From 963fdd643076a6f1002d19e447b0f352c113958c Mon Sep 17 00:00:00 2001 From: HD Moore Date: Sat, 3 Nov 2012 17:44:53 -0500 Subject: [PATCH 1/5] Initial commit for Digi RealPort modules --- lib/msf/core/exploit/mixins.rb | 2 +- lib/msf/core/exploit/realport.rb | 236 ++++++++++++++++++ .../scada/digi_realport_serialport_scan.rb | 83 ++++++ .../scanner/scada/digi_realport_version.rb | 45 ++++ 4 files changed, 365 insertions(+), 1 deletion(-) create mode 100644 lib/msf/core/exploit/realport.rb create mode 100644 modules/auxiliary/scanner/scada/digi_realport_serialport_scan.rb create mode 100644 modules/auxiliary/scanner/scada/digi_realport_version.rb diff --git a/lib/msf/core/exploit/mixins.rb b/lib/msf/core/exploit/mixins.rb index 76cfac86e4..af2e59d8bb 100644 --- a/lib/msf/core/exploit/mixins.rb +++ b/lib/msf/core/exploit/mixins.rb @@ -59,7 +59,7 @@ require 'msf/core/exploit/vim_soap' require 'msf/core/exploit/wdbrpc' require 'msf/core/exploit/wdbrpc_client' require 'msf/core/exploit/afp' - +require 'msf/core/exploit/realport' # Telephony require 'msf/core/exploit/dialup' diff --git a/lib/msf/core/exploit/realport.rb b/lib/msf/core/exploit/realport.rb new file mode 100644 index 0000000000..1d04c7dac0 --- /dev/null +++ b/lib/msf/core/exploit/realport.rb @@ -0,0 +1,236 @@ +# -*- coding: binary -*- + +require 'msf/core' +require 'msf/core/exploit/tcp' + +module Msf + +### +# +# This module provides methods for working with the RealPort protocol +# +### +module Exploit::Remote::RealPort + include Msf::Exploit::Remote::Tcp + + # + # Initializes an instance of an auxiliary module that uses RealPort + # + + def initialize(info = {}) + super + register_options( [ + Opt::RPORT(771) + ], Msf::Exploit::Remote::RealPort ) + end + + @@REALPORT_BAUD_MAP = { + '2400' => "\x03\x00", + '9600' => "\x00\xc0", + '19200' => "\x00\x60", + '38400' => "\x00\x30", + '57600' => "\x00\x30", + '76800' => "\x00\x10", + '115200' => "\x00\x10", # Yup, same as above + '230400' => "\x00\x08", + '460800' => "\x00\x04", + '921600' => "\x00\x02", + } + + # Connect to the RealPort service and send the initial handshake + # This has the benefit of retrieving the port count and product + # Returns true if it succeeds and nil otherwise + def realport_connect + connect + sock.put("\xfb\x01\xfb\x02\xfb\x18") + res = sock.get_once(12, 5) + return unless (res and res.length == 12) + + unless res[0,2] == "\xfc\x01" + vprint_error("#{rhost}:#{rport} Bad reply: #{res.inspect}") + return + end + + len = res[2,2].unpack("n").first + return unless len > 0 + + res = sock.get_once(len, 5) + unless res.length == len + vprint_error("#{rhost}:#{rport} Bad length: #{res.length} wanted #{len}") + return + end + + name,info = res.split("\xfc\x02", 2) + fields = info.unpack("n*") + + @realport_port_count = fields[1].to_i + @realport_name = name.gsub(/[\r\n]/, '') + + # The server also sends us an additional four-byte packet we can ignore here + # This throws away a \xFC\x18\x00\x04 sequence + sock.get_once(-1, 5) + + return true + end + + def realport_disconnect + disconnect + end + + def realport_baud_to_speed(baud) + @@REALPORT_BAUD_MAP[baud] + end + + def realport_recv_banner(port=0, timeout=30, max_data=4096) + # + # Data is received here, header is: + # a2 00 01 82 XX + # ^ [ counter ] [ length ] [ data ] + # + + # Can also see f0 here (keep alive) + + banner = "" + stime = Time.now.to_f + dcnt = 0 + pcnt = 0 + + while banner.length < max_data and (Time.now.to_f - stime) < timeout + + res = sock.get_once(1, 1) + unless res + if banner.length == 0 or pcnt < 3 + # Send a new line to wake up the remote end + realport_send(port, "\r") + pcnt += 1 + next + else + # Allow three empty reads *after* we have sent at least one probe and have data + dcnt += 1 + break if dcnt > 3 + next + end + end + bit = res.unpack("C").first + case bit + when (0xA0 + port) + # Read the packet