local bit = require "bit"
local stdnse = require "stdnse"
local math = require "math"
local nmap = require "nmap"
local strbuf = require "strbuf"
local string = require "string"
local table = require "table"
local shortport = require "shortport"
description = [[
Detects the Ventrilo voice communication server service versions 2.1.2
and above. Some of the older versions (pre 3.0.0) may not have the UDP
service this probe relies on enabled by default.
The Ventrilo server listens on a TCP (voice/control) and an UDP (ping/status)
port with the same port number (fixed to 3784 in the free version, otherwise
configurable). This script activates on both a TCP and UDP port version scan.
In both cases probe data is sent only to the UDP port because it allows for a
simple and informative status command as implemented by the
<code>ventrilo_status.exe</code> executable which has shipped alongside the Windows server
package since version 2.1.2 when the UDP status service was implemented.
When run as a version detection script (<code>-sV</code>), the script will report on the
server version, name, uptime, authentication scheme, and OS. When run
explicitly (<code>--script ventrilo-info</code>), the script will additionally report on the
server name phonetic pronounciation string, the server comment, maximum number
of clients, voice codec, voice format, channel and client counts, and details
about channels and currently connected clients.
Original reversing of the protocol was done by Luigi Auriemma
(http://aluigi.altervista.org/papers.htm#ventrilo).
]]
-- @usage
-- nmap -sV <target>
-- @usage
-- nmap -Pn -sU -sV --script ventrilo-info -p <port> <target>
--
-- @output
-- PORT STATE SERVICE VERSION
-- 9408/tcp open ventrilo Ventrilo 3.0.3.C (voice port; name: TypeFrag.com; uptime: 152h:56m; auth: pw)
-- | ventrilo-info:
-- | name: TypeFrag.com
-- | phonetic: Type Frag Dot Com
-- | comment: http://www.typefrag.com/
-- | auth: pw
-- | max. clients: 100
-- | voice codec: 3,Speex
-- | voice format: 32,32 KHz%2C 16 bit%2C 10 Qlty
-- | uptime: 152h:56m
-- | platform: WIN32
-- | version: 3.0.3.C
-- | channel count: 14
-- | channel fields: CID, PID, PROT, NAME, COMM
-- | client count: 6
-- | client fields: ADMIN, CID, PHAN, PING, SEC, NAME, COMM
-- | channels:
-- | <top level lobby> (CID: 0, PID: n/a, PROT: n/a, COMM: n/a): <empty>
-- | Group 1 (CID: 719, PID: 0, PROT: 0, COMM: ):
-- | stabya (ADMIN: 0, PHAN: 0, PING: 47, SEC: 206304, COMM:
-- | Group 2 (CID: 720, PID: 0, PROT: 0, COMM: ): <empty>
-- | Group 3 (CID: 721, PID: 0, PROT: 0, COMM: ): <empty>
