tcp payloads (f210be93) · Commits · nimrod / masscan

src/proto-banner1.c

+18 −0

Original line number	Diff line number	Diff line
		@@ -141,7 +141,9 @@ banner1_parse(
		return tcb_state->app_proto;
		}


		/***************************************************************************
		* Create the --banners systems
		***************************************************************************/
		struct Banner1 *
		banner1_create(void)
		@@ -170,6 +172,22 @@ banner1_create(void)

		banner_http.init(b);

		b->tcp_payloads[80] = &banner_http;
		b->tcp_payloads[8080] = &banner_http;

		b->tcp_payloads[443] = &banner_ssl; /* HTTP/s */
		b->tcp_payloads[465] = &banner_ssl; /* SMTP/s */
		b->tcp_payloads[990] = &banner_ssl; /* FTP/s */
		b->tcp_payloads[993] = &banner_ssl; /* IMAP4/s */
		b->tcp_payloads[995] = &banner_ssl; /* POP3/s */
		b->tcp_payloads[2083] = &banner_ssl; /* cPanel - SSL */
		b->tcp_payloads[2087] = &banner_ssl; /* WHM - SSL */
		b->tcp_payloads[2096] = &banner_ssl; /* cPanel webmail - SSL */
		b->tcp_payloads[8443] = &banner_ssl; /* Plesk Control Panel - SSL */
		b->tcp_payloads[9050] = &banner_ssl; /* Tor */
		b->tcp_payloads[8140] = &banner_ssl; /* puppet */


		return b;
		}

src/proto-banner1.h

+4 −2

Original line number	Diff line number	Diff line
		@@ -12,10 +12,12 @@ struct Banner1
		struct SMACK *http_fields;
		struct SMACK *html_fields;

		unsigned char *http_header;
		unsigned http_header_length;
		/unsigned char http_header;
		unsigned http_header_length;*/
		unsigned is_capture_html:1;
		unsigned is_capture_cert:1;

		const struct ProtocolParserStream *tcp_payloads[65536];
		};

		struct SSL_SERVER_HELLO {

src/proto-http.c

+4 −3

Original line number	Diff line number	Diff line
		@@ -39,6 +39,8 @@ static struct Patterns html_fields[] = {
		{0,0,0,0}
		};

		extern struct ProtocolParserStream banner_http;



		/***************************************************************************
		@@ -184,9 +186,8 @@ http_init(struct Banner1 *b)
		html_fields[i].is_anchored);
		smack_compile(b->html_fields);

		b->http_header_length = sizeof(http_hello) - 1;
		b->http_header = (unsigned char *)malloc(b->http_header_length + 1);
		memcpy(b->http_header, http_hello, b->http_header_length + 1);
		banner_http.hello = (unsigned char*)malloc(banner_http.hello_length);
		memcpy((char*)banner_http.hello, http_hello, banner_http.hello_length);

		return b->http_fields;
		}

src/proto-tcp.c

+24 −29

Original line number	Diff line number	Diff line
		@@ -30,6 +30,12 @@
		uint64_t global_tcb_count;


		/***************************************************************************
		* A "TCP control block" is what most operating-systems/network-stack
		* calls the structure that corresponds to a TCP connection. It contains
		* things like the IP addresses, port numbers, sequence numbers, timers,
		* and other things.
		***************************************************************************/
		struct TCP_Control_Block
		{

		@@ -171,12 +177,17 @@ tcpcon_set_parameter(struct TCP_ConnectionTable *tcpcon,
		const void *value)
		{
		if (name_equals(name, "http-user-agent")) {
		tcpcon->banner1->http_header_length =
		http_change_field(&tcpcon->banner1->http_header,
		tcpcon->banner1->http_header_length,
		banner_http.hello_length = http_change_field(
		(unsigned char**)&banner_http.hello,
		(unsigned)banner_http.hello_length,
		"User-Agent:",
		(const unsigned char *)value,
		(unsigned)value_length);
		return;
		}

		if (name_equals(name, "tcp-payload")) {
		return;
		}
		}

		@@ -774,6 +785,7 @@ tcpcon_handle(struct TCP_ConnectionTable *tcpcon,
		unsigned seqno_them)
		{
		const unsigned char payload = (const unsigned char )vpayload;
		struct Banner1 *banner1 = tcpcon->banner1;

		if (tcb == NULL)
		return;
		@@ -838,32 +850,15 @@ tcpcon_handle(struct TCP_ConnectionTable *tcpcon,
		{
		size_t x_len = 0;
		const unsigned char *x;
		switch (tcb->port_them) {
		case 80:
		case 8080:
		x = tcpcon->banner1->http_header;
		x_len = tcpcon->banner1->http_header_length;
		break;
		case 443: /* HTTP/s */
		case 465: /* SMTP/s */
		case 990: /* FTP/s */
		case 993: /* IMAP4/s */
		case 995: /* POP3/s */
		case 2083: /* cPanel - SSL */
		case 2087: /* WHM - SSL */
		case 2096: /* cPanel webmail - SSL */
		case 8443: /* Plesk Control Panel - SSL */
		case 9050: /* Tor */
		case 8140: /* puppet */

		/* if we have a "hello" message to send to the server,
		* then send it */
		if (banner1->tcp_payloads[tcb->port_them]) {
		x_len = banner1->tcp_payloads[tcb->port_them]->hello_length;
		x = banner1->tcp_payloads[tcb->port_them]->hello;
		if (banner1->tcp_payloads[tcb->port_them] == &banner_ssl)
		tcb->banner1_state.is_sent_sslhello = 1;
		x = (const unsigned char *)banner_ssl.hello;
		x_len = banner_ssl.hello_length;
		break;
		default:
		x = 0;
		break;
		}
		if (x && x_len) {

		/* Send request. This actually doens't send the packet right
		* now, but instead queues up a packet that the transmit
		* thread will send soon. */

src/proto-tcp.h

+5 −0

Original line number	Diff line number	Diff line
		@@ -18,6 +18,11 @@ struct TCP_ConnectionTable;
		#define TCP_IS_RST(px,i) ((TCP_FLAGS(px,i) & 0x4) == 0x4)
		#define TCP_IS_FIN(px,i) ((TCP_FLAGS(px,i) & 0x1) == 0x1)

		/**
		* [KLUDGE] The 'tcpcon' module doens't have access to the main configuration,
		* so specific configuration options have to be sent to it using this
		* function.
		*/
		void
		tcpcon_set_parameter(struct TCP_ConnectionTable *tcpcon,
		const char *name,