LANGuard Script

LANGuard Script is the encyclopedia’s name for LANS (LANguard Scripting), a small scripting language that GFI Software Ltd. built into GFI LANguard Network Security Scanner (N.S.S.), a Windows network vulnerability scanner. LANS let administrators write their own security checks: open a socket to a target, send a probe, read the reply and report whether the machine was vulnerable. It shipped with version 3 of the scanner in 2002. GFI replaced it with a VBScript-compatible engine in version 5 in 2004, so LANS had a working life of roughly a year and a half.

History & Origins

LANguard before LANS

GFI, which in 2000 still traded as GFI FAX & VOICE and was best known for fax servers, used the LANguard name for several security products. A June 2000 capture of languard.com shows “LANguard - Internet Access Control” from GFI FAX & VOICE. The scanner manuals later carried the notice “LANguard is copyright of GFI SOFTWARE Ltd. 2000-…”. That is probably where this encyclopedia’s catalogue year of 2000 comes from, but it is the year of the brand, not of the language.

The network scanner came next. It began as freeware, reportedly first released in August 2001 as LANguard Network Scanner; version 2.0 followed in a press release dated 27 February 2002, with a $99 commercial edition alongside the free one. GFI’s feature page for it, as captured in August 2002, lists port scanning, share and user enumeration and patch checks, but nothing about scripting.

Version 3 and LANS

On 19 September 2002 GFI launched GFI LANguard Network Security Scanner 3.0, which it described as “a commercial version of its popular freeware tool for conducting network security audits”. From October 2002 the product’s feature page includes a new entry:

LANguard Scripting (LANS)* — GFI LANguard N.S.S. includes a script creator for writing complex security checks. It includes a script editor with syntax highlighting capabilities and a debugger. Use GFI LANguard N.S.S. to create custom security checks for your network.

The asterisk marked features that only worked in the registered version. GFI’s own white paper from late 2002, which compared N.S.S. 3.0 with eEye Retina and Shavlik HFNetChk Pro, said that “a scripting language has been added to GFI LANguard N.S.S. to help in the creation of scripts and alerts”, alongside the scanner’s roughly 300 built-in alerts.

This page uses 2002 as the year LANS first appeared. No source found for this page shows LANS in any LANguard product before N.S.S. 3.0.

The 3.3 manual

The fullest description of the language is in the manual for N.S.S. 3.3, dated 28 March 2003. It gives LANS a 28-page chapter: syntax, a tutorial, a function reference and a short list of future plans. The chapter opens with a warning:

IMPORTANT NOTE: GFI cannot offer any support in the analysis of scripts that you have created that are not working. Therefore the LANguard scripting feature is unsupported.

The manual’s credits name two third-party components: TSynEdit, the syntax-highlighting editor control, and TRegExpr, Andrey V. Sorokin’s regular-expression library, which LANS used for its regexp function. Both are Delphi component libraries. That suggests the LANS editor and interpreter were written in Delphi, although GFI never said so.

Design Philosophy

LANS was a tool for one job: deciding whether a single host had a particular weakness. The design follows from that.

• A check is a script that returns yes or no. Before a script runs, the scanner sets the string _ip to the address of the machine being scanned. The script must set the integer _return to 1 (vulnerable) or 0 (not vulnerable) before it ends.
• Scripts are one condition among several. An alert could combine an operating-system test, an open-port test, a banner test and a LANS script, and it fired only if all of them matched. A script could therefore assume the cheap checks had already passed.
• Network I/O is built in. TCP and UDP sockets, DNS, WhoIs, SNMP and remote registry reads are ordinary functions, not library imports.
• Keep the language small. There are two data types, two control structures and no user-defined functions or procedures in the documented syntax.

The manual says scripts are for “Expert Users” only, the same warning it gives for hand-built alerts.

Key Features

Syntax

Comments start with #. Variables must be declared before use, and a declaration cannot also assign a value:

1
2
3
4
5
6

string   str1, str2
integer  i1, i2, j

i1 = 100
i2 = $3f          # hexadecimal uses a $ prefix; 0x3f is not allowed
str1 = "a sample string"   # strings use double quotes only

Strings can also be built from byte values, which suits network protocols, and they can be indexed from 1:

1
2
3
4

string stringVar
stringVar = {$41, $42, $43}                 # "ABC"
stringVar = stringVar + "DEF" + {$13, $10}
echo(stringVar[1])                          # prints A

The manual’s comment calls {$13, $10} an end-of-line, but with the $ prefix those are hexadecimal: CR+LF would be {$0D, $0A}. The snippet is quoted as printed.

A backslash at the end of a line continues the expression on the next line. The manual uses it for a long byte string called get_names, which appears to be a NetBIOS name-status query.

