Linux tsuru-no-tsurugi 5.15.0-186-generic #196-Ubuntu SMP Sat Jun 20 16:09:34 UTC 2026 x86_64
Apache/2.4.52 (Ubuntu)
Server IP : 192.168.0.18 & Your IP : 216.73.217.105
Domains :
Cant Read [ /etc/named.conf ]
User : www-data
Terminal
Auto Root
Create File
Create Folder
Localroot Suggester
Backdoor Destroyer
Readme
/
usr /
share /
nmap /
nselib /
Delete
Unzip
Name
Size
Permission
Date
Action
data
[ DIR ]
drwxr-xr-x
2024-08-29 14:21
afp.lua
71.48
KB
-rw-r--r--
2023-01-13 02:40
ajp.lua
16.77
KB
-rw-r--r--
2023-01-13 02:40
amqp.lua
10.41
KB
-rw-r--r--
2023-01-13 02:40
anyconnect.lua
4.31
KB
-rw-r--r--
2023-01-13 02:40
asn1.lua
14.57
KB
-rw-r--r--
2023-01-13 02:40
base32.lua
7.36
KB
-rw-r--r--
2023-01-13 02:40
base64.lua
5.83
KB
-rw-r--r--
2023-01-13 02:40
bin.lua
12.99
KB
-rw-r--r--
2023-01-13 02:40
bitcoin.lua
18.25
KB
-rw-r--r--
2023-01-13 02:40
bits.lua
2.54
KB
-rw-r--r--
2023-01-13 02:40
bittorrent.lua
35.76
KB
-rw-r--r--
2023-01-13 02:40
bjnp.lua
9.55
KB
-rw-r--r--
2023-01-13 02:40
brute.lua
50.64
KB
-rw-r--r--
2023-01-13 02:40
cassandra.lua
5.48
KB
-rw-r--r--
2023-01-13 02:40
citrixxml.lua
16
KB
-rw-r--r--
2023-01-13 02:40
coap.lua
75.1
KB
-rw-r--r--
2023-01-13 02:40
comm.lua
11.03
KB
-rw-r--r--
2023-01-13 02:40
creds.lua
18.26
KB
-rw-r--r--
2023-01-13 02:40
cvs.lua
3.05
KB
-rw-r--r--
2023-01-13 02:40
datafiles.lua
11.05
KB
-rw-r--r--
2023-01-13 02:40
datetime.lua
7.5
KB
-rw-r--r--
2023-01-13 02:40
dhcp.lua
28.57
KB
-rw-r--r--
2023-01-13 02:40
dhcp6.lua
19.86
KB
-rw-r--r--
2023-01-13 02:40
dns.lua
51.07
KB
-rw-r--r--
2023-01-13 02:40
dnsbl.lua
19.01
KB
-rw-r--r--
2023-01-13 02:40
dnssd.lua
12.61
KB
-rw-r--r--
2023-01-13 02:40
drda.lua
24.08
KB
-rw-r--r--
2023-01-13 02:40
eap.lua
7.54
KB
-rw-r--r--
2023-01-13 02:40
eigrp.lua
12.98
KB
-rw-r--r--
2023-01-13 02:40
formulas.lua
5.68
KB
-rw-r--r--
2023-01-13 02:40
ftp.lua
9.03
KB
-rw-r--r--
2023-01-13 02:40
geoip.lua
1.71
KB
-rw-r--r--
2023-01-13 02:40
giop.lua
18.42
KB
-rw-r--r--
2023-01-13 02:40
gps.lua
3.38
KB
-rw-r--r--
2023-01-13 02:40
http.lua
117.07
KB
-rw-r--r--
2023-01-13 02:40
httpspider.lua
36.65
KB
-rw-r--r--
2023-01-13 02:40
iax2.lua
9.58
KB
-rw-r--r--
2023-01-13 02:40
idna.lua
17.14
KB
-rw-r--r--
2023-01-13 02:40
ike.lua
14.63
KB
-rw-r--r--
2023-01-13 02:40
imap.lua
9.59
KB
-rw-r--r--
2023-01-13 02:40
informix.lua
39.93
KB
-rw-r--r--
2023-01-13 02:40
ipOps.lua
29.06
KB
-rw-r--r--
2023-01-13 02:40
ipmi.lua
8.08
KB
-rw-r--r--
2023-01-13 02:40
ipp.lua
12.57
KB
-rw-r--r--
2023-01-13 02:40
irc.lua
757
B
-rw-r--r--
2023-01-13 02:40
iscsi.lua
21.38
KB
-rw-r--r--
2023-01-13 02:40
isns.lua
14.98
KB
-rw-r--r--
2023-01-13 02:40
jdwp.lua
43.52
KB
-rw-r--r--
2023-01-13 02:40
json.lua
11.62
KB
-rw-r--r--
2023-01-13 02:40
knx.lua
2.42
KB
-rw-r--r--
2023-01-13 02:40
ldap.lua
31.94
KB
-rw-r--r--
2023-01-13 02:40
lfs.luadoc
1.68
KB
-rw-r--r--
2023-01-13 02:40
libssh2-utility.lua
4.69
KB
-rw-r--r--