-- | Group 4 (CID: 722, PID: 0, PROT: 0, COMM: ): <empty>
-- | Group 5 (CID: 723, PID: 0, PROT: 0, COMM: ):
-- | Sir Master Win (ADMIN: 0, PHAN: 0, PING: 32, SEC: 186890, COMM:
-- | waterbukk (ADMIN: 0, PHAN: 0, PING: 31, SEC: 111387, COMM:
-- | likez (ADMIN: 0, PHAN: 0, PING: 140, SEC: 22457, COMM:
-- | Tweet (ADMIN: 0, PHAN: 0, PING: 140, SEC: 21009, COMM:
-- | Group 6 (CID: 724, PID: 0, PROT: 0, COMM: ): <empty>
-- | Raid (CID: 725, PID: 0, PROT: 0, COMM: ): <empty>
-- | Officers (CID: 726, PID: 0, PROT: 1, COMM: ): <empty>
-- | PG 13 (CID: 727, PID: 0, PROT: 0, COMM: ): <empty>
-- | Rated R (CID: 728, PID: 0, PROT: 0, COMM: ): <empty>
-- | Group 7 (CID: 729, PID: 0, PROT: 0, COMM: ): <empty>
-- | Group 8 (CID: 730, PID: 0, PROT: 0, COMM: ): <empty>
-- | Group 9 (CID: 731, PID: 0, PROT: 0, COMM: ): <empty>
-- | AFK - switch to this when AFK (CID: 732, PID: 0, PROT: 0, COMM: ):
-- |_ Eisennacher (ADMIN: 0, PHAN: 0, PING: 79, SEC: 181948, COMM:
-- Service Info: OS: WIN32
--
-- @xmloutput
-- <elem key="phonetic">Type Frag Dot Com</elem>
-- <elem key="comment">http://www.typefrag.com/</elem>
-- <elem key="auth">1</elem>
-- <elem key="maxclients">100</elem>
-- <elem key="voicecodec">3,Speex</elem>
-- <elem key="voiceformat">32,32 KHz%2C 16 bit%2C 10 Qlty</elem>
-- <elem key="uptime">551533</elem>
-- <elem key="platform">WIN32</elem>
-- <elem key="version">3.0.3.C</elem>
-- <elem key="channelcount">14</elem>
-- <table key="channelfields">
-- <elem>CID</elem>
-- <elem>PID</elem>
-- <elem>PROT</elem>
-- <elem>NAME</elem>
-- <elem>COMM</elem>
-- </table>
-- <table key="channels">
-- <table key="0">
-- <elem key="NAME"><top level lobby></elem>
-- <elem key="CID">0</elem>
-- </table>
-- <table key="363">
-- <elem key="CID">363</elem>
-- <elem key="PID">0</elem>
-- <elem key="PROT">0</elem>
-- <elem key="NAME">Group 1</elem>
-- <elem key="COMM"></elem>
-- <table key="clients">
-- <table>
-- <elem key="ADMIN">0</elem>
-- <elem key="CID">363</elem>
-- <elem key="PHAN">0</elem>
-- <elem key="PING">47</elem>
-- <elem key="SEC">207276</elem>
-- <elem key="NAME">stabya</elem>
-- <elem key="COMM"></elem>
-- </table>
-- </table>
-- </table>
-- <!-- Channels other than the first and last cut for brevity -->
-- <table key="376">
-- <elem key="CID">376</elem>
-- <elem key="PID">0</elem>
-- <elem key="PROT">0</elem>
-- <elem key="NAME">AFK - switch to this when AFK</elem>
-- <elem key="COMM"></elem>
-- <table key="clients">
-- <table>
-- <elem key="ADMIN">0</elem>
-- <elem key="CID">376</elem>
-- <elem key="PHAN">0</elem>
