nccgroup/fat-fingerfinger를 통해 사용자를 열거하는 NMAP 스크립트
원본 finger.nse를 확장하여 /etc/passwd의 GECOS 필드에 대한 사용자 이름의 전체 일치 및 부분 일치를 통해 현재 로그온한 사용자를 열거하려고 시도합니다.
예제 출력:
@output
PORT STATE SERVICE
79/tcp open finger
| fat-finger: finger: admin: no such user.
| finger: unix: no such user.
| finger: dba: no such user.
| finger: oracle: no such user.
| finger: sybase: no such user.
| finger: ingres: no such user.
| finger: db: no such user.
| finger: help: no such user.
| finger: IT: no such user.
| finger: test: no such user.
| Login: root Name: root
| Directory: /root Shell: /bin/bash
| Last login Thu Nov 26 16:05 2009 (GMT) on pts/1 from 192.168.226.1
| No mail.
| No Plan.
|
| Login: mysql Name: MySQL Server
| Directory: /var/lib/mysql Shell: /bin/false
| Never logged in.
| No mail.
| No Plan.
|
| Login: ftp Name: ftp daemon
| Directory: /srv/ftp Shell: /bin/false
| Never logged in.
| No mail.
| No Plan.
|
| Login: hplip Name: HPLIP system user
| Directory: /var/run/hplip Shell: /bin/false
| Never logged in.
| No mail.
| No Plan.
|
| Login: gnats Name: Gnats Bug-Reporting System (admin)
| Directory: /var/lib/gnats Shell: /bin/sh
| Never logged in.
| No mail.
|_No Plan.
portrule = shortport.port_or_service(79, "finger")
action = function(host, port)
local try = nmap.new_try()
return try(comm.exchange(host, port, "root admin system unix dba oracle mysql sybase ingres db ftp help IT user test\r\n",
{lines=100, proto=port.protocol, timeout=5000}))
end