Re: Plugin to detect domain membership?

--000e0cd17b9a9cf051046348d265
Content-Type: multipart/alternative; boundary=000e0cd17b9a9ceff6046348d263

--000e0cd17b9a9ceff6046348d263
Content-Type: text/plain; charset=ISO-8859-1
Content-Transfer-Encoding: 7bit

here you go. should work on windows boxes and not false positive on unix
boxes with smb. will return a high if it can't get into the box.

On Thu, Feb 19, 2009 at 12:06 AM, Ray Van Dolson <[email protected]>wrote:

> On Wed, Feb 18, 2009 at 07:41:00PM -0800, Doug Nordwall wrote:
> > yes, I do. lemme get it out in the morning.
> >
>
> Thanks Doug.  Looking forward to seeing how you implemented it.  In the
> interim, I used the smb_login.nasl script and just parse the output for
> the mention of the credentials we're using to authenticate.  If it's
> present in the output I assume the machine must be a member of the
> domain.
>
> Ray
>
> > On Wed, Feb 18, 2009 at 2:56 PM, Ray Van Dolson <[email protected]>
> > wrote:
> >
> >     Anyone have a quickie script to confirm domain membership based on
> >     the
> >     SMB credentials provided?
> >
> >     Looks like I might be able to make use of plugin 10394 for this, but
> >     maybe someone already has something ready for use.
> >
> >     Thanks,
> >     Ray
>



-- 
Doug Nordwall
Unix, Network, and Security Administrator
You mean the vision is subject to low subscription rates?!!? - Scott Stone,
on MMORPGs

--000e0cd17b9a9ceff6046348d263
Content-Type: text/html; charset=ISO-8859-1
Content-Transfer-Encoding: quoted-printable

here you go. should work on windows boxes and not false positive on unix bo=
xes with smb. will return a high if it can&#39;t get into the box.<br><br><=
div class=3D"gmail_quote">On Thu, Feb 19, 2009 at 12:06 AM, Ray Van Dolson =
<span dir=3D"ltr">&lt;<a href=3D"mailto:[email protected]">rvandolson@esr=
i.com</a>&gt;</span> wrote:<br>
<blockquote class=3D"gmail_quote" style=3D"border-left: 1px solid rgb(204, =
204, 204); margin: 0pt 0pt 0pt 0.8ex; padding-left: 1ex;"><div class=3D"Ih2=
E3d">On Wed, Feb 18, 2009 at 07:41:00PM -0800, Doug Nordwall wrote:<br>
&gt; yes, I do. lemme get it out in the morning.<br>
&gt;<br>
<br>
</div>Thanks Doug. &nbsp;Looking forward to seeing how you implemented it. =
&nbsp;In the<br>
interim, I used the smb_login.nasl script and just parse the output for<br>
the mention of the credentials we&#39;re using to authenticate. &nbsp;If it=
&#39;s<br>
present in the output I assume the machine must be a member of the<br>
domain.<br>
<font color=3D"#888888"><br>
Ray<br>
</font><div><div></div><div class=3D"Wj3C7c"><br>
&gt; On Wed, Feb 18, 2009 at 2:56 PM, Ray Van Dolson &lt;<a href=3D"mailto:=
[email protected]">[email protected]</a>&gt;<br>
&gt; wrote:<br>
&gt;<br>
&gt; &nbsp; &nbsp; Anyone have a quickie script to confirm domain membershi=
p based on<br>
&gt; &nbsp; &nbsp; the<br>
&gt; &nbsp; &nbsp; SMB credentials provided?<br>
&gt;<br>
&gt; &nbsp; &nbsp; Looks like I might be able to make use of plugin 10394 f=
or this, but<br>
&gt; &nbsp; &nbsp; maybe someone already has something ready for use.<br>
&gt;<br>
&gt; &nbsp; &nbsp; Thanks,<br>
&gt; &nbsp; &nbsp; Ray<br>
</div></div></blockquote></div><br><br clear=3D"all"><br>-- <br>Doug Nordwa=
ll<br>Unix, Network, and Security Administrator<br>You mean the vision is s=
ubject to low subscription rates?!!? - Scott Stone, on MMORPGs<br>

