crypto_func.inc

漏洞扫描源码,可以扫描linux,windows,交换机路由器

#TRUSTED 8222c398940d2d6e4333f1312bfd7153aed5de8673feeafded256dc4b2fb2e3304fe33c1e3ae1134520d746aa7d1b635130809c57b5a406b97c837bafab4adac61bbc269a90bef3519ce76aff5675a3f79de7287278fd92bbb8cb78295ca1aeb4fbdb29b036837610dd78d387c193a8337dfa4652dc0af85f27ed46179d55df51cda3f80fd9a358b790ada9129e893d59f97d5a83384813baf14a3345b575256e114e418c4c02e066c9bbed996047a455af555ae750d9b2dc1b8602e4fa3687e0a5307f8fae95c8d4cfae9890dfda115955c55d314d76ba3b0ef3b9435b4eba6213a71bdde5835ada71f3657386ad5c6a43a264561b3694248487270f8dda7ad714329d30158ffcd7eecf128c120d1e9e8ba73e9d9a889d0693bedc26bc2fccce6341fbeb9b289e480be0b858bc1515a2e3d8875948717bd75ed3ceaf97e925dcae6fc981ed3ac4ab63563bd01e503e07cb78ec42a29cf233cd4fbc3c16d0f94acc04379de72ae683095aebfc59d338552181c4aa7e8d451144b0c832ffd4f5c085f09e9a4c4c3f6286323582ff7abc57e155e108c5fe5f70d8030a516b5ea96f9e7c3b3d2057ed78318eefdf2940e6c5a5ce0ddc45bde51eda9ce6c2ee323bf4bcb19cf4c5f0f2d420380b2e70dd37f0226dc2f1d3014ccda242699763ba693633a175e44573be96398f1472fb562fb3b9771ab3734705b33243c4de634bcd2
# -*- Fundamental -*-
#
# (C) 2005 Tenable Network Security
#
# This script is released under one of the Tenable Script Licenses and may not
# be used from within scripts released under another license without the
# authorization from Tenable Network Security Inc.
#
# See the following licenses for details :
#  http://www.nessus.org/plugins/RegisteredFeed.pdf
#  http://www.nessus.org/plugins/TenableCommercial.pdf
#  http://www.nessus.org/plugins/DirectFeed.pdf
#  http://www.nessus.org/plugins/DirectFeedCommercial.pdf
#
#
#
# @NOGPL@
#
# crypto_func.inc 
#


#---------------------------------------------------------#
# DES encryption code                                     #
#---------------------------------------------------------#



perm1 = make_list (57, 49, 41, 33, 25, 17,  9,
                     1, 58, 50, 42, 34, 26, 18,
                    10,  2, 59, 51, 43, 35, 27,
                    19, 11,  3, 60, 52, 44, 36,
                    63, 55, 47, 39, 31, 23, 15,
                     7, 62, 54, 46, 38, 30, 22,
                    14,  6, 61, 53, 45, 37, 29,
                    21, 13,  5, 28, 20, 12,  4 );


perm2 = make_list (14, 17, 11, 24,  1,  5,
                     3, 28, 15,  6, 21, 10,
                    23, 19, 12,  4, 26,  8,
                    16,  7, 27, 20, 13,  2,
                    41, 52, 31, 37, 47, 55,
                    30, 40, 51, 45, 33, 48,
                    44, 49, 39, 56, 34, 53,
                    46, 42, 50, 36, 29, 32 );

perm3 = make_list (58, 50, 42, 34, 26, 18, 10,  2,
                    60, 52, 44, 36, 28, 20, 12,  4,
                    62, 54, 46, 38, 30, 22, 14,  6,
                    64, 56, 48, 40, 32, 24, 16,  8,
                    57, 49, 41, 33, 25, 17,  9,  1,
                    59, 51, 43, 35, 27, 19, 11,  3,
                    61, 53, 45, 37, 29, 21, 13,  5,
                    63, 55, 47, 39, 31, 23, 15,  7 );

