mirror of
https://github.com/P-Aimon-Pen/ROFMAD
synced 2026-06-21 13:45:02 +00:00
paimon
108 lines
3.0 KiB
YAML
Executable File
108 lines
3.0 KiB
YAML
Executable File
specific_actions:
|
|
# ============================================================================
|
|
# SMB — port 445 is reliable in practice, keep contains condition
|
|
# ============================================================================
|
|
|
|
- name: "smb_signing_check"
|
|
condition:
|
|
contains: "445"
|
|
command: "nxc smb {{IP}}"
|
|
timeout_s: 60
|
|
tags:
|
|
- pattern: "signing:False"
|
|
tag: "smb-signing-disabled"
|
|
- pattern: "SMBv1:True"
|
|
tag: "smb-v1-enabled"
|
|
|
|
- name: "smb_anonymous_check"
|
|
condition:
|
|
contains: "445"
|
|
command: "nxc smb {{IP}}"
|
|
timeout_s: 60
|
|
tags:
|
|
- pattern: "Null Auth:True"
|
|
tag: "anonymous-smb-access"
|
|
|
|
- name: "smb_guest_check"
|
|
condition:
|
|
contains: "445"
|
|
has_not_tag: "anonymous-smb-access"
|
|
command: "nxc smb {{IP}} -u 'guest' -p ''"
|
|
timeout_s: 60
|
|
tags:
|
|
- pattern: "\\[\\+\\]"
|
|
tag: "guest-smb-access"
|
|
|
|
- name: "smb_share_enum_anonymous"
|
|
condition:
|
|
contains: "445"
|
|
has_tag: "anonymous-smb-access"
|
|
command: "nxc smb {{IP}} -u '' -p '' --shares"
|
|
timeout_s: 90
|
|
tags:
|
|
- pattern: "READ|WRITE"
|
|
tag: "unauthenticated-shares"
|
|
|
|
- name: "smb_share_enum_guest"
|
|
condition:
|
|
contains: "445"
|
|
has_tag: "guest-smb-access"
|
|
command: "nxc smb {{IP}} -u 'guest' -p '' --shares"
|
|
timeout_s: 90
|
|
tags:
|
|
- pattern: "READ|WRITE"
|
|
tag: "unauthenticated-shares"
|
|
|
|
- name: "smb_user_enum_anonymous"
|
|
condition:
|
|
contains: "445"
|
|
has_tag: "anonymous-smb-access"
|
|
command: "nxc smb {{IP}} -u '' -p '' --users"
|
|
timeout_s: 90
|
|
tags:
|
|
- pattern: "Enumerated"
|
|
tag: "unauthenticated-user-enum"
|
|
|
|
- name: "smb_user_enum_guest"
|
|
condition:
|
|
contains: "445"
|
|
has_tag: "guest-smb-access"
|
|
command: "nxc smb {{IP}} -u 'guest' -p '' --users"
|
|
timeout_s: 90
|
|
tags:
|
|
- pattern: "Enumerated"
|
|
tag: "unauthenticated-user-enum"
|
|
|
|
- name: "smb_vuln_check"
|
|
condition:
|
|
contains: "445"
|
|
has_tag: "Windows"
|
|
command: "nmap --script smb-vuln-ms17-010.nse -p445 {{IP}}"
|
|
timeout_s: 300
|
|
tags:
|
|
- pattern: "ms17-010.*VULNERABLE"
|
|
tag: "vulnerable-ms17-010"
|
|
|
|
# ============================================================================
|
|
# MSSQL — port varies (1433, 1434, named instances, dynamic ports)
|
|
# has_service with a single name → fires once per port running mssql
|
|
# {{SERVICE_PORT}} resolves to each instance's port in turn
|
|
# ============================================================================
|
|
|
|
- name: "mssql_sa_auth"
|
|
condition:
|
|
has_service: "mssql"
|
|
command: "nxc mssql {{IP}} -p {{SERVICE_PORT}} -u 'sa' -p 'sa'"
|
|
timeout_s: 60
|
|
tags:
|
|
- pattern: "\\[\\+\\]"
|
|
tag: "mssql-anonymous-access"
|
|
|
|
- name: "mssql_sa_auth-local-auth"
|
|
condition:
|
|
has_service: "mssql"
|
|
command: "nxc mssql {{IP}} -p {{SERVICE_PORT}} -u 'sa' -p 'sa' --local-auth"
|
|
timeout_s: 60
|
|
tags:
|
|
- pattern: "\\[\\+\\]"
|
|
tag: "mssql-anonymous-access" |