Nmap Development mailing list archives
Re: [nmap-svn] r32457 - nmap/scripts
From: Daniel Miller <bonsaiviking () gmail com>
Date: Wed, 23 Oct 2013 13:07:40 -0500
On 10/23/2013 12:45 PM, commit-mailer () nmap org wrote:
Author: dmiller Date: Wed Oct 23 17:45:48 2013 New Revision: 32457 Log: Add rfc868-time.nse, queries a Time protocol server Added: nmap/scripts/rfc868-time.nse Added: nmap/scripts/rfc868-time.nse ============================================================================== --- (empty file) +++ nmap/scripts/rfc868-time.nse Wed Oct 23 17:45:48 2013 @@ -0,0 +1,61 @@ +local comm = require "comm" +local shortport = require "shortport" +local stdnse = require "stdnse" +local bin = require "bin" +local nmap = require "nmap" +local os = require "os" + +description = [[ +Retrieves the day and time from the Time service. +]] + +--- +-- @output +-- PORT STATE SERVICE +-- 37/tcp open time +-- |_rfc868-time: 2013-10-23T10:33:00 + +author = "Daniel Miller" + +license = "Same as Nmap--See http://nmap.org/book/man-legal.html" + +categories = {"discovery", "safe", "version"} + + +portrule = shortport.port_or_service(37, "time", {"tcp", "udp"}) + +action = function(host, port) + local status, result = comm.exchange(host, port, "", {bytes=4, proto=port.protocol}) + + if status then + local _, stamp + local width = #result + if width == 4 then + _, stamp = bin.unpack(">I", result) + port.version.extrainfo = "32 bits" + elseif width == 8 then + _, stamp = bin.unpack(">I", result) + port.version.extrainfo = "64 bits" + else + stdnse.print_debug(1, "Odd response: %s", stdnse.filename_escape(response)) + return nil + end + + -- RFC 868 epoch is Jan 1, 1900 + stamp = stamp - 2208988800 + + -- Make sure we don't stomp a more-likely service detection. + if port.version.name == "time" then + local diff = os.difftime(stamp,os.time()) + if diff < 0 then diff = -diff end + -- confidence decreases by 1 for each year the time is off. + stdnse.print_debug(1, "Time difference: %d seconds (%0.2f years)", diff, diff / 31556926) + local confidence = 10 - diff / 31556926 + if confidence < 0 then confidence = 0 end + port.version.name_confidence = confidence + nmap.set_port_version(host, port, "hardmatched") + end + + return stdnse.format_timestamp(stamp) + end +end _______________________________________________ Sent through the svn mailing list http://nmap.org/mailman/listinfo/svn
Hi, List,This script pulls the date from an RFC 868 Time Protocol server. It's a bit tricky because the time is an unsigned integer number of seconds since 1900. This means that it will wrap in 2036, 2 years before the signed 32-bit Unix timestamp will wrap. Version detection is similarly tricky, because it depends on the current date and on the server being set to something reasonable. Here's some old discussion: http://hcsw.org/blog.pl?a=4&b=4
Let this also serve as a reminder that the nmap-service-probes file should be updated at each release! The current lines only match times through November 2014.
Dan _______________________________________________ Sent through the dev mailing list http://nmap.org/mailman/listinfo/dev Archived at http://seclists.org/nmap-dev/
Current thread:
- Re: [nmap-svn] r32457 - nmap/scripts Daniel Miller (Oct 23)
- Re: [nmap-svn] r32457 - nmap/scripts Fyodor (Oct 29)