sequence number (two bytes) + res = sock.get_once(2, 1) + when 0xF0 + # Skip this keep-alive response + when (0x80 + port) + # Read the one-byte length value + res = sock.get_once(1, 1) + if res + len = res.unpack("C").first + res = sock.get_once(len, 1) + if res + banner << res + end + end + end + end + banner + end + + def realport_send(port=0, data) + sock.put( [port].pack("C") + data ) + end + + def realport_close(port=0) + cprt = [ 0xb0 + port ].pack("C") + pkt = cprt + "\x28\x00\xc0\x00\xb0\x00\x01\x00\x00\x00\x00" + cprt + "\x0a\x03" + + # Response + # b2 0b 03 00 00 02 + + # Send a close request + sock.put(pkt) + res = sock.get_once(-1, 5) + + vprint_status("#{target_host}:#{rport} Port:#{port} Close:#{ res.inspect }") + return + end + + def realport_open(port=0, baud='9600') + + @realport_banner = '' + + cprt = [ 0xb0 + port ].pack("C") + aprt = [ 0xa0 + port ].pack("C") + + speed = realport_baud_to_speed(baud) + + # Open port + pkt1 = "\xf0" + cprt + "\x0a"+ "\x00" + + # Response + # b2 0b 00 00 00 02 + # ^ ^ <- port number + + # Open the port + sock.put(pkt1) + res = sock.get_once(-1, 5) + + vprint_status("#{target_host}:#{rport} Port:#{port} Baud:#{baud} Open:#{ res.inspect }") + + # Access the port + pkt2 = + cprt + "\x0e" + + cprt + "\x2a\x02\xc0\xf3" + + cprt + "\x10" + + cprt + "\x14" + + cprt + "\x16" + + cprt + "\x2c\x03\x00\x00" + + # Response (GOOD) + # b2 0f 00 00 00 00 b2 15 0f ff 0f ff b2 11 00 00 + # 13 b2 17 01 02 00 2f 06 a8 00 1c 20 00 00 00 00 + # 00 f3 f3 00 00 00 00 00 00 00 00 00 00 00 00 00 + # 00 + + # Response (BAD) + # \xFF \x17 Access to unopened port\x00 + + # Send negotiate request + sock.put(pkt2) + res = sock.get_once(-1, 5) + if res.to_s =~ /^\xff/ + vprint_status("#{target_host}:#{rport} Port:#{port} is closed: #{res.inspect}") + return :closed + end + + vprint_status("#{target_host}:#{rport} Port:#{port} Baud:#{baud} Negotiate:#{ res.inspect }") + + # Terminal settings + pkt3 = + cprt + "\x30\x03\xff\x00\x64" + + cprt + "\x2d\x03\xff\x0b\xff" + + cprt + "\x28" + speed + "\x04" + + cprt + "\x00\x01\x00\x00\x00\x00" + + cprt + "\x2c\x00\x12\x00" + + cprt + "\x2e\x11\x13\x16\x00\x00" + + cprt + "\x2f\x03\xff\x00\x64" + + cprt + "\x40\x37" + aprt + "\x0f\xff" + + # Response + # c2 12 00 00 f0 + # ^ + + # Send terminal settings request + sock.put(pkt3) + res = sock.get_once(-1, 5) + + if res.to_s =~ /^\xff/ + vprint_status("#{target_host}:#{rport} Port:#{port} is closed: #{res.inspect}") + return :closed + end + + vprint_status("#{target_host}:#{rport} Port:#{port} Baud:#{baud} Settings:#{ res.inspect }") + return :open + end + +end + + +end diff --git a/modules/auxiliary/scanner/scada/digi_realport_serialport_scan.rb b/modules/auxiliary/scanner/scada/digi_realport_serialport_scan.rb new file mode 100644 index 0000000000..e6acdf3b34 --- /dev/null +++ b/modules/auxiliary/scanner/scada/digi_realport_serialport_scan.rb @@ -0,0 +1,83 @@ +## +# $Id$ +## + +## +# This file is part of the Metasploit Framework and may be subject to +# redistribution and commercial restrictions. Please see the Metasploit +# web site for more information on licensing and terms of use. +# http://metasploit.com/ +## + +require 'msf/core' + +class Metasploit3 < Msf::Auxiliary + + include Msf::Exploit::Remote::RealPort + include Msf::Auxiliary::Report + include Msf::Auxiliary::Scanner + + def initialize + super( + 'Name' => 'Digi RealPort Serial Server Port Scanner', + 'Version' => '$Revision$', + 'Description' => 'Identify active ports on RealPort-enabled serial servers.', + 'References' => + [ + ['URL', 'http://www.digi.com/pdf/fs_realport.pdf'], + ['URL', 'http://www.digi.com/support/productdetail?pid=2229&type=drivers'] + ], + 'Author' => + [ + 'hdm' + ], + 'License' => MSF_LICENSE + ) + + register_options( + [ + OptInt.new("BANNER_TIMEOUT", [true, "How long to capture data from the serial port", 