vulnersCom/nmap-vulners v2.0.2

nmap-vulners 2.0.2

on GitHub

A correctness release for one thing: the banner this script reads out of nmap's
service fingerprint. If your targets answer with plain ASCII banners, nothing
changes. If any of them answer with a backslash or a NUL byte - Windows paths
in error pages, and most binary protocols - the identity this script derives
from that banner was wrong, and now is not.

When nmap's own probes cannot name a service, nmap records what came back in
port.version.service_fp, and this script reads the banner out of it. The
payload in there is escaped as a ready-made regex: the quote, both parens, the
dot and the backslash each take a backslash, a space becomes \x20, a NUL
becomes \0.

Undoing that took four sequential substitution passes. That is wrong for any
payload containing a literal backslash, because nmap writes one as two, and the
pass meant for \t reads the second half of the pair together with the letter
after it:

That string is matched against version rules and sent to the API as the
software text to look up, so a fabricated digit or bracket is a fabricated
identity. This was found by review, not by a report from the field.

One left-to-right pass, stated as a PEG, compiled once when the script loads.
The grammar is nmap's own, out of nselib/lpeg-utility.

What is not borrowed from that library is how it applies its own grammar.
Both of these reproduce on nmap 7.991:

• parse_fp and get_response unescape twice. They run escaped_quote(),
  which already halves a doubled backslash, and then run unescape over the
  result - so a backslash that was data is read a second time as the start of
  an escape. Each stage is correct alone. Composed, back\slash comes back as
  backslash and C:\temp as C: plus a TAB. It is visible in nmap's own
  shipped output: fingerprint-strings prints backslash for a service that
  really sent back\slash.
• unescape raises on a short hex escape. It accepts \x with fewer than
  two hex digits, and string.char(tonumber("", 16)) then throws. In NSE a
  raising script does not lose one value - nmap replaces every finding on that
  port with "Script execution failed". The grammar here requires exactly two.

The report, the matcher, the catalogue and every request this script makes are
untouched. api_version stays 2.0: it names the request generation the
service sees, not the release, and no request changed shape.

curl -fsSL https://raw.githubusercontent.com/vulnersCom/nmap-vulners/master/install.sh | sh

PowerShell, as Administrator:

irm https://raw.githubusercontent.com/vulnersCom/nmap-vulners/master/install.ps1 | iex

Full Changelog: v2.0.1...v2.0.2