Response"
	)

	-- Try each NRPE command, and collect the results.
	for _, cmd in pairs(cmds) do
		local status, result = nrpe_check(host, port, cmd)
		if status then
			tab.addrow(
				results,
				cmd,
				NRPE_STATES[result.state],
				result.data
			)
		end
	end

	-- If no queries generated responses, don't output anything.
	if #results == 1 then
		 return
	end

	-- Record service description.
	port.version.name = "nrpe"
	port.version.product = "Nagios Remote Plugin Executor"
	nmap.set_port_version(host, port)

	-- Format table, without trailing newline.
	results = tab.dump(results)
	results = results:sub(1, #results - 1)

	return "\n" .. results
end