local os = require "os" local stdnse = require "stdnse" local table = require "table" local xdmcp = require "xdmcp" description = [[ Discovers servers running the X Display Manager Control Protocol (XDMCP) by sending a XDMCP broadcast request to the LAN. Display managers allowing access are marked using the keyword Willing in the result. ]] --- -- @usage -- nmap --script broadcast-xdmcp-discover -- -- @output -- Pre-scan script results: -- | broadcast-xdmcp-discover: -- |_ 192.168.2.162 - Willing -- -- @args broadcast-xdmcp-discover.timeout socket timeout (default: 5s) author = "Patrik Karlsson" license = "Same as Nmap--See https://nmap.org/book/man-legal.html" categories = {"broadcast", "safe"} prerule = function() return true end local arg_timeout = stdnse.parse_timespec(stdnse.get_script_args(SCRIPT_NAME .. ".timeout")) action = function() local host, port = { ip = "255.255.255.255" }, { number = 177, protocol = "udp" } local options = { timeout = 1 } local helper = xdmcp.Helper:new(host, port, options) local status = helper:connect() local req = xdmcp.Packet[xdmcp.OpCode.BCAST_QUERY]:new(nil) local status, err = helper:send(req) if ( not(status) ) then return false, err end local timeout = arg_timeout or 5 local start = os.time() local result = {} repeat local status, response = helper:recv() if ( not(status) and response ~= "TIMEOUT" ) then break elseif ( status ) then local status, _, _, rhost = helper.socket:get_info() if ( response.header.opcode == xdmcp.OpCode.WILLING ) then result[rhost] = true else result[rhost] = false end end until( os.time() - start > timeout ) local output = {} for ip, res in pairs(result) do if ( res ) then table.insert(output, ("%s - Willing"):format(ip)) else table.insert(output, ("%s - Unwilling"):format(ip)) end end return stdnse.format_output(true, output) end