Gecko [ lostrivercommunitycenter.com ]

Name	Size	Permission	Date
data	[ DIR ]	drwxr-xr-x	2025-12-23 02:50
afp.lua	73.07 KB	-rw-r--r--	2025-12-18 12:48
ajp.lua	16.66 KB	-rw-r--r--	2025-12-18 12:48
amqp.lua	10.41 KB	-rw-r--r--	2025-12-18 12:48
anyconnect.lua	4.31 KB	-rw-r--r--	2025-12-18 12:48
asn1.lua	14.57 KB	-rw-r--r--	2025-12-18 12:48
base32.lua	7.33 KB	-rw-r--r--	2025-12-18 12:48
base64.lua	5.83 KB	-rw-r--r--	2025-12-18 12:48
bin.lua	13.07 KB	-rw-r--r--	2025-12-18 12:48
bitcoin.lua	18.25 KB	-rw-r--r--	2025-12-18 12:48
bits.lua	2.54 KB	-rw-r--r--	2025-12-18 12:48
bittorrent.lua	35.76 KB	-rw-r--r--	2025-12-18 12:48
bjnp.lua	9.55 KB	-rw-r--r--	2025-12-18 12:48
brute.lua	50.74 KB	-rw-r--r--	2025-12-18 12:48
cassandra.lua	5.48 KB	-rw-r--r--	2025-12-18 12:48
citrixxml.lua	16.15 KB	-rw-r--r--	2025-12-18 12:48
coap.lua	75.1 KB	-rw-r--r--	2025-12-18 12:48
comm.lua	11.03 KB	-rw-r--r--	2025-12-18 12:48
creds.lua	18.26 KB	-rw-r--r--	2025-12-18 12:48
cvs.lua	3.05 KB	-rw-r--r--	2025-12-18 12:48
datafiles.lua	11.05 KB	-rw-r--r--	2025-12-18 12:48
datetime.lua	8.06 KB	-rw-r--r--	2025-12-18 12:48
dhcp.lua	28.58 KB	-rw-r--r--	2025-12-18 12:48
dhcp6.lua	19.85 KB	-rw-r--r--	2025-12-18 12:48
dicom.lua	10.49 KB	-rw-r--r--	2025-12-18 12:48
dns.lua	51.07 KB	-rw-r--r--	2025-12-18 12:48
dnsbl.lua	19.01 KB	-rw-r--r--	2025-12-18 12:48
dnssd.lua	12.61 KB	-rw-r--r--	2025-12-18 12:48
drda.lua	24.08 KB	-rw-r--r--	2025-12-18 12:48
eap.lua	7.54 KB	-rw-r--r--	2025-12-18 12:48
eigrp.lua	12.98 KB	-rw-r--r--	2025-12-18 12:48
formulas.lua	5.69 KB	-rw-r--r--	2025-12-18 12:48
ftp.lua	9.03 KB	-rw-r--r--	2025-12-18 12:48
geoip.lua	3.14 KB	-rw-r--r--	2025-12-18 12:48
giop.lua	18.42 KB	-rw-r--r--	2025-12-18 12:48
gps.lua	3.38 KB	-rw-r--r--	2025-12-18 12:48
http.lua	117.73 KB	-rw-r--r--	2025-12-18 12:48
httpspider.lua	36.73 KB	-rw-r--r--	2025-12-18 12:48
iax2.lua	9.54 KB	-rw-r--r--	2025-12-18 12:48
idna.lua	17.14 KB	-rw-r--r--	2025-12-18 12:48
ike.lua	14.63 KB	-rw-r--r--	2025-12-18 12:48
imap.lua	9.59 KB	-rw-r--r--	2025-12-18 12:48
informix.lua	39.93 KB	-rw-r--r--	2025-12-18 12:48
ipOps.lua	29.14 KB	-rw-r--r--	2025-12-18 12:48
ipmi.lua	8.08 KB	-rw-r--r--	2025-12-18 12:48
ipp.lua	12.56 KB	-rw-r--r--	2025-12-18 12:48
