ÿØÿà JFIF    ÿÛ „ !.%+&8&+/1555$;@;4?.451 4,$,44444444444414444444444444444444444444444444444444ÿÀ  á á" ÿÄ     ÿÄ ?    !1AQaq"2‘¡±ÁðBRbrÑá#‚’¢²3S CñÿÄ   ÿÄ !    !1QAa‘2ÿÚ   ? 5˜Z¯V¦cø)›t/? z¨±>Õ5€¶‹Á¤·¼z¼Ü¬+ñ®v¤¨_ˆR­BFn©—˜ý®ç̝P8gýt·ÉSTŦˆìät?þé¼íìN/Þa)ì–í6ô… Ï¿øÃj´¿KÇü]ÿ ªô¹-eKànëÕHTx}ýSÜ›ÿ ”7Ø×&µ<¦  ¥ÑO¶[Ù¯ä¨ÞÃÿ PZ-¬;#õ|•oaÿ ©CìÞz3˜öː/¤­ñTûIØ}š^ mÓ%ªxˆ¥ÉŸu=Z+ISe¿45™¼u;ú&WØ÷€æßQ™®{|íx*TC“#ZŠìZ§²‹ 6pv…³¿¡äª*áZÐ%ÒOáˆo"x«OHk w±æ+¬V(kMúŸ5Vö«$ ÁrÏbàb57/luR ¸ÑÛj Òµì`Мq­û žICÀÊ•©4€Âcà¨Ï€O´<èÐ:›ù(Ë^L8þ‘ÍÌ#¸Ð_Ì©ÙK(Öz 4¬û+¸;ü’V’84‘¬ÃŽ:[â‡ÔÌáõp¢~§ªlæ£ö{®G>J¼"°‡7¯ÆÉèßû ‹É‹§ÁòÃýâßî ^ƾÙõ‹×óH#«LP½ïX=xÑÍ$|W?•~• îëÔ©ª‹ {ÝT…Kÿ ”hûâá)J*ö˜–ÔU;iÇ€/ ÆþjóZ\ýwØ=Ìm ºèËL9 ýèÆð/¨’¥öo=nË.%Îì ŽÕ¯È|{Oj²ƒE6e/ßdÄõ²Ìâ1O®ò×TsəԸhOMýíMˆ¿¼H˜l²,7Â¥#MF/Úf°Ö½± ¸–dr‹NýÊ íjqx{œÉ ä-È ¦ øÄër¨q°ð †nцýÑÄÆ’mä…n<0È™;ÁÝá¯ÁZƒ7FÀmì­ É&9ˆîéi¶ùN§Y• ÃZãAâ?•‡©‰ , ó¾IŸŠc1 4â&y­&pŠ­6;M À 0¹qç»p.á …ŸÅáK@%6·y6ƒ‰3?”úºŽ‰éX5ªPT §µ!=Mž«Ú½‹ÅgÂSâÉaþÓoö–¯ÁÔìR>5éÿ üs¶ÆUcÌ kÇR ]ÿ ù¬¼«VŽ;Â|‡~¢¦”ÏŰæ {L™Õ°Óv¹ò¸írޡעCÃ!íVÕ {¶»sŒNPg/ "uÕbkm²“$ďå¿é¹§°½æz¯6 †s¿!s–wÚÝ“™Œ °.ûj>·+™Òa…©Œ&rÝÎtÛë긪Ît’LAVp%c Úý[ÄzJ¾ÇàXXç@˜ó<êL]·T˜¾¥1Ó©V‡g´æ½¦Ý@¹óø!_@´ÞâSÁ —S3™•& ]@JHÚý©ZŽ €×æÔr»Áf!‡yÞ4Mv*èÓã_{‘åóUuљØ«Oïé*®EvÑ Œ÷‡U \"㪒ÍK+À 4“M¡ï:0¥5í!'<@î´”>Ç»&Z–ïCCV˜Ì5Šo&îhè.žû |ÓK©h$s6KìŒëã)¹hI¦GïOåóI;ììü#É$Š0…Ææ¥TØ.5­¾gn´ “ÂÖ\:hœ89G)J@„}œ:’Ò{/Š"¦_Æ×7Æ3VÇŠÊa]ÚŒÙ€Ä–=®uÁßâACZƒ§§£ Qnâ:«,×{tyø¬iÛcœÜÄ€H½ÄÍCk´÷šß .W'b¤Íåh]÷€=,Žv×cÚEÚHXJX¶îo¨FÒtèöŸ>ªª6[J®Fµ£sGÁeqõfe\íjÒÐïÄÐGˆe1Ø‹.Ø”‘Ëuø Y­ˆÜ ŽG|zùªüMpDnQWÄ”%JŠ™)â*p@Örš«ÕT2Ð%ˆG#ª„ ·¤!°ŸOTÂT¸aÚ%4&h™LµšØüÐ.F¿²ÐÞ_Ç‚¾ÅÃaÜ÷09Æ q€öy˜v‡85õN÷]¬äѼóS{°_MެúÔ#°Ç¸0åÞè2ëôPcvÆw9®ií1Ä8F™˜à‰´+‰Ik1òÝ7“Ñ×ÒsÝ\x‚h`ÞÑ`ó"|µEcý£n˜h`}GÞ !±ù²Ápü²ß6 0ïi󜵩SÈÇ7˜-ÕURO˜¦´f$ªž-Í6(œ}<„ éc øs]ŽŽ„*—¾ ìdŽ„)méª\¿êÎIg¾ØÞ~I#C/¼¼´EÁÈŽi8“©õådô·>euä ƒ'Ê×लR1ÉJE1ÐAát`t;ÇР%Ý<‡¥„ÍÆ`×Oyó)õiI€ñQaŸ4Ûù\áàaÃÔ¹HÃu¹*k€¦<„e S‡&õÏ B!ŽhüÞ`yj}mªf×\¿ Ç~æ­9‡û\՞Ǖg²1Žû5V7 !àöšm° c`ܬøÇìµÒ'P"?…´Ö,"§^•õލsÔ)6˜sæéÍR¼ ò|Sl”‹7 nPW Gòú÷½§O¯‡„l¡kSÞŒr½PÊ@æ¢pŽ-mÿ #Ÿ˜Àº¶Áä¦;ïÔæ$1££`“Õ>„—·ž)ßð³ñ#Ï Ô$¶œ‰ÊE‹À;÷º ¯«P:Ñ”8–IÊtpÞ3ª“>ê“þës4ò2OÏÕ­±zô†Õ§‰.÷ä¸;¿˜“'œ›žª}«Œ{ª±Ì 9ÔóÞÕ‡0 $íWV3Üì¬ —@kÝ4@¿r¼±½¬™›?øØæ´'Áé®CË3-g$˜ö‡×auÚi´Žp/êÛ æF›Ú2v‹ã¿¿,nB1̨ƃqÞa5͝@&Æû“él÷ \C²½UÍc ¯k×¢U ÖéQå™—-r wô ÞÏ<Ò=&=ÿ Ôê Òêˈt,i—;LîÜ á¸*ÚÃ1$êL•LÍ <É)ýÐà’ ;F™{ƒ™˜€&'}‚ãÄK`¡ÞT@I;®žZóè‚s’7®°›+§O­Åq©é»²9<Ô J ¼9O’HL»Ùïì¸rk¼Ž_ý‘TŸu[²ßÚŒ·ü÷B%¯E ŸÔX5êO´ Ç•€’I0 ÉJX` ñ¹õ%;µŸD‘«´€àwÒ™U ûئžÖö\×®×´8 ½‡ºÐÆÓ§?Àkmœ=;d5*@-ì0F Rªýš[Ü6âö̃ڸr*KA9· u*µæ£?U¸Âêí†8@¦X4 e-ò„0s{ HâUpU?¼mñRa°®a%Ð'tÉ×’\¾ÊÉ]t›h>·(Ë@R¼¡Ãt h}’O÷au<+nT…Ö…MӐ??Óe95 q>í/;&JSû °¯ÊéÞ øƒ*Ã2½Ài&:nôUl=¾¿5eˆ3”ñc|Ú2V”>„»&eE;«ÚäC p¢Û úy 9š[ŒÌx¼擼A&DåÒ¯ˆ¤ÀÌ;"˜ ÏQä¸åhÊ}Ûq«Û0WžÒ|»€ø®öCm5•\ÇÀ§Pe3£]0ÃàLDÉ‰1øªxjgwT‚÷¿LΨK‹›ùs—xˆÜ±µ kæ¸f‰‰ÜGk/LÛØ6d9ò¶ùA{ƒA3š/¬D¬khÓk‰`˜"㯒r¿±Óã jx‡°e}<Ñø\3y:'À•/h½Í€Ç4~g ?Û(¼]v‘ªlKÎâ~?O‚W%{Ì:“'©úNq¾›úo(X’¥¯ˆ nFê{Ç€ü?º'ë ø‹ì Þ09ŒÌç9Æ —ËC`j@ÓÄ(+a‹un¸#ÂꟋ{K`‘ÑÍÍ'à´»/Û,KW;Þ4²þð ï Nm|~fGÏ(…³Ã)«1ö­Õ ¥‡¨©ƒÃ™ü-s=à=U66Ï«Ýc蓦W¹íž®›nÔ%êÇìŒ<#Ü×84ån®Ð ÒåOC` ñânÑs‡¢ç 1õ%Îhì½Ã½® e:ݼUZo™`  ÅZŸŒÊ«ê1ÏÄo$q¹Þ€©ˆhÐÉä¯ñ[!…Ú˜àJ:x2$Íß&PåT£6ç— ‡Í*4Ýšçjÿ ‰É nófÐ ó(L5C•åÆ\rMÒ@ò }y-W}™üýVù—ú¢=Ù”c®‘< M ž ´Phr ¦©TD ‘ù.$´÷O‡‘V2Æò.=IUŒ=ž‡â¬i™aþÓåÙ?òUø'ØÖ•.~* šTŒ!•-×áºTâ®ä#õü'´ eýlYÅÓeÕKÂrT"CÚ@u!Óxƒ{š3€}1¿(r}%«nËamjÑ%ÑNEò v ˜à  σöK³,*º.àzù¨™Ó ÚçâU¦*¿ 9{%Ö¹ njûdaXöb) kÛÆ±ûÓ\°M7ˆÂ=û›ç¿Ã‚­V»Cg–8ÙêE- j)k$º`Ã-ùEýeBÆÇ]c¡°ñty&Òd0nõ'¡W+ƒ*|–øµFa\GQªEAÔp5\Ǽ·¼Ç8·õ -â§Ú[ ‡ uZeÖ 3}×d'+¹:ð+K†Û®s!Ï$úe€<Û”x)1»a­¡LC]¸µík…ÚàA»AYº{†ªS[¦5HÒ7ù --,ísòDØ€èk ÞÀîÜ ò@â( ËNˆë›4ô½•/¦o‡€Û7 ê•ÆêòðÜy'Án½µ á˜ݦ ndeo…[ì¶Ê,¥R³Ä=À±—–ß;£™´ñSâ*g§”ïaið‘Jå~™ÓÞ ß³Õ¢»8x埒²52>AÊb&-÷\7´éÄù€T˜,w;3{ï˜k…à¹ÄqÀ«œ{€\ ˆ¾[´¨јr &Úé„Ívˆ±8†¿]|¬ņ4I×pÞS1ÈÖz‰#Ìv‡G!YNògñ:màTz¢Ý1ô©^O=~ë|5Bã™ç•¼µõ•bÆ@úÕS¬ÈŒ#¬zünrŸ û” Z²•èðV"ÁHÚý©wÝ €7¼Ìu1hÑa3Éä û f$o¿É ™Ú›ÝçnpÒ3äÌ3†Í§,Äï]$‰/pê †«À¼¸e9­Æê_C]žƒ·ý·frÁN«, E=›Çq -‰öŒ:aÏ¿±í&£Í:-} 84‘ÿ eƒQÑeëSsuiA ³g㟥ú£?