omp2-brute

NSE detection rule by Henri Doreau · Same as Nmap--See https://nmap.org/book/man-legal.html

Performs brute force password auditing against the OpenVAS manager using OMPv2.

local brute = require "brute"
local creds = require "creds"
local omp2 = require "omp2"
local shortport = require "shortport"

description = [[
Performs brute force password auditing against the OpenVAS manager using OMPv2.
]]

---
-- @usage
-- nmap -p 9390 --script omp2-brute <target>
--
-- @output
-- PORT     STATE SERVICE REASON
-- 9390/tcp open  openvas syn-ack
-- | omp2-brute:
-- |   Accounts
-- |_    admin:secret => Valid credentials
--

author = "Henri Doreau"
license = "Same as Nmap--See https://nmap.org/book/man-legal.html"
categories = {"brute", "intrusive"}


portrule = shortport.port_or_service(9390, "openvas")


Driver = {
  new = function(self, host, port)
    local o = {}
    setmetatable(o, self)
    self.__index = self
    o.host = host
    o.port = port
    o.session = omp2.Session:new(brute.new_socket())
    return o
  end,

  --- Connects to the OpenVAS Manager
  --
  -- @return status boolean for connection success/failure
  -- @return err string describing the error on failure
  connect = function(self)
    return self.session:connect(self.host, self.port)
  end,

  --- Closes connection
  --
  -- @return status boolean for closing success/failure
  disconnect = function(self)
    return self.session:close()
  end,

  --- Attempts to login the OpenVAS Manager using a given username/password
  -- couple. Store the credentials in the registry on success.
  --
  -- @param username string containing the login username
  -- @param password string containing the login password
  -- @return status boolean for login success/failure
  -- @return err string describing the error on failure
  login = function(self, username, password)
    if self.session:authenticate(username, password) then
      -- store the account for possible future use
      omp2.add_account(self.host, username, password)
      return true, creds.Account:new(username, password, creds.State.VALID)
    else
      return false, brute.Error:new("login failed")
    end
  end,

}

action = function(host, port)
  local engine = brute.Engine:new(Driver, host, port)
  engine.options.script_name = SCRIPT_NAME
  local status, result = engine:start()
  return result
end

[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

9d8dda6f-d636-4b5e-82d3-cfa822892b4e

Propose edits, view related rules, and engage with the community through comments.

Executable code, not a declarative rule

This submission is arbitrary [[ currentRule.format ? currentRule.format.toUpperCase() : '' ]] code, not a declarative detection rule — review it as you would any script before running it, and note that it cannot be safely aggregated or auto-executed alongside YARA/Sigma/Suricata/CRS rules.

Rejected pattern present

[[ reason ]]

What does this mean?

Format & documentation suggestions

Not a security issue — this rule is valid and was accepted as-is. These are optional fields/conventions its own format recommends, mainly affecting its quality score and how well it documents itself for other reviewers.

[[ reason ]]

What do these messages mean?

[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

[[ currentRule.title ]]

Community Discussion