Bill Petersen wrote:
I would like to run a simple test against a group of systems.
I want to only test for
1. No passwords for ids like root, oracle, mysql, etc.
2. Default userid & passwords (like oracle's scott/tiger)
You could base yourself on the plugins that currently exist. Check out
default_account.inc and the NASL plugins that include it (most of the
account_XXX.nasl plugins do). It should be rather easy to base a
plugin that covers your specific needs with that.
Regards
Javier
#
# This script was written by Javier Fernandez-Sanguino
# based on a script written by Renaud Deraison <[EMAIL PROTECTED]>
#
# See the Nessus Scripts License for details
#
if(description)
{
script_id(99999);
script_cve_id("CAN-1999-0508");
script_version ("$Revision: x.x $");
name["english"] = "Cisco default password";
script_name(english:name["english"]);
desc["english"] = "
The remote CISCO router has a default password set.
This allows an attacker to get a lot information
about your network, and possibly to shut it down if
the 'enable' password is not set either or is also a default
password.
Solution : access this device and set a password using
enable secret
Risk factor : High";
script_description(english:desc["english"]);
summary["english"] = "Checks for a default password";
script_summary(english:summary["english"]);
script_category(ACT_GATHER_INFO);
script_copyright(english:"This script is Copyright (C) 2001 Renaud Deraison",
francais:"Ce script est Copyright (C) 2001 Renaud Deraison");
family["english"] = "CISCO";
family["francais"] = "CISCO";
script_family(english:family["english"], francais:family["francais"]);
script_dependencie("find_service.nes");
script_require_ports("Services/telnet", 23);
exit(0);
}
# We need telnet_func.inc for the get_telnet_banner() function
include telnet_func.inc
# Function to connect to a Cisco system through telnet, send
# a passwword
function check_cisco_telnet(login, password, port)
{
soc = open_sock_tcp(port);
msg = telnet_negotiate(socket:soc);
if(strlen(msg))
{
# The Cisco device might be using an AAA access model
# or have configured users:
if ( "sername:" >!< banner || "ogin:" >!< banner ) {
send(socket:soc, data:string(login, "\r\n"));
msg=recv(socket:soc, length:4096);
}
# Device can answer back with {P,p}assword or {P,p}asscode
# if we don't get it then fail
if ( "assword:" >!< msg || "asscode:" >!< msg ) {
close(soc);
return(0);
}
send(socket:soc, data:string(password, "\r\n"));
r = recv(socket:soc, length:4096);
# TODO: could check for Cisco's prompt here, it is typically
# the device name followed by '>'
# But the actual regexp is quite complex, from Net-Telnet-Cisco:
#
'/(?m:^[\r\b]?[\w.-]+\s?(?:\(config[^\)]*\))?\s?[\$\#>]\s?(?:\(enable\))?\s*$)/')
# Send a 'show ver', most users (regardless of privilege level)
# should be able to do this
send(socket:soc, data:string("show ver\r\n"));
r = recv(socket:soc, length:4096);
# TODO: This is probably not generic enough. Some Cisco devices don't
# use IOS but CatOS for example
if("Cisco Internetwork Operating System Software" >< r) security_hole(port);
# TODO: it could also try 'enable' here and see if it's capable
# of accessing the priviledge mode with the same password, or do it
# in a separate module
close(soc);
}
}
# Functions modified from the code available from default_accounts.inc
# (which is biased to UNIX)
function check_cisco_account(login, password)
{
local_var port, ret, banner, soc, res;
if ( defined_func("bn_random") )
{
# Prefer login thru SSH rather than telnet
port = get_kb_item("Services/ssh");
if ( ! port ) port = 22;
banner = get_kb_item("SSH/banner/" + port);
# GoodTech SSH server does not respect SSH protocol ...
if (banner && ("cryptlib" >!< banner))
{
soc = open_sock_tcp(port);
if ( soc )
{
ret = ssh_login(socket:soc, login:account, password:password);
close(soc);
if ( ret == 0 ) return port;
#else return 0;
}
}
}
port = get_kb_item("Services/telnet");
if(!port) port = 23;
if(get_port_state(port))
{
if ( isnull(password) ) password = "";
banner = get_telnet_banner(port:port);
# Check for banner, covers the case of Cisco telnet as well as the case
# of a console server to a Cisco port
# Note: banners of cisco systems are not necesarily set, so this
# might lead to FP!
if ( ! banner || "User Access Verification" >!< banner and ! banner || "Enter
password:" >!< banner)
return(0);
res = check_cisco_telnet(login:login, password:password, port:port);
if(res)
return(port);
}
return(0);
}
# Try with a blank password first
check_cisco_account(login:"", password:"", port:port);
# Test default access cisco/cisco
check_cisco_account(login:"cisco", password:"cisco", port:port);
# Or admin/cisco:
# TODO: this will make it generate if the device does not have
# users and the password is just "cisco"
check_cisco_account(login:"admin", password:"cisco", port:port);
# Another one (for Cisco Arrowpoint)
check_cisco_account(login:"admin", password:"system", port:port);
# Maybe some more?
check_cisco_account(login:"monitor", password:"monitor", port:port);
_______________________________________________
Nessus mailing list
[email protected]
http://mail.nessus.org/mailman/listinfo/nessus