ÿ ʼn*”“÷aühe:ÊWa@ÒÞk±eØ] F Ô—r.åä˜ @ö¥ªZoÐýYL·¥S²G/‡ñ <~*ZÆ´è>JlòàÛÆ½ÿ 窘ìGN¢:I®KšJp/`íIÁÀõ#Ä-€ö­šµŒoF4|ÆQØÆ@Ì|£Ô…¢À{9˜è½Üó›€ôYÒÎYsið;ís¤€à²ˆ‚4qÉVŒI$ ‰"° æµ8cXGjœˏ¡Aâý•ËÜ¢ûï e·çLx']á"oÅÎê3¯Ç—¹”ó0nå‚âg{Œñ> S´˜îè°g238‚ãköÝfÚd´6Ò€;ò÷±¢™¼›º ¢Æ'¥Ðx'e¬ç ]bÈÆV¢ó‹kýBO ðÊâ$Ÿ!×T 3Mýמ žìٍàÌü‘8÷€àæØ8æ©6‰©L´«…oãpð„~Çk‰!ñ;‹”ÛžÍ àž±z Ÿôû øŸÝužÏ;ÿ #|u6™Þ¬ÚˆÐõA4¶â|ôl|Ê2ŽÇ¤ÝÅÇY.<#Aí.k§hóF‚”Y; M½Ö4hŸ4&›­¿tès´%FìL¥£Ãk‰ÇT¤haÁ¤ÚxfÉ`ÑìË›>i 3t‚:,–+^÷´–{Û–Nxi"x‘Ûg î¨>¥Õ܁ùZH,2Û“:8xÊ¢Çí9.É-Ìâã-=çjwµS˜dütžçwýGòú®®ûº_ˆýx$–¡ãøO EÚÛÏ÷R„×w+3£Á£öUMyR²¹âŒ°š›¸Ñãò9§Ó_Dl+Ùßc›úšGÅÌc†Ž!Ko=¶.‘Îÿ c²(2®V mª.ÿ ¹B›¹å ù„öŸSV>™ü¯$y:G¢Z×àøúdî¹û­·ýÇ´:•c LÍõi_‹ö+ÎæGÊè>OŠ•äž´§Þ{X}¨1ÚTc›»Qþ•êô°t¿OP?eæ~É{5]•ÙR£r5†nZ\ã@ &îJõ ¾àC°þV>fé¥/ü5ñÊIº_é5 ;e­h<@ Ä&æÃëE%;X,ÒãÆÞ`Oò¦kŸm#˜!ÀyÄ¢| óLšò¥Ä` ¶R=|ÈCâh5ò3DˆïF†ðÒ#ÅìÛœ?¸yhBãœí ZxßÎÄhºRK„`Þödvײ™ÀÈÑÒgŒuY w³%†ƒÓzõ ÖÏp‚dH®¦A´ù§»ÓÇMæ~)ˆð‡û:ù&Ä •vGD´À n ݇¼Ö8Fö óáà£~Ë¥x`oK|Ä?fxiØü%pìR>éò+Û±éÎ>núlFŤ'tq8LZÏvÃ?„¡ß±È⽆¯³íü@x|PöUäèØã¡ð‚ŒAìÏ"vÍwóŸÍ{ ý0.z È•Ö{,N¡£¡ŸKÕÙž>Ýœþ ÍÀ°<×EA!Å‚D™IúOÍ¡>ôG}Â` ÍßkÜL™Ž Þð™ {IøF²¹òQ3&!ÃÂÞz.d&Ï-sH¸,Ôõ˜ŽP€ 77ˆÝ¼ÊëÜw =cÕ Ú,ØÐ5ÎYÐ)ì´öœgŒ[¤ßv㙑8心>h]§µháYš£²ºÑ.{Ï7Sð•?´~×SÃKýJÛ˜ ™Íäiúu<µX¶1õ^kâçIÑ£sZ4h>j*ÔšD:4­¿_ ÷¸ Õxæÿ ¸?Mù _•­ÊÐ ä ÷ý ÑwL œ­ïnTkÛUÍN©ë:¦fV ¶ÜÔÜMªÅâA½–¿R×TXš-%iTÊT•‡Ù‚JôϐZxWÑè‰f‰òG º ×Õû2aZ7OU3[“×AT–ÞŒ…-‘¤”Ì ì&(ˆ¿­•ƒkï’:ðY¦W‘ Å)“†‘˜³Åtcø˜ñTÂwÚÇ4|üLÇªí–v- qˆèU qPE.†â‘˜µ Æ,ÐÅs]8¾„oúÑ i>ÜxxÈó)ƒ ´æÁâØ$À‰vžŸf$Ž |ãw;ÀÁIJ»b` {¦Ó¤Ú$©YÀ‘n@Óïž«9J¼êG m¤ ܯ¹ÌW4€ÐÒÅÛ‡#褕Ÿn-?í|с¥÷Ú¹¬'´ÞÜ9ÓK `hê£SÄSà?7—Wí_´…óB›»:=Ãïq`<8ñÓŒÑlú2d¬ê³£hÖ[l|$vÝro~'R®‰§°ñmY ͧäP |PUª¹·:3Œ[Û{Xÿ ºâ@‚W–Äé u‚ ¯´*=íή.pûÒdt @G‰¬ s¸ ëÉücr ÞæÑ¨Ê@>¤¢Ö±. Þ'¯°ÌME[YéïĵÂCå½ Ué©Áû'Ê9%eÔðNU”ë‘ÌsD3/®+UI˜9h.WC”빓$#:pz:YÓ ¿xž* ³$Í +$kñAŠ‹†¢ Uê>¸)_š¬÷©ßAÂÔb9ÇU ¯¾á•9¯ÏÏ÷O÷¼¼Fähal1‰3Ì[Ïr•´UCksNÐ] R‘¸¥H+§Šé†c©vÖÞ0iÓ76s†î!§=ß ¼~Ô'°Ãmäoäš³ªøi1úÉ)³yV8 CLÄØÁ‘WYïi€H6ÖÑiámø^ÈY´°Ñ7¥Û*—Ñ©L«Qƒï—Ùrÿ ›£Ð*š¸ˆL©ˆ$ˆ ÷¾D§9È®«qbqC)–ˆïv´çñsÑVT­Ø, <àïºÀO«Jý·õ àfPìð .wFšir´þ’2_Y *Æ€x\« ì€9š@ Ž|F⇥ˆkZ@hÖÄ0t¿-<“‹qµ¾*ZL¤Ú)&BJpÓF5=$„at*Zš$’ÑtdûÝRI1 2މ$€$I$#‰SÞ’Hë¬ï;Á$¡t$’`<(ñÇt)$‡Ð.Êf¢X’Kt=Éé$‚ˆªè¢oÝëòI%Rgcª÷ŠyI%¡‰ÿ !ñ)´õ $¤ Ô’IIGÿÙlocal ipOps = require "ipOps" local packet = require "packet" local stdnse = require "stdnse" local string = require "string" local stringaux = require "stringaux" local tab = require "tab" local table = require "table" local target = require "target" --- The following file contains a list of decoders used by the -- broadcast-listener script. A decoder can be either "ethernet" based or IP -- based. As we're only monitoring broadcast traffic (ie. traffic not -- explicitly addressed to us) we're mainly dealing with: -- o UDP broadcast or multicast traffic -- o ethernet broadcast traffic -- -- Hence, the Decoder table defines two sub tables ether and udp. -- In order to match an incoming UDP packet the destination port number is -- used, therefore each function is indexed based on their destination port -- for the udp based decoders. For the ether table each decoder function is -- indexed according to a pattern that the decoding engine attempts to match. -- -- Each decoder defines three functions: -- o new - creates a new instance of the decoder -- o process - process a packet passed through the -- data argument. -- o getResults - retrieve any discovered results -- -- The discovery engine creates an instance of each decoder once it's needed. -- Then discovery engine stores this instance