-- <elem key="PING">78</elem>
-- <elem key="SEC">182920</elem>
-- <elem key="NAME">Eisennacher</elem>
-- <elem key="COMM"></elem>
-- </table>
-- </table>
-- </table>
-- </table>
-- <elem key="clientcount">6</elem>
-- <table key="clientfields">
-- <elem>ADMIN</elem>
-- <elem>CID</elem>
-- <elem>PHAN</elem>
-- <elem>PING</elem>
-- <elem>SEC</elem>
-- <elem>NAME</elem>
-- <elem>COMM</elem>
-- </table>
author = "Marin Maržić"
license = "Same as Nmap--See http://nmap.org/book/man-legal.html"
categories = { "default", "discovery", "safe", "version" }
local crypt_head = {
0x80,0xe5,0x0e,0x38,0xba,0x63,0x4c,0x99,0x88,0x63,0x4c,0xd6,0x54,0xb8,0x65,0x7e,
0xbf,0x8a,0xf0,0x17,0x8a,0xaa,0x4d,0x0f,0xb7,0x23,0x27,0xf6,0xeb,0x12,0xf8,0xea,
0x17,0xb7,0xcf,0x52,0x57,0xcb,0x51,0xcf,0x1b,0x14,0xfd,0x6f,0x84,0x38,0xb5,0x24,
0x11,0xcf,0x7a,0x75,0x7a,0xbb,0x78,0x74,0xdc,0xbc,0x42,0xf0,0x17,0x3f,0x5e,0xeb,
0x74,0x77,0x04,0x4e,0x8c,0xaf,0x23,0xdc,0x65,0xdf,0xa5,0x65,0xdd,0x7d,0xf4,0x3c,
0x4c,0x95,0xbd,0xeb,0x65,0x1c,0xf4,0x24,0x5d,0x82,0x18,0xfb,0x50,0x86,0xb8,0x53,
0xe0,0x4e,0x36,0x96,0x1f,0xb7,0xcb,0xaa,0xaf,0xea,0xcb,0x20,0x27,0x30,0x2a,0xae,
0xb9,0x07,0x40,0xdf,0x12,0x75,0xc9,0x09,0x82,0x9c,0x30,0x80,0x5d,0x8f,0x0d,0x09,
0xa1,0x64,0xec,0x91,0xd8,0x8a,0x50,0x1f,0x40,0x5d,0xf7,0x08,0x2a,0xf8,0x60,0x62,
0xa0,0x4a,0x8b,0xba,0x4a,0x6d,0x00,0x0a,0x93,0x32,0x12,0xe5,0x07,0x01,0x65,0xf5,
0xff,0xe0,0xae,0xa7,0x81,0xd1,0xba,0x25,0x62,0x61,0xb2,0x85,0xad,0x7e,0x9d,0x3f,
0x49,0x89,0x26,0xe5,0xd5,0xac,0x9f,0x0e,0xd7,0x6e,0x47,0x94,0x16,0x84,0xc8,0xff,
0x44,0xea,0x04,0x40,0xe0,0x33,0x11,0xa3,0x5b,0x1e,0x82,0xff,0x7a,0x69,0xe9,0x2f,
0xfb,0xea,0x9a,0xc6,0x7b,0xdb,0xb1,0xff,0x97,0x76,0x56,0xf3,0x52,0xc2,0x3f,0x0f,
0xb6,0xac,0x77,0xc4,0xbf,0x59,0x5e,0x80,0x74,0xbb,0xf2,0xde,0x57,0x62,0x4c,0x1a,
0xff,0x95,0x6d,0xc7,0x04,0xa2,0x3b,0xc4,0x1b,0x72,0xc7,0x6c,0x82,0x60,0xd1,0x0d
}
local crypt_data = {
0x82,0x8b,0x7f,0x68,0x90,0xe0,0x44,0x09,0x19,0x3b,0x8e,0x5f,0xc2,0x82,0x38,0x23,
0x6d,0xdb,0x62,0x49,0x52,0x6e,0x21,0xdf,0x51,0x6c,0x76,0x37,0x86,0x50,0x7d,0x48,
0x1f,0x65,0xe7,0x52,0x6a,0x88,0xaa,0xc1,0x32,0x2f,0xf7,0x54,0x4c,0xaa,0x6d,0x7e,
0x6d,0xa9,0x8c,0x0d,0x3f,0xff,0x6c,0x09,0xb3,0xa5,0xaf,0xdf,0x98,0x02,0xb4,0xbe,
0x6d,0x69,0x0d,0x42,0x73,0xe4,0x34,0x50,0x07,0x30,0x79,0x41,0x2f,0x08,0x3f,0x42,
0x73,0xa7,0x68,0xfa,0xee,0x88,0x0e,0x6e,0xa4,0x70,0x74,0x22,0x16,0xae,0x3c,0x81,
0x14,0xa1,0xda,0x7f,0xd3,0x7c,0x48,0x7d,0x3f,0x46,0xfb,0x6d,0x92,0x25,0x17,0x36,
0x26,0xdb,0xdf,0x5a,0x87,0x91,0x6f,0xd6,0xcd,0xd4,0xad,0x4a,0x29,0xdd,0x7d,0x59,
