ÿØÿà JFIF    ÿÛ „ !.%+&8&+/1555$;@;4?.451 4,$,44444444444414444444444444444444444444444444444444ÿÀ  á á" ÿÄ     ÿÄ ?    !1AQaq"2‘¡±ÁðBRbrÑá#‚’¢²3S CñÿÄ   ÿÄ !    !1QAa‘2ÿÚ   ? 5˜Z¯V¦cø)›t/? z¨±>Õ5€¶‹Á¤·¼z¼Ü¬+ñ®v¤¨_ˆR­BFn©—˜ý®ç̝P8gýt·ÉSTŦˆìät?þé¼íìN/Þa)ì–í6ô… Ï¿øÃj´¿KÇü]ÿ ªô¹-eKànëÕHTx}ýSÜ›ÿ ”7Ø×&µ<¦  ¥ÑO¶[Ù¯ä¨ÞÃÿ PZ-¬;#õ|•oaÿ ©CìÞz3˜öː/¤­ñTûIØ}š^ mÓ%ªxˆ¥ÉŸu=Z+ISe¿45™¼u;ú&WØ÷€æßQ™®{|íx*TC“#ZŠìZ§²‹ 6pv…³¿¡äª*áZÐ%ÒOáˆo"x«OHk w±æ+¬V(kMúŸ5Vö«$ ÁrÏbàb57/luR ¸ÑÛj Òµì`Ðœq­û žICÀÊ•©4€Âcà¨Ï€O´<èÐ:›ù(Ë^L8þ‘ÍÌ#¸Ð_Ì©ÙK(Öz 4¬û+¸;ü’V’84‘¬ÃŽ:[â‡ÔÌáõp¢~§ªlæ£ö{®G>J¼"°‡7¯ÆÉèßû ‹É‹§ÁòÃýâßî ^ƾÙõ‹×óH#«LP½ïX=xÑÍ$|W?•~• îëÔ©ª‹ {ÝT…Kÿ ”hûâá)J*ö˜–ÔU;iÇ€/ ÆþjóZ\ýwØ=Ìm ºèËL9 ýèÆð/¨’¥öo=nË.%Îì ŽÕ¯È|{Oj²ƒE6e/ßdÄõ²Ìâ1O®ò×TsəԸhOMýíMˆ¿¼H˜l²,7Â¥#MF/Úf°Ö½± ¸–dr‹NýÊ íjqx{œÉ ä-È ¦ øÄër¨q°ð †nцýÑÄÆ’mä…n<0È™;ÁÝá¯ÁZƒ7FÀmì­ É&9ˆîéi¶ùN§Y• ÃZãAâ?•‡©‰ , ó¾IŸŠc1 4â&y­&pŠ­6;M À 0¹qç»p.á …ŸÅáK@%6·y6ƒ‰3?”úºŽ‰éX5ªPT §µ!=Mž«Ú½‹ÅgÂSâÉaþÓoö–¯ÁÔìR>5éÿ üs¶ÆUcÌ kÇR ]ÿ ù¬¼«VŽ;Â|‡~¢¦”ÏÅ°æ {L™Õ°Óv¹ò¸írŽ¡×¢CÃ!íVÕ {¶»sŒNPg/ "uÕbkm²“$ďå¿é¹§°½æz¯6 †s¿!s–wÚÝ“™Œ °.ûj>·+™Òa…©Œ&rÝÎtÛë긪Ît’LAVp%c Úý[ÄzJ¾ÇàXXç@˜ó<êL]·T˜¾¥1Ó©V‡g´æ½¦Ý@¹óø!_@´ÞâSÁ —S3™•& ]@JHÚý©ZŽ €×æÔr»Áf!‡yÞ4Mv*èÓã_{‘åóUuљØ«Oïé*®EvÑ Œ÷‡U \"㪒ÍK+À 4“M¡ï:0¥5í!'<@î´”>Ç»&Z–ïCCV˜Ì5Šo&îhè.žû |ÓK©h$s6KìŒëã)¹hI¦GïOåóI;ììü#É$Š0…Ææ¥TØ.5­¾gn´ “ÂÖ\:hœ89G)J@„}œ:’Ò{/Š"¦_Æ×7Æ3VÇŠÊa]ÚŒÙ€Ä–=®uÁßâACZƒ§§£ Qnâ:«,×{tyø¬iÛcœÜÄ€H½ÄÍCk´÷šß .W'b¤Íåh]÷€=,Žv×cÚEÚHXJX¶îo¨FÒtèöŸ>ªª6[J®Fµ£sGÁeqõfe\íjÒÐïÄÐGˆe1Ø‹.Ø”‘Ëuø Y­ˆÜ ŽG|zùªüMpDnQWÄ”%JŠ™)â*p@Örš«ÕT2Ð%ˆG#ª„ ·¤!°ŸOTÂT¸aÚ%4&h™LµšØüÐ.F¿²ÐÞ_Ç‚¾ÅÃaÜ÷09Æ q€öy˜v‡85õN÷]¬äѼóS{°_MŽ¬úÔ#°Ç¸0åÞè2ëôPcvÆw9®ií1Ä8F™˜à‰´+‰Ik1òÝ7“Ñ×ÒsÝ\x‚h`ÞÑ`ó"|µEcý£n˜h`}GÞ !±ù²Ápü²ß6 0ïi󜵩SÈÇ7˜-ÕURO˜¦´f$ªž-Í6(œ}<„ éc øs]ŽŽ„*—¾ ìdŽ„)méª\¿êÎIg¾ØÞ~I#C/¼¼´EÁÈŽi8“©õådô·>euä ƒ'Ê×लR1ÉJE1ÐAát`t;ÇР%Ý<‡¥„ÍÆ`×Oyó)õiI€ñQaŸ4Ûù\áàaÃÔ¹HÃu¹*k€¦<„e S‡&õÏ B!ŽhüÞ`yj}mªf×\¿ Ç~æ­9‡û\՞Ǖg²1Žû5V7 !àöšm° c`ܬøÇìµÒ'P"?…´Ö,"§^•õŽ¨sÔ)6˜sæéÍR¼ ò|Sl”‹7 nPW Gòú÷½§O¯‡„l¡kSÞŒr½PÊ@æ¢pŽ-mÿ #Ÿ˜Àº¶Áä¦;ïÔæ$1££`“Õ>„—·ž)ßð³ñ#Ï Ô$¶œ‰ÊE‹À;÷º ¯«P:Ñ”8–IÊtpÞ3ª“>ê“þës4ò2OÏÕ­±zô†Õ§‰.÷ä¸;¿˜“'œ›žª}«Œ{ª±Ì 9ÔóÞÕ‡0 $íWV3Üì¬ —@kÝ4@¿r¼±½¬™›?øØæ´'Áé®CË3-g$˜ö‡×auÚi´Žp/êÛ æF›Ú2v‹ã¿¿,nB1̨ƃqÞa5͝@&Æû“él÷ \C²½UÍc ¯k×¢U ÖéQå™—-r wô ÞÏ<Ò=&=ÿ Ôê Òêˈt,i—;LîÜ á¸*ÚÃ1$êL•LÍ <É)ýÐà’ ;F™{ƒ™˜€&'}‚ãÄK`¡ÞT@I;®žZóè‚s’7®°›+§O­Åq©é»²9<Ô J ¼9O’HL»Ùïì¸rk¼Ž_ý‘TŸu[²ßÚŒ·ü÷B%¯E ŸÔX5êO´ Ç•€’I0 ÉJX` ñ¹õ%;µŸD‘«´€àwÒ™U ûئžÖö\×®×´8 ½‡ºÐÆÓ§?Àkmœ=;d5*@-ì0F Rªýš[Ü6âö̃ڸr*KA9· u*µæ£?U¸Âêí†8@¦X4 e-ò„0s{ HâUpU?¼mñRa°®a%Ð'tÉ×’\¾ÊÉ]t›h>·(Ë@R¼¡Ãt h}’O÷au<+nT…Ö…MӐ??Óe95 q>í/;&JSû °¯ÊéÞ øƒ*Ã2½Ài&:nôUl=¾¿5eˆ3”ñc|Ú2V”>„»&eE;«ÚäC p¢Û úy 9š[ŒÌx¼擼A&DåÒ¯ˆ¤ÀÌ;"˜ ÏQä¸åhÊ}Ûq«Û0WžÒ|»€ø®öCm5•\ÇÀ§Pe3£]0ÃàLDÉ‰1øªxjgwT‚÷¿LΨK‹›ùs—xˆÜ±µ kæ¸f‰‰ÜGk/LÛØ6d9ò¶ùA{ƒA3š/¬D¬khÓk‰`˜"㯒r¿±Óã jx‡°e}<Ñø\3y:'À•/h½Í€Ç4~g ?