Documentation
¶
Overview ¶
CVE-2017-0144 (EternalBlue / MS17-010) detector for the pentest cve custom-detector adapter.
Wraps the stateful SMBv1 Negotiate + Session Setup AnDX + malformed Trans2 SESSION_SETUP probe in internal/pentest/smb/eternalblue — a check that cannot be expressed as a nuclei template because it requires multiple PDU exchanges over a raw TCP socket with precise wire-level byte sequences. The detector emits NucleiAttemptInfo so the existing PentestNetworkCveWorkflowProcessor in the ontology handles its results identically to nuclei-generated findings.
No new cobra subcommand or PentestSmbAction entry is added. The check is only reachable through:
pentest cve --cves CVE-2017-0144 --years 2017 --protocol SMB --targets <host>[:445]
Or indirectly via a broad `--years 2017` scan when the target string includes port 445 explicitly.
CVE-2019-0708 (BlueKeep) detector for the pentest cve custom-detector adapter.
Wraps the stateful RDP X.224 + TLS upgrade + MCS Channel-Join probe in internal/pentest/rdp/bluekeep — a check that cannot be expressed as a nuclei template because it requires multiple PDU exchanges with a mid-stream TLS upgrade. The detector emits NucleiAttemptInfo so the existing PentestNetworkCveWorkflowProcessor in the ontology handles its results identically to nuclei-generated findings.
Run via: pentest cve --years 2019 --protocol RDP --targets host:3389
Package detectors holds one file per non-nuclei CVE check.
Each file in this directory defines a single type implementing internal/pentest/cve.Detector and is registered in internal/pentest/cve/registry.go.
File naming: cve_<year>_<id>.go (lower-case, underscores). The type name uses Go-friendly underscores too: CVE_2024_12345.
Skeleton for a new detector:
package detectors
import (
"context"
nuclei "github.com/Method-Security/networkscan/generated/go/common/nuclei"
)
type CVE_2024_12345 struct{}
func (CVE_2024_12345) CVEID() string { return "CVE-2024-12345" }
func (CVE_2024_12345) Year() string { return "2024" }
func (CVE_2024_12345) Protocol() string { return "FTP" }
func (d CVE_2024_12345) Detect(ctx context.Context, target string, timeout int) (*nuclei.NucleiAttemptInfo, error) {
// 1. Probe the target. Use utils.ParseHostPort to split host:port.
// 2. Return (nil, nil) if the service doesn't match (wrong banner, port closed, etc.).
// 3. Return (nil, err) for fatal probe errors.
// 4. On a clean probe, return an attempt with Finding.Finding=false.
// 5. On a confirmed hit, return an attempt with Finding.Finding=true and
// populate the NucleiFindingInfo fields (Name, Description, Severity,
// Classification.Cves) so downstream processors see the same shape they
// would from a nuclei template.
return nil, nil
}
Register in internal/pentest/cve/registry.go:
var registeredDetectors = []cve.Detector{
&detectors.CVE_2024_12345{},
}
Index ¶
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
This section is empty.
Types ¶
type CVE_2017_0144 ¶ added in v0.0.192
type CVE_2017_0144 struct{}
CVE_2017_0144 implements cve.Detector for EternalBlue (MS17-010).
func (CVE_2017_0144) CVEID ¶ added in v0.0.192
func (CVE_2017_0144) CVEID() string
CVEID returns the canonical identifier.
func (CVE_2017_0144) Detect ¶ added in v0.0.192
func (d CVE_2017_0144) Detect(ctx context.Context, target string, timeoutSec int) (*nuclei.NucleiAttemptInfo, error)
Detect runs the EternalBlue precondition probe against a single target and converts the result into a NucleiAttemptInfo with TemplateId == CVEID().
timeoutSec is in seconds (matching PentestCveConfig.Timeout / nuclei's unit). RunEternalblueCheck expects milliseconds internally, so we multiply by 1000.
Return semantics follow the cve.Detector contract:
- Wrong port → (nil, nil). The caller-supplied target string specified an explicit non-445 port, so this is not an SMB service. Skipped silently — see the "port gate" comment block in the body.
- VULNERABLE → attempt with Finding.Finding = true, severity "critical", Classification.Cves populated with CVE-2017-0144.
- PATCHED → attempt with Finding.Finding = false (no CVE instance).
- NOT_APPLICABLE → attempt with Finding.Finding = false, name notes that SMBv1 is disabled / unavailable.
- INDETERMINATE → attempt with Finding.Finding = false plus a one-line explanation in the Name field; the full evidence is preserved in Metadata["eternalblue_evidence"] for forensic inspection.
Except in the "wrong port" case, a nil attempt is never returned: every reached target produces at least one piece of evidence (even an unreachable host yields INDETERMINATE with an error message) so downstream processors always see the probe was attempted.
func (CVE_2017_0144) Protocol ¶ added in v0.0.192
func (CVE_2017_0144) Protocol() string
Protocol returns the application protocol filter token. "SMB" matches the --protocol filter the operator passes to `pentest cve`.
func (CVE_2017_0144) Year ¶ added in v0.0.192
func (CVE_2017_0144) Year() string
Year returns the 4-digit publication year.
type CVE_2019_0708 ¶
type CVE_2019_0708 struct{}
CVE_2019_0708 implements cve.Detector for BlueKeep.
func (CVE_2019_0708) CVEID ¶
func (CVE_2019_0708) CVEID() string
CVEID returns the canonical identifier.
func (CVE_2019_0708) Detect ¶
func (d CVE_2019_0708) Detect(ctx context.Context, target string, timeoutSec int) (*nuclei.NucleiAttemptInfo, error)
Detect runs the BlueKeep precondition probe against a single target and converts the result into a NucleiAttemptInfo with TemplateId == CVEID().
timeoutSec is in seconds (matching PentestCveConfig.Timeout / nuclei's unit). RunCheck expects milliseconds internally, so we multiply by 1000.
Return semantics follow the cve.Detector contract:
- Wrong port → (nil, nil). The caller-supplied target string specified an explicit non-3389 port, so this is not an RDP service. Skipped silently — see the "port gate" comment block in the body.
- VULNERABLE → attempt with Finding.Finding = true, severity "critical", Classification.Cves populated with CVE-2019-0708.
- PATCHED → attempt with Finding.Finding = false (no CVE instance).
- INDETERMINATE → attempt with Finding.Finding = false plus a one-line explanation in the Name field; the full evidence is preserved in Metadata["bluekeep_evidence"] for forensic inspection.
func (CVE_2019_0708) Protocol ¶
func (CVE_2019_0708) Protocol() string
Protocol returns the application protocol filter token. "RDP" matches the --protocol filter the operator passes to `pentest cve`.
func (CVE_2019_0708) Year ¶
func (CVE_2019_0708) Year() string
Year returns the 4-digit publication year.
Source Files