local bin = require "bin"
local bit = require "bit"
local nmap = require "nmap"
local shortport = require "shortport"
local stdnse = require "stdnse"
local string = require "string"
local tab = require "tab"
-- -*- mode: lua -*-
-- vim: set filetype=lua :
description = [[
Queries Nagios Remote Plugin Executor (NRPE) daemons to obtain information such as load averages, process counts, logged in user information, etc.
This script attempts to execute the stock list of commands that are
enabled. User-supplied arguments are not supported.
]]
---
-- @usage
-- nmap --script nrpe-enum -p 5666 <host>
--
-- @args nrpe-enum.cmds A colon-separated list of commands to be executed.
--
-- @output
-- PORT STATE SERVICE REASON
-- 5666/tcp open nrpe syn-ack
-- | nrpe-enum:
-- | Command State Response
-- | check_hda1 CRITICAL NRPE: Command 'check_hda1' not defined
-- | check_load OK OK - load average: 1.00, 1.00, 1.00|load1=1.000;15.000;30.000;0; load5=1.000;10.000;25.000;0; load15=1.000;5.000;20.000;0;
-- | check_total_procs OK PROCS OK: 5 processes
-- | check_users WARNING USERS WARNING - 2 users currently logged in |users=2;0;10;0
-- |_check_zombie_procs OK PROCS OK: 0 processes with STATE = Z
author = "Mak Kolybabi"
license = "Same as Nmap--See http://nmap.org/book/man-legal.html"
categories = {"discovery", "intrusive"}
local NRPE_PROTOCOLS = {
"ssl",
"tcp"
}
local NRPE_STATES = {
[0] = "OK",
[1] = "WARNING",
[2] ="CRITICAL",
[3] = "UNKNOWN"
}
local NRPE_COMMANDS = {
"check_hda1",
"check_load",
"check_total_procs",
"check_users",
"check_zombie_procs"
}
local CRC32_CONSTANTS = {
0x00000000, 0x77073096, 0xEE0E612C, 0x990951BA, 0x076DC419, 0x706AF48F,
0xE963A535, 0x9E6495A3, 0x0EDB8832, 0x79DCB8A4, 0xE0D5E91E, 0x97D2D988,
0x09B64C2B, 0x7EB17CBD, 0xE7B82D07, 0x90BF1D91, 0x1DB71064, 0x6AB020F2,
0xF3B97148, 0x84BE41DE, 0x1ADAD47D, 0x6DDDE4EB, 0xF4D4B551, 0x83D385C7,
0x136C9856, 0x646BA8C0, 0xFD62F97A, 0x8A65C9EC, 0x14015C4F, 0x63066CD9,
0xFA0F3D63, 0x8D080DF5, 0x3B6E20C8, 0x4C69105E, 0xD56041E4, 0xA2677172,
0x3C03E4D1, 0x4B04D447, 0xD20D85FD, 0xA50AB56B, 0x35B5A8FA, 0x42B2986C,
0xDBBBC9D6, 0xACBCF940, 0x32D86CE3, 0x45DF5C75, 0xDCD60DCF, 0xABD13D59,
0x26D930AC, 0x51DE003A, 0xC8D75180, 0xBFD06116, 0x21B4F4B5, 0x56B3C423,
0xCFBA9599, 0xB8BDA50F, 0x2802B89E, 0x5F058808, 0xC60CD9B2, 0xB10BE924,
0x2F6F7C87, 0x58684C11, 0xC1611DAB, 0xB6662D3D, 0x76DC4190, 0x01DB7106,
0x98D220BC, 0xEFD5102A, 0x71B18589, 0x06B6B51F, 0x9FBFE4A5, 0xE8B8D433,
0x7807C9A2, 0x0F00F934, 0x9609A88E, 0xE10E9818, 0x7F6A0DBB, 0x086D3D2D,
