From 1276042d00a1d11196404db674d6dd83af2df97f Mon Sep 17 00:00:00 2001
From: Maria Dobrska <maria_dobrska@rapid7.com>
Date: Mon, 5 Jan 2015 17:17:07 +0000
Subject: [PATCH 1/4] Adding new Cisco TelePresence banners

---
 xml/ftp_banners.xml   | 13 +++++++++++++
 xml/sip_banners.xml   | 12 +++++++++++-
 xml/snmp_sysdescr.xml | 44 ++++++++++++++++++++++++++++++++-----------
 3 files changed, 57 insertions(+), 12 deletions(-)

diff --git a/xml/ftp_banners.xml b/xml/ftp_banners.xml
index 588e52a8..fb0ed1ba 100644
--- a/xml/ftp_banners.xml
+++ b/xml/ftp_banners.xml
@@ -808,4 +808,17 @@ against these patterns to fingerprint FTP servers.
     <param pos="1" name="host.name"/>
     <param pos="2" name="service.version"/>
   </fingerprint>
+  <fingerprint pattern="^Welcome to the (?:Cisco )?(?:Tele[Pp]resence) ([a-zA-Z\s]*?) ((?:MSE )?\d+), version (\d+.\d+\(\d+.\d+\)).*?">
+    <description>Cisco TelePresence</description>
+    <example os.device = "AM GW" os.version="1.1(1.34)" hw.series="3610">Welcome to the Cisco TelePresence AM GW 3610, version 1.1(1.34) </example>
+    <example os.device = "IP GW" os.version="2.0(3.32)" hw.series="3510">Welcome to the Cisco TelePresence IP GW 3510, version 2.0(3.32) </example>
+    <example os.device = "MCU" os.version="4.3(2.18)" hw.series="4210">Welcome to the Cisco TelePresence MCU 4210, version 4.3(2.18) </example>
+    <example os.device = "MCU" os.version="4.3(1.68)" hw.series="MSE 8420">Welcome to the Cisco TelePresence MCU MSE 8420, version 4.3(1.68) </example>
+    <example os.device = "Server" os.version="2.1(1.18)" hw.series="7010">Welcome to the Telepresence Server 7010, version 2.1(1.18) </example>
+    <param pos="0" name="os.vendor" value="Cisco"/>
+    <param pos="0" name="os.product" value="TelePresence"/>
+    <param pos="1" name="os.device"/>
+    <param pos="2" name="hw.series"/>
+    <param pos="3" name="os.version"/>
+  </fingerprint>
 </fingerprints>
diff --git a/xml/sip_banners.xml b/xml/sip_banners.xml
index 0a71bbb2..9c5c0b86 100644
--- a/xml/sip_banners.xml
+++ b/xml/sip_banners.xml
@@ -2,7 +2,6 @@
 <!--
 SIP Server header values are matched against these patterns to fingerprint SIP devices.
 -->
-
 <fingerprints matches="sip_header.server">
    <fingerprint pattern="^Cisco-SIPGateway/IOS-([\d\.x]+)$">
       <description>Cisco SIPGateway</description>
@@ -11,4 +10,15 @@ SIP Server header values are matched against these patterns to fingerprint SIP d
       <param pos="0" name="os.product" value="IOS"/>
       <param pos="1" name="os.version"/>
    </fingerprint>
+   <fingerprint pattern="^TANDBERG\/\d+ \(([a-zA-Z]+\d+(?:\.\d+)+)(?:.*)\)">
+      <description>Cisco TelePresence</description>
+      <example os.version="X8.2.1">TANDBERG/4130 (X8.2.1)</example>
+      <example os.version="XC2.2.1">TANDBERG/4353 (XC2.2.1-b2bua-1.0)</example>
+      <example os.version="TC5.1.4.295090">TANDBERG/516 (TC5.1.4.295090)</example>
+      <example os.version="TCNC5.1.4.295090">TANDBERG/517 (TCNC5.1.4.295090)</example>
+      <example os.version="S5.30">TANDBERG/80 (S5.30)</example>
+      <param pos="0" name="os.vendor" value="Cisco"/>
+      <param pos="0" name="os.product" value="TelePresence"/>
+      <param pos="1" name="os.version"/>
+   </fingerprint>
 </fingerprints>
diff --git a/xml/snmp_sysdescr.xml b/xml/snmp_sysdescr.xml
index 8c049fbb..d568769e 100644
--- a/xml/snmp_sysdescr.xml
+++ b/xml/snmp_sysdescr.xml
@@ -1527,28 +1527,50 @@
    <!--======================================================================
                               CISCO
    =======================================================================-->
-   <fingerprint pattern="^(?:Cisco|TANDBERG) Codec SoftW: (.*\d+[\.\d+]*) MCU: Cisco TelePresence ([A-Z]+\d+).*">
+   <fingerprint pattern="^(?:Cisco|TANDBERG) Codec SoftW: (.*\d+[\.\d+]+)(?:(?: )?Beta\d)? (?:\w* )?MCU: (?:Cisco|TANDBERG) (?:\w* )?(\d+MXP|[A-Z]+\d+) .*?">
