openwebnet-discovery
NSE detection rule by Rewanth Cool · Same as Nmap--See https://nmap.org/book/man-legal.html
OpenWebNet is a communications protocol developed by Bticino since 2000.
Retrieves device identifying information and number of connected devices.
References:
* https://www.myopen-legrandgroup.com/solution-gallery/openwebnet/
* http://www.pimyhome.org/wiki/index.php/OWN_OpenWebNet_Language_Reference
local datetime = require "datetime"
local stdnse = require "stdnse"
local shortport = require "shortport"
local comm = require "comm"
local string = require "string"
local stringaux = require "stringaux"
local table = require "table"
description = [[
OpenWebNet is a communications protocol developed by Bticino since 2000.
Retrieves device identifying information and number of connected devices.
References:
* https://www.myopen-legrandgroup.com/solution-gallery/openwebnet/
* http://www.pimyhome.org/wiki/index.php/OWN_OpenWebNet_Language_Reference
]]
---
-- @usage
-- nmap --script openwebnet-discovery
--
-- @output
-- | openwebnet-discover:
-- | IP Address: 192.168.200.35
-- | Net Mask: 255.255.255.0
-- | MAC Address: 00:03:50:01:d3:11
-- | Device Type: F453AV
-- | Firmware Version: 3.0.14
-- | Uptime: 12d9h42m1s
-- | Date and Time: 4-07-2017T19:17:27
-- | Kernel Version: 2.3.8
-- | Distribution Version: 3.0.1
-- | Lighting: 115
-- | Automation: 15
-- |_ Burglar Alarm: 12
--
-- @xmloutput
-- <elem key="IP Address">192.168.200.35</elem>
-- <elem key="Net Mask">255.255.255.0</elem>
-- <elem key="MAC Address">00:03:50:01:d3:11</elem>
-- <elem key="Device Type">F453AV</elem>
-- <elem key="Firmware Version">3.0.14</elem>
-- <elem key="Uptime">12d9h42m1s</elem>
-- <elem key="Date and Time">4-07-2017T19:17:27</elem>
-- <elem key="Kernel Version">2.3.8</elem>
-- <elem key="Distribution Version">3.0.1</elem>
-- <elem key="Lighting">115</elem>
-- <elem key="Automation">15</elem>
-- <elem key="Burglar Alarm">12</elem>
author = "Rewanth Cool"
license = "Same as Nmap--See https://nmap.org/book/man-legal.html"
categories = {"discovery", "safe"}
portrule = shortport.port_or_service(20000, "openwebnet")
local device = {
[2] = "MHServer",
[4] = "MH200",
[6] = "F452",
[7] = "F452V",
[11] = "MHServer2",
[12] = "F453AV",
[13] = "H4684",
[15] = "F427 (Gateway Open-KNX)",
[16] = "F453",
[23] = "H4684",
[27] = "L4686SDK",
[44] = "MH200N",
[51] = "F454",
[200] = "F454 (new?)"
}
local who = {
[0] = "Scenarios",
[1] = "Lighting",
[2] = "Automation",
[3] = "Power Management",
[4] = "Heating",
[5] = "Burglar Alarm",
[6] = "Door Entry System",
[7] = "Multimedia",
[9] = "Auxiliary",
[13] = "Device Communication",
[14] = "Light+shutters actuators lock",
[15] = "CEN",
[16] = "Sound System",
[17] = "Scenario Programming",
[18] = "Energy Management",
[24] = "Lighting Management",
[25] = "CEN plus",
[1000] = "Diagnostic",
[1001] = "Automation Diagnostic",
[1004] = "Heating Diagnostic",
[1008] = "Door Entry System Diagnostic",
[1013] = "Device Diagnostic"
}
local device_dimension = {
["Time"] = "0",
["Date"] = "1",
["IP Address"] = "10",
["Net Mask"] = "11",
["MAC Address"] = "12",
["Device Type"] = "15",
["Firmware Version"] = "16",
["Hardware Version"] = "17",
["Uptime"] = "19",
["Micro Version"] = "20",
["Date and Time"] = "22",
["Kernel Version"] = "23",
["Distribution Version"] = "24",
["Gateway IP address"] = "50",
["DNS IP address 1"] = "51",
["DNS IP address 2"] = "52"
}
local ACK = "*#*1##"
local NACK = "*#*0##"
-- Initiates a socket connection
-- Returns the socket and error message
local function get_socket(host, port, request)
local sd, response, early_resp = comm.opencon(host, port, request, {recv_before=true, request_timeout=10000})
if sd == nil then
stdnse.debug("Socket connection error.")