2023-01-13 02:40
libssh2.luadoc
4.75
KB
-rw-r--r--
2023-01-13 02:40
listop.lua
4.66
KB
-rw-r--r--
2023-01-13 02:40
lpeg-utility.lua
5.64
KB
-rw-r--r--
2023-01-13 02:40
lpeg.luadoc
351
B
-rw-r--r--
2023-01-13 02:40
ls.lua
10.96
KB
-rw-r--r--
2023-01-13 02:40
match.lua
2.05
KB
-rw-r--r--
2023-01-13 02:40
membase.lua
9.93
KB
-rw-r--r--
2023-01-13 02:40
mobileme.lua
8.46
KB
-rw-r--r--
2023-01-13 02:40
mongodb.lua
21.3
KB
-rw-r--r--
2023-01-13 02:40
mqtt.lua
28.86
KB
-rw-r--r--
2023-01-13 02:40
msrpc.lua
190.07
KB
-rw-r--r--
2023-01-13 02:40
msrpcperformance.lua
29.65
KB
-rw-r--r--
2023-01-13 02:40
msrpctypes.lua
168.52
KB
-rw-r--r--
2023-01-13 02:40
mssql.lua
109.43
KB
-rw-r--r--
2023-01-13 02:40
multicast.lua
5.97
KB
-rw-r--r--
2023-01-13 02:40
mysql.lua
16.03
KB
-rw-r--r--
2023-01-13 02:40
natpmp.lua
5.11
KB
-rw-r--r--
2023-01-13 02:40
nbd.lua
16.04
KB
-rw-r--r--
2023-01-13 02:40
ncp.lua
35.64
KB
-rw-r--r--
2023-01-13 02:40
ndmp.lua
11.43
KB
-rw-r--r--
2023-01-13 02:40
netbios.lua
14.44
KB
-rw-r--r--
2023-01-13 02:40
nmap.luadoc
40.34
KB
-rw-r--r--
2023-01-13 02:40
nrpc.lua
4.46
KB
-rw-r--r--
2023-01-13 02:40
nsedebug.lua
3.49
KB
-rw-r--r--
2023-01-13 02:40
omp2.lua
4.78
KB
-rw-r--r--
2023-01-13 02:40
oops.lua
3.61
KB
-rw-r--r--
2023-01-13 02:40
openssl.luadoc
7.5
KB
-rw-r--r--
2023-01-13 02:40
ospf.lua
15.29
KB
-rw-r--r--
2023-01-13 02:40
packet.lua
36.18
KB
-rw-r--r--
2023-01-13 02:40
pcre.luadoc
6.79
KB
-rw-r--r--
2023-01-13 02:40
pgsql.lua
20.6
KB
-rw-r--r--
2023-01-13 02:40
pop3.lua
5.74
KB
-rw-r--r--
2023-01-13 02:40
pppoe.lua
29.42
KB
-rw-r--r--
2023-01-13 02:40
proxy.lua
11.37
KB
-rw-r--r--
2023-01-13 02:40
punycode.lua
11.5
KB
-rw-r--r--
2023-01-13 02:40
rand.lua
2.7
KB
-rw-r--r--
2023-01-13 02:40
rdp.lua
14.73
KB
-rw-r--r--
2023-01-13 02:40
re.lua
8.22
KB
-rw-r--r--
2023-01-13 02:40
redis.lua
3.61
KB
-rw-r--r--
2023-01-13 02:40
rmi.lua
47.77
KB
-rw-r--r--
2023-01-13 02:40
rpc.lua
107.64
KB
-rw-r--r--
2023-01-13 02:40
rpcap.lua
11.08
KB
-rw-r--r--
2023-01-13 02:40
rsync.lua
5.22
KB
-rw-r--r--
2023-01-13 02:40
rtsp.lua
8.62
KB
-rw-r--r--
2023-01-13 02:40
sasl.lua
16.51
KB
-rw-r--r--
2023-01-13 02:40
shortport.lua
11.99
KB
-rw-r--r--
2023-01-13 02:40
sip.lua
30.07
KB
-rw-r--r--
2023-01-13 02:40
slaxml.lua
17.9
KB
-rw-r--r--
2023-01-13 02:40
smb.lua
173.22
KB
-rw-r--r--
2023-01-13 02:40
smb2.lua
15.34
KB
-rw-r--r--
2023-01-13 02:40
smbauth.lua
37.33
KB
-rw-r--r--
2023-01-13 02:40
smtp.lua
19.85
KB
-rw-r--r--
2023-01-13 02:40
snmp.lua
16
KB
-rw-r--r--
2023-01-13 02:40
socks.lua
8.25
KB
-rw-r--r--
2023-01-13 02:40
srvloc.lua
10.99
KB
-rw-r--r--
2023-01-13 02:40
ssh1.lua
9.15
KB
-rw-r--r--
2023-01-13 02:40
ssh2.lua
11.73
KB
-rw-r--r--
2023-01-13 02:40
sslcert.lua
33.35
KB
-rw-r--r--
2023-01-13 02:40
sslv2.lua
9.68
KB
-rw-r--r--
2023-01-13 02:40
stdnse.lua
32.64
KB
-rw-r--r--
2023-01-13 02:40
strbuf.lua
4.52
KB
-rw-r--r--
2023-01-13 02:40
