find_service.c

漏洞扫描源码,可以扫描linux,windows,交换机路由器

mark_pop3pw_server(desc, port, buffer, trp)
	struct arglist *desc;
	int             port, trp;
	char           *buffer;
{
	char            ban[512];
	register_service(desc, port, "pop3pw");
	snprintf(ban, sizeof(ban), "pop3pw/banner/%d", port);
	plug_replace_key(desc, ban, ARG_STRING, buffer);
	snprintf(ban, sizeof(ban), "A pop3pw server is running on this port%s", get_encaps_through(trp));
	post_note(desc, port, ban);
}

/*
 * whois++ server, thanks to Adam Stephens - http://roads.sourceforge.net/index.php
 *
 * 00: 25 20 32 32 30 20 4c 55 54 20 57 48 4f 49 53 2b    % 220 LUT WHOIS+
 * 10: 2b 20 73 65 72 76 65 72 20 76 32 2e 31 20 72 65    + server v2.1 re
 * 20: 61 64 79 2e 20 20 48 69 21 0d 0a 25 20 32 30 30    ady.  Hi!..% 200
 * 30: 20 53 65 61 72 63 68 69 6e 67 20 66 6f 72 20 47     Searching for G
 * 40: 45 54 26 2f 26 48 54 54 50 2f 31 2e 30 0d 0a 25    ET&/&HTTP/1.0..%
 * 50: 20 35 30 30 20 45 72 72 6f 72 20 70 61 72 73 69     500 Error parsi
 * 60: 6e 67 20 42 6f 6f 6c 65 61 6e 20 65 78 70 72 65    ng Boolean expre
 * 70: 73 73 69 6f 6e 0d 0a                               ssion..
 */

static void
mark_whois_plus2_server(desc, port, buffer, trp)
	struct arglist *desc;
	int             port, trp;
	char           *buffer;
{
	char            ban[255];
	register_service(desc, port, "whois++");
	snprintf(ban, sizeof(ban), "whois++/banner/%d", port);
	plug_replace_key(desc, ban, ARG_STRING, buffer);
	snprintf(ban, sizeof(ban), "A whois++ server is running on this port%s", get_encaps_through(trp));
	post_note(desc, port, ban);
}

/*
 * mon server, thanks to Rafe Oxley <[e-mail]>
 * (http://www.kernel.org/software/mon/)
 * 
 * An unknown server is running on this port. If you know what it is, please
 * send this banner to the Nessus team: 00: 35 32 30 20 63 6f 6d 6d 61 6e 64
 * 20 63 6f 75 6c 520 command coul 10: 64 20 6e 6f 74 20 62 65 20 65 78 65 63
 * 75 74 65 d not be execute 20: 64 0a d.
 */
static void
mark_mon_server(desc, port, buffer, trp)
	struct arglist *desc;
	int             port, trp;
	char           *buffer;
{
	char            ban[255];
	register_service(desc, port, "mon");
	snprintf(ban, sizeof(ban), "mon/banner/%d", port);
	plug_replace_key(desc, ban, ARG_STRING, buffer);
	snprintf(ban, sizeof(ban), "A mon server is running on this port%s", get_encaps_through(trp));
	post_note(desc, port, ban);
}


static void
mark_fw1(desc, port, buffer, trp)
	struct arglist *desc;
	int             port, trp;
	char           *buffer;
{
	char            ban[255];
	register_service(desc, port, "cpfw1");
	plug_replace_key(desc, ban, ARG_STRING, buffer);
	snprintf(ban, sizeof(ban), "A CheckPoint FW1 SecureRemote or FW1 FWModule server is running on this port%s", get_encaps_through(trp));
	post_note(desc, port, ban);
}

/*
 * From: Mike Gitarev [mailto:[e-mail]]
 *
 * http://www.psychoid.lam3rz.de
 * 00: 3a 57 65 6c 63 6f 6d 65 21 70 73 79 42 4e 43 40    :Welcome!psyBNC@
 * 10: 6c 61 6d 33 72 7a 2e 64 65 20 4e 4f 54 49 43 45    lam3rz.de NOTICE
 * 20: 20 2a 20 3a 70 73 79 42 4e 43 32 2e 33 2e 31 2d     * :psyBNC2.3.1-
 * 30: 37 0d 0a                                           7..
 */

static void
mark_psybnc(desc, port, buffer, trp)
	struct arglist *desc;
	int             port, trp;
	char           *buffer;
{
	char            ban[255];
	register_service(desc, port, "psybnc");
	plug_replace_key(desc, ban, ARG_STRING, buffer);
	snprintf(ban, sizeof(ban), "A PsyBNC IRC proxy is running on this port%s", get_encaps_through(trp));
	post_note(desc, port, ban);
}