perm4 = make_list (32,  1,  2,  3,  4,  5,
                     4,  5,  6,  7,  8,  9,
                     8,  9, 10, 11, 12, 13,
                    12, 13, 14, 15, 16, 17,
                    16, 17, 18, 19, 20, 21,
                    20, 21, 22, 23, 24, 25,
                    24, 25, 26, 27, 28, 29,
                    28, 29, 30, 31, 32,  1 );

perm5 = make_list (16,  7, 20, 21,
                    29, 12, 28, 17,
                     1, 15, 23, 26,
                     5, 18, 31, 10,
                     2,  8, 24, 14,
                    32, 27,  3,  9,
                    19, 13, 30,  6,
                    22, 11,  4, 25 );

perm6 = make_list (40,  8, 48, 16, 56, 24, 64, 32,
                    39,  7, 47, 15, 55, 23, 63, 31,
                    38,  6, 46, 14, 54, 22, 62, 30,
                    37,  5, 45, 13, 53, 21, 61, 29,
                    36,  4, 44, 12, 52, 20, 60, 28,
                    35,  3, 43, 11, 51, 19, 59, 27,
                    34,  2, 42, 10, 50, 18, 58, 26,
                    33,  1, 41,  9, 49, 17, 57, 25 );

sc = make_list (1, 1, 2, 2, 2, 2, 2, 2, 1, 2, 2, 2, 2, 2, 2, 1);

sbox =    make_list (        14,  4, 13,  1,  2, 15, 11,  8,  3, 10,  6, 12,  5,  9,  0,  7,
                              0, 15,  7,  4, 14,  2, 13,  1, 10,  6, 12, 11,  9,  5,  3,  8,
                              4,  1, 14,  8, 13,  6,  2, 11, 15, 12,  9,  7,  3, 10,  5,  0,
                             15, 12,  8,  2,  4,  9,  1,  7,  5, 11,  3, 14, 10,  0,  6, 13,
	                  
                             15,  1,  8, 14,  6, 11,  3,  4,  9,  7,  2, 13, 12,  0,  5, 10,
		              3, 13,  4,  7, 15,  2,  8, 14, 12,  0,  1, 10,  6,  9, 11,  5,
			      0, 14,  7, 11, 10,  4, 13,  1,  5,  8, 12,  6,  9,  3,  2, 15,
			     13,  8, 10,  1,  3, 15,  4,  2, 11,  6,  7, 12,  0,  5, 14,  9,
	                  
                             10,  0,  9, 14,  6,  3, 15,  5,  1, 13, 12,  7, 11,  4,  2,  8,
		             13,  7,  0,  9,  3,  4,  6, 10,  2,  8,  5, 14, 12, 11, 15,  1,
			     13,  6,  4,  9,  8, 15,  3,  0, 11,  1,  2, 12,  5, 10, 14,  7,
			      1, 10, 13,  0,  6,  9,  8,  7,  4, 15, 14,  3, 11,  5,  2, 12,

	                      7, 13, 14,  3,  0,  6,  9, 10,  1,  2,  8,  5, 11, 12,  4, 15,
		             13,  8, 11,  5,  6, 15,  0,  3,  4,  7,  2, 12,  1, 10, 14,  9,
			     10,  6,  9,  0, 12, 11,  7, 13, 15,  1,  3, 14,  5,  2,  8,  4,
			      3, 15,  0,  6, 10,  1, 13,  8,  9,  4,  5, 11, 12,  7,  2, 14,

	                      2, 12,  4,  1,  7, 10, 11,  6,  8,  5,  3, 15, 13,  0, 14,  9,
		             14, 11,  2, 12,  4,  7, 13,  1,  5,  0, 15, 10,  3,  9,  8,  6,
			      4,  2,  1, 11, 10, 13,  7,  8, 15,  9, 12,  5,  6,  3,  0, 14,
			     11,  8, 12,  7,  1, 14,  2, 13,  6, 15,  0,  9, 10,  4,  5,  3,

		             12,  1, 10, 15,  9,  2,  6,  8,  0, 13,  3,  4, 14,  7,  5, 11,
		             10, 15,  4,  2,  7, 12,  9,  5,  6,  1, 13, 14,  0, 11,  3,  8,
			      9, 14, 15,  5,  2,  8, 12,  3,  7,  0,  4, 10,  1, 13, 11,  6,
			      4,  3,  2, 12,  9,  5, 15, 10, 11, 14,  1,  7,  6,  0,  8, 13,

