recog 2.3.22 → 2.3.23

data/xml/snmp_sysobjid.xml

@@ -89,8 +89,8 @@
 
   <fingerprint pattern="^Microsoft Windows CE Version ([\d.]+)">
     <description>Windows CE</description>
-    <example>Microsoft Windows CE Version 4.20 (Build 0)</example>
-    <example>Microsoft Windows CE Version 4.20 (Build 1088)</example>
+    <example os.version="4.20">Microsoft Windows CE Version 4.20 (Build 0)</example>
+    <example os.version="4.20">Microsoft Windows CE Version 4.20 (Build 1088)</example>
     <param pos="0" name="os.vendor" value="Microsoft"/>
     <param pos="0" name="os.family" value="Windows"/>
     <param pos="0" name="os.product" value="Windows CE"/>

data/xml/ssh_banners.xml

@@ -653,7 +653,7 @@
   <fingerprint pattern="^OpenSSH_(4\.2p1) (Debian-7ubuntu\d+(?:\.\d+)?)$">
     <description>OpenSSH running on Ubuntu 6.04</description>
     <example service.version="4.2p1" openssh.comment="Debian-7ubuntu3.1">OpenSSH_4.2p1 Debian-7ubuntu3.1</example>
-    <example>OpenSSH_4.2p1 Debian-7ubuntu3.2</example>
+    <example service.version="4.2p1" openssh.comment="Debian-7ubuntu3.2">OpenSSH_4.2p1 Debian-7ubuntu3.2</example>
     <param pos="1" name="service.version"/>
     <param pos="2" name="openssh.comment"/>
     <param pos="0" name="service.vendor" value="OpenBSD"/>
@@ -686,9 +686,9 @@
   <fingerprint pattern="^OpenSSH_(4\.6p1) (Debian-5ubuntu\d+(?:\.\d+)?)$">
     <description>OpenSSH running on Ubuntu 7.10</description>
     <example service.version="4.6p1" openssh.comment="Debian-5ubuntu0.2">OpenSSH_4.6p1 Debian-5ubuntu0.2</example>
-    <example>OpenSSH_4.6p1 Debian-5ubuntu0.5</example>
-    <example>OpenSSH_4.6p1 Debian-5ubuntu0.6</example>
-    <example>OpenSSH_4.6p1 Debian-5ubuntu0</example>
+    <example service.version="4.6p1" openssh.comment="Debian-5ubuntu0.5">OpenSSH_4.6p1 Debian-5ubuntu0.5</example>
+    <example service.version="4.6p1" openssh.comment="Debian-5ubuntu0.6">OpenSSH_4.6p1 Debian-5ubuntu0.6</example>
+    <example service.version="4.6p1" openssh.comment="Debian-5ubuntu0">OpenSSH_4.6p1 Debian-5ubuntu0</example>
     <param pos="1" name="service.version"/>
     <param pos="2" name="openssh.comment"/>
     <param pos="0" name="service.vendor" value="OpenBSD"/>
@@ -858,7 +858,7 @@
   <fingerprint pattern="^OpenSSH_(6\.0p1) (Debian-3ubuntu\d(?:\.\d)?)$">
     <description>OpenSSH running on Ubuntu 12.10</description>
     <example service.version="6.0p1" openssh.comment="Debian-3ubuntu1">OpenSSH_6.0p1 Debian-3ubuntu1</example>
-    <example>OpenSSH_6.0p1 Debian-3ubuntu1.2</example>
+    <example service.version="6.0p1" openssh.comment="Debian-3ubuntu1.2">OpenSSH_6.0p1 Debian-3ubuntu1.2</example>
     <param pos="1" name="service.version"/>
     <param pos="2" name="openssh.comment"/>
     <param pos="0" name="service.vendor" value="OpenBSD"/>
@@ -1732,6 +1732,7 @@
 
   <fingerprint pattern="^SSH Protocol Compatible Server SCS (.*)$">
     <description>Netscreen with version</description>
+    <example service.version="2.0">SSH Protocol Compatible Server SCS 2.0</example>
     <param pos="1" name="service.version"/>
     <param pos="0" name="service.vendor" value="Juniper"/>
     <param pos="0" name="service.family" value="NetScreen"/>
@@ -1859,6 +1860,7 @@
 