--000e0cd17b9a9ceff6046348d263--
--000e0cd17b9a9cf051046348d265
Content-Type: application/octet-stream; name="smb_domain_check.nasl"
Content-Disposition: attachment; filename="smb_domain_check.nasl"
Content-Transfer-Encoding: base64
X-Attachment-Id: f_frdpdclj0

IwojIChDKSBUZW5hYmxlIE5ldHdvcmsgU2VjdXJpdHkKIwoKIGRlc2NbImVuZ2xpc2giXSA9ICIK
U3lub3BzaXMgOgoKSXQgaXMgTk9UIHBvc3NpYmxlIHRvIGxvZyBpbnRvIHRoZSByZW1vdGUgaG9z
dCB1c2luZyB0aGUgZ2l2ZW4gY3JlZGVudGlhbHMuClRoaXMgc2hvdWxkIG9ubHkgaGlnaGxpZ2h0
IFdpbmRvd3MgbWFjaGluZXMuCgpEZXNjcmlwdGlvbiA6CgpUaGUgcmVtb3RlIGhvc3QgaXMgcnVu
bmluZyBvbmUgb2YgdGhlIE1pY3Jvc29mdCBXaW5kb3dzIG9wZXJhdGluZwpzeXN0ZW1zLiAgSXQg
d2FzIE5PVCBwb3NzaWJsZSB0byBsb2cgaW50byBpdCB1c2luZyBvbmUgb2YgdGhlIGZvbGxvd2lu
ZwphY2NvdW50IDoKCi0gR2l2ZW4gQ3JlZGVudGlhbHMKClNlZSBhbHNvIDoKCmh0dHA6Ly9zdXBw
b3J0Lm1pY3Jvc29mdC5jb20vc3VwcG9ydC9rYi9hcnRpY2xlcy9RMTQzLzQvNzQuQVNQCmh0dHA6
Ly9zdXBwb3J0Lm1pY3Jvc29mdC5jb20vc3VwcG9ydC9rYi9hcnRpY2xlcy9RMjQ2LzIvNjEuQVNQ
CgpSaXNrIGZhY3RvciA6Cgpub25lIjsKCgppZihkZXNjcmlwdGlvbikKewogc2NyaXB0X2lkKDYw
Mzk2KTsKIHNjcmlwdF9idWd0cmFxX2lkKDQ5NCwgOTkwLCAxMTE5OSk7CiBzY3JpcHRfdmVyc2lv
biAoIiRSZXZpc2lvbjogMS4wMCAkIik7CiAgc2NyaXB0X2N2ZV9pZCgKICAgICJDVkUtMTk5OS0w
NTA0IiwKICAgICJDVkUtMTk5OS0wNTA1IiwKICAgICJDVkUtMTk5OS0wNTA2IiwKICAgICJDVkUt
MjAwMC0wMjIyIiwKICAgICJDVkUtMjAwMi0xMTE3IiwKICAgICJDVkUtMjAwNS0zNTk1IgopOwog
bmFtZVsiZW5nbGlzaCJdID0gIlNNQiBEb21haW4gQ2hlY2siOwogCiBzY3JpcHRfbmFtZShlbmds
aXNoOm5hbWVbImVuZ2xpc2giXSk7CiAKIHNjcmlwdF9kZXNjcmlwdGlvbihlbmdsaXNoOmRlc2Nb
ImVuZ2xpc2giXSk7CiAKIHN1bW1hcnlbImVuZ2xpc2giXSA9ICJBdHRlbXB0cyB0byBsb2cgaW50
byB0aGUgcmVtb3RlIGhvc3QgdXNpbmcgdGhlIGdpdmVuIGNyZWRlbnRpYWxzIjsKIHNjcmlwdF9z
dW1tYXJ5KGVuZ2xpc2g6c3VtbWFyeVsiZW5nbGlzaCJdKTsKIAogc2NyaXB0X2NhdGVnb3J5KEFD
VF9HQVRIRVJfSU5GTyk7CiAKIHNjcmlwdF9jb3B5cmlnaHQoZW5nbGlzaDoiU2NyaXB0IGlzIGNv