0x91646C97, 0xE6635C01, 0x6B6B51F4, 0x1C6C6162, 0x856530D8, 0xF262004E,
0x6C0695ED, 0x1B01A57B, 0x8208F4C1, 0xF50FC457, 0x65B0D9C6, 0x12B7E950,
0x8BBEB8EA, 0xFCB9887C, 0x62DD1DDF, 0x15DA2D49, 0x8CD37CF3, 0xFBD44C65,
0x4DB26158, 0x3AB551CE, 0xA3BC0074, 0xD4BB30E2, 0x4ADFA541, 0x3DD895D7,
0xA4D1C46D, 0xD3D6F4FB, 0x4369E96A, 0x346ED9FC, 0xAD678846, 0xDA60B8D0,
0x44042D73, 0x33031DE5, 0xAA0A4C5F, 0xDD0D7CC9, 0x5005713C, 0x270241AA,
0xBE0B1010, 0xC90C2086, 0x5768B525, 0x206F85B3, 0xB966D409, 0xCE61E49F,
0x5EDEF90E, 0x29D9C998, 0xB0D09822, 0xC7D7A8B4, 0x59B33D17, 0x2EB40D81,
0xB7BD5C3B, 0xC0BA6CAD, 0xEDB88320, 0x9ABFB3B6, 0x03B6E20C, 0x74B1D29A,
0xEAD54739, 0x9DD277AF, 0x04DB2615, 0x73DC1683, 0xE3630B12, 0x94643B84,
0x0D6D6A3E, 0x7A6A5AA8, 0xE40ECF0B, 0x9309FF9D, 0x0A00AE27, 0x7D079EB1,
0xF00F9344, 0x8708A3D2, 0x1E01F268, 0x6906C2FE, 0xF762575D, 0x806567CB,
0x196C3671, 0x6E6B06E7, 0xFED41B76, 0x89D32BE0, 0x10DA7A5A, 0x67DD4ACC,
0xF9B9DF6F, 0x8EBEEFF9, 0x17B7BE43, 0x60B08ED5, 0xD6D6A3E8, 0xA1D1937E,
0x38D8C2C4, 0x4FDFF252, 0xD1BB67F1, 0xA6BC5767, 0x3FB506DD, 0x48B2364B,
0xD80D2BDA, 0xAF0A1B4C, 0x36034AF6, 0x41047A60, 0xDF60EFC3, 0xA867DF55,
0x316E8EEF, 0x4669BE79, 0xCB61B38C, 0xBC66831A, 0x256FD2A0, 0x5268E236,
0xCC0C7795, 0xBB0B4703, 0x220216B9, 0x5505262F, 0xC5BA3BBE, 0xB2BD0B28,
0x2BB45A92, 0x5CB36A04, 0xC2D7FFA7, 0xB5D0CF31, 0x2CD99E8B, 0x5BDEAE1D,
0x9B64C2B0, 0xEC63F226, 0x756AA39C, 0x026D930A, 0x9C0906A9, 0xEB0E363F,
0x72076785, 0x05005713, 0x95BF4A82, 0xE2B87A14, 0x7BB12BAE, 0x0CB61B38,
0x92D28E9B, 0xE5D5BE0D, 0x7CDCEFB7, 0x0BDBDF21, 0x86D3D2D4, 0xF1D4E242,
0x68DDB3F8, 0x1FDA836E, 0x81BE16CD, 0xF6B9265B, 0x6FB077E1, 0x18B74777,
0x88085AE6, 0xFF0F6A70, 0x66063BCA, 0x11010B5C, 0x8F659EFF, 0xF862AE69,
0x616BFFD3, 0x166CCF45, 0xA00AE278, 0xD70DD2EE, 0x4E048354, 0x3903B3C2,
0xA7672661, 0xD06016F7, 0x4969474D, 0x3E6E77DB, 0xAED16A4A, 0xD9D65ADC,
0x40DF0B66, 0x37D83BF0, 0xA9BCAE53, 0xDEBB9EC5, 0x47B2CF7F, 0x30B5FFE9,
0xBDBDF21C, 0xCABAC28A, 0x53B39330, 0x24B4A3A6, 0xBAD03605, 0xCDD70693,
0x54DE5729, 0x23D967BF, 0xB3667A2E, 0xC4614AB8, 0x5D681B02, 0x2A6F2B94,
0xB40BBE37, 0xC30C8EA1, 0x5A05DF1B, 0x2D02EF8D
}
local crc32 = function(s)
local crc = 0xFFFFFFFF
for i = 1, #s do
local p1 = s:byte(i)
local p2 = bit.bxor(crc, p1)
local p3 = bit.band(p2, 0xFF)
local p4 = bit.band(p3)
local p5 = CRC32_CONSTANTS[p4 + 1]
local p6 = bit.rshift(crc, 8)
crc = bit.bxor(p6, p5)
end
return bit.bxor(crc, 0xFFFFFFFF)
end
local nrpe_open = function(host, port)
for _, proto in pairs(NRPE_PROTOCOLS) do
local sock = nmap.new_socket()
sock:set_timeout(2000)
