1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
|
local stdnse = require "stdnse"
local shortport = require "shortport"
local http = require "http"
local string = require "string"
local vulns = require "vulns"
description = [[
Checks whether target machines are vulnerable to anonymous Frontpage login.
Older, default configurations of Frontpage extensions allow
remote user to login anonymously which may lead to server compromise.
]]
---
-- @usage
-- nmap <target> -p 80 --script=http-frontpage-login
--
-- @args http-frontpage-login.path Path prefix to Frontpage directories. Defaults
-- to root ("/").
--
-- @output
-- PORT STATE SERVICE REASON
-- 80/tcp open http syn-ack
-- | http-frontpage-login:
-- | VULNERABLE:
-- | Frontpage extension anonymous login
-- | State: VULNERABLE
-- | Description:
-- | Default installations of older versions of frontpage extensions allow anonymous logins which can lead to server compromise.
-- |
-- | References:
-- |_ http://insecure.org/sploits/Microsoft.frontpage.insecurities.html
author = "Aleksandar Nikolic"
license = "Same as Nmap--See https://nmap.org/book/man-legal.html"
categories = {"vuln", "safe"}
portrule = shortport.http
action = function(host, port)
local path = stdnse.get_script_args('http-frontpage-login.path') or "/"
local data
local frontpage_vuln = {
title = "Frontpage extension anonymous login",
description = [[
Default installations of older versions of frontpage extensions allow anonymous logins which can lead to server compromise.
]],
references = {
'http://insecure.org/sploits/Microsoft.frontpage.insecurities.html',
},
state = vulns.STATE.NOT_VULN,
};
local report = vulns.Report:new(SCRIPT_NAME, host, port);
data = http.get( host, port, path .. "/_vti_inf.html" )
if data and data.status and data.status == 200 then
--server does support frontpage extensions
local fp_version = string.match(data.body,"FPVersion=\"[%d%.]*\"")
if fp_version then
-- do post request http://msdn.microsoft.com/en-us/library/ms446353
local postdata = "method=open+service:".. fp_version .."&service_name=/"
data = http.post(host,port,path .. "/_vti_bin/_vti_aut/author.dll",nil,nil,postdata)
if data and data.status then
if data.status == 200 then
stdnse.debug1("Frontpage returned 200 OK, server vulnerable.")
frontpage_vuln.state = vulns.STATE.VULN;
elseif data.status == 401 then
stdnse.debug1("Frontpage returned 401, password protected.")
else
stdnse.debug1("Frontpage returned unknown response.")
end
end
end
end
stdnse.debug1("Frontpage probably not installed.")
return report:make_output(frontpage_vuln);
end
|