cHlyaWdodCBvZiBtZSIpOwogZmFtaWx5WyJlbmdsaXNoIl0gPSAiV2luZG93cyI7CiBzY3JpcHRf
ZmFtaWx5KGVuZ2xpc2g6ZmFtaWx5WyJlbmdsaXNoIl0pOwogCiBzY3JpcHRfZGVwZW5kZW5jaWVz
KCJuZXRiaW9zX25hbWVfZ2V0Lm5hc2wiLCAiY2lmczQ0NS5uYXNsIiwgImZpbmRfc2VydmljZTEu
bmFzbCIsICJsb2dpbnMubmFzbCIsICJzbWJfbmF0aXZlbGFubWFuLm5hc2wiLCAib3NfZmluZ2Vy
cHJpbnQubmFzbCIpOwogaWYgKCBOQVNMX0xFVkVMID49IDIyMDIgKSBzY3JpcHRfZGVwZW5kZW5j
aWVzKCJrZXJiZXJvcy5uYXNsIik7CiBzY3JpcHRfcmVxdWlyZV9rZXlzKCJIb3N0L09TIiwiU01C
L25hbWUiLCAiU01CL3RyYW5zcG9ydCIpOwogc2NyaXB0X3JlcXVpcmVfcG9ydHMoMTM5LCA0NDUp
OwogZXhpdCgwKTsKfQoKaW5jbHVkZSgic21iX2Z1bmMuaW5jIik7CmluY2x1ZGUoImdsb2JhbF9z
ZXR0aW5ncy5pbmMiKTsKCgoKCmZ1bmN0aW9uIGxvZ2luKGxnLCBwdywgZG9tLCBsbSwgbnRsbSkK
eyAKIGxvY2FsX3ZhciByLCBzb2M7Cgogc29jID0gb3Blbl9zb2NrX3RjcChwb3J0KTsKIGlmICgg
ISBzb2MgKSBleGl0KDApOwoKIHNlc3Npb25faW5pdChzb2NrZXQ6c29jLCBob3N0bmFtZTpuYW1l
KTsKIHIgPSBOZXRVc2VBZGQobG9naW46bGcsIHBhc3N3b3JkOnB3LCBkb21haW46ZG9tLCBsbV9o
YXNoOmxtLCBudGxtX2hhc2g6bnRsbSwgc2hhcmU6IklQQyQiKTsKIE5ldFVzZURlbCgpOwoKIGlm
ICggciA9PSAxICkKICByZXR1cm4gVFJVRTsKIGVsc2UKICByZXR1cm4gRkFMU0U7Cn0KCgoKbG9n
aW5faGFzX2JlZW5fc3VwcGxpZWQgPSAwOwpwb3J0ID0ga2Jfc21iX3RyYW5zcG9ydCgpOwpuYW1l
ID0ga2Jfc21iX25hbWUoKTsKCmlmICggISBnZXRfcG9ydF9zdGF0ZShwb3J0KSApCiAgZXhpdCgw
KTsKCm9zID0gZ2V0X2tiX2l0ZW0oIkhvc3QvT1MiKTsKaWYob3MpCnsKIGlmKCJXaW5kb3dzIiA+
ITwgb3MpZXhpdCgwKTsKfQoKc29jID0gb3Blbl9zb2NrX3RjcChwb3J0KTsKaWYgKCAhc29jICkK
ICBleGl0KDApOwpjbG9zZShzb2MpOwoKZm9yICggaSA9IDAgOyBUUlVFIDsgaSArKyApCnsKIGwg
PSBnZXRfa2JfaXRlbSgiU01CL2xvZ2luX2ZpbGxlZC8iICsgaSApOwogaWYgKGwpCiAgIGwgPSBl
cmVnX3JlcGxhY2UocGF0dGVybjoiKFteIF0qKSAqJCIsIHN0cmluZzpsLCByZXBsYWNlOiJcMSIp
OwoKIHAgPSBnZXRfa2JfaXRlbSgiU01CL3Bhc3N3b3JkX2ZpbGxlZC8iICsgaSApOwogaWYgKHAp
CiAgIHAgPSBlcmVnX3JlcGxhY2UocGF0dGVybjoiKFteIF0qKSAqJCIsIHN0cmluZzpwLCByZXBs
YWNlOiJcMSIpOwogZWxzZQogICBwID0gIiI7CgogZCA9IGdldF9rYl9pdGVtKCJTTUIvZG9tYWlu
