output as table, added info on ports, added comment with default ports. msftidy cleanup.
Bruno Morisson
parent
3cfcdfca9e
commit
7ab8485acc
|
|
@ -15,41 +15,41 @@ class Metasploit3 < Msf::Auxiliary
|
||||||
|
|
||||||
def initialize
|
def initialize
|
||||||
super(
|
super(
|
||||||
'Name' => 'SAPRouter Port Scanner',
|
'Name' => 'SAPRouter Port Scanner',
|
||||||
'Description' => %q{
|
'Description' => %q{
|
||||||
This module allows for mapping ACLs and identify open/closed ports accessible
|
This module allows for mapping ACLs and identify open/closed ports accessible
|
||||||
on hosts through a saprouter.
|
on hosts through a saprouter.
|
||||||
},
|
},
|
||||||
'Author' => [
|
'Author' => [
|
||||||
'Bruno Morisson <bm[at]integrity.pt>', # metasploit module
|
'Bruno Morisson <bm[at]integrity.pt>', # metasploit module
|
||||||
'nmonkee' # saprouter packet building code from sapcat.rb and default sap ports information
|
'nmonkee' # saprouter packet building code from sapcat.rb and default sap ports information
|
||||||
],
|
],
|
||||||
'References' =>
|
'References' =>
|
||||||
[
|
[
|
||||||
# General
|
# General
|
||||||
['URL', 'http://help.sap.com/saphelp_nw70/helpdata/EN/4f/992dfe446d11d189700000e8322d00/frameset.htm'],
|
['URL', 'http://help.sap.com/saphelp_nw70/helpdata/EN/4f/992dfe446d11d189700000e8322d00/frameset.htm'],
|
||||||
['URL', 'http://help.sap.com/saphelp_dimp50/helpdata/En/f8/bb960899d743378ccb8372215bb767/content.htm'],
|
['URL', 'http://help.sap.com/saphelp_dimp50/helpdata/En/f8/bb960899d743378ccb8372215bb767/content.htm'],
|
||||||
['URL', 'http://labs.mwrinfosecurity.com/blog/2012/09/13/sap-smashing-internet-windows/'],
|
['URL', 'http://labs.mwrinfosecurity.com/blog/2012/09/13/sap-smashing-internet-windows/'],
|
||||||
['URL', 'http://conference.hitb.org/hitbsecconf2010ams/materials/D2T2%20-%20Mariano%20Nunez%20Di%20Croce%20-%20SAProuter%20.pdf'],
|
['URL', 'http://conference.hitb.org/hitbsecconf2010ams/materials/D2T2%20-%20Mariano%20Nunez%20Di%20Croce%20-%20SAProuter%20.pdf'],
|
||||||
['URL', 'http://scn.sap.com/docs/DOC-17124'] # SAP default ports
|
['URL', 'http://scn.sap.com/docs/DOC-17124'] # SAP default ports
|
||||||
],
|
],
|
||||||
'License' => MSF_LICENSE
|
'License' => MSF_LICENSE
|
||||||
)
|
)
|
||||||
|
|
||||||
register_options(
|
register_options(
|
||||||
[
|
[
|
||||||
OptAddress.new('SAPROUTER_HOST', [true, 'SAPRouter address', '']),
|
OptAddress.new('SAPROUTER_HOST', [true, 'SAPRouter address', '']),
|
||||||
OptPort.new('SAPROUTER_PORT', [true, 'SAPRouter TCP port', '3299']),
|
OptPort.new('SAPROUTER_PORT', [true, 'SAPRouter TCP port', '3299']),
|
||||||
OptEnum.new('MODE', [true, 'Connection Mode: SAP_PROTO or TCP ', 'SAP_PROTO', ['SAP_PROTO', 'TCP']]),
|
OptEnum.new('MODE', [true, 'Connection Mode: SAP_PROTO or TCP ', 'SAP_PROTO', ['SAP_PROTO', 'TCP']]),
|
||||||
OptString.new('INSTANCES', [false, 'SAP instance numbers to scan (NN in PORTS definition)', '00-99']),
