metasploit-framework/lib/msf/core/exploit/sunrpc.rb

require 'rex/proto/sunrpc'

module Msf

###
#
# This mixin provides utility methods for interacting with a SunRPC service on
# a remote machine.  These methods may generally be useful in the context of
# exploitation.  This mixin extends the Tcp exploit mixin. Only one SunRPC
# service can be accessed at a time using this class.
#
# http://www.ietf.org/rfc/rfc1057.txt
#
###
module Exploit::Remote::SunRPC
	include Exploit::Remote::Tcp

	XDR = Rex::Encoder::XDR

	MSG_ACCEPTED = 0
	SUCCESS = 0		# RPC executed successfully
	PROG_UMAVAIL = 1	# Remote hasn't exported program
	PROG_MISMATCH = 2	# Remote can't support version #
	PROC_UNAVAIL = 3	# Program can't support procedure
	GARBAGE_ARGS = 4	# Procedure can't decode params'
	SYSTEM_ERR = 5    # System encountered some error

	def initialize(info = {})
		super

		register_evasion_options(
			[
				OptBool.new('ONCRPC::tcp_request_fragmentation', [false, 'Enable fragmentation of TCP ONC/RPC requests', 'false']),
			], Msf::Exploit::Remote::SunRPC
		)


		register_advanced_options(
			[
# XXX: Use portmapper to do call - Direct portmap to make the request to the program portmap_req
			], Msf::Exploit::Remote::SunRPC)

		register_options(
			[
# XXX: XPORT
				Opt::RHOST,
				Opt::RPORT(111),
			], Msf::Exploit::Remote::SunRPC
		)
	end

	def sunrpc_create(protocol, program, version)
		self.rpcobj = Rex::Proto::SunRPC::Client.new(rhost, rport.to_i, protocol, program, version)
		if datastore['ONCRPC::tcp_request_fragmentation'] == true
			self.rpcobj.should_fragment = 1
		end

		ret = rpcobj.create
		return print_error("#{rhost} - No response to SunRPC PortMap request") unless ret

		arr = XDR.decode!(ret, Integer, Integer, Integer, String, Integer, Integer)
		if arr[1] != MSG_ACCEPTED || arr[4] != SUCCESS || arr[5] == 0
			err = "#{rhost} - SunRPC PortMap request failed: "
			err << 'Message not accepted'  if arr[1] != MSG_ACCEPTED
			err << 'RPC did not execute'   if arr[4] != SUCCESS
			err << 'Program not available' if arr[5] == 0
			print_error(err)
			return nil
		end

		rpcobj.pport = arr[5]
		#progname = progresolv(rpcobj.program)
		#print_status("#{rhost} - SunRPC Found #{progname} on #{protocol} port #{rpcobj.pport}")
	end

	def sunrpc_call(proc, buf, timeout=60)
		ret = rpcobj.call(proc, buf, timeout)
		return print_error("#{rhost} - No response to SunRPC call for procedure: #{proc}") unless ret

		arr = Rex::Encoder::XDR.decode!(ret, Integer, Integer, Integer, String, Integer)
		if arr[1] != MSG_ACCEPTED || arr[4] != SUCCESS
			progname = progresolv(rpcobj.program)
			err = "SunRPC call for program #{rpcobj.program} [#{progname}], procedure #{proc}, failed: "
			if (arr[1] != MSG_ACCEPTED)
				err << 'Message not accepted'
			elsif (arr[4] and arr[4] != SUCCESS)
				case arr[4]
					when PROG_UMAVAIL  then err << "Program Unavailable"
					when PROG_MISMATCH then err << "Program Version Mismatch"
					when PROC_UNAVAIL  then err << "Procedure Unavailable"
					when GARBAGE_ARGS  then err << "Garbage Arguments"
					when SYSTEM_ERR    then err << "System Error"
					else err << "Unknown Error"
				end
			end
			print_error("#{rhost} - #{err}")
			return nil
		end
		return ret
	end

	def sunrpc_callsock
		self.rpcobj.call_sock
	end

	def sunrpc_destroy
		rpcobj.destroy
		rpcobj = nil
	end

	def sunrpc_authnull(*args)
		rpcobj.authnull_create(*args)
	end

	def sunrpc_authunix(*args)
		rpcobj.authunix_create(*args)
	end

	# XXX: Incomplete. Just moved from Rex::Proto::SunRPC::Client
	def portmap_qry()
		ret = portmap_req()
		arr = Rex::Encoder::XDR.decode!(ret, Integer, Integer, Integer, String, Integer)
		if arr[1] != MSG_ACCEPTED || arr[4] != SUCCESS || arr[5] == 0
			progname = progresolv(rpcobj.program)
			err = "SunRPC query for program #{rpcobj.program} [#{progname}] failed: "
			case arr[4]
				when PROG_UMAVAIL  then err << "Program Unavailable"
				when PROG_MISMATCH then err << "Program Version Mismatch"
				when PROC_UNAVAIL  then err << "Procedure Unavailable"
				when GARBAGE_ARGS  then err << "Garbage Arguments"
				else err << "Unknown Error"
			end
			print_error("#{rhost} - #{err}")
			return nil
		end

		return ret
	end

	def progresolv(number)
		names = File.join(Msf::Config.install_root, "data", "wordlists", "rpc_names.txt")
		File.open(names,"r").each_line do |line|
			next if line.empty? || line =~ /^\s*#/

			if line =~ /^(\S+?)\s+(\d+)/ && number == $2.to_i
				return $1
			end
		end

		return "UNKNOWN-#{number}"
	end

	# Used to track the last SunRPC context
	attr_accessor	:rpcobj
end

end