Chapter 14: Exploiting Vulnerabilities with the Nmap Scripting Engine

While Nmap has never tried to become an exploitation framework, it does have several features that make it a viable option. Transparent parallelism in network I/O operations allows speed and efficiency. Quick prototyping in Lua allows exploit writers to work with protocols or applications having many Nmap Scripting Engine (NSE) libraries available to save development time. NSE scripts will be ready to run on any system that can run Nmap. And they can run against entire network ranges or large lists of targets, making them ideal for vulnerability detection.

Hopefully, the previous chapter introduced you to the NSE script format, common functions, and libraries. This chapter will teach you how to apply that to vulnerability detection and exploitation within Nmap.

In this chapter, you will learn about the following:

• Generating vulnerability reports in NSE scripts
• Writing brute-force password auditing...

Generating vulnerability reports in NSE scripts

NSE is perfect for detecting vulnerabilities, and for this reason, there are already several exploitation scripts included with Nmap. Not too long ago, each developer used their criteria for what output to include when reporting these vulnerabilities. To address this issue and unify the output format and the amount of information provided, a new NSE library was introduced.

This recipe will teach you how to generate vulnerability reports in your NSE scripts with the vulns library.

How to do it...

The correct way to report vulnerabilities in NSE is through the vulns library. Let's review the process of reporting a vulnerability:

1. Load the vulns library in your script:

   local vulns = require 'vulns'

2. Create a vuln object table. Pay special attention to the state field:

   local vuln = { 
    title = '<TITLE GOES HERE>',
    state = vulns.STATE.NOT_VULN, 
    references = {'<URL1>', &apos...

Writing brute-force password auditing scripts

Brute-force password auditing has become a major strength of NSE. The brute library allows developers to quickly write scripts to perform custom brute-force attacks. Nmap offers libraries such as unpwd, which gives access to a flexible username and password database to further customize attacks, and the creds library, which provides an interface to manage the valid credentials found.

This recipe will guide you through the process of writing your brute-force script with the brute, unpwdb, and creds NSE libraries to perform brute-force password auditing on web applications.

How to do it...

Let's write an NSE script to brute-force WordPress accounts:

1. Create the http-wordpress-brute.nse file and fill in the required information tags:

   description = [[
   performs brute force password auditing against Wordpress CMS/blog installations.
   This script uses the unpwdb and brute libraries to perform password guessing. Any successful...

Crawling web servers to detect vulnerabilities

When assessing the security of web applications, certain checks need to be done on every file in a web server. For example, looking for forgotten backup files may reveal the application source code or database passwords. NSE supports web crawling, to help us with tasks that require a list of existing files on a web server.

This recipe will show you how to write an NSE script that will crawl a web server looking for files with a .php extension and perform an injection test via the $_SERVER['PHP_SELF'] variable to find reflected cross-site scripting vulnerabilities.

How to do it...

A common task that some major security scanners miss is locating reflected cross-site scripting vulnerabilities in PHP files via the $_SERVER['PHP_SELF'] variable. The web crawler httpspider library comes in handy when automating this task. Let's see how we can write a script:

1. Create the http-phpself-xss.nse script file...

Exploiting SMB vulnerabilities

NSE allows quick prototyping of proof-of-concept code to exploit a vulnerability due to the robust libraries available for protocols and applications. SMB has been heavily attacked in the past due to the amount of public critical vulnerabilities that surfaced. Since Nmap has a library for SMB, we can use it for crafting special packets and writing exploits easily.

This recipe will teach you how to write a vulnerability detection script for the infamous SMB vulnerability known as EternalBlue (MS17-010).

How to do it...

1. Start by writing the mandatory fields such as description, author, license, and categories, and loading the required libraries for SMB and other common tasks:

   local nmap = require 'nmap'
   local smb = require 'smb'
   local vulns = require 'vulns'
   local stdnse = require 'stdnse'
   local string = require 'string'

2. Create a function to encapsulate the code related to checking the vulnerability...