in a decoder table for reference -- once the next packet of the same type comes in. This allows the engine to -- discard duplicate packets and to request the collected results at the end -- of the session. -- -- Currently, the packet decoder decodes the following protocols: -- o Ether -- x ARP requests (IPv4) -- x CDP - Cisco Discovery Protocol -- x EIGRP - Cisco Enhanced Interior Gateway Routing Protocol -- x OSPF - Open Shortest Path First -- -- o UDP -- x DHCP -- x Netbios -- x SSDP -- x HSRP -- x DropBox -- x Logitech SqueezeBox Discovery -- x Multicast DNS/Bonjour/ZeroConf -- x Spotify -- -- -- @author Patrik Karlsson -- @copyright Same as Nmap--See https://nmap.org/book/man-legal.html -- Version 0.2 -- Created 07/25/2011 - v0.1 - created by Patrik Karlsson -- 02/12/2012 - v0.2 - added support for EIGRP - Tom Sellers -- 07/13/2012 - v0.3 - added support for OSPF - Hani Benhabiles Decoders = { ether = { -- ARP IPv4 ['^00..08000604'] = { new = function(self) local o = { dups = {} } setmetatable(o, self) self.__index = self return o end, process = function(self, data) stdnse.debug1("Process ARP") local hw, proto, hwsize, protosize, opcode, pos = string.unpack(">I2 I2 BB I2", data) stdnse.debug1("hwsize = %d; opcode = %d", hwsize, opcode) -- this shouldn't ever happen, given our filter if ( hwsize ~= 6 ) then return end -- if this isn't an ARP request, abort if ( opcode ~= 1 ) then return end local src_mac, src_ip, dst_mac, dst_ip, pos = string.unpack(">c6 c4 c6 c4", data, pos) stdnse.debug1("unpacked addresses") if ( not(self.results) ) then self.results = tab.new(3) tab.addrow(self.results, 'sender ip', 'sender mac', 'target ip') end src_mac = stdnse.format_mac(src_mac) --dst_mac = stdnse.format_mac(dst_mac) src_ip = ipOps.str_to_ip(src_ip) dst_ip = ipOps.str_to_ip(dst_ip) stdnse.debug1("Decoded ARP: %s, %s, %s", src_ip, src_mac, dst_ip) if not self.dups[src_ip .. src_mac] then if target.ALLOW_NEW_TARGETS then target.add(src_ip) end self.dups[src_ip .. src_mac] = true tab.addrow(self.results, src_ip, src_mac, dst_ip) end end, getResults = function(self) return { name = "ARP Request", (self.results and tab.dump(self.results)) } end, }, -- CDP ['^AAAA..00000C2000'] = { new = function(self) local o = { dups = {} } setmetatable(o, self) self.__index = self return o end, getAddresses = function(data) local addr_list = {} local count, pos = string.unpack(">I4", data) for i=1, count do local proto_type, addr_proto proto_type, addr_proto, pos = string.unpack(">B s1", data, pos) if ( addr_proto == '\xCC' -- IPv4 or addr_proto == '\xaa\xaa\x03\x00\x00\x00\x08\x00' -- IPv6 ) then local dev_addr dev_addr, pos = string.unpack(">s2", data, pos) addr_list[#addr_list+1] = ipOps.str_to_ip(dev_addr) end -- Add code here for other address types end return table.concat(addr_list, ' ') end, process = function(self, data) local ver, ttl, chk, pos = string.unpack(">BB I2", data, 9) if ( ver ~= 2 ) then return end if ( not(self.results) ) then self.results = tab.new(5) tab.addrow( self.results, 'ip', 'id', 'platform', 'version', 'notes' ) end local result_part = {} result_part.notes = '' while ( pos < #data ) do local typ, len, typdata typ, len, pos = string.unpack(">I2 I2", data, pos) typdata, pos = string.unpack("c" .. len - 4, data, pos) -- Device ID if ( typ == 1 ) then result_part.id = typdata -- Version elseif ( typ == 5 ) then result_part.version = typdata:match(", Version (.