irc.lua	757 B	-rw-r--r--	2025-12-18 12:48
iscsi.lua	21.38 KB	-rw-r--r--	2025-12-18 12:48
isns.lua	14.98 KB	-rw-r--r--	2025-12-18 12:48
jdwp.lua	43.52 KB	-rw-r--r--	2025-12-18 12:48
json.lua	11.91 KB	-rw-r--r--	2025-12-18 12:48
knx.lua	2.42 KB	-rw-r--r--	2025-12-18 12:48
ldap.lua	32 KB	-rw-r--r--	2025-12-18 12:48
lfs.luadoc	1.68 KB	-rw-r--r--	2025-12-18 12:48
libssh2-utility.lua	4.69 KB	-rw-r--r--	2025-12-18 12:48
libssh2.luadoc	4.75 KB	-rw-r--r--	2025-12-18 12:48
listop.lua	4.66 KB	-rw-r--r--	2025-12-18 12:48
lpeg-utility.lua	5.64 KB	-rw-r--r--	2025-12-18 12:48
lpeg.luadoc	351 B	-rw-r--r--	2025-12-18 12:48
ls.lua	10.96 KB	-rw-r--r--	2025-12-18 12:48
match.lua	2.05 KB	-rw-r--r--	2025-12-18 12:48
membase.lua	9.93 KB	-rw-r--r--	2025-12-18 12:48
mobileme.lua	8.46 KB	-rw-r--r--	2025-12-18 12:48
mongodb.lua	21.47 KB	-rw-r--r--	2025-12-18 12:48
mqtt.lua	28.74 KB	-rw-r--r--	2025-12-18 12:48
msrpc.lua	190.11 KB	-rw-r--r--	2025-12-18 12:48
msrpcperformance.lua	29.65 KB	-rw-r--r--	2025-12-18 12:48
msrpctypes.lua	168.74 KB	-rw-r--r--	2025-12-18 12:48
mssql.lua	113.78 KB	-rw-r--r--	2025-12-18 12:48
multicast.lua	5.97 KB	-rw-r--r--	2025-12-18 12:48
mysql.lua	16.04 KB	-rw-r--r--	2025-12-18 12:48
natpmp.lua	5.11 KB	-rw-r--r--	2025-12-18 12:48
nbd.lua	16.04 KB	-rw-r--r--	2025-12-18 12:48
ncp.lua	35.64 KB	-rw-r--r--	2025-12-18 12:48
ndmp.lua	11.43 KB	-rw-r--r--	2025-12-18 12:48
netbios.lua	14.51 KB	-rw-r--r--	2025-12-18 12:48
nmap.luadoc	40.34 KB	-rw-r--r--	2025-12-18 12:48
nrpc.lua	4.46 KB	-rw-r--r--	2025-12-18 12:48
nsedebug.lua	3.49 KB	-rw-r--r--	2025-12-18 12:48
omp2.lua	4.78 KB	-rw-r--r--	2025-12-18 12:48
oops.lua	3.61 KB	-rw-r--r--	2025-12-18 12:48
openssl.luadoc	7.5 KB	-rw-r--r--	2025-12-18 12:48
ospf.lua	15.29 KB	-rw-r--r--	2025-12-18 12:48
outlib.lua	2.09 KB	-rw-r--r--	2025-12-18 12:48
packet.lua	36.54 KB	-rw-r--r--	2025-12-18 12:48
pcre.luadoc	6.79 KB	-rw-r--r--	2025-12-18 12:48
pgsql.lua	20.6 KB	-rw-r--r--	2025-12-18 12:48
pop3.lua	5.74 KB	-rw-r--r--	2025-12-18 12:48
pppoe.lua	29.42 KB	-rw-r--r--	2025-12-18 12:48
proxy.lua	11.37 KB	-rw-r--r--	2025-12-18 12:48
punycode.lua	11.5 KB	-rw-r--r--	2025-12-18 12:48
rand.lua	2.7 KB	-rw-r--r--	2025-12-18 12:48
rdp.lua	14.73 KB	-rw-r--r--	2025-12-18 12:48
