id: perforce-detection

info:
  name: Perforce Server - Detection
  author: Morgan Robertson
  severity: info
  description: |
    Detecetd Perforce server was identified by emulating the binary handshake of a "p4 info" command and matching server-side keywords in the response.
  reference:
    - https://morganrobertson.net/p4wned/
    - https://www.keysight.com/blogs/en/tech/nwvs/2022/06/08/a-sneak-peek-into-the-protocol-behind-perforce
    - https://help.perforce.com/helix-core/release-notes/current/relnotes.txt
  classification:
    cpe: cpe:2.3:a:perforce:helix_core:*:*:*:*:*:*:*:*
  metadata:
    verified: true
    max-request: 2
    vendor: perforce
    product: helix_core
    shodan-query: port:1666 "P4D"
    fofa-query: port="1666" && protocol="unknown"
  tags: perforce,helixcore,scm,detect,p4d

tcp:
  - host:
      - "{{Host}}:{{Port}}"
      - "{{Host}}:1666"

    inputs:
      - type: hex
        data: "efef000000636d7066696c65000000000000616c7453796e63000000000000636c69656e7400020000003937006170690005000000393939393900656e61626c6553747265616d73000000000000656e61626c654772617068000000000000657870616e64416e646d6170730000000000006368756e6b696e67000000000000686f737400090000006c6f63616c686f737400706f727400120000003139322e3136382e302e3130313a3136363600736e646275660007000000313936393931390072637662756600050000003938333034006175746f54756e650001000000310066756e63000800000070726f746f636f6c00eded00000076657273696f6e001c000000323032342e322f4c494e555832365838365f36342f32363937383232006175746f4c6f67696e00000000000070726f670002000000703400636c69656e7400090000006c6f63616c686f73740063776400040000002f746d7000686f737400090000006c6f63616c686f7374006f730004000000554e4958006c6f63616c65000100000043007573657200040000007573657200756e69636f6465000000000000636861727365740001000000310075746638626f6d00010000003100636c69656e74436173650001000000300066756e630009000000757365722d696e666f00"

    read-size: 4096
    stop-at-first-match: true
    matchers:
      - type: word
        part: data
        encoding: hex
        words:
          - "xfiles"
          - "server"
        condition: and
# digest: 4a0a00473045022100da1416e05e794f56847d93206192607d9da2ef5351bde260d38020a270d7695a02204e2e37ff263641e47ac9d6718c338e6f4d759e9b2c4e7f81d80fc7633a88d691:922c64590222798bb761d5b6d8e72950