-),") -- Platform elseif ( typ == 6 ) then result_part.platform = typdata -- Address elseif ( typ == 2 ) then result_part.ip = self.getAddresses(typdata) elseif ( typ == 10) then local mgmt_vlan = string.unpack(">I2", data,pos - 2) result_part.notes = result_part.notes .. 'native vlan:' .. mgmt_vlan .. ' ' -- Management Address elseif ( typ == 22 ) then result_part.notes = result_part.notes .. 'mgmt ip:' .. self.getAddresses(typdata) .. ' ' -- TODO: add more decoding of types here ... end end -- TODO: add code for dups check if ( not(self.dups[result_part.ip]) ) then self.dups[result_part.ip] = true tab.addrow( self.results, result_part.ip, result_part.id, result_part.platform, result_part.version, result_part.notes ) end end, getResults = function(self) return { name = "CDP", (self.results and tab.dump(self.results) or "") } end, }, -- EIGRP Update ['0201....0000'] = { new = function(self) local o = { dups = {} } setmetatable(o, self) self.__index = self return o end, process = function(self, layer3) local p = packet.Packet:new( layer3, #layer3 ) -- EIGRP is IP protocol 88 (0x58), so verify this if ( p.ip_p ~= 88 ) then return end local data = layer3:sub(p.ip_data_offset + 1) local eigrp = require("eigrp") local route_type, proto_name -- Extract the EIGRP header local response = eigrp.EIGRP.parse(data) if response then -- Iterate over tlv tables for _, tlv in pairs(response.tlvs) do if eigrp.EIGRP.isRoutingTLV(tlv.type) then if ( not(self.results) ) then self.results = tab.new(7) tab.addrow(self.results, 'Sender IP', 'AS#', 'Route Type', 'Destination', 'Next hop', 'Ext Protocol', 'Orig Router ID') end if tlv.type == 0x102 then route_type = "Internal" elseif tlv.type == 0x103 then route_type = "External" for name, value in pairs(eigrp.EXT_PROTO) do if value == tlv.eproto then proto_name = name break end end end if ( not(self.dups[("%s:%s:s:%s"):format(p.ip_src, response.as, tlv.type, tlv.dst)]) ) then if ( target.ALLOW_NEW_TARGETS ) then target.add(p.ip_src) end self.dups[("%s:%s:%s:%s"):format(p.ip_src, response.as, tlv.type, tlv.dst)] = true tab.addrow( self.results, p.ip_src, response.as, route_type, tlv.dst, tlv.nexth, proto_name or 'X', tlv.orouterid or 'X') end end end end end, getResults = function(self) return { name = "EIGRP Update", (self.results and tab.dump(self.results) or "") } end, }, ['0205....0000'] = { new = function(self) local o = { dups = {} } setmetatable(o, self) self.__index = self return o end, process = function(self, layer3) local p = packet.Packet:new( layer3, #layer3 ) -- EIGRP is IP protocol 88 (0x58), so verify this if ( p.ip_p ~= 88 ) then return end local data = layer3:sub(p.ip_data_offset + 1) local eigrp = require("eigrp") -- Extract the EIGRP header local response = eigrp.EIGRP.parse(data) -- See if Software version TLV is included local swvertlv for num, tlv in pairs(response.tlvs) do if tlv.type == eigrp.TLV.SWVER then swvertlv = num end end if swvertlv then if ( not(self.results) ) then self.results = tab.new(5) tab.addrow(self.results, 'Sender IP', 'AS number', 'EIGRP version', 'IOS version') end if ( not(self.dups[("%s:%s"):format(p.ip_src,response.as)]) ) then if ( target.ALLOW_NEW_TARGETS ) then target.add(p.ip_src) end self.dups[("%s:%s"):format(p.ip_src,response.as)] = true tab.addrow( self.results, p.ip_src, response.as, response.tlvs[swvertlv].majv .. '.' .. response.tlvs[swvertlv].minv, response.tlvs[swvertlv].majtlv .. '.' .. response.tlvs[swvertlv].mintlv) end end end, getResults = function(self) return { name = "EIGRP Hello", (self.results and tab.dump(self.results) or "") } end, }, -- OSPF ['02010'] = { -- OSPFv2 Hello packet new = function(self) local o = { dups = {} } setmetatable(o, self) self.