1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
|
local afp = require "afp"
local nmap = require "nmap"
local shortport = require "shortport"
local stdnse = require "stdnse"
local table = require "table"
description = [[
Shows AFP server information. This information includes the server's
hostname, IPv4 and IPv6 addresses, and hardware type (for example
<code>Macmini</code> or <code>MacBookPro</code>).
]]
---
-- @output
-- PORT STATE SERVICE
-- 548/tcp open afp
-- | afp-serverinfo:
-- | Server Flags:
-- | Flags hex: 0x837d
-- | Super Client: true
-- | UUIDs: false
-- | UTF8 Server Name: true
-- | Open Directory: true
-- | Reconnect: false
-- | Server Notifications: true
-- | TCP/IP: true
-- | Server Signature: true
-- | Server Messages: true
-- | Password Saving Prohibited: true
-- | Password Changing: false
-- | Copy File: true
-- | Server Name: foobardigital
-- | Machine Type: Netatalk
-- | AFP Versions: AFPVersion 1.1, AFPVersion 2.0, AFPVersion 2.1, AFP2.2, AFPX03, AFP3.1
-- | UAMs: DHX2
-- | Server Signature: bbeb480e00000000bbeb480e00000000
-- | Network Addresses:
-- | 192.0.2.235
-- | foobardigital.com
-- |_ UTF8 Server Name: foobardigital
--
-- @xmloutput
-- <table key="Server Flags">
-- <elem key="Flags hex">0x837d</elem>
-- <elem key="Super Client">true</elem>
-- <elem key="UUIDs">false</elem>
-- <elem key="UTF8 Server Name">true</elem>
-- <elem key="Open Directory">true</elem>
-- <elem key="Reconnect">false</elem>
-- <elem key="Server Notifications">true</elem>
-- <elem key="TCP/IP">true</elem>
-- <elem key="Server Signature">true</elem>
-- <elem key="Server Messages">true</elem>
-- <elem key="Password Saving Prohibited">true</elem>
-- <elem key="Password Changing">false</elem>
-- <elem key="Copy File">true</elem>
-- </table>
-- <elem key="Server Name">foobardigital</elem>
-- <elem key="Machine Type">Netatalk</elem>
-- <table key="AFP Versions">
-- <elem>AFPVersion 1.1</elem>
-- <elem>AFPVersion 2.0</elem>
-- <elem>AFPVersion 2.1</elem>
-- <elem>AFP2.2</elem>
-- <elem>AFPX03</elem>
-- <elem>AFP3.1</elem>
-- </table>
-- <table key="UAMs">
-- <elem>DHX2</elem>
-- </table>
-- <elem key="Server Signature">
-- bbeb480e00000000bbeb480e00000000</elem>
-- <table key="Network Addresses">
-- <elem>192.0.2.235</elem>
-- <elem>foobardigital.com</elem>
-- </table>
-- <elem key="UTF8 Server Name">foobardigital</elem>
-- Version 0.2
-- Created 2010/02/09 - v0.1 - created by Andrew Orr
-- Revised 2010/02/10 - v0.2 - added checks for optional fields
-- Revised 2015/02/25 - v0.3 - XML structured output
author = "Andrew Orr"
license = "Same as Nmap--See https://nmap.org/book/man-legal.html"
categories = {"default", "discovery", "safe"}
portrule = shortport.port_or_service(548, "afp")
local commasep = {
__tostring = function (t)
return table.concat(t, ", ")
end
}
action = function(host, port)
local socket = nmap.new_socket()
local status
local result = stdnse.output_table()
local temp
-- set a reasonable timeout value
socket:set_timeout(5000)
-- do some exception handling / cleanup
local catch = function()
socket:close()
end
local try = nmap.new_try(catch)
try( socket:connect(host, port) )
-- get our data
local afp_proto = afp.Proto:new( { socket=socket } )
local response = afp_proto:fp_get_server_info( socket )
response = response.result
-- all the server information is output in the order it occurs in the server
-- response. It might be better rearranged?
-- output the server flags nicely
-- Would like to just pass response.flags, but key ordering would be more
-- work than it's worth.
local flags = stdnse.output_table()
flags["Flags hex"] = ("0x%04x"):format(response.flags.raw)
flags["Super Client"] = response.flags.SuperClient
flags["UUIDs"] = response.flags.UUIDs
flags["UTF8 Server Name"] = response.flags.UTF8ServerName
flags["Open Directory"] = response.flags.OpenDirectory
flags["Reconnect"] = response.flags.Reconnect
flags["Server Notifications"] = response.flags.ServerNotifications
flags["TCP/IP"] = response.flags.TCPoverIP
flags["Server Signature"] = response.flags.ServerSignature
flags["Server Messages"] = response.flags.ServerMessages
flags["Password Saving Prohibited"] = response.flags.NoPasswordSaving
flags["Password Changing"] = response.flags.ChangeablePasswords
flags["Copy File"] = response.flags.CopyFile
result["Server Flags"] = flags
-- other info
result["Server Name"] = response.server_name
result["Machine Type"] = response.machine_type
-- list the supported AFP versions
result["AFP Versions"] = response.afp_versions
setmetatable(result["AFP Versions"], commasep)
-- list the supported UAMs (User Authentication Modules)
result["UAMs"] = response.uams
setmetatable(result["UAMs"], commasep)
-- server signature, not sure of the format here so just showing a hex string
if response.flags.ServerSignature then
result["Server Signature"] = stdnse.tohex(response.server_signature)
end
-- listing the network addresses one line each
-- the default for Mac OS X AFP server is to bind everywhere, so this will
-- list all network interfaces that the machine has
if response.network_addresses_count > 0 then
result["Network Addresses"] = response.network_addresses
end
-- similar to above
if response.directory_names_count > 0 then
result["Directory Names"] = response.directory_names
end
-- and finally the utf8 server name
if response.flags.UTF8ServerName then
result["UTF8 Server Name"] = response.utf8_server_name
end
return result
end
|