strict.lua
2.53
KB
-rw-r--r--
2023-01-13 02:40
stringaux.lua
4.32
KB
-rw-r--r--
2023-01-13 02:40
stun.lua
11.08
KB
-rw-r--r--
2023-01-13 02:40
tab.lua
3.35
KB
-rw-r--r--
2023-01-13 02:40
tableaux.lua
2.06
KB
-rw-r--r--
2023-01-13 02:40
target.lua
3.93
KB
-rw-r--r--
2023-01-13 02:40
tftp.lua
9.41
KB
-rw-r--r--
2023-01-13 02:40
tls.lua
58.05
KB
-rw-r--r--
2023-01-13 02:40
tn3270.lua
46.99
KB
-rw-r--r--
2023-01-13 02:40
tns.lua
64.16
KB
-rw-r--r--
2023-01-13 02:40
unicode.lua
14.23
KB
-rw-r--r--
2023-01-13 02:40
unittest.lua
12.41
KB
-rw-r--r--
2023-01-13 02:40
unpwdb.lua
10.42
KB
-rw-r--r--
2023-01-13 02:40
upnp.lua
11.18
KB
-rw-r--r--
2023-01-13 02:40
url.lua
16.7
KB
-rw-r--r--
2023-01-13 02:40
versant.lua
8.58
KB
-rw-r--r--
2023-01-13 02:40
vnc.lua
25.54
KB
-rw-r--r--
2023-01-13 02:40
vulns.lua
76.45
KB
-rw-r--r--
2023-01-13 02:40
vuzedht.lua
16.21
KB
-rw-r--r--
2023-01-13 02:40
wsdd.lua
11.98
KB
-rw-r--r--
2023-01-13 02:40
xdmcp.lua
12.09
KB
-rw-r--r--
2023-01-13 02:40
xmpp.lua
15.91
KB
-rw-r--r--
2023-01-13 02:40
zlib.luadoc
4.88
KB
-rw-r--r--
2023-01-13 02:40
Save
Rename
--- -- A module implementing IPMI protocol (the code is a porting of the Metasploit ipmi scanner: -- https://github.com/rapid7/metasploit-framework/tree/master/modules/auxiliary/scanner/ipmi) -- -- @class module -- @name ipmi -- @author "Claudiu Perta <claudiu.perta@gmail.com>" local stdnse = require "stdnse" local string = require "string" local rand = require "rand" _ENV = stdnse.module("ipmi", stdnse.seeall) local HAVE_SSL, openssl = pcall(require,"openssl") PAYLOADS = { ["IPMI"] = 0, ["PAYLOAD_SOL"] = 1, ["RMCPPLUSOPEN_REQ"] = 0x10, ["RMCPPLUSOPEN_REP"] = 0x11, ["RAKP1"] = 0x12, ["RAKP2"] = 0x13, ["RAKP3"] = 0x14, ["RAKP4"] = 0x15, } RMCP_ERRORS = { [1] = "Insufficient resources to create new session \ (wait for existing sessions to timeout)", -- Shouldn't occur. [2] = "Invalid Session ID", -- Shouldn't occur. [3] = "Invalid payload type", -- If these happen, we need to enhance our mechanism for detecting -- supported auth algorithms. [4] = "Invalid authentication algorithm", [5] = "Invalid integrity algorithm", [6] = "No matching authentication payload", [7] = "No matching integrity payload", -- This suggests the session was timed out while trying to negotiate, -- shouldn't happen. [8] = "Inactive Session ID", [9] = "Invalid role", [0xa] = "Unauthorised role or privilege level requested", [0xb] = "Insufficient resources to create a session at the requested role", [0xc] = "Invalid username length", [0xd] = "Unauthorized name", [0xe] = "Unauthorized GUID", [0xf] = "Invalid integrity check value", [0x10] = "Invalid confidentiality algorithm", [0x11] = "No cipher suite match with proposed security algorithms", -- Never observed, most likely a bug in xCAT or IPMI device. [0x12] = "Illegal or unrecognized parameter", } channel_auth_request = function() return ( "\x06\x00\xff\x07" .. -- Header "\x00\x00\x00\x00" .. "\x00\x00\x00\x00\x00\x09\x20\x18" .. "\xc8\x81\x00\x38\x8e\x04\xb5" ) end rmcpplus_header = function (payload_type) return ( "\x06\x00\xff\x07" .. -- RMCP Header "\x06" .. -- RMCP+ Authentication Type string.char(PAYLOADS[payload_type]) .. -- Payload Type "\x00\x00\x00\x00" .. -- Session ID "\x00\x00\x00\x00" -- Sequence Number ) end -- Open rmcpplus_request session_open_request = function(console_session_id) local data = ( "\x00\x00" .. -- Maximum Access "\x00\x00" .. -- Reserved console_session_id .. "\x00\x00\x00\x08" .. "\x01\x00\x00\x00" .. "\x01\x00\x00\x08" .. "\x01\x00\x00\x00" .. -- HMAC-SHA1 "\x02\x00\x00\x08" .. "\x01\x00\x00\x00" -- AES Encryption ) return rmcpplus_header("RMCPPLUSOPEN_REQ") .. string.pack("<s2", data) end -- Open rmcpplus_request session_open_cipher_zero_request = function(console_session_id) console_session_id = console_session_id or rand.random_string(4) local data = ( "\x00\x00" .. -- Maximum Access "\x00\x00" .. -- Reserved console_session_id .. "\x00\x00\x00\x08" .. "\x00\x00\x00\x00" .. -- Cipher-zero "\x01\x00\x00\x08" .. "\x00\x00\x00\x00" .. -- Cipher-zero "\x02\x00\x00\x08" .. "\x00\x00\x00\x00" -- No Encryption ) return rmcpplus_header("RMCPPLUSOPEN_REQ") .. string.pack("<s2", data) end rakp_1_request = function(bmc_session_id, console_random_id, username) local data = string.pack( "<Bxxx I c16 Bxx s1", 0, -- Message Tag bmc_session_id, console_random_id, 0x14, -- Privilege level username ) return rmcpplus_header("RAKP1") .. string.pack("<s2", data) end rakp_hmac_sha1_salt = function( console_session_id, bmc_session_id, console_random_id, bmc_random_id, bmc_guid, authorization_level, username) local salt = string.pack( "c4 I c16c16c16 Bs1", console_session_id, bmc_session_id, console_random_id, bmc_random_id, bmc_guid, authorization_level, username ) return salt end verify_rakp_hmac_sha1 = function(salt, hash, password) if not(HAVE_SSL) then return false end local digest = openssl.hmac('sha1', password, salt) return (digest == hash) end --[[ Multi-byte fields in RMCP/ASF fields are specified as being transmitted in 'Network Byte Order' - meaning most-significant byte first. RMCP and ASF-specified fields are therefore transferred most-significant byte first. The IPMI convention is to transfer multi-byte numeric fields least-significant Byte first. Therefore, unless otherwise specified: Data in the IPMI Session Header and IPMI Message fields are transmitted least-significant byte first. --]] parse_channel_auth_reply = function(reply) local data = {} local pos = 0 local value data.rmcp_version, data.rmcp_padding, data.rmcp_sequence, value, pos = string.unpack("<BBBB", reply, pos) data.rmcp_mtype = ((value & 0x80) ~= 0) data.rmcp_class = (value & 