       <description>Cisco TelePresence</description>
-      <example os.version="TC5.1.0.280662" hw.product="SX20">Cisco Codec SoftW: TC5.1.0.280662 MCU: Cisco TelePresence SX20 Date: 2012-02-14 S/N: FTT16070041 BootSW: Board: 101790-6 [28]</example>
-      <example os.version="TE4.1.3.292001" hw.product="SX20">Cisco Codec SoftW: TE4.1.3.292001 MCU: Cisco TelePresence SX20 Date: 2012-06-21 S/N: FTT1625007Z BootSW: Board: 101790-6 [B0]</example>
-      <example os.version="TC4.2.0.259927" hw.product="MX200">TANDBERG Codec SoftW: TC4.2.0.259927 MCU: Cisco TelePresence MX200 Date: 2011-06-30 S/N: FTT1530000O BootSW: Board: 101770-4 [20]</example>
-      <example os.version="TC5.1.3.292001" hw.product="MX300">TANDBERG Codec SoftW: TC5.1.3.292001 MCU: Cisco TelePresence MX300 Date: 2012-06-21 S/N: FTT16030013 BootSW: Board: 101770-5 [22]</example>
+      <example os.version="TC5.1.0.280662" hw.series="SX20">Cisco Codec SoftW: TC5.1.0.280662 MCU: Cisco TelePresence SX20 Date: 2012-02-14 S/N: FTT16070041 BootSW: Board: 101790-6 [28]</example>
+      <example os.version="TC4.2.0.259927" hw.series="MX200">TANDBERG Codec SoftW: TC4.2.0.259927 MCU: Cisco TelePresence MX200 Date: 2011-06-30 S/N: FTT1530000O BootSW: Board: 101770-4 [20]</example>
+      <example os.version="TC5.1.3.292001" hw.series="MX300">TANDBERG Codec SoftW: TC5.1.3.292001 MCU: Cisco TelePresence MX300 Date: 2012-06-21 S/N: FTT16030013 BootSW: Board: 101770-5 [22]</example>
+      <example os.version="TC5.1.0.279658" hw.series="SX20">Cisco Codec SoftW: TC5.1.0.279658Beta7 MCU: Cisco TelePresence SX20 Date: 2012-02-03 S/N: FTT1616005D BootSW: Board: 101790-6 [B0]</example>
+      <example os.version="TC6.0.0" hw.series="SX20">Cisco Codec SoftW: TC6.0.0 Beta7 MCU: Cisco TelePresence SX20 Date: 2012-09-17 S/N: FTT163100A3 BootSW: Board: 101790-6 [B0]</example>
+      <example os.version="TC4.2.0.255978" hw.series="MX200">TANDBERG Codec SoftW: TC4.2.0.255978Beta2 MCU: Cisco TelePresence MX200 Date: 2011-05-23 S/N: FTT1524000I BootSW: Board: 101770-4 [00]</example>
+      <example os.version="TCNC5.0.1.275220" hw.series="MX200">TANDBERG Codec SoftW: TCNC5.0.1.275220 MCU: Cisco TelePresence MX200 Date: 2011-12-19 S/N: FTT1615003S BootSW: Board: 101770-5 [22]</example>
+      <example os.version="TCNC5.1.0.280662" hw.series="SX20">Cisco Codec SoftW: TCNC5.1.0.280662 MCU: Cisco TelePresence SX20 Date: 2012-02-14 S/N: FTT161300A0 BootSW: Board: 101790-6 [A0]</example>
+      <example os.version="F8.1" hw.series="6000MXP">TANDBERG Codec SoftW: F8.1 PAL MCU: TANDBERG Profile 6000MXP Date: 2009-09-07 S/N: 25A46936 BootSW: Rev. 1.15, 2008-01-04 Board: 100670 rev. 07</example>
+      <example os.version="F9.1" hw.series="6000MXP">TANDBERG Codec SoftW: F9.1 NTSC MCU: TANDBERG 6000MXP PORTABLE Date: 2011-06-08 S/N: 25A07029 BootSW: Rev. 1.16, 2009-01-21 Board: 100670 rev. 07</example>
+      <example os.version="TC4.2.0.260857" hw.series="C40">TANDBERG Codec SoftW: TC4.2.0.260857 MCU: TANDBERG Codec C40 Date: 2011-07-11 S/N: B1AV02D00182 BootSW: Board: 101681-1 [04]</example>
+      <example os.version="TC4.2.1.265253" hw.series="EX60">TANDBERG Codec SoftW: TC4.2.1.265253 MCU: TANDBERG EX60 Date: 2011-09-06 S/N: A1AZ02E00212 BootSW: Board: 101620-6 [22]</example>
+      <example os.version="TE1.0.0.175435" hw.series="E20">TANDBERG Codec SoftW: TE1.0.0.175435 MCU: TANDBERG E20 Date: 2009-02-09 S/N: A1AA11B00658 BootSW: Board: 101390-6</example>
       <param pos="0" name="os.certainty" value="0.85"/>
       <param pos="0" name="os.vendor" value="Cisco"/>
       <param pos="0" name="os.product" value="TelePresence"/>
+      <param pos="0" name="os.device" value="Codec"/>
       <param pos="1" name="os.version"/>
-      <param pos="2" name="hw.product"/>
+      <param pos="2" name="hw.series"/>
    </fingerprint>
 