re.lua	8.22 KB	-rw-r--r--	2025-12-18 12:48
redis.lua	3.61 KB	-rw-r--r--	2025-12-18 12:48
rmi.lua	47.77 KB	-rw-r--r--	2025-12-18 12:48
rpc.lua	107.75 KB	-rw-r--r--	2025-12-18 12:48
rpcap.lua	11.08 KB	-rw-r--r--	2025-12-18 12:48
rsync.lua	5.21 KB	-rw-r--r--	2025-12-18 12:48
rtsp.lua	8.66 KB	-rw-r--r--	2025-12-18 12:48
sasl.lua	16.51 KB	-rw-r--r--	2025-12-18 12:48
shortport.lua	12.83 KB	-rw-r--r--	2025-12-18 12:48
sip.lua	30.07 KB	-rw-r--r--	2025-12-18 12:48
slaxml.lua	17.9 KB	-rw-r--r--	2025-12-18 12:48
smb.lua	176.62 KB	-rw-r--r--	2025-12-18 12:48
smb2.lua	16.12 KB	-rw-r--r--	2025-12-18 12:48
smbauth.lua	37.33 KB	-rw-r--r--	2025-12-18 12:48
smtp.lua	19.85 KB	-rw-r--r--	2025-12-18 12:48
snmp.lua	17.24 KB	-rw-r--r--	2025-12-18 12:48
socks.lua	8.25 KB	-rw-r--r--	2025-12-18 12:48
srvloc.lua	10.99 KB	-rw-r--r--	2025-12-18 12:48
ssh1.lua	9.15 KB	-rw-r--r--	2025-12-18 12:48
ssh2.lua	13.44 KB	-rw-r--r--	2025-12-18 12:48
sslcert.lua	36.17 KB	-rw-r--r--	2025-12-18 12:48
sslv2.lua	9.68 KB	-rw-r--r--	2025-12-18 12:48
stdnse.lua	32.67 KB	-rw-r--r--	2025-12-18 12:48
strbuf.lua	4.52 KB	-rw-r--r--	2025-12-18 12:48
strict.lua	2.53 KB	-rw-r--r--	2025-12-18 12:48
stringaux.lua	4.35 KB	-rw-r--r--	2025-12-18 12:48
stun.lua	11.08 KB	-rw-r--r--	2025-12-18 12:48
tab.lua	3.35 KB	-rw-r--r--	2025-12-18 12:48
tableaux.lua	2.06 KB	-rw-r--r--	2025-12-18 12:48
target.lua	3.93 KB	-rw-r--r--	2025-12-18 12:48
tftp.lua	9.41 KB	-rw-r--r--	2025-12-18 12:48
tls.lua	69.24 KB	-rw-r--r--	2025-12-18 12:48
tn3270.lua	46.99 KB	-rw-r--r--	2025-12-18 12:48
tns.lua	63.35 KB	-rw-r--r--	2025-12-18 12:48
unicode.lua	14.23 KB	-rw-r--r--	2025-12-18 12:48
unittest.lua	12.42 KB	-rw-r--r--	2025-12-18 12:48
unpwdb.lua	10.52 KB	-rw-r--r--	2025-12-18 12:48
upnp.lua	11.18 KB	-rw-r--r--	2025-12-18 12:48
url.lua	16.54 KB	-rw-r--r--	2025-12-18 12:48
versant.lua	8.58 KB	-rw-r--r--	2025-12-18 12:48
vnc.lua	25.55 KB	-rw-r--r--	2025-12-18 12:48
vulns.lua	76.45 KB	-rw-r--r--	2025-12-18 12:48
vuzedht.lua	16.21 KB	-rw-r--r--	2025-12-18 12:48
wsdd.lua	11.98 KB	-rw-r--r--	2025-12-18 12:48
xdmcp.lua	12.09 KB	-rw-r--r--	2025-12-18 12:48
xmpp.lua	15.91 KB	-rw-r--r--	2025-12-18 12:48
zlib.luadoc	4.88 KB	-rw-r--r--	2025-12-18 12:48