0x7F) data.session_auth_type, data.session_sequence, data.session_id, data.message_length, data.ipmi_tgt_address, data.ipmi_tgt_lun, data.ipmi_header_checksum, data.ipmi_src_address, data.ipmi_src_lun, data.ipmi_command, data.ipmi_completion_code, data.ipmi_channel, value, pos = string.unpack("<BI4I4BBBBBBBBBB", reply, pos) data.ipmi_compat_20 = ((value & 0x80) ~= 0) data.ipmi_compat_reserved1 = ((value & 0x40) ~= 0) data.ipmi_compat_oem_auth = ((value & 0x20) ~= 0) data.ipmi_compat_password = ((value & 0x10) ~= 0) data.ipmi_compat_reserved2 = ((value & 0x08) ~= 0) data.ipmi_compat_md5 = ((value & 0x04) ~= 0) data.ipmi_compat_md2 = ((value & 0x02) ~= 0) data.ipmi_compat_none = ((value & 0x01) ~= 0) value, pos = string.unpack("B", reply, pos) data.ipmi_user_reserved1 = ((value >> 6) & 0x03) data.ipmi_user_kg = ((value & 0x20) ~= 0) data.ipmi_user_disable_message_auth = ((value & 0x10) ~= 0) data.ipmi_user_disable_user_auth = ((value & 0x08) ~= 0) data.ipmi_user_non_null = ((value & 0x04) ~= 0) data.ipmi_user_null = ((value & 0x02) ~= 0) data.ipmi_user_anonymous = ((value & 0x01) ~= 0) value, pos = string.unpack("B", reply, pos) data.ipmi_conn_reserved1 = ((value >> 2) & 0x3F) data.ipmi_conn_20 = ((value & 0x02) ~= 0) data.ipmi_conn_15 = ((value & 0x01) ~= 0) -- 24 bits OEMID data.ipmi_oem_id, pos = string.unpack("<I3", reply, pos) data.ipmi_oem_data = reply:sub(pos) return data end parse_open_session_reply = function(reply) local data = {} local pos = 0 local value -- 4 bytes Header data.rmcp_version, data.rmcp_padding, data.rmcp_sequence, value, pos = string.unpack("BBBB", reply, pos) -- bit 1 data.rmcp_mtype = ((value & 0x80) ~= 0) -- bit [2:8] data.rmcp_class = (value & 0x7F) data.session_auth_type, value, pos = string.unpack("BB", reply, pos) -- bit 1 data.session_payload_encrypted = ((value & 0x80) ~= 0) -- bit 2 data.session_payload_authenticated = ((value & 0x40) ~= 0) -- bit [3:8] data.session_payload_type = (value & 0x3F) data.session_id, data.session_sequence, data.message_length, data.ignored1, data.error_code, data.ignored2, data.console_session_id, data.bmc_session_id, pos = string.unpack("<I4I4I2BBI2I4I4", reply, pos) return data end parse_rakp_1_reply = function(reply) local data = {} local pos = 0 local value -- 4 bytes Header data.rmcp_version, data.rmcp_padding, data.rmcp_sequence, value, pos = string.unpack("BBBB", reply, pos) -- bit 1 data.rmcp_mtype = ((value & 0x80) ~= 0) -- bit [2:8] data.rmcp_class = (value & 0x7F) data.session_auth_type, value, pos = string.unpack("BB", reply, pos) -- bit 1 data.session_payload_encrypted = ((value & 0x80) ~= 0) -- bit 2 data.session_payload_authenticated = ((value & 0x40) ~= 0) -- bit [3:8] data.session_payload_type = (value & 0x3F) data.session_id, data.session_sequence, data.message_length, data.ignored1, data.error_code, data.ignored2, data.console_session_id, data.bmc_random_id, data.bmc_guid, data.hmac_sha1, pos = string.unpack("<I4I4I2BBI2I4c16c16c20", reply, pos) return data end return _ENV;