__index = self return o end, process = function(self, layer3) local p = packet.Packet:new( layer3, #layer3 ) -- IP Protocol is 89 for OSPF if p.ip_p ~= 89 then return end local ospf = require("ospf") local data = layer3:sub(p.ip_data_offset + 1) local header = ospf.OSPF.Header.parse(data) if header then if not(self.results) then self.results = tab.new(5) tab.addrow(self.results, 'Source IP', 'Router ID', 'Area ID', 'Auth Type', 'Password') end local srcip = p.ip_src local areaid = header.area_id local routerid = header.router_id local authtype = header.auth_type local authdata -- Format authentication type and data if header.auth_type == 0 then authtype = "None" authdata = '' elseif header.auth_type == 1 then authtype = "Password" authdata = header.auth_data.password elseif header.auth_type == 2 then authtype = "OSPF MD5" authdata = "" -- Not really helpful, as the MD5 -- is applied to the whole packet+password else -- Error stdnse.debug1("Unknown OSPF auth type %d", header.auth_type) return end if ( not(self.dups[("%s:%s"):format(routerid,areaid)]) ) then if ( target.ALLOW_NEW_TARGETS ) then target.add(routerid) end self.dups[("%s:%s"):format(routerid,areaid)] = true tab.addrow( self.results, srcip, routerid, areaid, authtype, authdata) end else return nil end end, getResults = function(self) return { name = "OSPF Hello", (self.results and tab.dump(self.results)) } end, }, }, udp = { -- DHCP [68] = { new = function(self) local o = { dups = {} } setmetatable(o, self) self.__index = self return o end, getOption = function(options, name) for _, v in ipairs(options) do if ( v.name == name ) then if ( type(v.value) == "table" ) then return table.concat(v.value, ", ") else return v.value end end end end, process = function(self, layer3) local dhcp = require("dhcp") local p = packet.Packet:new( layer3, #layer3 ) local data = layer3:sub(p.udp_offset + 9) -- the dhcp.parse function isn't optimal for doing -- this, but it will do for now. First, we need to -- extract the xid as the parse function checks that it -- was the same as in the request, which we didn't do. local msgtype, xid = string.unpack(" 1) then table.insert(result, { name = "Registrations", tab.dump(self.reg_result) }) end if ( #self.query_result > 1 ) then table.insert(result, { name = "Query", tab.dump(self.query_result) }) end return result end, }, -- BROWSER [138] = { new = function(self) local o = { dups = {} } setmetatable(o, self) self.__index = self return o end, process = function(self, layer3) local netbios = require('netbios') local p = packet.Packet:new( layer3, #layer3 ) local data = layer3:sub(p.udp_offset + 9) local ip, src, dst = string.unpack(">c4 xxxxxx c34 c34", data, 5) ip = ipOps.str_to_ip(ip) src = netbios.name_decode(src) dst = netbios.name_decode(dst) stdnse.debug1("Decoded BROWSER: %s, %s, %s", ip, src, dst) local dup_rec = ("%s:%s:%s"):format(ip, src, dst) if ( not(self.dups[dup_rec]) ) then self.dups[dup_rec] = true if ( not(self.results) ) then self.results = tab.new(3) tab.addrow(self.results, 'ip', 'src', 'dst') end tab.addrow(self.results, ip, src, dst) end end, getResults = function(self) return { name = "Browser", (self.results and tab.dump(self.results)) } end, }, -- DHCPv6 [547] = { new = function(self) local o = { dups = {} } setmetatable(o, self) self.