-   <fingerprint pattern="^Cisco TelePresence (Conductor|MCU (?:MSE )?\d+)">
+   <fingerprint pattern="^Cisco TelePresence ((?:HD )?MCU) ((?:MSE )?\d+)">
       <description>Cisco TelePresence</description>
-      <example hw.product="Conductor">Cisco TelePresence Conductor</example>
-      <example hw.product="MCU 4205">Cisco TelePresence MCU 4205</example>
-      <example hw.product="MCU MSE 8420">Cisco TelePresence MCU MSE 8420</example>
+      <example os.device = "MCU" hw.series="4205">Cisco TelePresence MCU 4205</example>
+      <example os.device = "MCU" hw.series="MSE 8420">Cisco TelePresence MCU MSE 8420</example>
+      <example os.device = "HD MCU" hw.series="4520">Cisco TelePresence HD MCU 4520</example>
       <param pos="0" name="os.certainty" value="0.85"/>
       <param pos="0" name="os.vendor" value="Cisco"/>
       <param pos="0" name="os.product" value="TelePresence"/>
-      <param pos="1" name="hw.product"/>
+      <param pos="1" name="os.device"/>
+      <param pos="2" name="hw.series"/>
+   </fingerprint>
+
+   <fingerprint pattern="^Cisco TelePresence (Conductor|Supervisor)(?: (MSE \d+))?">
+      <description>Cisco TelePresence</description>
+      <example os.device="Conductor">Cisco TelePresence Conductor</example>
+      <example os.device="Supervisor" hw.series="MSE 8050">Cisco TelePresence Supervisor MSE 8050</example>
+      <param pos="0" name="os.certainty" value="0.85"/>
+      <param pos="0" name="os.vendor" value="Cisco"/>
+      <param pos="0" name="os.product" value="TelePresence"/>
+      <param pos="1" name="os.device"/>
+      <param pos="2" name="hw.series"/>
    </fingerprint>
 
    <fingerprint pattern="^Cisco Adaptive Security Appliance Version (\d+\.\d+\(\d+\)\d*)">

From 756302dae61a718a78fcbe3c1d1942bde643241a Mon Sep 17 00:00:00 2001
From: Maria Dobrska <maria_dobrska@rapid7.com>
Date: Wed, 7 Jan 2015 11:32:04 +0000
Subject: [PATCH 2/4] TelePresence banners fixes

---
 xml/ftp_banners.xml   | 12 ++++++------
 xml/sip_banners.xml   |  2 +-
 xml/snmp_sysdescr.xml | 35 +++++++++++++++--------------------
 3 files changed, 22 insertions(+), 27 deletions(-)

