Add OPC UA TCP service detection

[ValtteriL]

Add OPC UA TCP service detection

Send HEL message with invalid EndpointURI and expect either ACK or ERR as response [1].
Ports are default ports on popular OPC UA software [2].
Rarity based on gut feeling.

References:

1. https://reference.opcfoundation.org/Core/Part6/v104/docs/7
2. https://claroty.com/team82/research/opc-ua-deep-dive-series-a-one-of-a-kind-opc-ua-exploit-framework

[f0rw4rd]

Adding multiple ports is a good idea :-)
I have a similar PR pending #2730, maybe we can merge the ideas?

[ValtteriL]

Indeed we should! You seem to have a more complete solution with error codes and all. With added ports it would be best of both worlds? :)

Can you add the ports to your PR? I can then try yours against my test systems and then proceed to close this one in favor of yours.

[f0rw4rd]

Sorry for the late response. You wrote such a nice blog article about on how to add custom services probes and I would like to support this by closing my PR. Could you include the error code detection from my PR ?

[ValtteriL]

I decreased the rarity by one and added the ports to the OPC UA probe. Otherwise kept your changes. Worked well on my systems. 💪

valtteri@t490:~/development/nmap/my-dir$ sudo nmap -T4 -n -sV --open -Pn --datadir . -p 53530 echo.koti.kontu
Starting Nmap 7.80 ( https://nmap.org ) at 2024-04-07 20:19 EEST
Nmap scan report for echo.koti.kontu (172.16.1.8)
Host is up (0.0027s latency).

PORT      STATE SERVICE VERSION
53530/tcp open  opcua   OPC UA Binary Connection Protocol (Error 2156068864 Bad_TcpEndpointUrlInvalid (code=0x80830000, description="The server does not recognize the QueryString ...)

Read from .: nmap-service-probes.
Read from /usr/bin/../share/nmap: nmap-payloads nmap-services.
Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 6.53 seconds

[f0rw4rd]

Looks good, closed my PR