5]), + OptString.new('BAUD_RATES', [true, "A space delimited list of baud rates to try for each port", "9600 115200"]), + OptString.new('PORTS', [true, "A space delimited list of 1-indexed serial port numbers to try, default is all supported", "ALL"]) + ], self.class) + end + + def setup + test_speeds = datastore['BAUD_RATES'].split(/\s+/) + test_speeds.each do |baud| + valid = realport_baud_to_speed(baud) + if not valid + raise RuntimeError, "The baud rate #{baud} is not supported" + end + end + end + + def run_host(target_host) + test_ports = datastore['PORTS'].upcase.split(/\s+/) + test_speeds = datastore['BAUD_RATES'].split(/\s+/) + + return unless realport_connect + + vprint_status("#{target_host}:#{rport} is running #{@realport_name} ( ports: #{@ports} )") + + 1.upto(@realport_port_count) do |pnum| + unless test_ports.include?('ALL') or test_ports.include?(pnum.to_s) + # Skip this port + next + end + + test_speeds.each do |baud| + ret = realport_open(pnum - 1, baud) + break unless ret == :open + res = realport_recv_banner(pnum - 1, datastore['BANNER_TIMEOUT']) + if res and res.length > 0 + print_status("#{target_host}:#{rport} [port #{pnum} @ #{baud}bps] #{res.inspect}") + end + realport_close(pnum - 1) + end + end + + realport_disconnect + end + +end diff --git a/modules/auxiliary/scanner/scada/digi_realport_version.rb b/modules/auxiliary/scanner/scada/digi_realport_version.rb new file mode 100644 index 0000000000..9cc209c12b --- /dev/null +++ b/modules/auxiliary/scanner/scada/digi_realport_version.rb @@ -0,0 +1,45 @@ +## +# $Id$ +## + +## +# This file is part of the Metasploit Framework and may be subject to +# redistribution and commercial restrictions. Please see the Metasploit +# web site for more information on licensing and terms of use. +# http://metasploit.com/ +## + +require 'msf/core' + +class Metasploit3 < Msf::Auxiliary + + include Msf::Exploit::Remote::RealPort + include Msf::Auxiliary::Report + include Msf::Auxiliary::Scanner + + def initialize + super( + 'Name' => 'Digi RealPort Serial Server Version', + 'Version' => '$Revision$', + 'Description' => 'Detect serial servers that speak the RealPort protocol.', + 'References' => + [ + ['URL', 'http://www.digi.com/pdf/fs_realport.pdf'], + ['URL', 'http://www.digi.com/support/productdetail?pid=2229&type=drivers'] + ], + 'Author' => + [ + 'hdm' + ], + 'License' => MSF_LICENSE + ) + end + + def run_host(target_host) + if realport_connect + info = "#{@realport_name} ( ports: #{@realport_port_count} )" + print_status("#{target_host}:#{rport} #{info}") + report_service(:host => rhost, :port => rport, :name => "realport", :info => info) + end + end +end From ae9b462b99ef6e9c5edcd194aaf2f6c7823fafbd Mon Sep 17 00:00:00 2001 From: HD Moore Date: Sun, 4 Nov 2012 22:38:16 -0600 Subject: [PATCH 2/5] Fix baud rate (see PR #1008) --- lib/msf/core/exploit/realport.rb | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/lib/msf/core/exploit/realport.rb b/lib/msf/core/exploit/realport.rb index 1d04c7dac0..66b95374cd 100644 --- a/lib/msf/core/exploit/realport.rb +++ b/lib/msf/core/exploit/realport.rb @@ -28,7 +28,7 @@ module Exploit::Remote::RealPort '2400' => "\x03\x00", '9600' => "\x00\xc0", '19200' => "\x00\x60", - '38400' => "\x00\x30", + '38400' => "\x00\x20", '57600' => "\x00\x30", '76800' => "\x00\x10", '115200' => "\x00\x10", # Yup, same as above From 36f82fba09badb8be7f011e29ed9e4a63ff9d179 Mon Sep 17 00:00:00 2001 From: HD Moore Date: Sun, 4 Nov 2012 22:38:31 -0600 Subject: [PATCH 3/5] Remove unused version fields from template --- modules/auxiliary/scanner/scada/digi_realport_serialport_scan.rb | 1 - modules/auxiliary/scanner/scada/digi_realport_version.rb | 1 - 2 files changed, 2 deletions(-) diff --git a/modules/auxiliary/scanner/scada/digi_realport_serialport_scan.rb b/modules/auxiliary/scanner/scada/digi_realport_serialport_scan.rb index e6acdf3b34..c5e7dcd9e7 