__index = self return o end, process = function(self, layer3) local tab = require('tab') local p = packet.Packet:new( layer3, #layer3 ) local data = layer3:sub(p.udp_offset + 9) local dhcp6 = require("dhcp6") local resp = dhcp6.DHCP6.Response.parse(data) for _, v in ipairs(resp.opts or {}) do if v.resp and v.resp.fqdn then if ( not(self.results) ) then self.results = tab.new(2) tab.addrow(self.results, 'ip', 'fqdn') end if ( not(self.dups[p.ip_src]) or not(self.dups[p.ip_src][v.resp.fqdn]) ) then tab.addrow(self.results, p.ip_src, v.resp.fqdn ) self.dups[p.ip_src] = self.dups[p.ip_src] or {} self.dups[p.ip_src][v.resp.fqdn] = true end end end end, getResults = function(self) return { name = "DHCP6", (self.results and tab.dump(self.results)) } end, }, -- CUPS [631] = { new = function(self) local o = { dups = {} } setmetatable(o, self) self.__index = self return o end, process = function(self, layer3) local tab = require('tab') local p = packet.Packet:new( layer3, #layer3 ) local data = layer3:sub(p.udp_offset + 9) local function split(str) local start, pos, stop = 1, 1 local pattern = "" local result = {} while(pos) do start = pos + #pattern pos, stop = str:find("\"", start) pattern = (pos == start and "\" " or " ") pos, stop = str:find(pattern, start + 1) table.insert(result, str:sub(start, (stop and stop - (#pattern)))) end return ( #result > 0 and result or nil ) end local results = split(data) local uri = ( #results > 3 and results[3]:match('[^%"]+') ) local loc = ( #results > 4 and results[4]:match('[^%"]+') or "") local info = ( #results > 5 and results[5]:match('[^%"]+') or "") local model = ( #results > 6 and results[6]:match('[^%"]+') or "") if ( not(self.results) ) then self.results = tab.new(4) tab.addrow(self.results, 'ip', 'uri', 'loc', 'model') end stdnse.debug1("Decoded CUPS: %s, %s, %s, %s", p.ip_src, uri, loc, model) if ( not(self.dups[p.ip_src]) or not(self.dups[p.ip_src][uri]) ) then tab.addrow(self.results, p.ip_src, uri, loc, model) self.dups[p.ip_src] = self.dups[p.ip_src] or {} self.dups[p.ip_src][uri] = self.dups[p.ip_src][uri] or true end end, getResults = function(self) return { name = "CUPS", (self.results and tab.dump(self.results)) } end, }, -- SSDP [1900] = { new = function(self) local o = { dups = {} } setmetatable(o, self) self.__index = self return o end, process = function(self, layer3) local p = packet.Packet:new( layer3, #layer3 ) local data = layer3:sub(p.udp_offset + 9) local headers = stringaux.strsplit("\r\n", data) for _, h in ipairs(headers) do local st = "" if ( h:match("^ST:.*") ) then st = h:match("^ST:(.*)") if ( not(self.results) ) then self.results = tab.new(1) tab.addrow( self.results, 'ip', 'uri' ) end if ( not(self.dups[("%s:%s"):format(p.ip_src,st)]) ) then if ( target.ALLOW_NEW_TARGETS ) then target.add(p.ip_src) end tab.addrow( self.results, p.ip_src, st ) self.dups[("%s:%s"):format(p.ip_src,st)] = true end end end end, getResults = function(self) return { name = "SSDP", (self.results and tab.dump(self.results)) } end, }, --- HSRP [1985] = { new = function(self) local o = { dups = {} } setmetatable(o, self) self.