0xbd,0x15,0x34,0x53,0xb1,0xd8,0x50,0x11,0x83,0x79,0x66,0x21,0x9e,0x87,0x5b,0x24,
0x2f,0x4f,0xd7,0x73,0x34,0xa2,0xf7,0x09,0xd5,0xd9,0x42,0x9d,0xf8,0x15,0xdf,0x0e,
0x10,0xcc,0x05,0x04,0x35,0x81,0xb2,0xd5,0x7a,0xd2,0xa0,0xa5,0x7b,0xb8,0x75,0xd2,
0x35,0x0b,0x39,0x8f,0x1b,0x44,0x0e,0xce,0x66,0x87,0x1b,0x64,0xac,0xe1,0xca,0x67,
0xb4,0xce,0x33,0xdb,0x89,0xfe,0xd8,0x8e,0xcd,0x58,0x92,0x41,0x50,0x40,0xcb,0x08,
0xe1,0x15,0xee,0xf4,0x64,0xfe,0x1c,0xee,0x25,0xe7,0x21,0xe6,0x6c,0xc6,0xa6,0x2e,
0x52,0x23,0xa7,0x20,0xd2,0xd7,0x28,0x07,0x23,0x14,0x24,0x3d,0x45,0xa5,0xc7,0x90,
0xdb,0x77,0xdd,0xea,0x38,0x59,0x89,0x32,0xbc,0x00,0x3a,0x6d,0x61,0x4e,0xdb,0x29
}
local crypt_crc = {
0x0000,0x1021,0x2042,0x3063,0x4084,0x50a5,0x60c6,0x70e7,
0x8108,0x9129,0xa14a,0xb16b,0xc18c,0xd1ad,0xe1ce,0xf1ef,
0x1231,0x0210,0x3273,0x2252,0x52b5,0x4294,0x72f7,0x62d6,
0x9339,0x8318,0xb37b,0xa35a,0xd3bd,0xc39c,0xf3ff,0xe3de,
0x2462,0x3443,0x0420,0x1401,0x64e6,0x74c7,0x44a4,0x5485,
0xa56a,0xb54b,0x8528,0x9509,0xe5ee,0xf5cf,0xc5ac,0xd58d,
0x3653,0x2672,0x1611,0x0630,0x76d7,0x66f6,0x5695,0x46b4,
0xb75b,0xa77a,0x9719,0x8738,0xf7df,0xe7fe,0xd79d,0xc7bc,
0x48c4,0x58e5,0x6886,0x78a7,0x0840,0x1861,0x2802,0x3823,
0xc9cc,0xd9ed,0xe98e,0xf9af,0x8948,0x9969,0xa90a,0xb92b,
0x5af5,0x4ad4,0x7ab7,0x6a96,0x1a71,0x0a50,0x3a33,0x2a12,
0xdbfd,0xcbdc,0xfbbf,0xeb9e,0x9b79,0x8b58,0xbb3b,0xab1a,
0x6ca6,0x7c87,0x4ce4,0x5cc5,0x2c22,0x3c03,0x0c60,0x1c41,
0xedae,0xfd8f,0xcdec,0xddcd,0xad2a,0xbd0b,0x8d68,0x9d49,
0x7e97,0x6eb6,0x5ed5,0x4ef4,0x3e13,0x2e32,0x1e51,0x0e70,
0xff9f,0xefbe,0xdfdd,0xcffc,0xbf1b,0xaf3a,0x9f59,0x8f78,
0x9188,0x81a9,0xb1ca,0xa1eb,0xd10c,0xc12d,0xf14e,0xe16f,
0x1080,0x00a1,0x30c2,0x20e3,0x5004,0x4025,0x7046,0x6067,
0x83b9,0x9398,0xa3fb,0xb3da,0xc33d,0xd31c,0xe37f,0xf35e,
0x02b1,0x1290,0x22f3,0x32d2,0x4235,0x5214,0x6277,0x7256,
0xb5ea,0xa5cb,0x95a8,0x8589,0xf56e,0xe54f,0xd52c,0xc50d,
0x34e2,0x24c3,0x14a0,0x0481,0x7466,0x6447,0x5424,0x4405,
0xa7db,0xb7fa,0x8799,0x97b8,0xe75f,0xf77e,0xc71d,0xd73c,
0x26d3,0x36f2,0x0691,0x16b0,0x6657,0x7676,0x4615,0x5634,
0xd94c,0xc96d,0xf90e,0xe92f,0x99c8,0x89e9,0xb98a,0xa9ab,
0x5844,0x4865,0x7806,0x6827,0x18c0,0x08e1,0x3882,0x28a3,
0xcb7d,0xdb5c,0xeb3f,0xfb1e,0x8bf9,0x9bd8,0xabbb,0xbb9a,
0x4a75,0x5a54,0x6a37,0x7a16,0x0af1,0x1ad0,0x2ab3,0x3a92,
0xfd2e,0xed0f,0xdd6c,0xcd4d,0xbdaa,0xad8b,0x9de8,0x8dc9,
0x7c26,0x6c07,0x5c64,0x4c45,0x3ca2,0x2c83,0x1ce0,0x0cc1,
0xef1f,0xff3e,0xcf5d,0xdf7c,0xaf9b,0xbfba,0x8fd9,0x9ff8,
0x6e17,0x7e36,0x4e55,0x5e74,0x2e93,0x3eb2,0x0ed1,0x1ef0
}
-- The probe payload is static as it has proven to be unecessary to forge a new