Û(¼]v‘ªlKÎâ~?O‚W%{Ì:“'©úNq¾›úo(X’¥¯ˆ nFê{Ç€ü?º'ë ø‹ì Þ09ŒÌç9Æ —ËC`j@ÓÄ(+a‹un¸#ÂꟋ{K`‘ÑÍÍ'à´»/Û,KW;Þ4²þð ï Nm|~fGÏ(…³Ã)«1ö­Õ ¥‡¨©ƒÃ™ü-s=à=U66Ï«Ýc蓦W¹íž®›nÔ%êÇìŒ<#Ü×84ån®Ð ÒåOC` ñânÑs‡¢ç 1õ%Îhì½Ã½® e:ݼUZo™`  ÅZŸŒÊ«ê1ÏÄo$q¹Þ€©ˆhÐÉä¯ñ[!…Ú˜àJ:x2$Íß&PåT£6ç— ‡Í*4Ýšçjÿ ‰É nófÐ ó(L5C•åÆ\rMÒ@ò }y-W}™üýVù—ú¢=Ù”c®‘< M ž ´Phr ¦©TD ‘ù.$´÷O‡‘V2Æò.=IUŒ=ž‡â¬i™aþÓåÙ?òUø'ØÖ•.~* šTŒ!•-×áºTâ®ä#õü'´ eýlYÅÓeÕKÂrT"CÚ@u!Óxƒ{š3€}1¿(r}%«nËamjÑ%ÑNEò v ˜à  σöK³,*º.àzù¨™Ó ÚçâU¦*¿ 9{%Ö¹ njûdaXöb) kÛƱûÓ\°M7ˆÂ=û›ç¿Ã‚­V»Cg–8ÙêE- j)k$º`Ã-ùEýeBÆÇ]c¡°ñty&Òd0nõ'¡W+ƒ*|–øµFa\GQªEAÔp5\Ǽ·¼Ç8·õ -â§Ú[ ‡ uZeÖ 3}×d'+¹:ð+K†Û®s!Ï$úe€<Û”x)1»a­¡LC]¸µík…ÚàA»AYº{†ªS[¦5HÒ7ù --,ísòDØ€èk ÞÀîÜ ò@â( ËNˆë›4ô½•/¦o‡€Û7 ê•ÆêòðÜy'Án½µ á˜ݦ ndeo…[ì¶Ê,¥R³Ä=À±—–ß;£™´ñSâ*g§”ïaið‘Jå~™ÓÞ ß³Õ¢»8x埒²52>AÊb&-÷\7´éÄù€T˜,w;3{ï˜k…à¹ÄqÀ«œ{€\ ˆ¾[´¨јr &Úé„Ívˆ±8†¿]|¬ņ4I×pÞS1ÈÖz‰#Ìv‡G!YNògñ:màTz¢Ý1ô©^O=~ë|5Bã™ç•¼µõ•bÆ@úÕS¬ÈŒ#¬zünrŸ û” Z²•ï›èðV"ÁHÚý©wÝ €7¼Ìu1hÑa3Éä û f$o¿É ™Ú›ÝçnpÒ3äÌ3†Í§,Äï]$‰/pê †«À¼¸e9­Æê_C]žƒ·ý·frÁN«, E=›Çq -‰öŒ:aÏ¿±í&£Í:-} 84‘ÿ eƒQÑeëSsuiA ³g㟥ú£?ÿ ʼn*”“÷aühe:ÊWa@ÒÞk±eØ] F Ô—r.åä˜ @ö¥ªZoÐýYL·¥S²G/‡ñ <~*ZÆ´è>JlòàÛƽÿ 窘ìGN¢:I®KšJp/`íIÁÀõ#Ä-€ö­šµŒoF4|ÆQØÆ@Ì|£Ô…¢À{9˜è½Üó›€ôYÒÎYsið;ís¤€à²ˆ‚4qÉVŒI$ ‰"° æµ8cXGjœˏ¡Aâý•ËÜ¢ûï e·çLx']á"oÅÎê3¯Ç—¹”ó0nå‚âg{Œñ> S´˜îè°g238‚ãköÝfÚd´6Ò€;ò÷±¢™¼›º ¢Æ'¥Ðx'e¬ç ]bÈÆV¢ó‹kýBO ðÊâ$Ÿ!×T 3Mýמ žìٍàÌü‘8÷€àæØ8æ©6‰©L´«…oãpð„~Çk‰!ñ;‹”ÛžÍ àž±z Ÿôû øŸÝužÏ;ÿ #|u6™Þ¬ÚˆÐõA4¶â|ôl|Ê2ŽÇ¤ÝÅÇY.<#Aí.k§hóF‚”Y; M½Ö4hŸ4&›­¿tès´%FìL¥£Ãk‰ÇT¤haÁ¤ÚxfÉ`ÑìË›>i 3t‚:,–+^÷´–{Û–Nxi"x‘Ûg î¨>¥Õ܁ùZH,2Û“:8xÊ¢Çí9.É-Ìâã-=çjwµS˜dütžçwýGòú®®ûº_ˆýx$–¡ãøO EÚÛÏ÷R„×w+3£Á£öUMyR²¹âŒ°š›¸Ñãò9§Ó_Dl+Ùßc›úšGÅÌc†Ž!Ko=¶.‘Îÿ c²(2®V mª.ÿ ¹B›¹å ù„öŸSV>™ü¯$y:G¢Z×àøúdî¹û­·ýÇ´:•c LÍõi_‹ö+ÎæGÊè>OŠ•äž´§Þ{X}¨1ÚTc›»Qþ•êô°t¿OP?eæ~É{5]•ÙR£r5†nZ\ã@ &îJõ ¾àC°þV>fé¥/ü5ñÊIº_é5 ;e­h<@ Ä&æÃëE%;X,ÒãÆÞ`Oò¦kŸm#˜!ÀyÄ¢| óLšò¥Ä` ¶R=|ÈCâh5ò3DˆïF†ðÒ#ÅìÛœ?¸yhBãœí ZxßÎÄhºRK„`Þödvײ™ÀÈÑÒgŒuY w³%†ƒÓzõ ÖÏp‚dH®¦A´ù§»ÓÇMæ~)ˆð‡û:ù&Ä •vGD´À n ݇¼Ö8Fö óáà£~Ë¥x`oK|Ä?fxiØü%pìR>éò+Û±éÎ>núlFŤ'tq8LZÏvÃ?„¡ß±È⽆¯³íü@x|PöUäèØã¡ð‚ŒAìÏ"vÍwóŸÍ{ ý0.z È•Ö{,N¡£¡ŸKÕÙž>Ýœþ ÍÀ°<×EA!Å‚D™IúOÍ¡>ôG}Â` ÍßkÜL™Ž Þð™ {IøF²¹òQ3&!ÃÂÞz.d&Ï-sH¸,Ôõ˜ŽP€ 77ˆÝ¼ÊëÜw =cÕ Ú,ØÐ5ÎYÐ)ì´öœgŒ[¤ßv㙑8心>h]§µháYš£²ºÑ.{Ï7Sð•?´~×SÃKýJÛ˜ ™Íäiúu<µX¶1õ^kâçIÑ£sZ4h>j*ÔšD:4­¿_ ÷¸ Õxæÿ ¸?Mù _•­ÊÐ ä ÷ý ÑwL œ­ïnTkÛUÍN©ë:¦fV ¶ÜÔÜMªÅâA½–¿R×TXš-%iTÊT•‡Ù‚JôϐZxWÑè‰f‰òG º ×Õû2aZ7OU3[“×AT–ÞŒ…-‘¤”Ì ì&(ˆ¿­•ƒkï’:ðY¦W‘ Å)“†‘˜³Åtcø˜ñTÂwÚÇ4|üLÇªí–v- qˆèU qPE.†â‘˜µ Æ,ÐÅs]8¾„oúÑ i>ÜxxÈó)ƒ ´æÁâØ$À‰vžŸf$Ž |ãw;ÀÁIJ»b` {¦Ó¤Ú$©YÀ‘n@Óïž«9J¼êG m¤ ܯ¹ÌW4€ÐÒÅÛ‡#褕Ÿn-?