编辑文件 - eppc-enum-processes.nse

✏️ 正在编辑: eppc-enum-processes.nse

路径: /usr/share/nmap/scripts/eppc-enum-processes.nse
提示: 您可以编辑任何文件（包括二进制文件），但请注意不当修改可能导致文件损坏。

local nmap      = require('nmap')
local shortport = require('shortport')
local stdnse    = require('stdnse')
local string    = require('string')
local tab       = require('tab')

description = [[
Attempts to enumerate process info over the Apple Remote Event protocol.
When accessing an application over the Apple Remote Event protocol the
service responds with the uid and pid of the application, if it is running,
prior to requesting authentication.
]]

author = "Patrik Karlsson"
license = "Same as Nmap--See https://nmap.org/book/man-legal.html"
categories = {"discovery", "safe"}

portrule = shortport.port_or_service(3031, "eppc", "tcp", "open")

action = function( host, port )

local socket = nmap.new_socket()
  socket:set_timeout(5000)

local try = nmap.new_try(
    function()
      stdnse.debug1("failed")
      socket:close()
    end
  )

-- a list of application that may or may not be running on the target
  local apps = {
    "Address Book",
    "App Store",
    "Facetime",
    "Finder",
    "Firefox",
    "Google Chrome",
    "iChat",
    "iPhoto",
    "Keychain Access",
    "iTunes",
    "Photo booth",
    "QuickTime Player",
    "Remote Buddy",
    "Safari",
    "Spotify",
    "Terminal",
    "TextMate",
    "Transmission",
    "VLC",
    "VLC media player",
  }

local results = tab.new(3)
  tab.addrow( results, "application", "uid", "pid" )

for _, app in ipairs(apps) do
    try( socket:connect(host, port, "tcp") )
    local data

local packets = {
      "PPCT\0\0\0\1\0\0\0\1",
      -- unfortunately I've found no packet specifications, so this has to do
      stdnse.fromhex("e44c50525401e101")
      .. string.pack("Bs1", 225 + #app, app)
      .. stdnse.fromhex("dfdbe302013ddfdfdfdfd500"),
    }

for _, v in ipairs(packets) do
      try( socket:send(v) )
      data = try( socket:receive() )
    end

local uid, pid = data:match("uid=(%d+)&pid=(%d+)")
    if ( uid and pid ) then tab.addrow( results, app, uid, pid ) end

try( socket:close() )
  end

return "\n" .. tab.dump(results)

end

← 返回文件管理器