From 35f4f5d5172e424ebcff7cbd45fa7dcc4568a6f7 Mon Sep 17 00:00:00 2001
From: Gavin Schneider <gavin_schneider@rapid7.com>
Date: Fri, 16 Jun 2017 15:51:33 -0700
Subject: [PATCH 1/2] Convert ruby \h regex syntax to be language-agnostic

---
 xml/ftp_banners.xml | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/xml/ftp_banners.xml b/xml/ftp_banners.xml
index c94478fc..278876ae 100644
--- a/xml/ftp_banners.xml
+++ b/xml/ftp_banners.xml
@@ -216,7 +216,7 @@ example.com FTP server (Version:  Mac OS X Server) ready.</example>
     <param pos="0" name="service.product" value="ProFTPD"/>
     <param pos="1" name="host.name"/>
   </fingerprint>
-  <fingerprint pattern="^ProFTPD (\d+\.[^\s]+) Server \((.*)\) \[[\h.:\]]*$">
+  <fingerprint pattern="^ProFTPD (\d+\.[^\s]+) Server \((.*)\) \[[[a-f\d].:\]]*$">
     <description>ProFTPD with version info - truncated</description>
     <example service.version="1.3.2c">ProFTPD 1.3.2c Server (ProFTPD Default Installation) [</example>
     <example proftpd.server.name="svrname.hosting.com">ProFTPD 1.3.0 Server (svrname.hosting.com) [10.10.10.</example>
@@ -1123,7 +1123,7 @@ more text</example>
     <param pos="0" name="service.vendor" value="Multicraft"/>
     <param pos="1" name="service.version"/>
   </fingerprint>
-  <fingerprint pattern="^bftpd ([\d.]+) at ([\h.:]+) ready\.$">
+  <fingerprint pattern="^bftpd ([\d.]+) at ([[a-f\d].:]+) ready\.$">
     <description>Bftpd FTPD Server</description>
     <example service.version="2.2.1" host.ip="192.168.0.1">bftpd 2.2.1 at 192.168.0.1 ready.</example>
     <example service.version="2.2" host.ip="::ffff:192.168.1.1">bftpd 2.2 at ::ffff:192.168.1.1 ready.</example>
@@ -1133,7 +1133,7 @@ more text</example>
     <param pos="1" name="service.version"/>
     <param pos="2" name="host.ip"/>
   </fingerprint>
-  <fingerprint pattern="^NASFTPD Turbo station (?:2.x )?([\w.]+) Server \(ProFTPD\) \[([\h.:]+)\]$">
+  <fingerprint pattern="^NASFTPD Turbo station (?:2.x )?([\w.]+) Server \(ProFTPD\) \[([[a-f\d].:]+)\]$">
     <description>ProFTPD on QNAP Turbo Station NAS</description>
     <example service.version="1.3.5a" host.ip="192.168.1.100">NASFTPD Turbo station 1.3.5a Server (ProFTPD) [192.168.1.100]</example>
     <example service.version="1.3.1rc2" host.ip="192.168.1.100">NASFTPD Turbo station 2.x 1.3.1rc2 Server (ProFTPD) [192.168.1.100]</example>
@@ -1191,7 +1191,7 @@ more text</example>
     <param pos="0" name="os.family" value="Windows"/>
     <param pos="0" name="os.product" value="Windows"/>
   </fingerprint>
-  <fingerprint pattern="^FTP Server \(ZyWALL (USG\s?[\w-]+)\) \[([\h:.]+)\]$">
+  <fingerprint pattern="^FTP Server \(ZyWALL (USG\s?[\w-]+)\) \[([[a-f\d]:.]+)\]$">
     <description>ZyXEL Unified Security Gateway</description>
     <example hw.product="USG 20" host.ip="::ffff:192.168.0.2">FTP Server (ZyWALL USG 20) [::ffff:192.168.0.2]</example>
     <example hw.product="USG100-PLUS" host.ip="::ffff:192.168.5.101">FTP Server (ZyWALL USG100-PLUS) [::ffff:192.168.5.101]</example>

From b02e99342b3452d6efbd371ebde42e9ced0aa6ac Mon Sep 17 00:00:00 2001
From: Gavin Schneider <gavin_schneider@rapid7.com>
Date: Fri, 16 Jun 2017 15:52:17 -0700
Subject: [PATCH 2/2] Fix horrible backtracking regex for Windows catch-all

This regex was really bad and took 20-30 seconds to match in java. After
this change it comes down to milliseconds.
---
 xml/operating_system.xml | 5 ++---
 1 file changed, 2 insertions(+), 3 deletions(-)

diff --git a/xml/operating_system.xml b/xml/operating_system.xml
index cb80509c..72ca15d3 100644
--- a/xml/operating_system.xml
+++ b/xml/operating_system.xml
@@ -89,15 +89,14 @@
     <param pos="0" name="os.family" value="Windows"/>
     <param pos="1" name="os.product"/>
   </fingerprint>
-  <fingerprint pattern="^(?i:(?:Microsoft )?Windows(?:\s?\w+?)*?\s?(\d+?(?:\.\d+?)*?)?)$">
+  <fingerprint pattern="^(?i:(?:Microsoft )?Windows.*)$">
     <description>Windows catch-all</description>
-    <example os.version="3.11">Windows for Workgroups 3.11</example>
+    <example>Windows for Workgroups 3.11</example>
     <example>Microsoft Windows</example>
     <param pos="0" name="os.vendor" value="Microsoft"/>
     <param pos="0" name="os.family" value="Windows"/>
     <param pos="0" name="os.product" value="Windows"/>
     <param pos="0" name="os.certainty" value="0.5"/>
-    <param pos="1" name="os.version"/>
   </fingerprint>
   <!-- Windows end -->