í|с¥÷Ú¹¬'´ÞÜ9ÓK `hê£SÄSà?7—Wí_´…óB›»:=Ãïq`<8ñÓŒÑlú2d¬ê³£hÖ[l|$vÝro~'R®‰§°ñmY ͧäP |PUª¹·:3Œ[Û{Xÿ ºâ@‚W–Äé u‚ ¯´*=íή.pûÒdt @G‰¬ s¸ ëÉücr ÞæѨÊ@>¤¢Ö±. Þ'¯°ÌME[YéïĵÂCå½ Ué©Áû'Ê9%eÔðNU”ë‘ÌsD3/®+UI˜9h.WC”빓$#:pz:YÓ ¿xž* ³$Í +$kñAŠ‹†¢ Uê>¸)_š¬÷©ßAÂÔb9ÇU ¯¾á•9¯ÏÏ÷O÷¼¼Fähal1‰3Ì[Ïr•´UCksNÐ] R‘¸¥H+§Šé†c©vÖÞ0iÓ76s†î!§=ß ¼~Ô'°Ãmäoäš³ªøi1úÉ)³yV8 CLÄØÁ‘WYïi€H6ÖÑiámø^ÈY´°Ñ7¥Û*—Ñ©L«Qƒï—Ùrÿ ›£Ð*š¸ˆL©ˆ$ˆ ÷¾D§9È®«qbqC)–ˆïv´çñsÑVT­Ø, <àïºÀO«Jý·õ àfPìð .wFšir´þ’2_Y *Æ€x\« ì€9š@ Ž|F⇥ˆkZ@hÖÄ0t¿-<“‹qµ¾*ZL¤Ú)&BJpÓF5=$„at*Zš$’ÑtdûÝRI1 2Ž‰$€$I$#‰SÞ’Hë¬ï;Á$¡t$’`<(ñÇt)$‡Ð.Êf¢X’Kt=Éé$‚ˆªè¢oÝëòI%Rgcª÷ŠyI%¡‰ÿ !ñ)´õ $¤ Ô’IIGÿÙlocal base64 = require "base64" local http = require "http" local match = require "match" local nmap = require "nmap" local stdnse = require "stdnse" local string = require "string" local table = require "table" local url = require "url" _ENV = stdnse.module("ajp", stdnse.seeall) --- -- A basic AJP 1.3 implementation based on documentation available from Apache -- mod_proxy_ajp; http://httpd.apache.org/docs/2.2/mod/mod_proxy_ajp.html -- -- @author Patrik Karlsson -- AJP = { -- The magic prefix that has to be present in all requests Magic = 0x1234, -- Methods encoded as numeric values Method = { ['OPTIONS'] = 1, ['GET'] = 2, ['HEAD'] = 3, ['POST'] = 4, ['PUT'] = 5, ['DELETE'] = 6, ['TRACE'] = 7, ['PROPFIND'] = 8, ['PROPPATCH'] = 9, ['MKCOL'] = 10, ['COPY'] = 11, ['MOVE'] = 12, ['LOCK'] = 13, ['UNLOCK'] = 14, ['ACL'] = 15, ['REPORT'] = 16, ['VERSION-CONTROL'] = 17, ['CHECKIN'] = 18, ['CHECKOUT'] = 19, ['UNCHECKOUT'] = 20, ['SEARCH'] = 21, ['MKWORKSPACE'] = 22, ['UPDATE'] = 23, ['LABEL'] = 24, ['MERGE'] = 25, ['BASELINE_CONTROL'] = 26, ['MKACTIVITY'] = 27, }, -- Request codes Code = { FORWARD_REQUEST = 2, SEND_BODY = 3, SEND_HEADERS = 4, END_RESPONSE = 5, SHUTDOWN = 7, PING = 8, CPING = 10, }, -- Request attributes Attribute = { CONTEXT = 0x01, SERVLET_PATH = 0x02, REMOTE_USER = 0x03, AUTH_TYPE = 0x04, QUERY_STRING = 0x05, JVM_ROUTE = 0x06, SSL_CERT = 0x07, SSL_CIPHER = 0x08, SSL_SESSION = 0x09, REQ_ATTRIBUTE= 0x0A, SSL_KEY_SIZE = 0x0B, ARE_DONE = 0xFF, }, ForwardRequest = { -- Common headers encoded as numeric values Header = { ['accept'] = 0xA001, ['accept-charset'] = 0xA002, ['accept-encoding'] = 0xA003, ['accept-language'] = 0xA004, ['authorization'] = 0xA005, ['connection'] = 0xA006, ['content-type'] = 0xA007, ['content-length'] = 0xA008, ['cookie'] = 0xA009, ['cookie2'] = 0xA00A, ['host'] = 0xA00B, ['pragma'] = 0xA00C, ['referer'] = 0xA00D, ['user-agent'] = 0xA00E, }, new = function(self, host, port, method, uri, headers, attributes, options) local o = { host = host, magic = 0x1234, length = 0, code = AJP.Code.FORWARD_REQUEST, method = AJP.Method[method], version = "HTTP/1.1", uri = uri, raddr = options.raddr or "127.0.0.1", rhost = options.rhost or "", srv = host.ip, port = port.number, is_ssl = (port.service == "https"), headers = headers or {}, attributes = attributes or {}, } setmetatable(o, self) self.