		              4, 11,  2, 14, 15,  0,  8, 13,  3, 12,  9,  7,  5, 10,  6,  1,
		             13,  0, 11,  7,  4,  9,  1, 10, 14,  3,  5, 12,  2, 15,  8,  6,
			      1,  4, 11, 13, 12,  3,  7, 14, 10, 15,  6,  8,  0,  5,  9,  2,
			      6, 11, 13,  8,  1,  4, 10,  7,  9,  5,  0, 15, 14,  2,  3, 12,

	                     13,  2,  8,  4,  6, 15, 11,  1, 10,  9,  3, 14,  5,  0, 12,  7,
		              1, 15, 13,  8, 10,  3,  7,  4, 12,  5,  6, 11,  0, 14,  9,  2,
			      7, 11,  4,  1,  9, 12, 14,  2,  0,  6, 10, 13, 15,  3,  5,  8,
			      2,  1, 14,  7,  4, 10,  8, 13, 15, 12,  9,  0,  3,  5,  6, 11 );

function permute (in, p)
{
 local_var buf, i;

 buf = NULL;
 for (i = 0; i < strlen(p); i++)
    buf += in[ord(p[i]) - 1];
 
 return buf;
}

function lshift (d, count)
{
 local_var buf, i;

 buf = NULL;
 for (i = 0; i < strlen(d); i++)
   buf += d[(i+count)%strlen(d)];
  
 return buf;
} 

function xor (in1, in2)
{
 local_var buf, i;

 buf = NULL;
 for (i = 0; i < strlen(in2); i++)
   buf += raw_string (ord(in1[i]) ^ ord(in2[i]));
 
 return buf;
}


global_var _b, _er, _erk, _cb, _pcb, _l, _r, _r2, _buf;

_b = make_list(0,0,0,0,0,0,0,0,
               0,0,0,0,0,0,0,0,
               0,0,0,0,0,0,0,0,
               0,0,0,0,0,0,0,0,
               0,0,0,0,0,0,0,0,
               0,0,0,0,0,0,0,0);

_er = make_list(0,0,0,0,0,0,0,0,
               0,0,0,0,0,0,0,0,
               0,0,0,0,0,0,0,0,
               0,0,0,0,0,0,0,0,
               0,0,0,0,0,0,0,0,
               0,0,0,0,0,0,0,0);

_erk = make_list(0,0,0,0,0,0,0,0,
               0,0,0,0,0,0,0,0,
               0,0,0,0,0,0,0,0,
               0,0,0,0,0,0,0,0,
               0,0,0,0,0,0,0,0,
               0,0,0,0,0,0,0,0,
               0,0,0,0,0,0,0,0);

_cb = make_list(0,0,0,0,0,0,0,0,
               0,0,0,0,0,0,0,0,
               0,0,0,0,0,0,0,0,
               0,0,0,0,0,0,0,0,
               0,0,0,0,0,0,0,0);

_pcb = make_list(0,0,0,0,0,0,0,0,
               0,0,0,0,0,0,0,0,
               0,0,0,0,0,0,0,0,
               0,0,0,0,0,0,0,0,
               0,0,0,0,0,0,0,0);

_l = make_list(0,0,0,0,0,0,0,0,
               0,0,0,0,0,0,0,0,
               0,0,0,0,0,0,0,0,
               0,0,0,0,0,0,0,0,
               0,0,0,0,0,0,0,0);

_r = make_list(0,0,0,0,0,0,0,0,
               0,0,0,0,0,0,0,0,
               0,0,0,0,0,0,0,0,
               0,0,0,0,0,0,0,0,
               0,0,0,0,0,0,0,0);

_r2 = make_list(0,0,0,0,0,0,0,0,
               0,0,0,0,0,0,0,0,
               0,0,0,0,0,0,0,0,
               0,0,0,0,0,0,0,0,
               0,0,0,0,0,0,0,0);