__index = self return o end, process = function(self, layer3) local p = packet.Packet:new( layer3, #layer3 ) local data = layer3:sub(p.udp_offset + 9) local State = { [0] = "Initial", [1] = "Learn", [2] = "Listen", [4] = "Speak", [8] = "Standby", [16] = "Active" } local Op = { [0] = "Hello", [1] = "Coup", [2] = "Resign", } local version, op, state, prio, group, secret, pos = string.unpack("BBBxxBBxz", data) if ( version ~= 0 ) then return end pos = pos + ( 7 - #secret ) local virtip virtip, pos = string.unpack(">I4", data, pos) if ( not(self.dups[p.ip_src]) ) then if ( not(self.results) ) then self.results = tab.new(7) tab.addrow(self.results, 'ip', 'version', 'op', 'state', 'prio', 'group', 'secret', 'virtual ip') end if ( target.ALLOW_NEW_TARGETS ) then target.add(p.ip_src) end self.dups[p.ip_src] = true tab.addrow(self.results, p.ip_src, version, Op[op], State[state], prio, group, secret, ipOps.fromdword(virtip)) end end, getResults = function(self) return { name = "HSRP", (self.results and tab.dump(self.results) or "") } end, }, -- Dropbox [17500] = { new = function(self) local o = { dups = {} } setmetatable(o, self) self.__index = self return o end, process = function(self, layer3) local json = require("json") local p = packet.Packet:new( layer3, #layer3 ) local data = layer3:sub(p.udp_offset + 9) local status, info = json.parse(data) if ( not(status) ) then return false, "Failed to parse JSON data" end -- Add host to list. for _, key1 in pairs({"namespaces", "version"}) do for key2, val in pairs(info[key1]) do info[key1][key2] = tostring(info[key1][key2]) end end if ( not(self.results) ) then self.results = tab.new(6) tab.addrow( self.results, 'displayname', 'ip', 'port', 'version', 'host_int', 'namespaces' ) end if ( not(self.dups[p.ip_src]) ) then tab.addrow( self.results, info.displayname, p.ip_src, info.port, table.concat(info.version, "."), info.host_int, table.concat(info.namespaces, ", ") ) self.dups[p.ip_src] = true if ( target.ALLOW_NEW_TARGETS ) then target.add(p.ip_src) end end end, getResults = function(self) return { name = "DropBox", (self.results and tab.dump(self.results) or "") } end, }, --- Squeezebox Discovery [3483] = { new = function(self) local o = { dups = {} } setmetatable(o, self) self.__index = self return o end, process = function(self, layer3) local p = packet.Packet:new( layer3, #layer3 ) local data = layer3:sub(p.udp_offset + 9) if ( data:match("^eIPAD") ) then if ( not(self.results) ) then self.results = tab.new(1) tab.addrow( self.results, 'ip' ) end if ( not(self.dups[p.ip_src]) ) then tab.addrow( self.results, p.ip_src ) self.dups[p.ip_src] = true if ( target.ALLOW_NEW_TARGETS ) then target.add(p.ip_src) end end end end, getResults = function(self) return { name = "Squeezebox Discovery", (self.results and tab.dump(self.results) or "") } end, }, -- Multicast DNS/BonJour/ZeroConf [5353] = { new = function(self) local o = { dups = {}, macbooks = {}, generic = {} } setmetatable(o, self) self.__index = self return o end, process = function(self, layer3) local dns = require('dns') local p = packet.Packet:new( layer3, #layer3 ) local data = layer3:sub(p.udp_offset + 9) local dresp = dns.decode(data) local name if ( dresp.questions and #dresp.questions > 0 ) then name = dresp.questions[1].dname elseif ( dresp.answers and #dresp.answers > 0 ) then -- Identify MacBooks local macbook, model, ip, ipv6 if ( p.ip_src:match(":") ) then ipv6 = p.ip_src else ip = p.ip_src end for i in ipairs(dresp.answers) do if ( dresp.answers[i]['data'] ) then local data = string.unpack("s1", dresp.answers[i]['data']) if ( data ) then model = data:match("^model=(.*)") if ( model ) then macbook = dresp.answers[i]['dname']:match("^(.