/*
 * From "Russ Paton" <[e-mail]>
 *
 * 00: 49 43 59 20 32 30 30 20 4f 4b 0d 0a 69 63 79 2d ICY 200 OK..icy-
 * 10: 6e 6f 74 69 63 65 31 3a 3c 42 52 3e 54 68 69 73 notice1:<BR>This
 * 20: 20 73 74 72 65 61 6d 20 72 65 71 75 69 72 65 73 stream requires
 */
static void
mark_shoutcast_server(desc, port, buffer, trp)
	struct arglist *desc;
	int             port, trp;
	char           *buffer;
{
	char            ban[255];
	register_service(desc, port, "shoutcast");
	plug_replace_key(desc, ban, ARG_STRING, buffer);
	snprintf(ban, sizeof(ban), "A shoutcast server is running on this port%s", get_encaps_through(trp));
	post_note(desc, port, ban);
}


/*
 * From "Hendrickson, Chris" <[e-mail]>
 * 00: 41 64 73 47 6f 6e 65 20 42 6c 6f 63 6b 65 64 20    AdsGone Blocked
 * 10: 48 54 4d 4c 20 41 64                               HTML Ad
 */

static void
mark_adsgone(desc, port, buffer, trp)
	struct arglist *desc;
	int             port, trp;
	char           *buffer;
{
	char            ban[255];
	register_service(desc, port, "adsgone");
	plug_replace_key(desc, ban, ARG_STRING, buffer);
	snprintf(ban, sizeof(ban), "An AdsGone (a popup banner blocking server) is running on this port%s", get_encaps_through(trp));
	post_note(desc, port, ban);
}



/*
 * Sig from  harm vos <[e-mail]> :
 * 
 * 00: 2a 20 41 43 41 50 20 28 49 4d 50 4c 45 4d 45 4e    * ACAP (IMPLEMEN 10:
 * 54 41 54 49 4f 4e 20 22 43 6f 6d 6d 75 6e 69 47    TATION "CommuniG 20: 61
 * 74 65 20 50 72 6f 20 41 43 41 50 20 34 2e 30    ate Pro ACAP 4.0 30: 62 39
 * 22 29 20 28 53 54 41 52 54 54 4c 53 29 20    b9") (STARTTLS) 40: 28 53 41
 * 53 4c 20 22 4c 4f 47 49 4e 22 20 22 50    (SASL "LOGIN" "P 50: 4c 41 49 4e
 * 22 20 22 43 52 41 4d 2d 4d 44 35 22    LAIN" "CRAM-MD5" 60: 20 22 44 49 47
 * 45 53 54 2d 4d 44 35 22 20 22 4e     "DIGEST-MD5" "N 70: 54 4c 4d 22 29 20
 * 28 43 4f 4e 54 45 58 54 4c 49    TLM") (CONTEXTLI 80: 4d 49 54 20 22 32 30
 * 30 22 29 0d 0a                MIT "200")..
 * 
 * The ACAP protocol allows a client (mailer) application to connect to the
 * Server computer and upload and download the application preferences,
 * configuration settings and other datasets (such as personal address
 * books).
 */
static void
mark_acap_server(desc, port, buffer, trp)
	struct arglist *desc;
	int             port, trp;
	char           *buffer;
{
	char            ban[255];
	register_service(desc, port, "acap");
	snprintf(ban, sizeof(ban), "acap/banner/%d", port);
	plug_replace_key(desc, ban, ARG_STRING, buffer);
	{
		snprintf(ban, sizeof(ban), "An ACAP server is running on this port%s",
			 get_encaps_through(trp));
		post_note(desc, port, ban);
	}
}


/*
 * Sig from Cedric Foll <[e-mail]>
 * 
 * 
 * 00: 53 6f 72 72 79 2c 20 79 6f 75 20 28 31 37 32 2e Sorry, you (172. 10: 33
 * 30 2e 31 39 32 2e 31 30 33 29 20 61 72 65 20 30.192.103)are 20: 6e 6f 74
 * 20 61 6d 6f 6e 67 20 74 68 65 20 61 6c not among the al 30: 6c 6f 77 65 64
 * 20 68 6f 73 74 73 2e 2e 2e 0a lowed hosts....
 * 
 * The ACAP protocol allows a client (mailer) application to connect to the
 * Server computer and upload and download the application preferences,
 * configuration settings and other datasets (such as personal address
 * books).
 */
static void
mark_nagiosd_server(desc, port, buffer, trp)
	struct arglist *desc;
	int             port, trp;
	char           *buffer;
{
	char            ban[255];
	register_service(desc, port, "nagiosd");
	snprintf(ban, sizeof(ban), "A nagiosd server is running on this port%s",
		 get_encaps_through(trp));
	post_note(desc, port, ban);

