local nmap = require "nmap" local shortport = require "shortport" local snmp = require "snmp" local table = require "table" description = [[ Attempts to enumerate Windows user accounts through SNMP ]] --- -- @usage -- nmap -sU -p 161 --script=snmp-win32-users -- @output -- | snmp-win32-users: -- | Administrator -- | Guest -- | IUSR_EDUSRV011 -- | IWAM_EDUSRV011 -- | SUPPORT_388945a0 -- | Tomcat -- | db2admin -- | ldaptest -- |_ patrik -- @xmloutput -- Administrator -- Guest -- IUSR_EDUSRV011 -- IWAM_EDUSRV011 -- SUPPORT_388945a0 -- Tomcat -- db2admin -- ldaptest -- patrik author = "Patrik Karlsson" license = "Same as Nmap--See https://nmap.org/book/man-legal.html" categories = {"default", "auth", "safe"} dependencies = {"snmp-brute"} -- Version 0.3 -- Created 01/15/2010 - v0.1 - created by Patrik Karlsson -- Revised 01/19/2010 - v0.2 - fixed loop that would occur if a mib did not exist -- Revised 04/11/2010 - v0.3 - moved snmp_walk to snmp library portrule = shortport.port_or_service(161, "snmp", "udp", {"open", "open|filtered"}) --- Processes the table and creates the script output -- -- @param tbl table containing oid and value -- @return table with just the values local function process_answer( tbl ) local new_tab = {} for _, v in ipairs( tbl ) do table.insert( new_tab, v.value ) end table.sort( new_tab ) return new_tab end action = function(host, port) local snmpoid = "1.3.6.1.4.1.77.1.2.25" local users = {} local status local snmpHelper = snmp.Helper:new(host, port) snmpHelper:connect() status, users = snmpHelper:walk( snmpoid ) if( not(status) ) then return end users = process_answer( users ) if ( users == nil ) or ( #users == 0 ) then return end nmap.set_port_state(host, port, "open") return users end