local creds = require "creds"
local brute = require "brute"
local nmap = require "nmap"
local shortport = require "shortport"
local string = require "string"
local stdnse = require "stdnse"

description = [[
Performs brute force password auditing against the Netbus backdoor
("remote administration") service.
]]

---
-- @usage
-- nmap -p 12345 --script netbus-brute <target>
--
-- @output
-- 12345/tcp open  netbus
-- |_netbus-brute: password123

author = "Toni Ruottu, Claudiu Perta"
license = "Same as Nmap--See http://nmap.org/book/man-legal.html"
categories = {"brute", "intrusive"}


dependencies = {"netbus-version"}

portrule = shortport.port_or_service (12345, "netbus", {"tcp"})

Driver = {

  new = function(self, host, port)
    local o = {}
    setmetatable(o, self)
    self.__index = self
    o.host = host
    o.port = port
    return o
  end,

  connect = function(self)
    self.socket = nmap.new_socket()
    local status, err = self.socket:connect(self.host, self.port)
    if (not(status)) then
      return false, brute.Error:new("Couldn't connect to host: " .. err)
    end

    -- skip the banner
    local buffer, err = stdnse.make_buffer(self.socket, "\r")
    local _ = buffer()

    return true
  end,

  login = function(self, username, password)
    local buffer, err = stdnse.make_buffer(self.socket, "\r")

    local formatted_password = string.format("Password;0;%s\r", password)
    self.socket:send(formatted_password)

    local reply = buffer()

    if (reply == "Access;1") then
       -- Store the password for other netbus scripts
      local key = string.format("%s:%d", self.host.ip, self.port.number)

      if not nmap.registry.netbuspasswords then
        nmap.registry.netbuspasswords = {}
      end
      nmap.registry.netbuspasswords[key] = password
      return true, brute.Account:new("", password, creds.State.VALID)
    else
      return false, brute.Error:new("Incorrect password")
    end
  end,

  disconnect = function(self)
    self.socket:close()
    return true
  end,

  check = function(self)
    return true
  end
}

action = function(host, port)
  local status, result
  local engine = brute.Engine:new(Driver, host, port)

  engine.options.firstonly = true
  engine.options.passonly = true
  engine.options.script_name = SCRIPT_NAME

  status, result = engine:start()

  return result
end