}

/*
 * Sig from  Michael L鰂fler <[e-mail]>
 * 
 * 00: 5b 54 53 5d 0a 65 72 72 6f 72 0a                   [TS].error.
 * 
 * That's Teamspeak2 rc2 Server - http://www.teamspeak.org/
 */
static void
mark_teamspeak2_server(desc, port, buffer, trp)
	struct arglist *desc;
	int             port, trp;
	char           *buffer;
{
	char            ban[255];
	register_service(desc, port, "teamspeak2");
	snprintf(ban, sizeof(ban), "A teamspeak2 server is running on this port%s",
		 get_encaps_through(trp));
	post_note(desc, port, ban);

}


/*
 * Sig from <[e-mail]>
 * 
 * 
 * 
 * 
 * 00: 4c 61 6e 67 75 61 67 65 20 72 65 63 65 69 76 65    Language receive 10:
 * 64 20 66 72 6f 6d 20 63 6c 69 65 6e 74 3a 20 47    d from client: G 20: 45
 * 54 20 2f 20 48 54 54 50 2f 31 2e 30 0d 0a 53    ET / HTTP/1.0..S 30: 65 74
 * 6c 6f 63 61 6c 65 3a 20 0a                   etlocale: .
 * 
 * Port 9090 is for WEBSM, the GUI SMIT tool that AIX RMC  (port 657) is
 * configured and used with.  (AIX Version 5.1)
 */
static void
mark_websm_server(desc, port, buffer, trp)
	struct arglist *desc;
	int             port, trp;
	char           *buffer;
{
	char            ban[255];
	register_service(desc, port, "websm");
	snprintf(ban, sizeof(ban), "A WEBSM server is running on this port%s",
		 get_encaps_through(trp));
	post_note(desc, port, ban);

}

/*
 * From Gary Crowell :
 * 00: 43 4e 46 47 41 50 49                               CNFGAPI
 */
static void
mark_ofa_express_server(desc, port, buffer, trp)
	struct arglist *desc;
	int             port, trp;
	char           *buffer;
{
	char            ban[255];
	register_service(desc, port, "ofa_express");
	snprintf(ban, sizeof(ban), "An OFA/Express server is running on this port%s",
		 get_encaps_through(trp));
	post_note(desc, port, ban);

}



/*
 * From Pierre Abbat <[e-mail]> 00: 53 75 53 45 20 4d 65 74 61 20
 * 70 70 70 64 20 28 SuSE Meta pppd ( 10: 73 6d 70 70 70 64 29 2c 20 56 65 72
 * 73 69 6f 6e    smpppd), Version 20: 20 30 2e 37 38 0d 0a
 * 0.78..
 */
static void
mark_smppd_server(desc, port, buffer, trp)
	struct arglist *desc;
	int             port, trp;
	char           *buffer;
{
	char            ban[255];
	register_service(desc, port, "smppd");
	snprintf(ban, sizeof(ban), "A SuSE Meta pppd server is running on this port%s",
		 get_encaps_through(trp));
	post_note(desc, port, ban);
}

/*
 * From DaLiV <[e-mail]
 *
 * 00: 45 52 52 20 55 4e 4b 4e 4f 57 4e 2d 43 4f 4d 4d ERR UNKNOWN-COMM
 * 10: 41 4e 44 0a 45 52 52 20 55 4e 4b 4e 4f 57 4e 2d AND.ERR UNKNOWN-
 * 20: 43 4f 4d 4d 41 4e 44 0a COMMAND.
 */
static void
mark_upsmon_server(desc, port, buffer, trp)
	struct arglist *desc;
	int             port, trp;
	char           *buffer;
{
	char            ban[255];
	register_service(desc, port, "upsmon");
	snprintf(ban, sizeof(ban), "An upsd/upsmon server is running on this port%s",
		 get_encaps_through(trp));
	post_note(desc, port, ban);
}

