local nmap = require "nmap" local stdnse = require "stdnse" local shortport = require "shortport" local table = require "table" local ike = require "ike" description=[[ Obtains information (such as vendor and device type where available) from an IKE service by sending four packets to the host. This scripts tests with both Main and Aggressive Mode and sends multiple transforms per request. ]] --- -- @usage -- nmap -sU -sV -p 500 -- nmap -sU -p 500 --script ike-version -- -- @output -- PORT STATE SERVICE REASON VERSION -- 500/udp open isakmp udp-response Fortinet FortiGate v5 -- | ike-version: -- | vendor_id: Fortinet FortiGate v5 -- | attributes: -- | Dead Peer Detection v1.0 -- |_ XAUTH -- Service Info: OS: Fortigate v5; Device: Network Security Appliance; CPE: cpe:/h:fortinet:fortigate -- -- @xmloutput -- Fortinet FortiGate v5 -- -- 1234567890abcdef --
-- -- Dead Peer Detection v1.0 -- XAUTH --
--- author = "Jesper Kueckelhahn" license = "Same as Nmap--See https://nmap.org/book/man-legal.html" categories = {"default", "discovery", "safe", "version"} portrule = shortport.version_port_or_service(500, "isakmp", "udp") -- Test different methods for getting version -- local function get_version(host, port) local packet, version, t local auth = {"psk", "rsa", "Hybrid", "XAUTH"} local encryption = {"des", "3des", "aes/128", "aes/192", "aes/256"} local hash = {"md5", "sha1"} local group = {"768", "1024", "1536"} -- generate transforms t = {} for h,a in pairs(auth) do for i,e in pairs(encryption) do for j,h in pairs(hash) do for k,g in pairs(group) do table.insert(t, { ['auth'] = a, ['encryption'] = e, ['hash'] = h, ['group'] = g}); end end end end -- try aggressive mode (diffie hellman group 2) local diffie = 2 stdnse.debug1("Sending Aggressive mode packet ...") packet = ike.request(port.number, port.protocol, 'Aggressive', t, diffie, 'vpngroup') version = ike.send_request(host, port, packet) if version.success then return version end stdnse.debug1("Aggressive mode (dh 2) failed") -- try aggressive mode (diffie hellman group 1) diffie = 1 stdnse.debug1("Sending Aggressive mode packet ...") packet = ike.request(port.number, port.protocol, 'Aggressive', t, diffie, 'vpngroup') version = ike.send_request(host, port, packet) if version.success then return version end stdnse.debug1("Aggressive mode (dh 1) failed") -- try aggressive mode (diffie hellman group 2, no id) -- some checkpoint devices respond to this local diffie = 2 stdnse.debug1("Sending Aggressive mode packet ...") packet = ike.request(port.number, port.protocol, 'Aggressive', t, diffie, '') version = ike.send_request(host, port, packet) if version.success then return version end stdnse.debug1("Aggressive mode (dh 2, no id) failed") -- try main mode stdnse.debug1("Sending Main mode packet ...") packet = ike.request(port.number, port.protocol, 'Main', t, '') version = ike.send_request(host, port, packet) if version.success then return version end stdnse.debug1("Main mode failed") stdnse.debug1("Version detection not possible") return false end action = function( host, port ) local ike_response = get_version(host, port) if ike_response then -- get_version only returns something if ike.send_request().success == true nmap.set_port_state(host, port, "open") -- Extra information found in the response. Kept for future reference. -- local mode = ike_response['mode'] -- local vids = ike_response['vids'] local info = ike_response['info'] local set_version = false local out = stdnse.output_table() if info.vendor ~= nil then set_version = true if info.vendor.vendor then out.vendor_id = info.vendor.vendor port.version.product = info.vendor.vendor end if info.vendor.version then port.version.version = info.vendor.version out.vendor_id = (out.vendor_id or "") .. " " .. info.vendor.version end port.version.ostype = info.vendor.ostype port.version.devicetype = info.vendor.devicetype table.insert(port.version.cpe, info.vendor.cpe) end local attribs = {} for i, attrib in ipairs(info.attribs) do attribs[i] = attrib.text if attrib.ostype or attrib.devicetype or attrib.cpe then set_version = true port.version.ostype = port.version.ostype or attrib.ostype port.version.devicetype = port.version.devicetype or attrib.devicetype table.insert(port.version.cpe, attrib.cpe) end end out.unmatched_ids = info.unmatched_ids if next(attribs) then out.attributes = attribs end if set_version then nmap.set_port_version(host, port, "hardmatched") end stdnse.debug1("Version: %s", port.version.product ) return out end end