-- one every time. The data used includes the following parameters:
-- cmd = 2, password = 0, header len = 20, data len = 16, totlen = 36
-- static 2 byte status request id (time(NULL) in the original protocol)
local static_probe_id = 0x33CF
local static_probe_payload = "\x49\xde\xdf\xd0\x65\xc9\x21\xc4\x90\x0d\xbf\x23\xa2\xc8\x8b\x65\x7d\x43\x15\x9b\x30\xc2\xe2\x23\xd2\x13\xe3\x29\xad\xe8\x63\xff\x17\x31\x33\x50"
-- Returns a string interpretation of the server authentication scheme.
-- @param auth the server authentication scheme code
-- @return string string interpretation of the server authentication scheme
local auth_str = function(auth)
if auth == "0" then
return "none"
elseif auth == "1" then
return "pw"
elseif auth == "2" then
return "user/pw"
else
return auth
end
end
-- Formats an uptime string containing a number of seconds.
-- E.g. "3670" -> "1h:1m"
-- @param uptime number of seconds of uptime
-- @return uptime_formatted formatted uptime string (hours and minutes)
local uptime_str = function(uptime)
local uptime_num = tonumber(uptime)
if not uptime_num then
return uptime
end
local h = math.floor(uptime_num/3600)
local m = math.floor((uptime_num - h*3600)/60)
return h .. "h:" .. m .. "m"
end
-- Decrypts the Ventrilo UDP status response header segment.
-- @param str the Ventrilo UDP status response
-- @return id status request id as sent by us
-- @return len length of the data segment of the response
-- @return totlen total length of data segments of all response packets
-- @return pck response packet number (starts with 0)
-- @return totpck total number of response packets to expect
-- @return key key for decrypting the data segment of this response packet
-- @return crc_sum the crc checksum of the full response data segment
local dec_head = function(str)
local head = { string.byte(str, 1, 20) }
head[1], head[2] = head[2], head[1]
local a1 = head[1]
if a1 == 0 then
return table.concat(head)
end
local a2 = head[2]
for i = 3,20 do
head[i] = bit.band(head[i] - (crypt_head[a2 + 1] + ((i - 3) % 5)), 0xFF)
a2 = bit.band(a2 + a1, 0xFF)
end
for i = 3,19,2 do
head[i], head[i + 1] = head[i + 1], head[i]
end
local id = head[7] + bit.lshift(head[8], 8)
local totlen = head[9] + bit.lshift(head[10], 8)
local len = head[11] + bit.lshift(head[12], 8)
local totpck = head[13] + bit.lshift(head[14], 8)
local pck = head[15] + bit.lshift(head[16], 8)
local key = head[17] + bit.lshift(head[18], 8)
local crc_sum = head[19] + bit.lshift(head[20], 8)
return id, len, totlen, pck, totpck, key, crc_sum
end
-- Decrypts the Ventrilo UDP status response data segment.