   <fingerprint pattern="^([\d.]{1,8}) sshlib: MOVEit DMZ SSH (.*)$">
     <description>MOVEit DMZ (which uses Bitvise sshlib)</description>
+    <example service.component.version="1.29" service.version="3.0.5.0">1.29 sshlib: MOVEit DMZ SSH 3.0.5.0</example>
     <param pos="1" name="service.component.version"/>
     <param pos="2" name="service.version"/>
     <param pos="0" name="service.component.vendor" value="Bitvise"/>
@@ -1886,6 +1888,7 @@
 
   <fingerprint pattern="^Pragma SecureShell\s*(.*)$">
     <description>Pragma SecureShell</description>
+    <example service.version="3.0">Pragma SecureShell 3.0</example>
     <param pos="1" name="service.version"/>
     <param pos="0" name="service.vendor" value="Pragma Systems"/>
     <param pos="0" name="service.family" value="FortressSSH Server"/>
@@ -2047,6 +2050,7 @@
 
   <fingerprint pattern="MultiNet">
     <description>Process Software MultiNet is a suite of network apps for OpenVMS</description>
+    <example>Process Software SSH 6.1.5.0 MultiNet</example>
     <param pos="0" name="service.vendor" value="Process Software"/>
     <param pos="0" name="service.family" value="MultiNet"/>
     <param pos="0" name="service.product" value="MultiNet"/>

data/xml/telnet_banners.xml

@@ -2238,6 +2238,55 @@
     <param pos="3" name="hw.version"/>
   </fingerprint>
 
+  <fingerprint pattern="^(TAU-\d+[A-Z]*(?:\.IP)?) login:$$">
+    <description>Eltex TAU model VoIP gateway</description>
+    <example hw.product="TAU-8">TAU-8 login:</example>
+    <example hw.product="TAU-2M.IP">TAU-2M.IP login:</example>
+    <param pos="0" name="os.vendor" value="Eltex"/>
+    <param pos="0" name="os.product" value="{hw.product} Firmware"/>
+    <param pos="0" name="os.device" value="VoIP Gateway"/>
+    <param pos="0" name="hw.vendor" value="Eltex"/>
+    <param pos="1" name="hw.product"/>
+    <param pos="0" name="hw.device" value="VoIP Gateway"/>
+  </fingerprint>
+
+  <fingerprint pattern="(?m)^\**(?:\r|\n)*\**\s*Welcome to (SMG-?\d+[A-Z]?)\s*\**(?:\r|\n)*\**(?:\r|\n)+(\S+) login:\s*$">
+    <description>Eltex SMG model VoIP gateway - banner with model number</description>
+    <!--
+      ********************************************
+      *            Welcome to SMG1016M           *
+      ********************************************
+
+      foo.bar.baz login:
+    -->
+    <example hw.product="SMG1016M" host.name="foo.bar.baz" _encoding="base64">
+      DQ0KDQoNKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioNCg0qI
+      CAgICAgICAgICAgV2VsY29tZSB0byBTTUcxMDE2TSAgICAgICAgICAgKg0KDSoqKioqKioqKi
+      oqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqDQoNDQoNZm9vLmJhci5iYXogbG9
+      naW46IA==
+    </example>
+    <param pos="0" name="os.vendor" value="Eltex"/>
+    <param pos="0" name="os.product" value="{hw.product} Firmware"/>
+    <param pos="0" name="os.device" value="VoIP Gateway"/>
+    <param pos="0" name="hw.vendor" value="Eltex"/>
+    <param pos="1" name="hw.product"/>
+    <param pos="0" name="hw.device" value="VoIP Gateway"/>
+    <param pos="2" name="host.name"/>
+  </fingerprint>
+
+  <fingerprint pattern="^eltex-nv(\d+) login:$">
+    <description>Eltex - NV model IPTV set top box</description>
+    <example hw.model="101">eltex-nv101 login:</example>
+    <example hw.product="NV102">eltex-nv102 login:</example>
+    <param pos="0" name="os.vendor" value="Eltex"/>
+    <param pos="0" name="os.product" value="{hw.product} Firmware"/>
+    <param pos="0" name="os.device" value="IPTV"/>
+    <param pos="1" name="hw.model"/>
+    <param pos="0" name="hw.vendor" value="Eltex"/>
+    <param pos="0" name="hw.product" value="NV{hw.model}"/>
+    <param pos="0" name="hw.device" value="IPTV"/>
+  </fingerprint>
+
   <fingerprint pattern="&quot;BeerTemp&quot;:.*&quot;FridgeTemp&quot;:">
     <description>Fermentrack Beer Brewing Monitor</description>
     <example>T:{"BeerTemp":null,"BeerSet":null,"BeerAnn":null,"FridgeTemp":null,"FridgeSet":null,"FridgeAnn":null,"State":0}</example>