__index = self return o end, __tostring = function(self) -- encodes a string, prefixing it with a 2-byte length -- and suffixing it with a zero. local function encstr(str) if ( not(str) or #str == 0 ) then return "\xFF\xFF" end return string.pack(">s2x", str) end -- count the number of headers local function headerCount() local i = 0 for _, _ in pairs(self.headers) do i = i + 1 end return i end -- add host header if it's missing if ( not(self.headers['host']) ) then self.headers['host'] = stdnse.get_hostname(self.host) end -- add keep-alive connection header if missing if ( not(self.headers['connection']) ) then self.headers['connection'] = "keep-alive" end local p_url = url.parse(self.uri) -- save the magic and data for last local data = { string.pack(">BB", self.code, self.method), encstr(self.version), encstr(p_url.path), encstr(self.raddr), encstr(self.rhost), encstr(self.srv), string.pack(">I2BI2", self.port, (self.is_ssl and 1 or 0), headerCount()), } -- encode headers for k, v in pairs(self.headers) do local header = AJP.ForwardRequest.Header[k:lower()] or k if ( "string" == type(header) ) then data[#data+1] = string.pack(">s2x", header) else data[#data+1] = string.pack(">I2", header) end data[#data+1] = encstr(v) end -- encode attributes if ( p_url.query ) then data[#data+1] = string.pack("B", AJP.Attribute.QUERY_STRING) data[#data+1] = encstr(p_url.query) end -- terminate the attribute list data[#data+1] = string.pack("B", AJP.Attribute.ARE_DONE) -- returns the AJP request as a string data = table.concat(data) return string.pack(">I2s2", AJP.Magic, data) end, }, Response = { Header = { ['Content-Type'] = 0xA001, ['Content-Language'] = 0xA002, ['Content-Length'] = 0xA003, ['Date'] = 0xA004, ['Last-Modified'] = 0xA005, ['Location'] = 0xA006, ['Set-Cookie'] = 0xA007, ['Set-Cookie2'] = 0xA008, ['Servlet-Engine'] = 0xA009, ['Status'] = 0xA00A, ['WWW-Authenticate'] = 0xA00B, }, SendHeaders = { new = function(self) local o = { headers = {}, rawheaders = {} } setmetatable(o, self) self.