local status, err = sock:connect(host, port, proto)
if status then
NRPE_PROTOCOLS = {proto}
return true, sock
end
stdnse.print_debug(2, "Can't connect using %s: %s", proto, err)
sock:close()
end
return false, nil
end
local nrpe_write = function(cmd)
-- Create request packet, before checksum.
local pkt = ""
pkt = pkt .. bin.pack(">S", 2)
pkt = pkt .. bin.pack(">S", 1)
pkt = pkt .. bin.pack(">I", 0)
pkt = pkt .. bin.pack(">S", 0)
pkt = pkt .. bin.pack("A", cmd)
pkt = pkt .. string.char(0x00):rep(1024 - #cmd)
pkt = pkt .. bin.pack(">S", 0)
-- Calculate the checksum, and insert it into the packet.
pkt = bin.pack(
"A>IA",
string.char(pkt:byte(1, 4)),
crc32(pkt),
string.char(pkt:byte(9, #pkt))
)
return pkt
end
local nrpe_read = function(pkt)
local i
local result = {}
-- Parse packet.
i, result.version = bin.unpack(">S", pkt, i)
i, result.type = bin.unpack(">S", pkt, i)
i, result.crc32 = bin.unpack(">I", pkt, i)
i, result.state = bin.unpack(">S", pkt, i)
i, result.data = bin.unpack("z", pkt, i)
return result
end
local nrpe_check = function(host, port, cmd)
-- Create connection.
local status, sock = nrpe_open(host, port)
if not status then
return false, nil
end
-- Send query.
local status, err = sock:send(nrpe_write(cmd))
if not status then
stdnse.print_debug(1, "Failed to send NRPE query for command %s: %s", cmd, err)
sock:close()
return false, nil
end
-- Receive response.
local status, resp = sock:receive()
if not status then
stdnse.print_debug(1, "Can't read NRPE response: %s", resp)
sock:close()
return false, nil
end
sock:close()
return true, nrpe_read(resp)
end
portrule = shortport.port_or_service(5666, "nrpe")
action = function(host, port)
-- Get script arguments.
local cmds = stdnse.get_script_args("nrpe-enum.cmds")
if cmds then
cmds = stdnse.strsplit(":", cmds)
else
cmds = NRPE_COMMANDS
end
-- Create results table.
local results = tab.new()
tab.addrow(
results,
"Command",
"State",
"Response"
)
-- Try each NRPE command, and collect the results.
for _, cmd in pairs(cmds) do
local status, result = nrpe_check(host, port, cmd)
if status then
tab.addrow(
results,
cmd,
NRPE_STATES[result.state],
result.data
)
end
end
-- If no queries generated responses, don't output anything.
if #results == 1 then
return
end
-- Record service description.
port.version.name = "nrpe"
port.version.product = "Nagios Remote Plugin Executor"
nmap.set_port_version(host, port)
-- Format table, without trailing newline.
results = tab.dump(results)
results = results:sub(1, #results - 1)
return "\n" .. results
end
@KyuuKazami