Mailing List Archive: what's wrong with this

I'm writing up a policy compliance script... all it does is check to see if
the credentials provided can log into the box. They happen to be domain
credentials, and I'm trying to see if the box is on the domain. If not, it
elevates to critical.

desc["english"] = "
Synopsis :

This machine does not appear to be in the domain provided

Description :

This machine does not appear to be in the domain provided

Risk factor :

None / CVSS Base Score : 0
(AV:L/AC:H/Au:R/C:N/A:N/I:N/B:N)";

if(description)
{
script_id(30395);
script_version("$Revision: 1.9 $");
name["english"] = "Check for domain membership";

script_name(english:name["english"]);

script_description(english:desc["english"]);

summary["english"] = "Checks to see if the machine is in the domain
provided";

script_summary(english:summary["english"]);

script_category(ACT_GATHER_INFO);

script_copyright(english:"This script is borrowed heavily");
family["english"] = "Policy Compliance";
script_family(english:family["english"]);
script_dependencies("netbios_name_get.nasl",
"smb_login.nasl");
script_require_keys("SMB/transport", "SMB/name", "SMB/login",
"SMB/password");
script_require_ports (139,445);
exit(0);
}

include ("smb_func.inc");

name = kb_smb_name(); if(!name)exit(0);
login = kb_smb_login();
pass = kb_smb_password();
domain = kb_smb_domain();
port = kb_smb_transport();

if ( ! get_port_state(port) ) exit(0);
soc = open_sock_tcp(port);
if ( ! soc ) exit(0);

display("we're in the script and made it to the socket\n");

session_init(socket:soc, hostname:name);
r = NetUseAdd(login:login, password:pass, domain:domain, share:"IPC$");
NetUseDel();
if ( r != 1 )
{
report += string("\n\n", name, " doesn't appear to be on the domain",
domain);
report = string (desc["english"], report);
display("we couldn't login\n");
security_hole(port:port, data:report);
}

--
Doug Nordwall
Unix, Network, and Security Administrator
Noise proves nothing. Often a hen who has merely laid an egg cackles as if
she laid an asteroid. -- Mark Twain

Doug Nordwall wrote:
> I'm writing up a policy compliance script... all it does is check to see if
> the credentials provided can log into the box. They happen to be domain
> credentials, and I'm trying to see if the box is on the domain. If not, it
> elevates to critical.
>

This script can't work correctly due to the way smb_login.nasl works.

"SMB/login", "SMB/password" and "SMB/domain" have different values for:

- Correct domain credentials (including domain name)
- Correct domain credentials (but the domain name was wrong)
- Correct local credentials
- NULL session is valid

So if your host is not in the domain but has a local account with the
same login/password or if the host accepts NULL sessions (all Windows
systems do that) the connection to IPC$ will succeed and the host will
be considered as being part of the domain.

To make it work you should do a copy of smb_login.nasl and only keep the
domain credentials connection test :

supplied_login_is_correct = FALSE;

for ( i = 0 ; logins[i] && supplied_login_is_correct == FALSE ; i ++ )
{
user_login = logins[i];
user_password = passwords[i];
user_domain = domains[i];

if ((login(lg:user_login, pw:user_password, dom:user_domain) == TRUE )
&& ( session_is_guest() == 0 ))
{
supplied_login_is_correct = TRUE;
}
}

Nicolas
_______________________________________________
Plugins-writers mailing list
Plugins-writers@list.nessus.org
http://mail.nessus.org/mailman/listinfo/plugins-writers