Add drda module for IBM DB2 / DRDA database servers#748
Open
Seanstoppable wants to merge 5 commits into
Open
Conversation
Adds a new `drda` scan module that probes DRDA (Distributed Relational
Database Architecture) database servers on TCP port 50000. DRDA is spoken by
IBM DB2 (and Apache Derby / Informix).
The module sends a DRDA EXCSAT ("Exchange Server Attributes") request and
parses the EXCSATRD reply, decoding the EBCDIC-encoded attributes into
structured output: server class / platform (e.g. QDB2/NT64), instance name,
product release level (e.g. SQL11013), a human-readable version (11.01.3),
and external name. This mirrors the data surfaced by Shodan and nmap's
drda-info script.
Includes:
- modules/drda: scanner, DRDA packet build/parse, EBCDIC decoding, unit tests
- zgrab2_schemas/zgrab2/drda.py: output schema
- integration_tests/drda: mock DRDA server container + test.sh
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
The drda module parses untrusted binary input (binary.BigEndian, io.ReadFull), so scripts/check-fuzz-coverage.sh requires a fuzz test. Add FuzzParseEXCSATRD covering parseEXCSATRD with real, minimal, and adversarial (short buffers, bad magic, lying length prefixes, overrunning parameters) seed inputs. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
- golangci-lint (prealloc): preallocate DDM buffer capacity in buildEXCSAT and the test helper so the trailing append does not reallocate. - black: reformat drda.py schema and mock server.py to satisfy the Python formatter. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Remove the mock DRDA server container and docker-compose wiring. The module's unit tests (drda_test.go) and fuzz test already cover the DRDA build/parse logic, matching the convention of other binary-protocol modules (e.g. modbus, oracle, siemens) that ship without an integration test. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Complete the integration-test removal: drop the drda service block and drda-network that referenced the now-deleted ./drda/container context. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This PR was generated with the assistance of GitHub Copilot CLI and may require human review.
Summary
Adds a new
drdascan module that probes DRDA (Distributed Relational Database Architecture) database servers on TCP port 50000. DRDA is the wire protocol spoken by IBM DB2 (and Apache Derby / Informix).The module sends a DRDA EXCSAT ("Exchange Server Attributes") request and parses the EXCSATRD reply, decoding the EBCDIC-encoded attributes into structured JSON. This mirrors the data surfaced by Shodan and nmap's
drda-infoscript.Example against a live DB2 11.1 server:
{"protocol":"drda","port":50000,"result":{ "server_class":"QDB2/NT64","instance_name":"DB2", "release_level":"SQL11013","version":"11.01.3", "external_name":"DB2 db2sysc ...%FED%Y00"}}Run it:
echo <ip> | zgrab2 drda --port 50000Output fields
server_classQDB2/NT64instance_nameDB2release_levelSQL11013version11.01.3external_nameDB2 db2sysc ...product_idChanges
modules/drda/— scanner, DRDA packet build/parse, EBCDIC decoding, unit + live testsmodules/drda.go— module registrationzgrab2_schemas/zgrab2/drda.py— output schema (registered in__init__.py)integration_tests/drda/— a minimal mock DRDA server container +test.shTesting
go test ./modules/drda/— passgofmt/go vet— cleannmap --script drda-info