__buf = make_list (
               0,0,0,0,0,0,0,0,
               0,0,0,0,0,0,0,0,
               0,0,0,0,0,0,0,0,
               0,0,0,0,0,0,0,0,
               0,0,0,0,0,0,0,0,
               0,0,0,0,0,0,0,0,
               0,0,0,0,0,0,0,0,
               0,0,0,0,0,0,0,0);

function des_encrypt (in, key, type)
{
 local_var i, j, k, c, d, cd, pd1, l, r, rl, pk1;
 local_var cb, pcb, r2, tmp, val, ki;
 local_var m, n;
 local_var cmpt, tmp1, tmp2, count;
 
 pk1 = c = d = cd = NULL;

 for (cmpt = 0; cmpt < 56; cmpt++)
   pk1 += key[perm1[cmpt] - 1];

 c = substr (pk1, 0, 27);
 d = substr (pk1, 28, 55);

 for (i = 0; i < 16; i++)
 {
  tmp1 = tmp2 = NULL;
  count = sc[i];
  for (cmpt = 0; cmpt < 28; cmpt++)
  {
    tmp1 += c[(cmpt+count)%28];
    tmp2 += d[(cmpt+count)%28];
  }

  c = tmp1;
  d = tmp2;

  cd = c + d;

  ki[i] = NULL;
  for (cmpt = 0; cmpt < 48; cmpt++)
    ki[i] += cd[perm2[cmpt] - 1];
 }

 for (cmpt = 0; cmpt < 64; cmpt++)
 {
  if (cmpt < 32)
    _l[cmpt] = in[perm3[cmpt] - 1];
  else
    _r[cmpt-32] = in[perm3[cmpt] - 1];
 }

 
 for (i = 0; i < 16; i++)
 {
  for (cmpt = 0; cmpt < 48; cmpt++)
     _er[cmpt] = _r[perm4[cmpt] - 1];

  if (type == 1)
  { 
    tmp2 = ki[i];
    for (cmpt = 0; cmpt < 48; cmpt++)
      _b[cmpt] = (_er[cmpt] ^ ord(tmp2[cmpt]));
  }
  else
  {
    tmp2 = ki[15-i];
    for (cmpt = 0; cmpt < 48; cmpt++)
      _b[cmpt] = (_er[cmpt] ^ ord(tmp2[cmpt]));
  }

  for (j = 0; j < 8; j++)
  {
   tmp2 = j*6;
   m = (_b[tmp2] << 1);
   m = m | (_b[tmp2 + 5]);

   n = (_b[tmp2 + 1] << 3);
   n = n | (_b[tmp2 + 2] << 2);
   n = n | (_b[tmp2 + 3] << 1);
   n = n | (_b[tmp2 + 4]);

   tmp1 = sbox [j*4*16 + m*16 + n];
   for (k = 0; k < 4; k++)
      if ((tmp1 & (1<<(3-k))) == 0)
        _b[tmp2 + k] = 0;
      else
        _b[tmp2 + k] = 1;
  }
 
  for (j=0; j<8; j++)
  {
   tmp2 = j*6;
   tmp1 = j*4;
   _cb[tmp1] = _b[tmp2];
   _cb[tmp1+1] = _b[tmp2+1];
   _cb[tmp1+2] = _b[tmp2+2];
   _cb[tmp1+3] = _b[tmp2+3];
  }

  for (cmpt = 0; cmpt < 32; cmpt++)
    _pcb[cmpt] = _cb[perm5[cmpt] - 1];
 
  for (cmpt = 0; cmpt < 32; cmpt++)
    _r2[cmpt] = (_l[cmpt] ^ _pcb[cmpt]);

  _l = _r;
  _r = _r2;
 }
 
 for (cmpt = 0; cmpt < 64; cmpt++)
 {
   tmp2 = perm6[cmpt]-1;
   if (tmp2 < 32)
     __buf[cmpt] = _r[tmp2];
   else
     __buf[cmpt] = _l[tmp2-32];
 }

 return __buf;
}


global_var _zero, _one, _inb;

_zero = raw_string(0);
_one = raw_string(1);