/*
 * From Andrew Yates <[e-mail]>
 *
 * 00: 63 6f 6e 6e 65 63 74 65 64 2e 20 31 39 3a 35 31    connected. 19:51
 * 10: 20 2d 20 4d 61 79 20 32 35 2c 20 32 30 30 33 2c     - May 25, 2003,
 * 20: 20 53 75 6e 64 61 79 2c 20 76 65 72 3a 20 4c 65     Sunday, ver: Le
 * 30: 67 65 6e 64 73 20 32 2e 31                         gends 2.1
 */
static void
mark_sub7_server(desc, port, buffer, trp)
	struct arglist *desc;
	int             port, trp;
	char           *buffer;
{
	char            ban[255];
	register_service(desc, port, "sub7");
	snprintf(ban, sizeof(ban), "The Sub7 trojan is running on this port%s",
		 get_encaps_through(trp));
	post_hole(desc, port, ban);
}


/*
 * From "Alex Lewis" <[e-mail]>
 *
 *  00: 53 50 41 4d 44 2f 31 2e 30 20 37 36 20 42 61 64    SPAMD/1.0 76 Bad
 *  10: 20 68 65 61 64 65 72 20 6c 69 6e 65 3a 20 47 45     header line: GE
 *  20: 54 20 2f 20 48 54 54 50 2f 31 2e 30 0d 0d 0a       T /
 */
static void
mark_spamd_server(desc, port, buffer, trp)
	struct arglist *desc;
	int             port, trp;
	char           *buffer;
{
	char            ban[255];
	register_service(desc, port, "spamd");
	snprintf(ban, sizeof(ban), "a spamd server (part of spamassassin) is running on this port%s",
		 get_encaps_through(trp));
	post_note(desc, port, ban);
}

/* Thanks to Mike Blomgren */
static void
mark_quicktime_streaming_server(desc, port, buffer, trp)
	struct arglist *desc;
	int             port, trp;
	char           *buffer;
{
	char            ban[255];
	register_service(desc, port, "quicktime-streaming-server");
	snprintf(ban, sizeof(ban), "a quicktime streaming server is running on this port%s",
		 get_encaps_through(trp));
	post_note(desc, port, ban);
}

/* Thanks to Allan <[e-mail]> */
static void
mark_dameware_server(desc, port, buffer, trp)
	struct arglist *desc;
	int             port, trp;
	char           *buffer;
{
	char            ban[255];
	register_service(desc, port, "dameware");
	snprintf(ban, sizeof(ban), "a dameware server is running on this port%s",
		 get_encaps_through(trp));
	post_note(desc, port, ban);
}

static void
mark_stonegate_auth_server(desc, port, buffer, trp)
	struct arglist *desc;
	int             port, trp;
	char           *buffer;
{
	char            ban[255];
	register_service(desc, port, "SG_ClientAuth");
	snprintf(ban, sizeof(ban), "a StoneGate authentication server is running on this port%s",
		 get_encaps_through(trp));
	post_note(desc, port, ban);
}



void
mark_listserv_server(desc, port, buffer, trp)
	struct arglist *desc;
	int             port, trp;
	char           *buffer;
{
	char            ban[255];
	register_service(desc, port, "listserv");
	{
		snprintf(ban, sizeof(ban), "A LISTSERV daemon seems to be running on this port%s",
			 get_encaps_through(trp));
		post_note(desc, port, ban);
	}
}


void
mark_fssniffer(desc, port, buffer, trp)
	struct arglist *desc;
	int             port, trp;
	char           *buffer;
{
	char            ban[255];
	register_service(desc, port, "FsSniffer");
	{
		snprintf(ban, sizeof(ban), "A FsSniffer backdoor seems to be running on this port%s",
			 get_encaps_through(trp));
		post_hole(desc, port, ban);
	}
}

void
mark_remote_nc_server(desc, port, buffer, trp)
	struct arglist *desc;
	int             port, trp;
	char           *buffer;
{
	char            ban[255];
	register_service(desc, port, "RemoteNC");
	{
		snprintf(ban, sizeof(ban), "A RemoteNC backdoor seems to be running on this port%s",
			 get_encaps_through(trp));
		post_hole(desc, port, ban);
	}
}



/* Do not use register_service for unknown and wrapped services! */

#ifdef DETECT_WRAPPED_SVC
static void
mark_wrapped_svc(desc, port, delta)
	struct arglist *desc;
	int             port, delta;
{
	char            msg[256];

	snprintf(msg, sizeof(msg), "The service closed the connection after %d seconds without sending any data\n\
It might be protected by some TCP wrapper\n", delta);
	post_note(desc, port, msg);