Check if target machines are vulnerable to anonymous Frontpage login.
Ports
Any
Protocols
n/a
Attribution
Aleksandar Nikolic (upstream: ea/nmap-scripts)
Copy the command and adjust the target or script arguments as needed.
nmap <target> -p 80 --script=http-frontpage-loginThe full script source is stored with this entry and is hidden by default to keep the page easier to scan.
local stdnse = require "stdnse"
local shortport = require "shortport"
local http = require "http"
local string = require "string"
local url = require "url"
local vulns = require "vulns"
description = [[
Check if target machines are vulnerable to anonymous Frontpage login.
Older, default configurations of Frontpage extensions allow
remote user to login anonymously which may lead to server compromise.
]]
---
-- @usage
-- nmap <target> -p 80 --script=http-frontpage-login
--
-- @args http-frontpage-login.path Path prefix to Frontpage directories. Defaults
-- to root ("/").
--
-- @output
-- PORT STATE SERVICE REASON
-- 80/tcp open http syn-ack
-- | http-frontpage-login:
-- | VULNERABLE:
-- | Frontpage extension anonymous login
-- | State: VULNERABLE
-- | Description:
-- | Default installations of older versions of frontpage extensions allow anonymous logins which can lead to server compromise.
-- |
-- | References:
-- |_ http://insecure.org/sploits/Microsoft.frontpage.insecurities.html
author = "Aleksandar Nikolic"
license = "Same as Nmap--See http://nmap.org/book/man-legal.html"
categories = {"vuln", "safe"}
portrule = shortport.http
action = function(host, port)
local path = stdnse.get_script_args('http-frontpage-login.path') or "/"
local data
local frontpage_vuln = {
title = "Frontpage extension anonymous login",
description = [[
Default installations of older versions of frontpage extensions allow anonymous logins which can lead to server compromise.
]],
references = {
'http://insecure.org/sploits/Microsoft.frontpage.insecurities.html',
},
exploit_results = {},
};
local report = vulns.Report:new(SCRIPT_NAME, host, port);
frontpage_vuln.state = vulns.STATE.NOT_VULN;
data = http.get( host, port, path .. "/_vti_inf.html" )
if data and data.status and data.status == 200 then
--server does support frontpage extensions
local fp_version = string.match(data.body,"FPVersion=\"[%d%.]*\"")
if fp_version then
-- do post request http://msdn.microsoft.com/en-us/library/ms446353
local postdata = "method=open+service:".. fp_version .."&service_name=/"
data = http.post(host,port,path .. "/_vti_bin/_vti_aut/author.dll",nil,nil,postdata)
if data and data.status then
if data.status == 200 then
stdnse.print_debug("Frontpage returned 200 OK, server vulnerable.")
frontpage_vuln.state = vulns.STATE.VULN;
return report:make_output(frontpage_vuln);
elseif data.status == 401 then
stdnse.print_debug("Frontpage returned 401, password protected.")
return false
else
stdnse.print_debug("Frontpage returned unknown response.")
return false
end
end
end
end
stdnse.print_debug("Frontpage probably not installed.")
return false
end
Imported from the upstream repository ea/nmap-scripts. Check if target machines are vulnerable to anonymous Frontpage login. Older, default configurations of Frontpage extensions allow remote user to login anonymously which may lead to server compromise.