data/xml/tls_jarm.xml

@@ -56,9 +56,13 @@
     <param pos="0" name="os.device" value="Router"/>
   </fingerprint>
 
-  <fingerprint pattern="^07d14d16d21d21d00042d43d000000aa99ce74e2c6d013c745aa52b5cc042d$">
+  <fingerprint pattern="^07d14d16d21d21d00042d43d000000aa99ce74e2c6d013c745aa52b5cc042d|07d14d16d21d21d07c42d43d000000f50d155305214cf247147c43c0f1a823|07b08b09b21b21b07b07b08b07b21b23aeefb38b723c523befb314af6e95ac|07c08c09c21c21c07c07c08c07c21c23aeefb38b723c523befb314af6e95ac|07d14d16d21d21d00007d14d07d21d0ae59125bcd90b8876b50928af8f6cd4$">
     <description>Metasploit listener</description>
+    <example>07b08b09b21b21b07b07b08b07b21b23aeefb38b723c523befb314af6e95ac</example>
+    <example>07c08c09c21c21c07c07c08c07c21c23aeefb38b723c523befb314af6e95ac</example>
+    <example>07d14d16d21d21d00007d14d07d21d0ae59125bcd90b8876b50928af8f6cd4</example>
     <example>07d14d16d21d21d00042d43d000000aa99ce74e2c6d013c745aa52b5cc042d</example>
+    <example>07d14d16d21d21d07c42d43d000000f50d155305214cf247147c43c0f1a823</example>
     <param pos="0" name="service.vendor" value="Rapid7"/>
     <param pos="0" name="service.product" value="Metasploit"/>
     <param pos="0" name="service.cpe23" value="cpe:/a:rapid7:metasploit:-"/>
@@ -67,9 +71,10 @@
   <!-- This fingerprint matches Java's TLS stack,
     see https://blog.cobaltstrike.com/2020/12/08/a-red-teamer-plays-with-jarm/ for details -->
 
-  <fingerprint pattern="^07d14d16d21d21d07c42d41d00041d24a458a375eef0c576d23a7bab9a9fb1$">
+  <fingerprint pattern="^07d14d16d21d21d07c42d41d00041d24a458a375eef0c576d23a7bab9a9fb1|07d14d16d21d21d00042d41d00041de5fb3038104f457d92ba02e9311512c2$">
     <description>Cobalt Strike listener</description>
     <example>07d14d16d21d21d07c42d41d00041d24a458a375eef0c576d23a7bab9a9fb1</example>
+    <example>07d14d16d21d21d00042d41d00041de5fb3038104f457d92ba02e9311512c2</example>
     <param pos="0" name="service.vendor" value="Strategic Cyber LLC"/>
     <param pos="0" name="service.product" value="Cobalt Strike Listener"/>
     <param pos="0" name="service.certainty" value="0.3"/>
@@ -159,4 +164,19 @@
     <param pos="0" name="service.product" value="Merlin"/>
   </fingerprint>
 
+  <fingerprint pattern="^21d14d00000000000021d14d21d21d16c46827964490e6024618c0a3d7d893$">
+    <description>Covenant .NET C2 framework</description>
+    <example>21d14d00000000000021d14d21d21d16c46827964490e6024618c0a3d7d893</example>
+    <param pos="0" name="service.product" value="Covenant"/>
+  </fingerprint>
+
+  <fingerprint pattern="^16d16d16d14d16d00016d16d16d16da6fda484e06f95db4f56339284c90672$">
+    <description>HP Printer</description>
+    <example>16d16d16d14d16d00016d16d16d16da6fda484e06f95db4f56339284c90672</example>
+    <param pos="0" name="hw.device" value="Printer"/>
+    <param pos="0" name="hw.vendor" value="HP"/>
+    <param pos="0" name="os.vendor" value="HP"/>
+    <param pos="0" name="os.device" value="Printer"/>
+  </fingerprint>
+
 </fingerprints>