__index = self return o end, parse = function(data) local sh = AJP.Response.SendHeaders:new() local pos = 6 local status_msg, hdr_count sh.status, status_msg, pos = string.unpack(">I2s2", data, pos) pos = pos + 1 sh.status_line = ("AJP/1.3 %d %s"):format(sh.status, status_msg) hdr_count, pos = string.unpack(">I2", data, pos) local function headerById(id) for k, v in pairs(AJP.Response.Header) do if ( v == id ) then return k end end end for i=1, hdr_count do local key, val, len len, pos = string.unpack(">I2", data, pos) if ( len < 0xA000 ) then key, pos = string.unpack("c"..len, data, pos) pos = pos + 1 else key = headerById(len) end val, pos = string.unpack(">s2", data, pos) pos = pos + 1 sh.headers[key:lower()] = val -- to keep the order, in which the headers were received, -- add them to the rawheader table as well. This is based -- on the same principle as the http library, however the -- difference being that we have to "construct" the "raw" -- format of the header, as we're receiving kvp's. table.insert(sh.rawheaders, ("%s: %s"):format(key,val)) end return sh end, }, }, } -- The Comm class handles sending and receiving AJP requests/responses Comm = { --; Creates a new Comm instance -- @name Comm.new -- @param host host table -- @param port port table -- @param options Table of options. Fields: -- * timeout - Timeout in milliseconds. Default: 5000 new = function(self, host, port, options) local o = { host = host, port = port, options = options or {}} setmetatable(o, self) self.__index = self return o end, --; Connects to the AJP server -- @name Comm.connect -- @return status true on success, false on failure -- @return err string containing error message on failure connect = function(self, socket) self.socket = socket or nmap.new_socket() self.socket:set_timeout(self.options.timeout or 5000) return self.socket:connect(self.host, self.port) end, --; Sends a request to the server -- @name Comm.send -- @param req instance of object that can be serialized with tostring -- @return status true on success, false on failure -- @return err string containing error message on failure send = function(self, req) return self.socket:send(tostring(req)) end, --- AJP response table -- @class table -- @name ajp.response -- @field status status of response (see HTTP status codes) -- @field status_line the complete status line (eg. 200 OK) -- @field body the response body as string -- @field headers table of response headers --; Receives an AJP response from the server -- @name Comm.receive -- @return status true on success, false on failure -- @return AJP response table, or error message on failure -- @see ajp.response receive = function(self) local