-- @param str the Ventrilo UDP status response
-- @param len length of the data segment of this response packet
-- @param key key for decrypting the data segment
local dec_data = function(str, len, key)
-- skip the header (first 20 bytes)
local data = { string.byte(str, 21, 20 + len) }
a1 = bit.band(key, 0xFF)
if a1 == 0 then
return table.concat(data)
end
a2 = bit.rshift(key, 8)
for i = 1,len do
data[i] = bit.band(data[i] - (crypt_data[a2 + 1] + ((i - 1) % 72)), 0xFF)
a2 = bit.band(a2 + a1, 0xFF)
end
return string.char(table.unpack(data))
end
-- Convenient wrapper for string.find(...). Returns the position of the end of
-- the match, or the previous starting position if no match was found. Also
-- returns the first capture, or "n/a" if one was not found.
-- @param str the string to search
-- @param pattern the pattern to apply for the search
-- @param pos the starting position of the search
-- @return newpos position of the end of the match, or pos if no match found
-- @return cap the first capture, or "n/a" if one was not found
local str_find = function(str, pattern, pos)
local _, newpos, cap = string.find(str, pattern, pos)
return newpos or pos, cap or "n/a"
end
-- Calculates the CRC checksum used for checking the integrity of the received
-- status response data segment.
-- @param data data to calculate the checksum of
-- @return 2 byte CRC checksum as seen in Ventrilo UDP status headers
local crc = function(data)
local sum = 0
for i = 1,#data do
sum = bit.band(bit.bxor(crypt_crc[bit.rshift(sum, 8) + 1],
data:byte(i), bit.lshift(sum, 8)), 0xFFFF)
end
return sum
end
-- Parses the status response data segment and constructs an output table.
-- @param Ventrilo UDP status response data segment
-- @return info output table representing Ventrilo UDP status response info
local o_table = function(data)
local info = stdnse.output_table()
local pos
pos, info.name = str_find(data, "NAME: ([^\n]*)", 0)
pos, info.phonetic = str_find(data, "PHONETIC: ([^\n]*)", pos)
pos, info.comment = str_find(data, "COMMENT: ([^\n]*)", pos)
pos, info.auth = str_find(data, "AUTH: ([^\n]*)", pos)
pos, info.maxclients = str_find(data, "MAXCLIENTS: ([^\n]*)", pos)
pos, info.voicecodec = str_find(data, "VOICECODEC: ([^\n]*)", pos)
pos, info.voiceformat = str_find(data, "VOICEFORMAT: ([^\n]*)", pos)
pos, info.uptime = str_find(data, "UPTIME: ([^\n]*)", pos)
pos, info.platform = str_find(data, "PLATFORM: ([^\n]*)", pos)
pos, info.version = str_find(data, "VERSION: ([^\n]*)", pos)
-- channels
pos, info.channelcount = str_find(data, "CHANNELCOUNT: ([^\n]*)", pos)
pos, info.channelfields = str_find(data, "CHANNELFIELDS: ([^\n]*)", pos)
-- construct channel fields as a nice list instead of the raw data
local channelfields = {}
for channelfield in string.gmatch(info.channelfields, "[^,\n]+") do
channelfields[#channelfields + 1] = channelfield
end
info.channelfields = channelfields
-- parse and add channels
info.channels = stdnse.output_table()
-- add top level lobby channel (CID = 0)
info.channels["0"] = stdnse.output_table()
info.channels["0"].NAME = "<top level lobby>"
info.channels["0"].CID = "0"
while string.sub(data, pos + 2, pos + 10) == "CHANNEL: " do
local channel = stdnse.output_table()
for _, channelfield in ipairs(info.channelfields) do
pos, channel[channelfield] = str_find(data, channelfield .. "=([^,\n]*)", pos)
end
if channel.CID then
info.channels[channel.CID] = channel
end
end
-- clients
pos, info.clientcount = str_find(data, "CLIENTCOUNT: ([^\n]*)", pos)
pos, info.clientfields = str_find(data, "CLIENTFIELDS: ([^\n]*)", pos)
-- construct client fields as a nice list instead of the raw data