Operators and control flow

The only control structures are if … else … end if and while … end while.

Built-in functions

The 3.3 manual groups the built-in functions like this:

Functions that return more than one result, such as snmpget and registryRead, take the name of the receiving variable as a quoted string, for example registryRead(ip, path, key, "version").

echo writes to the debugger window and takes an optional colour: _color_black, _color_red, _color_green, _color_blue, _color_purple, _color_silver, _color_yellow, or an RGB value such as $1F11FF. writetolog appends to lans_log.txt.

A complete check

This is the manual’s tutorial script, which tests for a bug in the Solaris finger daemon that lists every account in response to finger "a b c d e f g h"@host:

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21

# Solaris finger bug '@a b c d e f g h'
string request, data, fdata
integer sock
#_ip = "192.168.8.10"
_return = 0
echo("ip= " +_ip,_color_green)
request = "a b c d e f g h" + _eol
sock = open_tcp(_ip, 79)
if sock > 0
   send(sock, request)
   fdata = ""
   data = "1"
   while length(data) > 0
      data = recv(sock, 256)
      fdata = fdata + data
   end while
   echo(fdata)
   if pos("nobody", fdata) > 0
      _return = 1
   end if
end if

_eol is a predefined CR+LF string. The commented-out _ip line is there so a developer can point the script at a test machine while debugging it. The script was saved with a .lans extension next to the alert definition in the scanner’s Alerts\Miscellaneous folder.

Evolution

The 3.3 manual’s “Future Plans for LANS” promised closer integration with the scanner’s window and “the capability to forge IP packets and a nice packet editor”. Neither appears in the sources. GFI went to VBScript instead. Its N.S.S. 5 manual gives this skeleton for a check:

Function Main
echo "Script has run successfully"
Main = true
End Function

The structure is the same as in LANS: a script per check, a true/false result, an echo for debugging output. The language underneath was now one that Windows administrators already knew. The 5.0 manual still says “LANS script QRS run and checks for the vulnerability” in one example, left over from the 3.x text.

Current Relevance

LANS is historical. It existed only inside GFI’s commercial scanner, it was never published separately, and the last manual that documents it dates from 2003. No interpreter is available apart from old N.S.S. 3.x installers, and there is no Docker image.

The language survives in two places: the 3.x manual in the Internet Archive, and a “99 Bottles of Beer” program submitted on 20 April 2005 by 3pixelBob under the name “LANGuard Script”. That program uses exactly the syntax in the manual:

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15

integer num_beers

num_beers = 99

while num_beers > 0
      echo( inttostr( num_beers ) + " bottles of beer on the wall," )
      echo( inttostr( num_beers ) + " bottles of beer," )
      echo( "Take one down and pass it around," )
      num_beers = num_beers - 1
      echo( inttostr( num_beers ) + " bottles of beer on the wall." )
end while

if num_beers = 0
   echo( "No more beer!", _color_red )
end if

The product continues as GFI LanGuard. Its custom checks are now written in VBScript or Python.

Why It Matters

LANS belongs to the family of small check languages built into vulnerability scanners, of which Nessus’s NASL is the best known. A built-in language with sockets, SNMP and registry access as first-class functions let a scanner’s users add checks the day an advisory appeared, without waiting for the vendor.

It also shows why such languages often did not last. GFI wrote, documented and debugged its own interpreter, then said in the manual that it could not support the scripts people wrote with it. By version 5 it had switched to a VBScript-compatible engine, a language its Windows-administrator customers already knew. The check model stayed the same: one script per vulnerability, returning true or false.

Sources

• GFI Software Ltd., GFI LANguard Network Security Scanner 3.3 Manual, version 3.3, last updated 28 March 2003, chapter “LANS: LANguard Scripting” (archived copy of gfi.com/lannetscan/lanscan3manual.pdf).
• GFI Software Ltd., GFI LANguard Network Security Scanner 5 Manual, version 5.0, 2004 (archived copy of gfi.com/lannetscan/lanscan5manual.pdf).
• GFI LANguard N.S.S. product pages, features list and comparison white paper, gfi.com/lannetscan/, archived August–December 2002.
• GFI Software Ltd., GFI LANguard Network Security Scanner manual, version 8.0, last updated 11 April 2007 (archived copy of gfi.com/lannetscan/lanscan8manual.pdf).
• Help Net Security, “GFI Upgrades LANguard Network Scanner, a Security Audit Tool for Windows Networks”, press release of 27 February 2002.
• Help Net Security, “GFI Releases a Major Upgrade Of Its Acclaimed Network Security Scanner”, 12 April 2004.
• 99 Bottles of Beer, “Language LANGuard Script”, entry by 3pixelBob, 20 April 2005.