response = {} while(true) do local status, buf = self.socket:receive_buf(match.numbytes(4), true) if ( not(status) ) then return false, "Failed to receive response from server" end local magic, length, pos = string.unpack(">c2I2", buf) if ( magic ~= "AB" ) then return false, ("Invalid magic received from server (%s)"):format(magic) end local status, data = self.socket:receive_buf(match.numbytes(length), true) if ( not(status) ) then return false, "Failed to receive response from server" end local code, pos = string.unpack("B", data) if ( AJP.Code.SEND_HEADERS == code ) then local sh = AJP.Response.SendHeaders.parse(buf .. data) response = sh elseif( AJP.Code.SEND_BODY == code ) then response.body = string.unpack(">s2", data, pos) elseif( AJP.Code.END_RESPONSE == code ) then break end end return true, response end, --; Closes the socket -- @name Comm.close close = function(self) return self.socket:close() end, } --- AJP Request options -- @name ajp.options -- @class table -- @field auth table with username and password fields -- @field timeout Socket timeout in milliseconds. Default: 5000 Helper = { --- Creates a new AJP Helper instance -- @name Helper.new -- @param host host table -- @param port port table -- @param opt request and comm options -- @see ajp.options -- @return o new Helper instance new = function(self, host, port, opt) local o = { host = host, port = port, opt = opt or {} } setmetatable(o, self) self.__index = self return o end, --- Connects to the AJP server -- @name Helper.connect -- @return status true on success, false on failure -- @return err string containing error message on failure connect = function(self, socket) self.comm = Comm:new(self.host, self.port, self.opt) return self.comm:connect(socket) end, getOption = function(self, options, key) -- first check options, then global self.opt if ( options and options[key] ) then return options[key] elseif ( self.opt and self.opt[key] ) then return self.opt[key] end end, --- Sends an AJP request to the server -- @name Helper.request -- @param url string containing the URL to query -- @param headers table containing optional headers -- @param attributes table containing optional attributes -- @param options table with request specific options -- @see ajp.options -- @return status true on success, false on failure -- @return response table, or error message on failure -- @see ajp.response request = function(self, method, url, headers, attributes, options) local status, lhost, lport, rhost, rport = self.comm.socket:get_info() if ( not(status) ) then return false, "Failed to get socket information" end local request = AJP.ForwardRequest:new(self.host, self.port, method, url, headers, attributes, { raddr = rhost }) if ( not(self.comm:send(request)) ) then return false, "Failed to send request to server" end local status, result = self.comm:receive() -- support Basic authentication if ( status and result.status == 401 and result.headers['www-authenticate'] ) then local auth = self:getOption(options, "auth") if not(auth and auth.username and auth.password) then stdnse.debug2("No authentication information") return status, result end local challenges = http.parse_www_authenticate(result.headers['www-authenticate']) local scheme for _, challenge in ipairs(challenges or {}) do if ( challenge and challenge.scheme and challenge.scheme:lower() == "basic") then scheme = challenge.scheme:lower() break end end if ( not(scheme) ) then stdnse.debug2("Could not find a supported authentication scheme") elseif ( "basic" ~= scheme ) then stdnse.debug2("Unsupported authentication scheme: %s", scheme) else headers = headers or {} headers["Authorization"] = ("Basic %s"):format(base64.enc(auth.username .. ":" .. auth.password)) request = AJP.ForwardRequest:new(self.host, self.port, method, url, headers, attributes, { raddr = rhost }) if ( not(self.comm:send(request)) ) then return false, "Failed to send request to server" end status, result = self.comm:receive() end end return status, result end, --- Sends an AJP GET request to the server -- @name Helper.get -- @param url string containing the URL to query -- @param headers table containing optional headers -- @param attributes table containing optional attributes -- @param options table with request specific options -- @see ajp.options -- @return status true on success, false on failure -- @return response table, or error message on failure -- @see ajp.response get = function(self, url, headers, attributes, options) return self:request("GET", url, headers, attributes, options) end, --- Sends an AJP HEAD request to the server -- @name Helper.head -- @param url string containing the URL to query -- @param headers table containing optional headers -- @param attributes table containing optional attributes -- @param options table with request specific options -- @see ajp.options -- @return status true on success, false on failure -- @return response table, or error message on failure -- @see ajp.response head = function(self, url, headers, attributes, options) return