|
OptString.new('INSTANCES', [false, 'SAP instance numbers to scan (NN in PORTS definition)', '00-99']),
|
||||||
OptString.new('PORTS', [true, 'Ports to scan (e.g. 3200-3299,5NN13)', '32NN']),
|
OptString.new('PORTS', [true, 'Ports to scan (e.g. 3200-3299,5NN13)', '32NN']),
|
||||||
# Default ports: 32NN,33NN,48NN,80NN,36NN,81NN,5NN00-5NN19,21212,21213,
|
# Default ports: 32NN,33NN,48NN,80NN,36NN,81NN,5NN00-5NN19,21212,21213,
|
||||||
# 59975,59976,4238-4241,3299,3298,515,7200,7210,7269,7270,7575,39NN,
|
# 59975,59976,4238-4241,3299,3298,515,7200,7210,7269,7270,7575,39NN,
|
||||||
# 3909,4NN00,8200,8210,8220,8230,4363,4444,4445,9999,3NN01-3NN08,
|
# 3909,4NN00,8200,8210,8220,8230,4363,4444,4445,9999,3NN01-3NN08,
|
||||||
# 3NN11,3NN17,20003-20007,31596,31597,31602,31601,31604,2000-2002,
|
# 3NN11,3NN17,20003-20007,31596,31597,31602,31601,31604,2000-2002,
|
||||||
# 8355,8357,8351-8353,8366,1090,1095,20201,1099,1089,443NN,444NN
|
# 8355,8357,8351-8353,8366,1090,1095,20201,1099,1089,443NN,444NN
|
||||||
OptInt.new('CONCURRENCY', [true, 'The number of concurrent ports to check per host', 10]),
|
OptInt.new('CONCURRENCY', [true, 'The number of concurrent ports to check per host', 10]),
|
||||||
], self.class)
|
], self.class)
|
||||||
|
|
||||||
deregister_options('RPORT')
|
deregister_options('RPORT')
|
||||||
|
|
||||||
|
|
@ -98,15 +98,15 @@ class Metasploit3 < Msf::Auxiliary
|
||||||
|
|
||||||
route_data=''
|
route_data=''
|
||||||
ni_packet = [
|
ni_packet = [
|
||||||
'NI_ROUTE',
|
'NI_ROUTE',
|
||||||
0,
|
0,
|
||||||
2,
|
2,
|
||||||
39,
|
39,
|
||||||
2,
|
2,
|
||||||
mode,
|
mode,
|
||||||
0,
|
0,
|
||||||
0,
|
0,
|
||||||
1
|
1
|
||||||
].pack("A8c8")
|
].pack("A8c8")
|
||||||
|
|
||||||
first = false
|
first = false
|
||||||
|
|
@ -306,8 +306,8 @@ class Metasploit3 < Msf::Auxiliary
|
||||||
|
|
||||||
s = connect(false,
|
s = connect(false,
|
||||||
{
|
{
|
||||||
'RPORT' => sap_port,
|
'RPORT' => sap_port,
|
||||||
'RHOST' => sap_host
|
'RHOST' => sap_host
|
||||||
}
|
}
|
||||||
)
|
)
|
||||||
|
|
||||||
|
|
@ -339,18 +339,18 @@ class Metasploit3 < Msf::Auxiliary
|
||||||
end
|
end
|
||||||
|
|
||||||
tbl = Msf::Ui::Console::Table.new(
|
tbl = Msf::Ui::Console::Table.new(
|
||||||
Msf::Ui::Console::Table::Style::Default,
|
Msf::Ui::Console::Table::Style::Default,
|
||||||
'Header' => "Portscan Results",
|
'Header' => "Portscan Results",
|
||||||
'Prefix' => "\n",
|
'Prefix' => "\n",
|
||||||
'Postfix' => "\n",
|
'Postfix' => "\n",
|
||||||
'Indent' => 1,
|
'Indent' => 1,
|
||||||
'Columns' =>
|
'Columns' =>
|
||||||
[
|
[
|
||||||
"Host",
|
"Host",
|
||||||
"Port",
|
"Port",
|
||||||
"State",
|
"State",
|
||||||
"Info",
|
"Info",
|
||||||
])
|
])
|
||||||
|
|
||||||
r.each do |res|
|
r.each do |res|
|
||||||
tbl << [res[0], res[1], res[2], res[3]]
|
tbl << [res[0], res[1], res[2], res[3]]
|
||||||
|
|
|
||||||
Loading…
Reference in New Issue