data/xml/x11_banners.xml

@@ -62,13 +62,13 @@
   <fingerprint pattern="^Fedora Project$">
     <description>Fedora Project</description>
     <example>Fedora Project</example>
-    <param pos="0" name="os.vendor" value="Red Hat"/>
+    <param pos="0" name="os.vendor" value="Fedora Project"/>
     <param pos="0" name="service.vendor" value="X.Org"/>
     <param pos="0" name="service.product" value="X.Org X11"/>
     <param pos="0" name="service.cpe23" value="cpe:/a:x.org:x11:-"/>
-    <param pos="0" name="os.product" value="Fedora Core Linux"/>
+    <param pos="0" name="os.product" value="Fedora Core"/>
     <param pos="0" name="os.family" value="Linux"/>
-    <param pos="0" name="os.cpe23" value="cpe:/o:redhat:fedora_core:-"/>
+    <param pos="0" name="os.cpe23" value="cpe:/o:fedoraproject:fedora_core:-"/>
   </fingerprint>
 
   <fingerprint pattern="^freedesktop\.org$">

data/xml/x509_issuers.xml

@@ -377,10 +377,11 @@
   </fingerprint>
 
   <fingerprint pattern="(?i)^CN=\S+,OU=FreshTomato Team,O=FreshTomato,L=Columbus,ST=Ohio,C=US(?:.*)$">
-    <description>FreshTomato Router Fireware</description>
+    <description>FreshTomato Router Firmware</description>
     <example>CN=192.168.1.1,OU=FreshTomato Team,O=FreshTomato,L=Columbus,ST=Ohio,C=US</example>
     <param pos="0" name="os.vendor" value="FreshTomato"/>
-    <param pos="0" name="os.product" value="Linux"/>
+    <param pos="0" name="os.family" value="Linux"/>
+    <param pos="0" name="os.product" value="FreshTomato"/>
     <param pos="0" name="os.device" value="Router"/>
   </fingerprint>
 

data/xml/x509_subjects.xml

@@ -248,7 +248,7 @@
   <fingerprint pattern="^CN=OA\-([a-fA-F0-9]+),OU=Onboard Administrator,">
     <description>HP iLO (Onboard Administrator)</description>
     <example host.mac="001F296E21A3">CN=OA-001F296E21A3,OU=Onboard Administrator,O=Corp.,L=Location,ST=N/A,C=US</example>
-    <example>CN=OA-80C16E999999,OU=Onboard Administrator,O=Hewlett-Packard</example>
+    <example host.mac="80C16E999999">CN=OA-80C16E999999,OU=Onboard Administrator,O=Hewlett-Packard</example>
     <param pos="0" name="hw.device" value="Lights Out Management"/>
     <param pos="0" name="hw.vendor" value="HP"/>
     <param pos="0" name="hw.family" value="iLO"/>
@@ -353,8 +353,8 @@
 
   <fingerprint pattern="^CN=HP Jetdirect [a-zA-Z0-9]+,OU=([a-fA-F0-9]{12})\+OU=([a-zA-Z0-9]+),O=Hewlett-Packard Co\.$">
     <description>HP Jet Direct - with host MAC and product</description>
-    <example host.mac="2C413883186A" hw.product="J8028E">CN=HP Jetdirect 38831831,OU=2C413883186A+OU=J8028E,O=Hewlett-Packard Co.</example>
-    <example os.product="J8016E">CN=HP Jetdirect FBFA31E7,OU=8851FBE33ABB+OU=J8016E,O=Hewlett-Packard Co.</example>
+    <example host.mac="2C413883186A" hw.product="J8028E" os.product="J8028E">CN=HP Jetdirect 38831831,OU=2C413883186A+OU=J8028E,O=Hewlett-Packard Co.</example>
+    <example os.product="J8016E" host.mac="8851FBE33ABB" hw.product="J8016E">CN=HP Jetdirect FBFA31E7,OU=8851FBE33ABB+OU=J8016E,O=Hewlett-Packard Co.</example>
     <param pos="0" name="hw.device" value="Printer"/>
     <param pos="0" name="hw.vendor" value="HP"/>
     <param pos="0" name="hw.family" value="JetDirect"/>