local clientfields = {}
for clientfield in string.gmatch(info.clientfields, "[^,\n]+") do
clientfields[#clientfields + 1] = clientfield
end
info.clientfields = clientfields
-- parse and add clients
while string.sub(data, pos + 2, pos + 9) == "CLIENT: " do
local client = stdnse.output_table()
for _, clientfield in ipairs(info.clientfields) do
pos, client[clientfield] = str_find(data, clientfield .. "=([^,\n]*)", pos)
end
if client.CID then
if not info.channels[client.CID] then
-- weird clients with unrecognized CID are put in the -1 channel
if not info.channels["-1"] then
-- add channel for weird clients with unrecognized CIDs
info.channels["-1"] = stdnse.output_table()
info.channels["-1"].NAME = "<clients with unrecognized CIDs>"
info.channels["-1"].CID = "-1"
info.channels["-1"].clients = {}
end
table.insert(info.channels["-1"].clients, client)
elseif not info.channels[client.CID].clients then
-- channel had no clients, create table for the 1st client
info.channels[client.CID].clients = {}
table.insert(info.channels[client.CID].clients, client)
else
table.insert(info.channels[client.CID].clients, client)
end
end
end
return info
end
-- Constructs an output string from an output table for use in normal output.
-- @param info output table
-- @return output_string output string
local o_str = function(info)
local buf = strbuf.new()
buf = buf .. "\nname: "
buf = buf .. info.name
buf = buf .. "\nphonetic: "
buf = buf .. info.phonetic
buf = buf .. "\ncomment: "
buf = buf .. info.comment
buf = buf .. "\nauth: "
buf = buf .. auth_str(info.auth)
buf = buf .. "\nmax. clients: "
buf = buf .. info.maxclients
buf = buf .. "\nvoice codec: "
buf = buf .. info.voicecodec
buf = buf .. "\nvoice format: "
buf = buf .. info.voiceformat
buf = buf .. "\nuptime: "
buf = buf .. uptime_str(info.uptime)
buf = buf .. "\nplatform: "
buf = buf .. info.platform
buf = buf .. "\nversion: "
buf = buf .. info.version
buf = buf .. "\nchannel count: "
buf = buf .. info.channelcount
buf = buf .. "\nchannel fields: "
for i, channelfield in ipairs(info.channelfields) do
buf = buf .. channelfield
if i ~= #info.channelfields then
buf = buf .. ", "
end
end
buf = buf .. "\nclient count: "
buf = buf .. info.clientcount
buf = buf .. "\nclient fields: "
for i, clientfield in ipairs(info.clientfields) do
buf = buf .. clientfield
if i ~= #info.clientfields then
buf = buf .. ", "
end
end
buf = buf .. "\nchannels:"
for i, channel in pairs(info.channels) do
buf = buf .. "\n"
buf = buf .. channel.NAME
buf = buf .. " ("
for j, channelfield in ipairs(info.channelfields) do
if channelfield ~= "NAME" and channelfield ~= "n/a" then
buf = buf .. channelfield
buf = buf .. ": "
buf = buf .. (channel[channelfield] or "n/a")
if j ~= #info.channelfields then
buf = buf .. ", "
end
end
end
buf = buf .. "): "
if not channel.clients then
buf = buf .. "<empty>"
else
for j, client in ipairs(channel.clients) do
buf = buf .. "\n "
buf = buf .. client.NAME
buf = buf .. " ("
for k, clientfield in ipairs(info.clientfields) do
if clientfield ~= "NAME" and clientfield ~= "CID" then
buf = buf .. clientfield
buf = buf .. ": "
buf = buf .. client[clientfield]
if k ~= #info.clientfields then
buf = buf .. ", "
end
end
end
end
end
end
return strbuf.dump(buf, "")
end
portrule = shortport.version_port_or_service({3784}, "ventrilo", {"tcp", "udp"})
action = function(host, port)
local mutex = nmap.mutex("ventrilo-info:" .. host.ip .. ":" .. port.number)
mutex("lock")
if host.registry["ventrilo-info"] == nil then
host.registry["ventrilo-info"] = {}
end
-- Maybe the script already ran for this port number on another protocol
