Attempts to extract system information from the UPnP service.
Controls whether we override the IP address information returned by the UPNP service for the location of the XML file that describes the device. Defaults to true for unicast hosts.
See the documentation for the slaxml library.
See the documentation for the http library.
See the documentation for the target library.
See the documentation for the smbauth library.
nmap -sU -p 1900 --script=upnp-info <target>
| upnp-info: System/1.0 UPnP/1.0 IGD/1.0
|_ Location: http://192.168.1.1:80/UPnP/IGD.xml
local nmap = require "nmap"
local shortport = require "shortport"
local stdnse = require "stdnse"
local string = require "string"
local upnp = require "upnp"
description = [[
Attempts to extract system information from the UPnP service.
]]
---
-- @usage
-- nmap -sU -p 1900 --script=upnp-info <target>
-- @output
-- | upnp-info: System/1.0 UPnP/1.0 IGD/1.0
-- |_ Location: http://192.168.1.1:80/UPnP/IGD.xml
--
-- @args upnp-info.override Controls whether we override the IP address information
-- returned by the UPNP service for the location of the XML
-- file that describes the device. Defaults to true for
-- unicast hosts.
-- 2010-10-05 - add prerule support <[email protected]>
-- 2010-10-10 - add newtarget support <[email protected]>
-- 2010-10-29 - factored out all of the code to upnp.lua <[email protected]>
author = "Thomas Buchanan"
license = "Same as Nmap--See https://nmap.org/book/man-legal.html"
categories = {"default", "discovery", "safe"}
---
-- Runs on UDP port 1900
portrule = shortport.portnumber(1900, "udp", {"open", "open|filtered"})
---
-- Sends UPnP discovery packet to host,
-- and extracts service information from results
action = function(host, port)
local override = stdnse.get_script_args("upnp-info.override")
local helper = upnp.Helper:new( host, port )
if ( override ~= nil ) and ( string.lower(override) == "false" ) then
helper:setOverride( false )
else
helper:setOverride( true )
end
local status, result = helper:queryServices()
if ( status ) then
nmap.set_port_state(host, port, "open")
return stdnse.format_output(true, result)
end
end