diff --git a/xml/ftp_banners.xml b/xml/ftp_banners.xml
index fb0ed1ba..4dc48e7b 100644
--- a/xml/ftp_banners.xml
+++ b/xml/ftp_banners.xml
@@ -808,13 +808,13 @@ against these patterns to fingerprint FTP servers.
     <param pos="1" name="host.name"/>
     <param pos="2" name="service.version"/>
   </fingerprint>
-  <fingerprint pattern="^Welcome to the (?:Cisco )?(?:Tele[Pp]resence) ([a-zA-Z\s]*?) ((?:MSE )?\d+), version (\d+.\d+\(\d+.\d+\)).*?">
+  <fingerprint pattern="^Welcome to the (?:Cisco )?(?:TelePresence) ([a-zA-Z\s]*?) ((?:MSE )?\d+), version (\d+.\d+\(\d+.\d+\)).*?" flags="REG_ICASE">
     <description>Cisco TelePresence</description>
-    <example os.device = "AM GW" os.version="1.1(1.34)" hw.series="3610">Welcome to the Cisco TelePresence AM GW 3610, version 1.1(1.34) </example>
-    <example os.device = "IP GW" os.version="2.0(3.32)" hw.series="3510">Welcome to the Cisco TelePresence IP GW 3510, version 2.0(3.32) </example>
-    <example os.device = "MCU" os.version="4.3(2.18)" hw.series="4210">Welcome to the Cisco TelePresence MCU 4210, version 4.3(2.18) </example>
-    <example os.device = "MCU" os.version="4.3(1.68)" hw.series="MSE 8420">Welcome to the Cisco TelePresence MCU MSE 8420, version 4.3(1.68) </example>
-    <example os.device = "Server" os.version="2.1(1.18)" hw.series="7010">Welcome to the Telepresence Server 7010, version 2.1(1.18) </example>
+    <example os.device="AM GW" os.version="1.1(1.34)" hw.series="3610">Welcome to the Cisco TelePresence AM GW 3610, version 1.1(1.34) </example>
+    <example os.device="IP GW" os.version="2.0(3.32)" hw.series="3510">Welcome to the Cisco TelePresence IP GW 3510, version 2.0(3.32) </example>
+    <example os.device="MCU" os.version="4.3(2.18)" hw.series="4210">Welcome to the Cisco TelePresence MCU 4210, version 4.3(2.18) </example>
+    <example os.device="MCU" os.version="4.3(1.68)" hw.series="MSE 8420">Welcome to the Cisco TelePresence MCU MSE 8420, version 4.3(1.68) </example>
+    <example os.device="Server" os.version="2.1(1.18)" hw.series="7010">Welcome to the Telepresence Server 7010, version 2.1(1.18) </example>
     <param pos="0" name="os.vendor" value="Cisco"/>
     <param pos="0" name="os.product" value="TelePresence"/>
     <param pos="1" name="os.device"/>
diff --git a/xml/sip_banners.xml b/xml/sip_banners.xml
index 9c5c0b86..1bc3a31c 100644
--- a/xml/sip_banners.xml
+++ b/xml/sip_banners.xml
@@ -10,7 +10,7 @@ SIP Server header values are matched against these patterns to fingerprint SIP d
       <param pos="0" name="os.product" value="IOS"/>
       <param pos="1" name="os.version"/>
    </fingerprint>
-   <fingerprint pattern="^TANDBERG\/\d+ \(([a-zA-Z]+\d+(?:\.\d+)+)(?:.*)\)">
+   <fingerprint pattern="^TANDBERG/\d+ \(([a-zA-Z]+\d+(?:\.\d+)+).*\)">
       <description>Cisco TelePresence</description>
       <example os.version="X8.2.1">TANDBERG/4130 (X8.2.1)</example>
       <example os.version="XC2.2.1">TANDBERG/4353 (XC2.2.1-b2bua-1.0)</example>
diff --git a/xml/snmp_sysdescr.xml b/xml/snmp_sysdescr.xml
index d568769e..54ada0ef 100644
--- a/xml/snmp_sysdescr.xml
+++ b/xml/snmp_sysdescr.xml
@@ -1573,6 +1573,21 @@
       <param pos="2" name="hw.series"/>
    </fingerprint>
 
+   <fingerprint pattern="^TANDBERG Codec$">
+      <description>Tandberg videoconferencing device</description>
+      <example>TANDBERG Codec</example>
+      <param pos="0" name="os.vendor" value="Cisco"/>
+      <param pos="0" name="os.device" value="Web cam"/>
+   </fingerprint>
+
+   <fingerprint pattern="^TANDBERG MPS-MCU$">
+      <description>Tandberg videoconferencing bridge</description>
+      <example>TANDBERG MPS-MCU</example>
+      <param pos="0" name="os.vendor" value="Cisco"/>
+      <param pos="0" name="os.product" value="MPS-MCU"/>
+      <param pos="0" name="os.device" value="VOIP"/>
+   </fingerprint>
+
    <fingerprint pattern="^Cisco Adaptive Security Appliance Version (\d+\.\d+\(\d+\)\d*)">
       <description>Cisco Adaptive Security Appliance</description>
       <example os.version="8.0(2)">Cisco Adaptive Security Appliance Version 8.0(2)</example>
@@ -7842,26 +7857,6 @@ Copyright (c) 1995-2005 by Cisco Systems
       <param pos="2" name="os.version"/>
    </fingerprint>
 