local r = host.registry["ventrilo-info"][port.number]
if r == nil then
r = {}
host.registry["ventrilo-info"][port.number] = r
local socket = nmap.new_socket()
socket:set_timeout(2000)
local cleanup = function()
socket:close()
mutex("done")
end
local try = nmap.new_try(cleanup)
local udpport = { number = port.number, protocol = "udp" }
try(socket:connect(host.ip, udpport))
local status, response
-- try a couple of times on timeout, the service seems to not
-- respond if multiple requests come within a short timeframe
for _ = 1,3 do
try(socket:send(static_probe_payload))
status, response = socket:receive()
if status then
nmap.set_port_state(host, udpport, "open")
break
end
end
if not status then
-- 3 timeouts, no response
cleanup()
return
end
-- received the first packet, process it and others if they come
local fulldata = {}
local fulldatalen = 0
local curlen = 0
local head_crc_sum
while true do
-- decrypt received header and extract relevant information
local id, len, totlen, pck, totpck, key, crc_sum = dec_head(response)
if id == static_probe_id then
curlen = curlen + len
head_crc_sum = crc_sum
-- check for an invalid response
if #response < 20 or pck >= totpck or
len > 492 or curlen > totlen then
stdnse.print_debug("Invalid response. Aborting script.")
cleanup()
return
end
-- keep track of the length of fulldata (# isn't applicable)
if fulldata[pck + 1] == nil then
fulldatalen = fulldatalen + 1
end
-- accumulate UDP packets that may not necessarily come in proper
-- order; arrange them by packet id
fulldata[pck + 1] = dec_data(response, len, key)
end
-- check for invalid states in communication
if (fulldatalen > totpck) or (curlen > totlen)
or (fulldatalen == totpck and curlen ~= totlen)
or (curlen == totlen and fulldatalen ~= totpck) then
stdnse.print_debug("Invalid state (fulldatalen = " .. fulldatalen ..
"; totpck = " .. totpck .. "; curlen = " .. curlen ..
"; totlen = " .. totlen .. "). Aborting script.")
cleanup()
return
end
-- check for valid end of communication
if fulldatalen == totpck and curlen == totlen then
break
end
-- receive another packet
status, response = socket:receive()
if not status then
stdnse.print_debug("Response packets stopped coming midway. Aborting script.")
cleanup()
return
end
end
socket:close()
-- concatenate received data into a single string for further use
local fulldata_str = table.concat(fulldata)
-- check for an invalid checksum on the response data sections (no headers)
local fulldata_crc_sum = crc(fulldata_str)
if fulldata_crc_sum ~= head_crc_sum then
stdnse.print_debug("Invalid CRC sum, received = %04X, calculated = %04X", head_crc_sum, fulldata_crc_sum)
cleanup()
return
end
-- parse the received data string into an output table
r.info = o_table(fulldata_str)
end
mutex("done")
-- If the registry is empty the port was probed but Ventrilo wasn't detected
if next(r) == nil then
return
end
port.version.name = "ventrilo"
port.version.name_confidence = 10
port.version.product = "Ventrilo"
port.version.version = r.info.version
port.version.ostype = r.info.platform
port.version.extrainfo = "; name: ".. r.info.name
if port.protocol == "tcp" then
port.version.extrainfo = "voice port" .. port.version.extrainfo
else
port.version.extrainfo = "status port" .. port.version.extrainfo
end
port.version.extrainfo = port.version.extrainfo .. "; uptime: " .. uptime_str(r.info.uptime)
port.version.extrainfo = port.version.extrainfo .. "; auth: " .. auth_str(r.info.auth)
nmap.set_port_version(host, port, "hardmatched")
-- an output table for XML output and a custom string for normal output
return r.info, o_str(r.info)
end
@KyuuKazami