Re: [nmap-svn] r32457 - nmap/scripts

[Daniel Miller <bonsaiviking () gmail com>]

On 10/23/2013 12:45 PM, commit-mailer () nmap org wrote:
> Author: dmiller
> Date: Wed Oct 23 17:45:48 2013
> New Revision: 32457
>
> Log:
> Add rfc868-time.nse, queries a Time protocol server
>
> Added:
>     nmap/scripts/rfc868-time.nse
>
> Added: nmap/scripts/rfc868-time.nse
> ==============================================================================
> --- (empty file)
> +++ nmap/scripts/rfc868-time.nse        Wed Oct 23 17:45:48 2013
> @@ -0,0 +1,61 @@
> +local comm = require "comm"
> +local shortport = require "shortport"
> +local stdnse = require "stdnse"
> +local bin = require "bin"
> +local nmap = require "nmap"
> +local os = require "os"
> +
> +description = [[
> +Retrieves the day and time from the Time service.
> +]]
> +
> +---
> +-- @output
> +-- PORT   STATE SERVICE
> +-- 37/tcp open  time
> +-- |_rfc868-time: 2013-10-23T10:33:00
> +
> +author = "Daniel Miller"
> +
> +license = "Same as Nmap--See http://nmap.org/book/man-legal.html";
> +
> +categories = {"discovery", "safe", "version"}
> +
> +
> +portrule = shortport.port_or_service(37, "time", {"tcp", "udp"})
> +
> +action = function(host, port)
> +  local status, result = comm.exchange(host, port, "", {bytes=4, proto=port.protocol})
> +
> +  if status then
> +    local _, stamp
> +    local width = #result
> +    if width == 4 then
> +      _, stamp = bin.unpack(">I", result)
> +      port.version.extrainfo = "32 bits"
> +    elseif width == 8 then
> +      _, stamp = bin.unpack(">I", result)
> +      port.version.extrainfo = "64 bits"
> +    else
> +      stdnse.print_debug(1, "Odd response: %s", stdnse.filename_escape(response))
> +      return nil
> +    end
> +
> +    -- RFC 868 epoch is Jan 1, 1900
> +    stamp = stamp - 2208988800
> +
> +    -- Make sure we don't stomp a more-likely service detection.
> +    if port.version.name == "time" then
> +      local diff = os.difftime(stamp,os.time())
> +      if diff < 0 then diff = -diff end
> +      -- confidence decreases by 1 for each year the time is off.
> +      stdnse.print_debug(1, "Time difference: %d seconds (%0.2f years)", diff, diff / 31556926)
> +      local confidence = 10 - diff / 31556926
> +      if confidence < 0 then confidence = 0 end
> +      port.version.name_confidence = confidence
> +      nmap.set_port_version(host, port, "hardmatched")
> +    end
> +
> +    return stdnse.format_timestamp(stamp)
> +  end
> +end
>
> _______________________________________________
> Sent through the svn mailing list
> http://nmap.org/mailman/listinfo/svn
Hi, List,

This script pulls the date from an RFC 868 Time Protocol server. It's a 
bit tricky because the time is an unsigned integer number of seconds 
since 1900. This means that it will wrap in 2036, 2 years before the 
signed 32-bit Unix timestamp will wrap. Version detection is similarly 
tricky, because it depends on the current date and on the server being 
set to something reasonable. Here's some old discussion: 
http://hcsw.org/blog.pl?a=4&b=4

Let this also serve as a reminder that the nmap-service-probes file 
should be updated at each release! The current lines only match times 
through November 2014.

Dan
_______________________________________________
Sent through the dev mailing list
http://nmap.org/mailman/listinfo/dev
Archived at http://seclists.org/nmap-dev/