LM_check_script.nse

---
-- https://shellcode.blog/services
---

--Usage:
--nmap -script LM_check_script.nse -sU -p 19998 <host>
--Output Example:
-- PORT      STATE SERVICE    REASON
-- 19998/udp open  Lazy Mouse script-set
-- | LM_check_script: 
-- |   VULNERABLE:
-- |   Lazy Mouse Remote Code Execution
-- |     State: VULNERABLE
-- |     IDs:  CVE:CVE-2022-45482
-- |     Risk factor: High  CVSSv3: 9.8 (HIGH) (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
-- |             The Lazy Mouse server enforces a vulnerable authentication mechanism allowing remote unauthenticated users tobypass it and execute arbitrary commands.
-- |              
-- |     Disclosure date: 2022-11-30
-- |     References:
-- |_      https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-45482


-- Load required Nmap modules
local nmap = require "nmap"
local shortport = require "shortport"
local stdnse = require "stdnse"
local string = require "string"
local vulns = require "vulns"

description = [[
Lazy Mouse CVE-2022-45481 & CVE-2022-45482 Remote Code Execution Vulnerabilites.
This script looks the existence of CVE-2022-45481 & CVE-2022-45482 based on the server's response. 
]]

author = "Mohammed Alshehri"
license = "Same as Nmap--See http://nmap.org/book/man-legal.html"
categories = {"auth", "vuln"}


function set_nmap(host, port)
	port.state = "open"
	port.version.name = "Lazy Mouse"
	port.version.product = "2.0.1"
	nmap.set_port_version(host, port)
	nmap.set_port_state(host, port, "open")
 end


-- Define the port rule for the script
portrule = shortport.port_or_service(19998, "Lazy Mouse", "udp")

-- Main action function of the script
action = function(host, port)
    -- Define the detection code to send
    local detection_code = string.char(0x32, 0x3a, 0x30, 0x31)

    -- Define the vulnerability information for CVE-2022-45481
    local vuln_45481 = {
        title = "Lazy Mouse Remote Code Execution",
        state = vulns.STATE.NOT_VULN,
        risk_factor = "High",
        scores = {
            CVSSv3 = "9.8 (HIGH) (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)",
        },
        description = [[
            Remote unauthenticated users can execute arbitrary code with no prior authentication.
        ]],
        IDS = {CVE = "CVE-2022-45481"},
        references = {
            'https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-45481'
        },
        dates = {disclosure = {year = '2022', month = '11', day = '30'}}
    }

    -- Define the vulnerability information for CVE-2022-45482
    local vuln_45482 = {
        title = "Lazy Mouse Remote Code Execution",
        state = vulns.STATE.NOT_VULN,
        risk_factor = "High",
        scores = {
            CVSSv3 = "9.8 (HIGH) (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)",
        },
        description = [[
            The Lazy Mouse server enforces a vulnerable authentication mechanism allowing remote unauthenticated users to bypass it and execute arbitrary commands.
        ]],
        IDS = {CVE = "CVE-2022-45482"},
        references = {
            'https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-45482'
        },
        dates = {disclosure = {year = '2022', month = '11', day = '30'}}
    }

    -- Create a new vuln report object for the script
    local vuln_report = vulns.Report:new(SCRIPT_NAME, host, port)

    -- Create a UDP socket to send the detection code
    local sock = nmap.new_socket("udp")
    sock:set_timeout(1000)

    -- Connect to the target host and port

	local constatus,conerr = sock:connect(host, port,"udp")
  if not constatus then
    stdnse.debug1(
      'Error establishing a UDP connection for %s - %s', host, conerr
      )
    return nil
  end

  -- Create a new UDP socket object
  local sock2 = nmap.new_socket("udp")

  -- Set the timeout for receiving data from the socket to 5000 milliseconds (5 seconds)
  sock2:set_timeout(5000)

  -- Bind the socket to all available IP addresses on port 19998
  sock2:bind("0.0.0.0", 19998)

  -- Send the detection code over the first socket (sock) and capture the status and any error message
  local status, senderr = sock:send(detection_code)

  -- If the send operation failed, log an error and return an error code
  if(status == false) then
    stdnse.debug1(
      'Error sending a UDP message for %s - %s', host, conerr
      )
    stdnse.debug1(senderr)
    return "Error: 2"
  end

  -- Close the first socket (sock)
  sock:close()

  -- Wait for a response on the second socket (sock2) and capture the status and any received data
  local status, response  = sock2:receive()

  -- If no response was received before the timeout, log a message indicating success and return nil
  if(status == false) then
    stdnse.debug1("Good news! The server never replied : )")
    stdnse.debug1(senderr)
    return nil
  end

  -- If 2:01 then show CVE-2022-45481.
  if response and response:find("2:1") then
    stdnse.debug1("CVE-2022-45481 condition")
    vuln_45481.state = vulns.STATE.VULN
    set_nmap(host, port)
    return vuln_report:make_output (vuln_45481)
  end
    -- If 2:4 then show CVE-2022-45482
  if response and response:find("2:4") then
    stdnse.debug1("CVE-2022-45482 condition")
    vuln_45482.state = vulns.STATE.VULN
    set_nmap(host, port)
    stdnse.debug1(response)
    return vuln_report:make_output (vuln_45482)
  end
  -- Else, we gucci
  -- close socket
  sock2:close()
  -- return output table to Nmap
  return nil
end