-)%._") end end elseif ( dresp.answers[i]['ip'] ) then ip = dresp.answers[i]['ip'] elseif ( dresp.answers[i]['ipv6'] ) then ipv6 = dresp.answers[i]['ipv6'] elseif ( not(macbook) and dresp.answers[i]['domain'] ) then macbook = dresp.answers[i]['domain'] end end if ( macbook and model ) then self.macbooks[macbook] = self.macbooks[macbook] or {} self.macbooks[macbook]['macbook'] = self.macbooks[macbook]['macbook'] or macbook self.macbooks[macbook]['model'] = self.macbooks[macbook]['model'] or model self.macbooks[macbook]['ip'] = self.macbooks[macbook]['ip'] or ip self.macbooks[macbook]['ipv6'] = self.macbooks[macbook]['ipv6'] or ipv6 stdnse.debug1("Decoded MDNS(MacBook): %s, %s, %s, %s", (self.macbooks[macbook]['ip'] or ""), (self.macbooks[macbook]['ipv6'] or ""), self.macbooks[macbook]['model'], self.macbooks[macbook]['macbook']) else name = dresp.answers[1].dname if ( not(name) ) then return end self.generic[name] = self.generic[name] or {} self.generic[name]['name'] = self.generic[name]['name'] or name if ( p.ip_src:match(":") ) then self.generic[name]['ipv6'] = p.ip_src else self.generic[name]['ip'] = p.ip_src end stdnse.debug1("Decoded MDNS(Generic): %s, %s", name, p.ip_src) end end end, getResults = function(self) local tab = require('tab') local result = { name = "MDNS" } -- build a macbooks table local macbooks, generic if ( next(self.generic) ) then table.sort(self.generic) generic = tab.new(3) tab.addrow(generic, 'ip', 'ipv6', 'name') for name, v in pairs(self.generic) do tab.addrow(generic, (v.ip or ""), (v.ipv6 or ""), name) end table.insert(result, { name = 'Generic', tab.dump(generic) } ) end if ( next(self.macbooks) ) then table.sort(self.macbooks) macbooks = tab.new(4) tab.addrow(macbooks, 'ip', 'ipv6', 'name', 'model') for _, v in pairs(self.macbooks) do tab.addrow(macbooks, (v.ip or ""), (v.ipv6 or ""), v.macbook, v.model) end table.insert(result, { name = 'Macbooks', tab.dump(macbooks) } ) end return result end, }, [5355] = { -- LLMNR new = function(self) local o = { dups = {} } setmetatable(o, self) self.__index = self return o end, process = function(self, layer3) local tab = require('tab') local dns = require('dns') local p = packet.Packet:new( layer3, #layer3 ) local data = layer3:sub(p.udp_offset + 9) local resp = dns.decode(data) if ( not(self.results) ) then self.results = tab.new(2) tab.addrow(self.results, 'ip', 'query') end local name = (( resp.questions and #resp.questions > 0 ) and resp.questions[1].dname ) if ( not(name) ) then return end stdnse.debug1("Decoded LLMNR: %s, %s", p.ip_src, name) if ( not(self.dups[("%s:%s"):format(p.ip_src, name)]) ) then self.dups[("%s:%s"):format(p.ip_src, name)] = true tab.addrow(self.results, p.ip_src, name) end end, getResults = function(self) return { name = "LLMNR", (self.results and tab.dump(self.results)) } end, }, --- Spotify [57621] = { new = function(self) local o = { dups = {} } setmetatable(o, self) self.__index = self return o end, process = function(self, layer3) local p = packet.Packet:new( layer3, #layer3 ) local data = layer3:sub(p.udp_offset + 9) if ( data:match("^SpotUdp") ) then if ( not(self.results) ) then self.results = tab.new(1) tab.addrow( self.results, 'ip' ) end if ( not(self.dups[p.ip_src]) ) then tab.addrow( self.results, p.ip_src ) self.dups[p.ip_src] = true if ( target.ALLOW_NEW_TARGETS ) then target.add(p.ip_src) end end end end, getResults = function(self) return { name = "Spotify", (self.results and tab.dump(self.results)) } end, } } }