metasploit-framework/modules/auxiliary/scanner/smb/pipe_auditor.rb

##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# web site for more information on licensing and terms of use.
#   http://metasploit.com/
##


require 'msf/core'


class Metasploit3 < Msf::Auxiliary

  # Exploit mixins should be called first
  include Msf::Exploit::Remote::SMB
  include Msf::Exploit::Remote::SMB::Authenticated

  # Scanner mixin should be near last
  include Msf::Auxiliary::Scanner
  include Msf::Auxiliary::Report

  def initialize
    super(
      'Name'        => 'SMB Session Pipe Auditor',
      'Description' => 'Determine what named pipes are accessible over SMB',
      'Author'      => 'hdm',
      'License'     => MSF_LICENSE
    )

    deregister_options('RPORT')
  end

  @@target_pipes = [
    'netlogon',
    'lsarpc',
    'samr',
    'browser',
    'atsvc',
    'DAV RPC SERVICE',
    'epmapper',
    'eventlog',
    'InitShutdown',
    'keysvc',
    'lsass',
    'LSM_API_service',
    'ntsvcs',
    'plugplay',
    'protected_storage',
    'router',
    'SapiServerPipeS-1-5-5-0-70123',
    'scerpc',
    'srvsvc',
    'tapsrv',
    'trkwks',
    'W32TIME_ALT',
    'wkssvc',
    'PIPE_EVENTROOT\CIMV2SCM EVENT PROVIDER',
    'db2remotecmd'
  ]

  # Fingerprint a single host
  def run_host(ip)

    pass = []

    [[139, false], [445, true]].each do |info|

    datastore['RPORT'] = info[0]
    datastore['SMBDirect'] = info[1]

    begin
      connect()
      smb_login()
      @@target_pipes.each do |pipe|
        begin
          fid = smb_create("\\#{pipe}")
          # print_status("Opened pipe \\#{pipe}")
          pass.push(pipe)
        rescue ::Rex::Proto::SMB::Exceptions::ErrorCode => e
          # print_error("Could not open \\#{pipe}: Error 0x%.8x" % e.error_code)
        end
      end

      disconnect()

      break
    rescue ::Exception => e
      # print_line($!.to_s)
      # print_line($!.backtrace.join("\n"))
    end
    end

    if(pass.length > 0)
      print_status("#{ip} - Pipes: #{pass.map{|c| "\\#{c}"}.join(", ")}")
      #Add Report
      report_note(
        :host	=> ip,
        :proto => 'tcp',
        :sname	=> 'smb',
        :port	=> rport,
        :type	=> 'Pipes Founded',
        :data	=> "Pipes: #{pass.map{|c| "\\#{c}"}.join(", ")}"
      )
    end
  end


end