X2ZpbGxlZC8iICsgaSApOwogaWYgKGQpCiAgIGQgPSBlcmVnX3JlcGxhY2UocGF0dGVybjoiKFte
IF0qKSAqJCIsIHN0cmluZzpkLCByZXBsYWNlOiJcMSIpOwoKIGlmICggbCApCiB7CiAgbG9naW5f
aGFzX2JlZW5fc3VwcGxpZWQgKys7CiAgbG9naW5zW2ldID0gbDsKICBwYXNzd29yZHNbaV0gPSBw
OwogIGRvbWFpbnNbaV0gPSBkOwogfQogZWxzZSBicmVhazsKfQoKc21iX2RvbWFpbiA9IHN0cmlu
ZyhnZXRfa2JfaXRlbSgiU01CL3dvcmtncm91cCIpKTsKCmlmIChzbWJfZG9tYWluKQp7CiBzbWJf
ZG9tYWluID0gZXJlZ19yZXBsYWNlKHBhdHRlcm46IihbXiBdKikgKiQiLCBzdHJpbmc6c21iX2Rv
bWFpbiwgcmVwbGFjZToiXDEiKTsKfQoKaG9sZSA9IDA7CnJhbmRfbGcgPSBzdHJpbmcgKCAibmVz
c3VzIiwgcmFuZCgpLCByYW5kKCksIHJhbmQoKSApOyAKcmFuZF9wdyA9IHN0cmluZyAoICJuZXNz
dXMiLCByYW5kKCksIHJhbmQoKSwgcmFuZCgpICk7CgoKdmFsaWRfbG9naW5zICAgPSBtYWtlX2xp
c3QoKTsKdmFsaWRfcGFzc3dvcmRzID0gbWFrZV9saXN0KCk7CgoKCmlmICggbG9naW4obGc6TlVM
TCwgcHc6TlVMTCwgZG9tOk5VTEwpID09IFRSVUUgKQogbnVsbF9zZXNzaW9uID0gVFJVRTsKZWxz
ZQogbnVsbF9zZXNzaW9uID0gRkFMU0U7CgoKaWYgKCAhIHN1cHBsaWVkX2xvZ2luc19vbmx5ICAp
CnsKIGlmICggKCBsb2dpbihsZzoiYWRtaW5pc3RyYXRvciIsIHB3Ok5VTEwsIGRvbTpOVUxMKSA9
PSBUUlVFICkgJiYgKCBzZXNzaW9uX2lzX2d1ZXN0KCkgPT0gMCApICkKICBhZG1pbl9ub19wdyA9
IFRSVUU7CiBlbHNlCiAgYWRtaW5fbm9fcHcgPSBGQUxTRTsKCiBpZiAoICggbG9naW4obGc6cmFu
ZF9sZywgcHc6cmFuZF9wdywgZG9tOk5VTEwpID09IFRSVUUgKSApCiB7CiAgYW55X2xvZ2luID0g
VFJVRTsKICBzZXRfa2JfaXRlbShuYW1lOiJTTUIvYW55X2xvZ2luIiwgdmFsdWU6VFJVRSk7CiB9
CiBlbHNlCiAgYW55X2xvZ2luID0gRkFMU0U7Cn0KCnN1cHBsaWVkX2xvZ2luX2lzX2NvcnJlY3Qg
PSBGQUxTRTsKCnBfdHlwZSA9IGdldF9rYl9pdGVtKCJTTUIvcGFzc3dvcmRfdHlwZSIpOwoKZm9y
ICggaSA9IDAgOyBsb2dpbnNbaV0gJiYgc3VwcGxpZWRfbG9naW5faXNfY29ycmVjdCA9PSBGQUxT
RSA7IGkgKysgKQp7CiAgdXNlcl9sb2dpbiA9IGxvZ2luc1tpXTsKICBrX3Bhc3N3b3JkID0gdXNl
cl9wYXNzd29yZCA9IHBhc3N3b3Jkc1tpXTsKICB1c2VyX2RvbWFpbiA9IGRvbWFpbnNbaV07Cgog
IGlmIChwX3R5cGUgPT0gMCkKICB7CiAgIGxtID0gbnRsbSA9IE5VTEw7CiAgfQogIGlmIChwX3R5
