Script `http-avaya-ipoffice-users`

Script types: portrule
Categories: exploit, vuln
Download: https://svn.nmap.org/nmap/scripts/http-avaya-ipoffice-users.nse

Script Summary

Attempts to enumerate users in Avaya IP Office systems 7.x.

Avaya IP Office systems allow unauthenticated access to the URI '/system/user/scn_user_list' which returns a XML file containing user information such as display name, full name and extension number.

Tested on Avaya IP Office 7.0(27).

Script Arguments

slaxml.debug: See the documentation for the slaxml library.
http.host, http.max-body-size, http.max-cache-size, http.max-pipeline, http.pipeline, http.truncated-ok, http.useragent: See the documentation for the http library.
smbdomain, smbhash, smbnoguest, smbpassword, smbtype, smbusername: See the documentation for the smbauth library.
vulns.short, vulns.showall: See the documentation for the vulns library.

Example Usage

nmap -p80 --script http-avaya-ipoffice-users <target>

nmap -sV --script http-avaya-ipoffice-users <target>

Script Output

PORT   STATE SERVICE REASON         VERSION
80/tcp open  http    syn-ack ttl 99 Avaya IP Office VoIP PBX httpd 7.0(27)
| http-avaya-ipoffice-users:
|   title: Avaya IP Office User Listing
|   users:
|
|       full_name: John Doe
|       extension: 211
|       name: JDoe
|_  data_source: IPOFFICE/7.0(27) xxx.xxx.xxx.xxx

Requires

Author:

Paulino Calderon <calderon@websec.mx>