return nil, response
end
if not response then
stdnse.debug("Poor internet connection or no response.")
return nil, response
end
if response == NACK then
stdnse.debug("Received a negative ACK as response.")
return nil, response
end
return sd, nil
end
local function get_response(sd, request)
local res = {}
local status, data
sd:send(request)
repeat
status, data = sd:receive_buf("##", true)
if status == nil then
stdnse.debug("Error: " .. data)
if data == "TIMEOUT" then
-- Avoids false results by capturing NACK after TIMEOUT occurred.
status, data = sd:receive_buf("##", true)
break
else
-- Captures other kind of errors like EOF
sd:close()
return res
end
end
if status and data ~= ACK then
table.insert(res, data)
end
if data == ACK then
break
end
-- If response is NACK, it means the request method is not supported
if data == NACK then
res = nil
break
end
until not status
return res
end
local function format_dimensions(res)
if res["Date and Time"] then
local params = {
"hour", "min", "sec", "msec", "dayOfWeek", "day", "month", "year"
}
local values = {}
for counter, val in ipairs(stringaux.strsplit("%.%s*", res["Date and Time"])) do
values[ params[counter] ] = val
end
res["Date and Time"] = datetime.format_timestamp(values)
end
if res["Device Type"] then
res["Device Type"] = device[ tonumber( res["Device Type"] ) ]
end
if res["MAC Address"] then
res["MAC Address"] = string.gsub(res["MAC Address"], "(%d+)(%.?)", function(num, separator)
if separator == "." then
return string.format("%02x:", num)
else
return string.format("%02x", num)
end
end
)
end
if res["Uptime"] then
local t = {}
local units = {
"d", "h", "m", "s"
}
for counter, v in ipairs(stringaux.strsplit("%.%s*", res["Uptime"])) do
table.insert(t, v .. units[counter])
end
res["Uptime"] = table.concat(t, "")
end
return res
end
action = function(host, port)
local output = stdnse.output_table()
local sd, err = get_socket(host, port, nil)
-- Socket connection creation failed
if sd == nil then
return err
end
-- Fetching list of dimensions of a device
for _, device in ipairs({"IP Address", "Net Mask", "MAC Address", "Device Type", "Firmware Version", "Uptime", "Date and Time", "Kernel Version", "Distribution Version"}) do
local head = "*#13**"
local tail = "##"
stdnse.debug("Fetching " .. device)
local res = get_response(sd, head .. device_dimension[device] .. tail)
-- Extracts substring from the result
-- Ex:
-- Request - *#13**16##
-- Response - *#13**16*3*0*14##
-- Trimmed Output - 3*0*14
if res and next(res) then
local regex = string.gsub(head, "*", "%%*") .. device_dimension[device] .. "%*" .."(.+)" .. tail
local tempRes = string.match(res[1], regex)
if tempRes then
output[device] = string.gsub(tempRes, "*", ".")
end
end
end
-- Format the output based on dimension
output = format_dimensions(output)
-- Fetching list of each device
for i = 1, 6 do
stdnse.debug("Fetching the list of " .. who[i] .. " devices.")
local res = get_response(sd, "*#" .. i .. "*0##")
if res and #res > 0 then
output[who[i]] = #res
end
end
if #output > 0 then
return output
else
return nil
end
end