Re: [NSE] New NSE library for DICOM and scripts dicom-ping and dicom-brute
"Arturo 'Buanzo' Busleiman" <[email protected]> Tue, 6 Aug 2019 11:05:10 -0300
| Newsgroups | gmane.comp.security.nmap.devel |
|---|---|
| Message-ID | <CAAcS2GpqdoZraNFXXFvb4aRRXgWH=YRz6uT+rujRTo4Mp8GWZA@mail.gmail.com> |
--===============7506930099296533563== Content-Type: multipart/alternative; boundary="000000000000aed771058f73502f" --000000000000aed771058f73502f Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable Wonderful work Paulino, as usual. On Mon, Aug 5, 2019 at 11:48 AM Paulino Calderon <[email protected]> wrote: > Hey, > > I=E2=80=99ve committed in r37704 a NSE library for the DICOM protocol [1]= commonly > found in medical environments. With this new library I=E2=80=99ve committ= ed scripts > dicom-ping[2] and dicom-brute[3] which can be used to identify and brute > force DICOM servers. I=E2=80=99m posting these scripts now as they are re= ady but I > also (should) have working copies of two more scripts using this library: > dicom-assoc-flood and dicom-fuzzer > > Next, for this library I would like to finish the implementation of the > C-FIND operation to get Nmap to list patient=E2=80=99s information. :) > > Cheers. > > dicom.lua > ++++++++++++++++++++ > -- > -- DICOM library > -- > -- This library implements (partially) the DICOM protocol. This protocol > is used to > -- capture, store and distribute medical images. > -- > -- From Wikipedia: > -- The core application of the DICOM standard is to capture, store and > distribute > -- medical images. The standard also provides services related to imaging > such as > -- managing imaging procedure worklists, printing images on film or > digital media > -- like DVDs, reporting procedure status like completion of an imaging > acquisition, > -- confirming successful archiving of images, encrypting datasets, > removing patient > -- identifying information from datasets, organizing layouts of images fo= r > review, > -- saving image manipulations and annotations, calibrating image displays= , > encoding > -- ECGs, encoding CAD results, encoding structured measurement data, and > storing > -- acquisition protocols. > -- > -- OPTIONS: > -- *<code>called_aet</code> - If set it changes the called Application > Entity Title > -- used in the requests. Default: ANY-SCP > -- *<code>calling_aet</code> - If set it changes the calling Application > Entity Title > -- used in the requests. Default: ECHOSCU > -- > -- @args dicom.called_aet Called Application Entity Title. Default: ANY-S= CP > -- @args dicom.calling_aet Calling Application Entity Title. Default: > ECHOSCU > -- > -- @author Paulino Calderon <[email protected]> > -- @copyright Same as Nmap--See https://nmap.org/book/man-legal.html > =E2=80=94 > > dicom-ping.nse > ++++++++++++++++++++ > description =3D [[ > Attempts to discover DICOM servers (DICOM Service Provider) through a > partial C-ECHO request. > It also detects if the server allows any called Application Entity Title > or not. > > The script responds with the message "Called AET check enabled" when the > association request > is rejected due configuration. This value can be bruteforced. > > C-ECHO requests are commonly known as DICOM ping as they are used to test > connectivity. > Normally, a 'DICOM ping' is formed as follows: > * Client -> A-ASSOCIATE request -> Server > * Server -> A-ASSOCIATE ACCEPT/REJECT -> Client > * Client -> C-ECHO request -> Server > * Server -> C-ECHO response -> Client > * Client -> A-RELEASE request -> Server > * Server -> A-RELEASE response -> Client > > For this script we only send the A-ASSOCIATE request and look for the > success code > in the response as it seems to be a reliable way of detecting