netbus-brute

NSE detection rule by Toni Ruottu · Same as Nmap--See https://nmap.org/book/man-legal.html

Performs brute force password auditing against the Netbus backdoor ("remote administration") service.

local nmap = require "nmap"
local shortport = require "shortport"
local stdnse = require "stdnse"
local string = require "string"
local unpwdb = require "unpwdb"

description = [[
Performs brute force password auditing against the Netbus backdoor ("remote administration") service.
]]

---
-- @see netbus-auth-bypass.nse
-- @usage
-- nmap -p 12345 --script netbus-brute <target>
--
-- @output
-- 12345/tcp open  netbus
-- |_netbus-brute: password123

author = "Toni Ruottu"
license = "Same as Nmap--See https://nmap.org/book/man-legal.html"
categories = {"brute", "intrusive"}


dependencies = {"netbus-version"}

portrule = shortport.port_or_service (12345, "netbus", {"tcp"})

action = function( host, port )
  local try = nmap.new_try()
  local passwords = try(unpwdb.passwords())
  local socket = nmap.new_socket()
  local status, err = socket:connect(host, port)
  if not status then
    return
  end
  local buffer, err = stdnse.make_buffer(socket, "\r")
  local _ = buffer() --skip the banner
  if not (_ and _:match("^NetBus")) then
    stdnse.debug1("Not NetBus")
    return nil
  end
  for password in passwords do
    local foo = string.format("Password;0;%s\r", password)
    socket:send(foo)
    local login = buffer()
    if login == "Access;1" then
      -- Store the password for other netbus scripts
      local key = string.format("%s:%d", host.ip, port.number)
      if not nmap.registry.netbuspasswords then
        nmap.registry.netbuspasswords = {}
      end
      nmap.registry.netbuspasswords[key] = password
      if password == "" then
        return "<empty>"
      end
      return string.format("%s", password)
    end
  end
  socket:close()
end

[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

9c4912c2-e73b-4834-85c3-541ddb02bae7

Propose edits, view related rules, and engage with the community through comments.

Executable code, not a declarative rule

This submission is arbitrary [[ currentRule.format ? currentRule.format.toUpperCase() : '' ]] code, not a declarative detection rule — review it as you would any script before running it, and note that it cannot be safely aggregated or auto-executed alongside YARA/Sigma/Suricata/CRS rules.

Rejected pattern present

[[ reason ]]

What does this mean?

Format & documentation suggestions

Not a security issue — this rule is valid and was accepted as-is. These are optional fields/conventions its own format recommends, mainly affecting its quality score and how well it documents itself for other reviewers.

[[ reason ]]

What do these messages mean?

[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

[[ currentRule.title ]]

Community Discussion