Re: [Plugins-writers] Write a plugin to determine if LanDesk client is NOT listening

Previous message: George A. Theall: "Re: [Plugins-writers] Write a plugin to determine if LanDesk client is NOT listening"
In reply to: James Kelly: "[Plugins-writers] Write a plugin to determine if LanDesk client is NOT listening"
Messages sorted by: [ date ] [ thread ] [ subject ] [ author ] [ attachment ]

mikhail@private

On Sat Oct 07 2006 at 00:34, James Kelly wrote:

> port = 9595;
> if(get_port_state(port))
> {
>  soc = open_sock_tcp(port);
>  if(!soc)
> #    security_note(port);
>    print "LanDesk not found";
> }

The logic is wrong.
get_port_state will return TRUE if :
- port 9595 was not scanned and "consider unscanned ports as closed"
  is FALSE.
or:
- port 9595 was scanned and it is open.

Let's suppose it is scanned:
If it is open, get_port_state will return TRUE, and unless something
bad happens on the network at the moment, open_sock_tcp will succeed.
If it is closed, get_port_state will return FALSE.
In both cases, you don't execute the security_note statement (BTW, as 
George said, there is nothing like "print" in NASL. Use display or
log_print from "global_settings.inc") 

Your script will only work in one case:
the port is closed AND it was not scanned AND "consider unscanned
ports as closed" is unchecked.

Try something like this:

port = 9595;
k = strcat("Ports/tcp/", port);
if (get_kb_item(k))     # Port was found open by the scanner
 exit(0);

flag = get_preference("unscanned_closed") ;
if (flag) exit(0);      # Don't connect to unscanned or closed port

# Here, either the port is closed, or it was not scanned

soc = open_sock_tcp(port);
if (!soc)
 security_note(port: port,
  data: "Port is closed. LanDesk is not running");

If you want your script to always test 9595 even if it is not in the
port range, remove the get_preference call.
_______________________________________________
Plugins-writers mailing list
Plugins-writers@private
http://mail.nessus.org/mailman/listinfo/plugins-writers