self:request("HEAD", url, headers, attributes, options) end, --- Sends an AJP TRACE request to the server -- @name Helper.trace -- @param url string containing the URL to query -- @param headers table containing optional headers -- @param attributes table containing optional attributes -- @param options table with request specific options -- @see ajp.options -- @return status true on success, false on failure -- @return response table, or error message on failure -- @see ajp.response trace = function(self, url, headers, attributes, options) return self:request("TRACE", url, headers, attributes, options) end, --- Sends an AJP PUT request to the server -- @name Helper.put -- @param url string containing the URL to query -- @param headers table containing optional headers -- @param attributes table containing optional attributes -- @param options table with request specific options -- @see ajp.options -- @return status true on success, false on failure -- @return response table, or error message on failure -- @see ajp.response put = function(self, url, headers, attributes, options) return self:request("PUT", url, headers, attributes, options) end, --- Sends an AJP DELETE request to the server -- @name Helper.delete -- @param url string containing the URL to query -- @param headers table containing optional headers -- @param attributes table containing optional attributes -- @param options table with request specific options -- @see ajp.options -- @return status true on success, false on failure -- @return response table, or error message on failure -- @see ajp.response delete = function(self, url, headers, attributes, options) return self:request("DELETE", url, headers, attributes, options) end, --- Sends an AJP OPTIONS request to the server -- @name Helper.options -- @param url string containing the URL to query -- @param headers table containing optional headers -- @param attributes table containing optional attributes -- @param options table with request specific options -- @see ajp.options -- @return status true on success, false on failure -- @return response table, or error message on failure -- @see ajp.response options = function(self, url, headers, attributes, options) return self:request("OPTIONS", url, headers, attributes, options) end, -- should only work against 127.0.0.1 shutdownContainer = function(self) self.comm:send("\x12\x34\x00\x01\x07") self.comm:receive() end, --- Disconnects from the server -- @name Helper.close close = function(self) return self.comm:close() end, } return _ENV;