DICOM > servers. > ]] > > dicom-brute.nse > ++++++++++++++++++++ > description =3D [[ > Attempts to brute force the Application Entity Title of a DICOM server > (DICOM Service Provider). > > Application Entity Titles (AET) are used to restrict responses only to > clients knowing the title. Hence, > the called AET is used as a form of password. > ]] > > --- > -- @usage nmap -p4242 --script dicom-brute <target> > -- @usage nmap -sV --script dicom-brute <target> > -- @usage nmap --script dicom-brute --script-args passdb=3Daets.txt <targ= et> > -- > -- @output > -- PORT STATE SERVICE REASON > -- 4242/tcp open vrml-multi-use syn-ack > -- | dicom-brute: > -- | Accounts: > -- | Called Application Entity Title:ORTHANC - Valid credentials > -- |_ Statistics: Performed 5 guesses in 1 seconds, average tps: 5.0 > --- > > > [1] https://svn.nmap.org/nmap/nselib/dicom.lua > [2] https://svn.nmap.org/nmap/scripts/dicom-ping.nse > [3] https://svn.nmap.org/nmap/scripts/dicom-brute.nse > > _______________________________________________ > Sent through the dev mailing list > https://nmap.org/mailman/listinfo/dev > Archived at http://seclists.org/nmap-dev/ --000000000000aed771058f73502f Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable <div dir=3D"ltr"><div>Wonderful work Paulino, as usual.</div><div><br></div= ></div><br><div class=3D"gmail_quote"><div dir=3D"ltr" class=3D"gmail_attr"= >On Mon, Aug 5, 2019 at 11:48 AM Paulino Calderon <<a href=3D"mailto:pau= [email protected]">[email protected]</a>> wrote:<br></div><bl= ockquote class=3D"gmail_quote" style=3D"margin:0px 0px 0px 0.8ex;border-lef= t:1px solid rgb(204,204,204);padding-left:1ex">Hey,<br> <br> I=E2=80=99ve committed in r37704 a NSE library for the DICOM protocol [1] c= ommonly found in medical environments. With this new library I=E2=80=99ve c= ommitted scripts dicom-ping[2] and dicom-brute[3] which can be used to iden= tify and brute force DICOM servers. I=E2=80=99m posting these scripts now a= s they are ready but I also (should) have working copies of two more script= s using this library: dicom-assoc-flood and dicom-fuzzer <br> <br> Next, for this library I would like to finish the implementation of the C-F= IND operation to get Nmap to list patient=E2=80=99s information. :)<br> <br> Cheers.<br> <br> dicom.lua<br> ++++++++++++++++++++<br> --<br> -- DICOM library<br> --<br> -- This library implements (partially) the DICOM protocol. This protocol is= used to<br> -- capture, store and distribute medical images.<br> --<br> -- From Wikipedia:<br> -- The core application of the DICOM standard is to capture, store and dist= ribute<br> -- medical images. The standard also provides services related to imaging s= uch as<br> -- managing imaging procedure worklists, printing images on film or digital= media<br> -- like DVDs, reporting procedure status like completion of an imaging acqu= isition,<br> -- confirming successful archiving of images, encrypting datasets, removing= patient<br> -- identifying information from datasets, organizing layouts of images for = review,<br> -- saving image manipulations and annotations, calibrating image displays, = encoding<br> -- ECGs, encoding CAD results, encoding structured measurement data, and st= oring<br> -- acquisition protocols.<br> --<br> -- OPTIONS:<br> -- *<code>called_aet</code> - If set it changes the called Appl= ication Entity Title<br> --=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2= =A0 =C2=A0 =C2=A0 =C2=A0 used in the requests. Default: ANY-SCP<br> -- *<code>calling_aet</code> - If set it changes the calling Ap= plication Entity Title<br> --=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2= =A0 =C2=A0 =C2=A0 =C2=A0 used in the requests. Default: ECHOSCU<br> --<br> -- @args dicom.called_aet Called Application Entity Title. Default: ANY-SCP= <br> -- @args dicom.calling_aet Calling Application Entity Title. Default: ECHOS= CU<br> -- <br> -- @author Paulino Calderon <<a href=3D"mailto:[email protected]"= target=3D"_blank">[email protected]</a>><br> -- @copyright Same as Nmap--See <a href=3D"https://nmap.org/book/man-legal.