Rename

---
-- A module implementing IPMI protocol (the code is a porting of the Metasploit ipmi scanner:
-- https://github.com/rapid7/metasploit-framework/tree/master/modules/auxiliary/scanner/ipmi)
--
-- @class module
-- @name ipmi
-- @author "Claudiu Perta <claudiu.perta@gmail.com>"
local stdnse = require "stdnse"
local string = require "string"
local rand = require "rand"

_ENV = stdnse.module("ipmi", stdnse.seeall)

local HAVE_SSL, openssl = pcall(require,"openssl")

PAYLOADS = {
  ["IPMI"] = 0,
  ["PAYLOAD_SOL"]  = 1,
  ["RMCPPLUSOPEN_REQ"] = 0x10,
  ["RMCPPLUSOPEN_REP"] = 0x11,
  ["RAKP1"] = 0x12,
  ["RAKP2"] = 0x13,
  ["RAKP3"] = 0x14,
  ["RAKP4"] = 0x15,
}

RMCP_ERRORS = {
  [1] = "Insufficient resources to create new session \
         (wait for existing sessions to timeout)",

-- Shouldn't occur.
  [2] = "Invalid Session ID",

-- Shouldn't occur.
  [3] = "Invalid payload type",

-- If these happen, we need to enhance our mechanism for detecting
  -- supported auth algorithms.
  [4] = "Invalid authentication algorithm",
  [5] = "Invalid integrity algorithm",

[6] = "No matching authentication payload",
  [7] = "No matching integrity payload",

-- This suggests the session was timed out while trying to negotiate,
  -- shouldn't happen.
  [8] = "Inactive Session ID",

[9] = "Invalid role",
  [0xa] = "Unauthorised role or privilege level requested",
  [0xb] = "Insufficient resources to create a session at the requested role",
  [0xc] = "Invalid username length",
  [0xd] = "Unauthorized name",
  [0xe] = "Unauthorized GUID",
  [0xf] = "Invalid integrity check value",
  [0x10] = "Invalid confidentiality algorithm",
  [0x11] = "No cipher suite match with proposed security algorithms",

-- Never observed, most likely a bug in xCAT or IPMI device.
  [0x12] = "Illegal or unrecognized parameter",
}

channel_auth_request = function()
  return (
    "\x06\x00\xff\x07" .. -- Header
    "\x00\x00\x00\x00" ..
    "\x00\x00\x00\x00\x00\x09\x20\x18" ..
    "\xc8\x81\x00\x38\x8e\x04\xb5"
    )
end

rmcpplus_header = function (payload_type)
  return (
    "\x06\x00\xff\x07" ..           -- RMCP Header
    "\x06" ..                       -- RMCP+ Authentication Type
    string.char(PAYLOADS[payload_type]) .. -- Payload Type
    "\x00\x00\x00\x00" ..           -- Session ID
    "\x00\x00\x00\x00"            -- Sequence Number
    )
end

-- Open rmcpplus_request
session_open_request = function(console_session_id)
  local data = (
    "\x00\x00" .. -- Maximum Access
    "\x00\x00" .. -- Reserved
    console_session_id ..
    "\x00\x00\x00\x08" ..
    "\x01\x00\x00\x00" ..
    "\x01\x00\x00\x08" ..
    "\x01\x00\x00\x00" .. -- HMAC-SHA1
    "\x02\x00\x00\x08" ..
    "\x01\x00\x00\x00"  -- AES Encryption
    )

return rmcpplus_header("RMCPPLUSOPEN_REQ") .. string.pack("<s2", data)
end

-- Open rmcpplus_request
session_open_cipher_zero_request = function(console_session_id)
  console_session_id = console_session_id or rand.random_string(4)

local data = (
    "\x00\x00" .. -- Maximum Access
    "\x00\x00" .. -- Reserved
    console_session_id ..
    "\x00\x00\x00\x08" ..
    "\x00\x00\x00\x00" .. -- Cipher-zero
    "\x01\x00\x00\x08" ..
    "\x00\x00\x00\x00" .. -- Cipher-zero
    "\x02\x00\x00\x08" ..
    "\x00\x00\x00\x00"  -- No Encryption
    )

return rmcpplus_header("RMCPPLUSOPEN_REQ") .. string.pack("<s2", data)
end

rakp_1_request = function(bmc_session_id, console_random_id, username)
  local data = string.pack(
    "<Bxxx I c16 Bxx s1",
    0,                       -- Message Tag
    bmc_session_id,
    console_random_id,
    0x14,                       -- Privilege level
    username
    )

return rmcpplus_header("RAKP1") .. string.pack("<s2", data)
end

rakp_hmac_sha1_salt = function(
    console_session_id,
    bmc_session_id,
    console_random_id,
    bmc_random_id,
    bmc_guid,
    authorization_level,
    username)

local salt = string.pack(
    "c4 I c16c16c16 Bs1",
    console_session_id,
    bmc_session_id,
    console_random_id,
    bmc_random_id,
    bmc_guid,
    authorization_level,
    username
    )

return salt

end

verify_rakp_hmac_sha1 = function(salt, hash, password)
  if not(HAVE_SSL) then
    return false
  end

local digest = openssl.hmac('sha1', password, salt)
  return (digest == hash)
end