_inb = make_list(0,0,0,0,0,0,0,0,
               0,0,0,0,0,0,0,0,
               0,0,0,0,0,0,0,0,
               0,0,0,0,0,0,0,0,
               0,0,0,0,0,0,0,0,
               0,0,0,0,0,0,0,0,
               0,0,0,0,0,0,0,0,
               0,0,0,0,0,0,0,0);

function set_des_key (key)
{
 local_var keyb, i;

 keyb = NULL;

 for (i=0;i<64;i++)
 {

  if ((ord(key[i/8]) & (1<<(7-(i%8)))) == 0)
    keyb += _zero;
  else
    keyb += _one;
 }

 return keyb;
}


function str_to_key (str)
{
 local_var key, i;

 key = raw_string ( ((ord(str[0])>>1) << 1) ,
                    ((((ord(str[0])&0x01)<<6) | (ord(str[1])>>2)) << 1) ,
                    ((((ord(str[1])&0x03)<<5) | (ord(str[2])>>3)) << 1) ,
                    ((((ord(str[2])&0x07)<<4) | (ord(str[3])>>4)) << 1) ,
                    ((((ord(str[3])&0x0F)<<3) | (ord(str[4])>>5)) << 1) ,
                    ((((ord(str[4])&0x1F)<<2) | (ord(str[5])>>6)) << 1) ,
                    ((((ord(str[5])&0x3F)<<1) | (ord(str[6])>>7)) << 1) ,
                    ((ord(str[6])&0x7F) << 1) );

 return set_des_key(key:key);
}


function DES (in, key, _string, type)
{
 local_var inb, keyb, key2, outb, out, buf, i;

 inb = keyb= outb = buf = NULL;

 if (isnull(_string) || (_string == TRUE))
   key2 = str_to_key (str:key);
 else
   key2 = key;

 for (i=0;i<64;i++)
 {
  if ((ord(in[i/8]) & (1<<(7-(i%8)))) == 0)
    _inb[i] = 0;
  else
    _inb[i] = 1;    
 }

 outb = des_encrypt(in:_inb, key:key2, type:type);

 out = make_list (0,0,0,0,0,0,0,0);

 for (i=0;i<64;i++) 
 {
  if (outb[i] == 1)
    out[i/8] = out[i/8] | (1<<(7-(i%8)));
 }

 for (i=0;i<8;i++)
 {
  buf += raw_string (out[i]);
 }

 return buf;
}





#---------------------------------------------------------#
# RC4 HMAC encryption code                                #
#---------------------------------------------------------#

global_var arcS, arcS2;

function arcfour_setkey (key)
{
 local_var i,j,temp;

 arcS = NULL;
 for (i=0; i < 256; i++)
 {
  arcS[i] = i;
  arcS2[i] = ord(key[i % strlen(key)]);
 }

 j = 0;
 
 for (i=0; i < 256; i++)
 {
  j = (j + arcS[i] + arcS2[i]) % 256;
  temp = arcS[i];
  arcS[i] = arcS[j];
  arcS[j] = temp;
 }
}


function ARCFOUR (data)
{
 local_var i,j,temp,t,k,output,l;

 output = NULL;
 i = j = 0;
 
 for (l=0; l < strlen(data); l++)
 {
  i = (i+1) % 256;
  j = (j + arcS[i]) % 256;
  temp = arcS[i];
  arcS[i] = arcS[j];
  arcS[j] = temp;
  t = (arcS[i] + arcS[j]) % 256;
  k = arcS[t];

  output += raw_string (k ^ ord(data[l]));
 }

 return output;
}


function rc4_hmac_string_to_key (string)
{
 # Must be unicode !!!
 return MD4 (string);
}


function rc4_hmac_checksum (key,type,data,real_key)
{
 local_var hmac, tmp, key2;

 hmac = HMAC_MD5 (key:key, data:"signaturekey"+raw_byte(b:0));
 tmp = MD5 (type+data);
 
 return HMAC_MD5 (key:hmac, data:tmp);
}


function rc4_hmac_encrypt (key,data,type,real_key)
{
 local_var hmac, checksum, conf_data, K3, random, key2, val1, i;

 if (isnull(real_key) || (real_key == FALSE))
   key2 = rc4_hmac_string_to_key (string:key);
 else
   key2 = key;
 
 random = NULL;
 
 hmac = HMAC_MD5 (key:key2, data:type);