= html" rel=3D"noreferrer" target=3D"_blank">https://nmap.org/book/man-legal.= html</a><br> =E2=80=94<br> <br> dicom-ping.nse<br> ++++++++++++++++++++<br> description =3D [[<br> Attempts to discover DICOM servers (DICOM Service Provider) through a parti= al C-ECHO request.<br> =C2=A0It also detects if the server allows any called Application Entity Ti= tle or not.<br> <br> The script responds with the message "Called AET check enabled" w= hen the association request<br> =C2=A0is rejected due configuration. This value can be bruteforced.<br> <br> C-ECHO requests are commonly known as DICOM ping as they are used to test c= onnectivity.<br> Normally, a 'DICOM ping' is formed as follows:<br> * Client -> A-ASSOCIATE request -> Server<br> * Server -> A-ASSOCIATE ACCEPT/REJECT -> Client<br> * Client -> C-ECHO request -> Server<br> * Server -> C-ECHO response -> Client<br> * Client -> A-RELEASE request -> Server<br> * Server -> A-RELEASE response -> Client<br> <br> For this script we only send the A-ASSOCIATE request and look for the succe= ss code<br> =C2=A0in the response as it seems to be a reliable way of detecting DICOM s= ervers.<br> ]]<br> <br> dicom-brute.nse<br> ++++++++++++++++++++<br> description =3D [[<br> Attempts to brute force the Application Entity Title of a DICOM server (DIC= OM Service Provider).<br> <br> Application Entity Titles (AET) are used to restrict responses only to clie= nts knowing the title. Hence,<br> =C2=A0the called AET is used as a form of password.<br> ]]<br> <br> ---<br> -- @usage nmap -p4242 --script dicom-brute <target><br> -- @usage nmap -sV --script dicom-brute <target><br> -- @usage nmap --script dicom-brute --script-args passdb=3Daets.txt <tar= get><br> -- <br> -- @output<br> -- PORT=C2=A0 =C2=A0 =C2=A0STATE SERVICE=C2=A0 =C2=A0 =C2=A0 =C2=A0 REASON<= br> -- 4242/tcp open=C2=A0 vrml-multi-use syn-ack<br> -- | dicom-brute: <br> -- |=C2=A0 =C2=A0Accounts: <br> -- |=C2=A0 =C2=A0 =C2=A0Called Application Entity Title:ORTHANC - Valid cre= dentials<br> -- |_=C2=A0 Statistics: Performed 5 guesses in 1 seconds, average tps: 5.0<= br> ---<br> <br> <br> [1] <a href=3D"https://svn.nmap.org/nmap/nselib/dicom.lua" rel=3D"noreferre= r" target=3D"_blank">https://svn.nmap.org/nmap/nselib/dicom.lua</a><br> [2] <a href=3D"https://svn.nmap.org/nmap/scripts/dicom-ping.nse" rel=3D"nor= eferrer" target=3D"_blank">https://svn.nmap.org/nmap/scripts/dicom-ping.nse= </a><br> [3] <a href=3D"https://svn.nmap.org/nmap/scripts/dicom-brute.nse" rel=3D"no= referrer" target=3D"_blank">https://svn.nmap.org/nmap/scripts/dicom-brute.n= se</a><br> <br> _______________________________________________<br> Sent through the dev mailing list<br> <a href=3D"https://nmap.org/mailman/listinfo/dev" rel=3D"noreferrer" target= =3D"_blank">https://nmap.org/mailman/listinfo/dev</a><br> Archived at <a href=3D"http://seclists.org/nmap-dev/" rel=3D"noreferrer" ta= rget=3D"_blank">http://seclists.org/nmap-dev/</a></blockquote></div> --000000000000aed771058f73502f-- --===============7506930099296533563== Content-Type: text/plain; charset="us-ascii" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit Content-Disposition: inline _______________________________________________ Sent through the dev mailing list https://nmap.org/mailman/listinfo/dev Archived at http://seclists.org/nmap-dev/ --===============7506930099296533563==--