--[[
Multi-byte fields in RMCP/ASF fields are specified as being transmitted in
'Network Byte Order' - meaning most-significant byte first.
RMCP and ASF-specified fields are therefore transferred most-significant byte
first.
The IPMI convention is to transfer multi-byte numeric fields least-significant
Byte first. Therefore, unless otherwise specified:
Data in the IPMI Session Header and IPMI Message fields are transmitted
least-significant byte first.
--]]

parse_channel_auth_reply = function(reply)
  local data = {}
  local pos = 1
  local value

data.rmcp_version,
  data.rmcp_padding,
  data.rmcp_sequence,
  value, pos = string.unpack("<BBBB", reply, pos)

data.rmcp_mtype = ((value & 0x80) ~= 0)
  data.rmcp_class = (value & 0x7F)

data.session_auth_type,
  data.session_sequence,
  data.session_id,
  data.message_length,
  data.ipmi_tgt_address,
  data.ipmi_tgt_lun,
  data.ipmi_header_checksum,
  data.ipmi_src_address,
  data.ipmi_src_lun,
  data.ipmi_command,
  data.ipmi_completion_code,
  data.ipmi_channel,
  value, pos = string.unpack("<BI4I4BBBBBBBBBB", reply, pos)

data.ipmi_compat_20 = ((value & 0x80) ~= 0)
  data.ipmi_compat_reserved1 = ((value & 0x40) ~= 0)
  data.ipmi_compat_oem_auth = ((value & 0x20) ~= 0)
  data.ipmi_compat_password = ((value & 0x10) ~= 0)
  data.ipmi_compat_reserved2 = ((value & 0x08) ~= 0)
  data.ipmi_compat_md5 = ((value & 0x04) ~= 0)
  data.ipmi_compat_md2 = ((value & 0x02) ~= 0)
  data.ipmi_compat_none = ((value & 0x01) ~= 0)

value, pos = string.unpack("B", reply, pos)
  data.ipmi_user_reserved1 = ((value >> 6) & 0x03)
  data.ipmi_user_kg = ((value & 0x20) ~= 0)
  data.ipmi_user_disable_message_auth = ((value & 0x10) ~= 0)
  data.ipmi_user_disable_user_auth = ((value & 0x08) ~= 0)
  data.ipmi_user_non_null = ((value & 0x04) ~= 0)
  data.ipmi_user_null = ((value & 0x02) ~= 0)
  data.ipmi_user_anonymous = ((value & 0x01) ~= 0)

value, pos = string.unpack("B", reply, pos)
  data.ipmi_conn_reserved1 = ((value >> 2) & 0x3F)
  data.ipmi_conn_20 = ((value & 0x02) ~= 0)
  data.ipmi_conn_15 = ((value & 0x01) ~= 0)

-- 24 bits OEMID
  data.ipmi_oem_id, pos = string.unpack("<I3", reply, pos)
  data.ipmi_oem_data = reply:sub(pos)

return data
end

parse_open_session_reply = function(reply)
  local data = {}
  local pos = 1
  local value

-- 4 bytes Header
  data.rmcp_version,
  data.rmcp_padding,
  data.rmcp_sequence,
  value, pos = string.unpack("BBBB", reply, pos)
  -- bit 1
  data.rmcp_mtype = ((value & 0x80) ~= 0)
  -- bit [2:8]
  data.rmcp_class = (value & 0x7F)

data.session_auth_type,
  value, pos = string.unpack("BB", reply, pos)
  -- bit 1
  data.session_payload_encrypted = ((value & 0x80) ~= 0)
  -- bit 2
  data.session_payload_authenticated = ((value & 0x40) ~= 0)
  -- bit [3:8]
  data.session_payload_type = (value & 0x3F)

data.session_id,
  data.session_sequence,
  data.message_length,
  data.ignored1,
  data.error_code,
  data.ignored2,
  data.console_session_id,
  data.bmc_session_id, pos = string.unpack("<I4I4I2BBI2I4I4", reply, pos)

return data
end

parse_rakp_1_reply = function(reply)
  local data = {}
  local pos = 1
  local value

data.session_id,
  data.session_sequence,
  data.message_length,
  data.ignored1,
  data.error_code,
  data.ignored2,
  data.console_session_id,
  data.bmc_random_id,
  data.bmc_guid,
  data.hmac_sha1, pos = string.unpack("<I4I4I2BBI2I4c16c16c20", reply, pos)

return data
end

return _ENV;