100644 --- a/modules/auxiliary/scanner/scada/digi_realport_serialport_scan.rb +++ b/modules/auxiliary/scanner/scada/digi_realport_serialport_scan.rb @@ -20,7 +20,6 @@ class Metasploit3 < Msf::Auxiliary def initialize super( 'Name' => 'Digi RealPort Serial Server Port Scanner', - 'Version' => '$Revision$', 'Description' => 'Identify active ports on RealPort-enabled serial servers.', 'References' => [ diff --git a/modules/auxiliary/scanner/scada/digi_realport_version.rb b/modules/auxiliary/scanner/scada/digi_realport_version.rb index 9cc209c12b..4fc8aa3eb0 100644 --- a/modules/auxiliary/scanner/scada/digi_realport_version.rb +++ b/modules/auxiliary/scanner/scada/digi_realport_version.rb @@ -20,7 +20,6 @@ class Metasploit3 < Msf::Auxiliary def initialize super( 'Name' => 'Digi RealPort Serial Server Version', - 'Version' => '$Revision$', 'Description' => 'Detect serial servers that speak the RealPort protocol.', 'References' => [ From dccfb63bd632c44d9d51cca61870d19565051228 Mon Sep 17 00:00:00 2001 From: HD Moore Date: Sun, 4 Nov 2012 22:47:56 -0600 Subject: [PATCH 4/5] Cleanup based on PR #1008 feedback --- .../scanner/scada/digi_realport_serialport_scan.rb | 13 ++++++++++++- .../scanner/scada/digi_realport_version.rb | 1 + 2 files changed, 13 insertions(+), 1 deletion(-) diff --git a/modules/auxiliary/scanner/scada/digi_realport_serialport_scan.rb b/modules/auxiliary/scanner/scada/digi_realport_serialport_scan.rb index c5e7dcd9e7..d713af29e5 100644 --- a/modules/auxiliary/scanner/scada/digi_realport_serialport_scan.rb +++ b/modules/auxiliary/scanner/scada/digi_realport_serialport_scan.rb @@ -57,7 +57,9 @@ class Metasploit3 < Msf::Auxiliary return unless realport_connect - vprint_status("#{target_host}:#{rport} is running #{@realport_name} ( ports: #{@ports} )") + info = "#{@realport_name} ( ports: #{@realport_port_count} )" + vprint_status("#{target_host}:#{rport} is running #{info}") + report_service(:host => rhost, :port => rport, :name => "realport", :info => info) 1.upto(@realport_port_count) do |pnum| unless test_ports.include?('ALL') or test_ports.include?(pnum.to_s) @@ -71,6 +73,15 @@ class Metasploit3 < Msf::Auxiliary res = realport_recv_banner(pnum - 1, datastore['BANNER_TIMEOUT']) if res and res.length > 0 print_status("#{target_host}:#{rport} [port #{pnum} @ #{baud}bps] #{res.inspect}") + report_note( + :host => target_host, + :proto => 'tcp', + :port => rport, + :type => "realport.port#{pnum}.banner", + :data => {:baud => baud, :banner => res}, + :update => :unique_data + ) + end realport_close(pnum - 1) end diff --git a/modules/auxiliary/scanner/scada/digi_realport_version.rb b/modules/auxiliary/scanner/scada/digi_realport_version.rb index 4fc8aa3eb0..9860efe614 100644 --- a/modules/auxiliary/scanner/scada/digi_realport_version.rb +++ b/modules/auxiliary/scanner/scada/digi_realport_version.rb @@ -40,5 +40,6 @@ class Metasploit3 < Msf::Auxiliary print_status("#{target_host}:#{rport} #{info}") report_service(:host => rhost, :port => rport, :name => "realport", :info => info) end + realport_disconnect end end From 3d7e0b7b3ddb776e8c1ab1dcbc188638494c7ad0 Mon Sep 17 00:00:00 2001 From: HD Moore Date: Sun, 4 Nov 2012 22:50:47 -0600 Subject: [PATCH 5/5] Fix bad indent that snuck into the comments --- lib/msf/core/exploit/realport.rb | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/lib/msf/core/exploit/realport.rb b/lib/msf/core/exploit/realport.rb index 66b95374cd..72727f9594 100644 --- a/lib/msf/core/exploit/realport.rb +++ b/lib/msf/core/exploit/realport.rb @@ -189,10 +189,10 @@ module Exploit::Remote::RealPort # 00 f3 f3 00 00 00 00 00 00 00 00 00 00 00 00 00 # 00 - # Response (BAD) - # \xFF \x17 Access to unopened port\x00 + # Response (BAD) + # \xFF \x17 Access to unopened port\x00 - # Send negotiate request + # Send negotiate request sock.put(pkt2) res = sock.get_once(-1, 5) if res.to_s =~ /^\xff/