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: recog
 version: !ruby/object:Gem::Version
-  version: 2.3.22
+  version: 2.3.23
 platform: ruby
 authors:
 - Rapid7 Research
 autorequire:
 bindir: bin
 cert_chain: []
-date: 2021-12-14 00:00:00.000000000 Z
+date: 2022-03-30 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: rspec
@@ -137,6 +137,10 @@ files:
 - ".ruby-version"
 - ".snyk"
 - ".travis.yml"
+- ".vscode/bin/monitor-recog-fingerprints.sh"
+- ".vscode/extensions.json"
+- ".vscode/settings.json"
+- ".vscode/tasks.json"
 - ".yardopts"
 - CONTRIBUTING.md
 - COPYING
@@ -155,12 +159,14 @@ files:
 - features/data/multiple_banners_fingerprints.xml
 - features/data/no_tests.xml
 - features/data/sample_banner.txt
+- features/data/schema_failure.xml
 - features/data/successful_tests.xml
 - features/data/tests_with_failures.xml
 - features/data/tests_with_warnings.xml
 - features/match.feature
 - features/support/aruba.rb
 - features/support/env.rb
+- features/support/hooks.rb
 - features/verify.feature
 - identifiers/README.md
 - identifiers/fields.txt
@@ -180,13 +186,13 @@ files:
 - lib/recog/fingerprint.rb
 - lib/recog/fingerprint/regexp_factory.rb
 - lib/recog/fingerprint/test.rb
+- lib/recog/fingerprint_parse_error.rb
 - lib/recog/formatter.rb
 - lib/recog/match_reporter.rb
 - lib/recog/matcher.rb
 - lib/recog/matcher_factory.rb
 - lib/recog/nizer.rb
 - lib/recog/verifier.rb
-- lib/recog/verifier_factory.rb
 - lib/recog/verify_reporter.rb
 - lib/recog/version.rb
 - misc/convert_mysql_err
@@ -196,6 +202,10 @@ files:
 - spec/data/best_os_match_1.yml
 - spec/data/best_os_match_2.yml
 - spec/data/best_service_match_1.yml
+- spec/data/external_example_fingerprint.xml
+- spec/data/external_example_fingerprint/hp_printer_ex_01.txt
+- spec/data/external_example_fingerprint/hp_printer_ex_02.txt
+- spec/data/external_example_illegal_path_fingerprint.xml
 - spec/data/smb_native_os.txt
 - spec/data/test_fingerprints.xml
 - spec/data/verification_fingerprints.xml
@@ -289,16 +299,22 @@ test_files:
 - features/data/multiple_banners_fingerprints.xml
 - features/data/no_tests.xml
 - features/data/sample_banner.txt
+- features/data/schema_failure.xml
 - features/data/successful_tests.xml
 - features/data/tests_with_failures.xml
 - features/data/tests_with_warnings.xml
 - features/match.feature
 - features/support/aruba.rb
 - features/support/env.rb
+- features/support/hooks.rb
 - features/verify.feature
 - spec/data/best_os_match_1.yml
 - spec/data/best_os_match_2.yml
 - spec/data/best_service_match_1.yml
+- spec/data/external_example_fingerprint.xml
+- spec/data/external_example_fingerprint/hp_printer_ex_01.txt
+- spec/data/external_example_fingerprint/hp_printer_ex_02.txt
+- spec/data/external_example_illegal_path_fingerprint.xml
 - spec/data/smb_native_os.txt
 - spec/data/test_fingerprints.xml
 - spec/data/verification_fingerprints.xml

data/lib/recog/verifier_factory.rb

@@ -1,13 +0,0 @@
-require 'recog/verifier'
-require 'recog/formatter'
-require 'recog/verify_reporter'
-
-module Recog
-module VerifierFactory
-  def self.build(options, db)
-    formatter = Formatter.new(options, $stdout)
-    reporter  = VerifyReporter.new(options, formatter, db.path)
-    Verifier.new(db, reporter)
-  end
-end
-end