cGUgPT0gMSkKICB7CiAgIGxtID0gaGV4MnJhdzIoczp0b2xvd2VyKHVzZXJfcGFzc3dvcmQpKTsK
ICAgbnRsbSA9IHVzZXJfcGFzc3dvcmQgPSBOVUxMOwogIH0KICBlbHNlIGlmIChwX3R5cGUgPT0g
MikKICB7CiAgIG50bG0gPSBoZXgycmF3MihzOnRvbG93ZXIodXNlcl9wYXNzd29yZCkpOwogICBs
bSA9IHVzZXJfcGFzc3dvcmQgPSBOVUxMOwogIH0KCiBpZiAoKGxvZ2luKGxnOnVzZXJfbG9naW4s
IHB3OnVzZXJfcGFzc3dvcmQsIGRvbTp1c2VyX2RvbWFpbiwgbG06bG0sIG50bG06bnRsbSkgPT0g
VFJVRSApICAmJiAoIHNlc3Npb25faXNfZ3Vlc3QoKSA9PSAwICkpCiB7CiAgc3VwcGxpZWRfbG9n
aW5faXNfY29ycmVjdCA9IFRSVUU7CiAgc21iX2RvbWFpbiA9IHVzZXJfZG9tYWluOwogfQogZWxz
ZQogewogIGlmICh0b2xvd2VyKHVzZXJfZG9tYWluKSAhPSB0b2xvd2VyKHNtYl9kb21haW4pKQog
IHsKICAgaWYgKChsb2dpbihsZzp1c2VyX2xvZ2luLCBwdzp1c2VyX3Bhc3N3b3JkLCBkb206c21i
X2RvbWFpbiwgbG06bG0sIG50bG06bnRsbSkgPT0gVFJVRSApICAmJiAoIHNlc3Npb25faXNfZ3Vl
c3QoKSA9PSAwICkpCiAgIHsKICAgIHN1cHBsaWVkX2xvZ2luX2lzX2NvcnJlY3QgPSBUUlVFOwog
ICB9CiAgfQoKICBpZiAoIXN1cHBsaWVkX2xvZ2luX2lzX2NvcnJlY3QpCiAgewogICBpZiAoKGxv
Z2luKGxnOnVzZXJfbG9naW4sIHB3OnVzZXJfcGFzc3dvcmQsIGRvbTpOVUxMLCBsbTpsbSwgbnRs
bTpudGxtKSA9PSBUUlVFICkgICYmICggc2Vzc2lvbl9pc19ndWVzdCgpID09IDAgKSkKICAgewog
ICAgc3VwcGxpZWRfbG9naW5faXNfY29ycmVjdCA9IFRSVUU7CiAgICBzbWJfZG9tYWluID0gTlVM
TDsKICAgfQogIH0KCiB9Cn0KCmlmICggIXN1cHBsaWVkX2xvZ2luX2lzX2NvcnJlY3QgKQp7CiBy
ZXBvcnQgKz0gc3RyaW5nKCItIFRoZSBTTUIgdGVzdHMgZmFpbGVkIHdpdGggJyIsIHVzZXJfbG9n
aW4sICInLycqKioqKionXG4iKTsKIHJlcG9ydCA9IHN0cmluZyAoZGVzY1siZW5nbGlzaCJdLAoJ
CSJcblxuUGx1Z2luIG91dHB1dCA6XG5cbiIsCgkJcmVwb3J0KTsKIHNlY3VyaXR5X2hvbGUocG9y
dDpwb3J0LCBkYXRhOnJlcG9ydCk7Cn0K
--000e0cd17b9a9cf051046348d265
Content-Type: text/plain; charset="us-ascii"
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
Content-Disposition: inline

_______________________________________________
Nessus mailing list
[email protected]
http://mail.nessus.org/mailman/listinfo/nessus
--000e0cd17b9a9cf051046348d265--