-
-   <!--======================================================================
-                              TANDBERG
-   =======================================================================-->
-
-   <fingerprint pattern="^TANDBERG Codec$">
-      <description>Tandberg videoconferencing device</description>
-      <example>TANDBERG Codec</example>
-      <param pos="0" name="os.vendor" value="Tandberg"/>
-      <param pos="0" name="os.device" value="Web cam"/>
-   </fingerprint>
-
-   <fingerprint pattern="^TANDBERG MPS-MCU$">
-      <description>Tandberg videoconferencing bridge</description>
-      <example>TANDBERG MPS-MCU</example>
-      <param pos="0" name="os.vendor" value="Tandberg"/>
-      <param pos="0" name="os.product" value="MPS-MCU"/>
-      <param pos="0" name="os.device" value="VOIP"/>
-   </fingerprint>
-
    <!--======================================================================
                               TEKTRONIX
    =======================================================================-->

From 4aeab09b0c73d8efd612b51874f0c5e487c17098 Mon Sep 17 00:00:00 2001
From: Maria Dobrska <maria_dobrska@rapid7.com>
Date: Thu, 8 Jan 2015 11:23:05 +0000
Subject: [PATCH 3/4] TelePresence snmp banners fixes

---
 xml/snmp_sysdescr.xml | 15 ++++++++-------
 1 file changed, 8 insertions(+), 7 deletions(-)

diff --git a/xml/snmp_sysdescr.xml b/xml/snmp_sysdescr.xml
index 54ada0ef..84b39b53 100644
--- a/xml/snmp_sysdescr.xml
+++ b/xml/snmp_sysdescr.xml
@@ -1550,16 +1550,16 @@
       <param pos="2" name="hw.series"/>
    </fingerprint>
 
-   <fingerprint pattern="^Cisco TelePresence ((?:HD )?MCU) ((?:MSE )?\d+)">
+   <fingerprint pattern="^Cisco TelePresence (?:(?:HD )?MCU) ((?:MSE )?\d+)">
       <description>Cisco TelePresence</description>
-      <example os.device = "MCU" hw.series="4205">Cisco TelePresence MCU 4205</example>
-      <example os.device = "MCU" hw.series="MSE 8420">Cisco TelePresence MCU MSE 8420</example>
-      <example os.device = "HD MCU" hw.series="4520">Cisco TelePresence HD MCU 4520</example>
+      <example hw.series="4205">Cisco TelePresence MCU 4205</example>
+      <example hw.series="MSE 8420">Cisco TelePresence MCU MSE 8420</example>
+      <example hw.series="4520">Cisco TelePresence HD MCU 4520</example>
       <param pos="0" name="os.certainty" value="0.85"/>
       <param pos="0" name="os.vendor" value="Cisco"/>
       <param pos="0" name="os.product" value="TelePresence"/>
-      <param pos="1" name="os.device"/>
-      <param pos="2" name="hw.series"/>
+      <param pos="0" name="os.device" value="Bridge"/>
+      <param pos="1" name="hw.series"/>
    </fingerprint>
 
    <fingerprint pattern="^Cisco TelePresence (Conductor|Supervisor)(?: (MSE \d+))?">
@@ -1577,7 +1577,8 @@
       <description>Tandberg videoconferencing device</description>
       <example>TANDBERG Codec</example>
       <param pos="0" name="os.vendor" value="Cisco"/>
-      <param pos="0" name="os.device" value="Web cam"/>
+      <param pos="0" name="os.product" value="TelePresence"/>
+      <param pos="0" name="os.device" value="Codec"/>
    </fingerprint>
 
    <fingerprint pattern="^TANDBERG MPS-MCU$">

From c4767fed2cf02529217d93269a9737e66ff67bb2 Mon Sep 17 00:00:00 2001
From: Jon Hart <jon_hart@rapid7.com>
Date: Thu, 8 Jan 2015 08:38:39 -0800
Subject: [PATCH 4/4] Bump version to 1.0.8 for Cisco TelePresence/Tandberg
 improvements

---
 lib/recog/version.rb | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/lib/recog/version.rb b/lib/recog/version.rb
index b62abee4..3db16b5a 100644
--- a/lib/recog/version.rb
+++ b/lib/recog/version.rb
@@ -1,3 +1,3 @@
 module Recog
-  VERSION = "1.0.7"
+  VERSION = '1.0.8'
 end