From 3529cdad7b8e8c070e73648832e283e2984bf4f7 Mon Sep 17 00:00:00 2001 From: jvazquez-r7 Date: Mon, 28 Sep 2015 13:30:10 -0500 Subject: [PATCH 01/15] Add attributes --- .../framework/login_scanner/rex_socket.rb | 20 +++++++++++-------- 1 file changed, 12 insertions(+), 8 deletions(-) diff --git a/lib/metasploit/framework/login_scanner/rex_socket.rb b/lib/metasploit/framework/login_scanner/rex_socket.rb index d8fa26eeaf..b327d9f60f 100644 --- a/lib/metasploit/framework/login_scanner/rex_socket.rb +++ b/lib/metasploit/framework/login_scanner/rex_socket.rb @@ -18,17 +18,21 @@ module Metasploit # @!attribute ssl_version # @return [String] The version of SSL to implement attr_accessor :ssl_version + # @!attribute ssl_verify_mode + # @return [String] The SSL certification verification mechanism + attr_accessor :ssl_verify_mode + # @!attribute ssl_cipher + # @return [String] The SSL cipher to use for the context + attr_accessor :ssl_cipher + # @!attribute chost + # @return [String] The local host for outgoing connections + attr_accessor :chost + # @!attribute cport + # @return [Fixnum] The local port for outgoing connections + attr_accessor :cport private - def chost - '0.0.0.0' - end - - def cport - 0 - end - def rhost host end From 1e4e5c5bae084074e60a79517d30a93689b0e5c0 Mon Sep 17 00:00:00 2001 From: jvazquez-r7 Date: Mon, 28 Sep 2015 13:50:20 -0500 Subject: [PATCH 02/15] Update ACPP login scanner to have into account advanced options --- lib/metasploit/framework/login_scanner/base.rb | 6 ++++++ .../framework/login_scanner/rex_socket.rb | 16 +++++++++------- modules/auxiliary/scanner/acpp/login.rb | 6 ++++++ 3 files changed, 21 insertions(+), 7 deletions(-) diff --git a/lib/metasploit/framework/login_scanner/base.rb b/lib/metasploit/framework/login_scanner/base.rb index 352065916b..4c50065fd8 100644 --- a/lib/metasploit/framework/login_scanner/base.rb +++ b/lib/metasploit/framework/login_scanner/base.rb @@ -30,6 +30,12 @@ module Metasploit # @!attribute port # @return [Fixnum] The port to connect to attr_accessor :port + # @!attribute host + # @return [String] The local host for outgoing connections + attr_accessor :local_host + # @!attribute port + # @return [Fixnum] The local port for outgoing connections + attr_accessor :local_port # @!attribute proxies # @return [String] The proxy directive to use for the socket attr_accessor :proxies diff --git a/lib/metasploit/framework/login_scanner/rex_socket.rb b/lib/metasploit/framework/login_scanner/rex_socket.rb index b327d9f60f..03302d9af9 100644 --- a/lib/metasploit/framework/login_scanner/rex_socket.rb +++ b/lib/metasploit/framework/login_scanner/rex_socket.rb @@ -19,17 +19,11 @@ module Metasploit # @return [String] The version of SSL to implement attr_accessor :ssl_version # @!attribute ssl_verify_mode - # @return [String] The SSL certification verification mechanism + # @return [String] the SSL certification verification mechanism attr_accessor :ssl_verify_mode # @!attribute ssl_cipher # @return [String] The SSL cipher to use for the context attr_accessor :ssl_cipher - # @!attribute chost - # @return [String] The local host for outgoing connections - attr_accessor :chost - # @!attribute cport - # @return [Fixnum] The local port for outgoing connections - attr_accessor :cport private @@ -40,6 +34,14 @@ module Metasploit def rport port end + + def chost + local_host || '0.0.0.0' + end + + def cport + local_port || 0 + end end end end diff --git a/modules/auxiliary/scanner/acpp/login.rb b/modules/auxiliary/scanner/acpp/login.rb index 57677b9661..10047d1b06 100644 --- a/modules/auxiliary/scanner/acpp/login.rb +++ b/modules/auxiliary/scanner/acpp/login.rb @@ -74,6 +74,12 @@ class Metasploit3 < Msf::Auxiliary send_delay: datastore['TCP::send_delay'], framework: framework, framework_module: self, + ssl: datastore['SSL'], + ssl_version: datastore['SSLVersion'], + ssl_verify_mode: datastore['SSLVerifyMode'], + ssl_cipher: datastore['SSLCipher'], + local_port: datastore['CPORT'], + local_host: datastore['CHOST'] ) scanner.scan! do |result| From 50249bd6400568f4c9a22346c4b5c09562ee0ea9 Mon Sep 17 00:00:00 2001 From: jvazquez-r7 Date: Mon, 28 Sep 2015 13:57:08 -0500 Subject: [PATCH 03/15] Update Metasploit::Framework::Tcp::Client to have SSLVerifyMode and SSLCipher into account --- lib/metasploit/framework/tcp/client.rb | 20 +++++++++++--------- 1 file changed, 11 insertions(+), 9 deletions(-) diff --git a/lib/metasploit/framework/tcp/client.rb b/lib/metasploit/framework/tcp/client.rb index 9789d5d2e7..195f12640a 100644 --- a/lib/metasploit/framework/tcp/client.rb +++ b/lib/metasploit/framework/tcp/client.rb @@ -82,15 +82,17 @@ module Metasploit end nsock = Rex::Socket::Tcp.create( - 'PeerHost' => opts['RHOST'] || rhost, - 'PeerPort' => (opts['RPORT'] || rport).to_i, - 'LocalHost' => opts['CHOST'] || chost || "0.0.0.0", - 'LocalPort' => (opts['CPORT'] || cport || 0).to_i, - 'SSL' => dossl, - 'SSLVersion' => opts['SSLVersion'] || ssl_version, - 'Proxies' => proxies, - 'Timeout' => (opts['ConnectTimeout'] || connection_timeout || 10).to_i, - 'Context' => { 'Msf' => framework, 'MsfExploit' => framework_module } + 'PeerHost' => opts['RHOST'] || rhost, + 'PeerPort' => (opts['RPORT'] || rport).to_i, + 'LocalHost' => opts['CHOST'] || chost || "0.0.0.0", + 'LocalPort' => (opts['CPORT'] || cport || 0).to_i, + 'SSL' => dossl, + 'SSLVersion' => opts['SSLVersion'] || ssl_version, + 'SSLVerifyMode' => opts['SSLVerifyMode'] || ssl_verify_mode, + 'SSLCipher' => opts['SSLCipher'] || ssl_cipher, + 'Proxies' => proxies, + 'Timeout' => (opts['ConnectTimeout'] || connection_timeout || 10).to_i, + 'Context' => { 'Msf' => framework, 'MsfExploit' => framework_module } ) # enable evasions on this socket set_tcp_evasions(nsock) From 983bedeb85169c5f5c606f820b5e5fd1ca089b30 Mon Sep 17 00:00:00 2001 From: jvazquez-r7 Date: Mon, 28 Sep 2015 13:58:08 -0500 Subject: [PATCH 04/15] Add debug message --- lib/rex/socket/tcp.rb | 1 + 1 file changed, 1 insertion(+) diff --git a/lib/rex/socket/tcp.rb b/lib/rex/socket/tcp.rb index b334f0f167..361b231a71 100644 --- a/lib/rex/socket/tcp.rb +++ b/lib/rex/socket/tcp.rb @@ -25,6 +25,7 @@ module Rex::Socket::Tcp # @see Rex::Socket::Parameters.from_hash def self.create(hash = {}) hash['Proto'] = 'tcp' + puts "parameters: #{hash.inspect}" self.create_param(Rex::Socket::Parameters.from_hash(hash)) end From 07b44fccb91d5b610f32b1df1d72475664b74c8d Mon Sep 17 00:00:00 2001 From: jvazquez-r7 Date: Mon, 28 Sep 2015 14:03:55 -0500 Subject: [PATCH 05/15] Update AFP login scanner to have into account advanced options --- modules/auxiliary/scanner/afp/afp_login.rb | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/modules/auxiliary/scanner/afp/afp_login.rb b/modules/auxiliary/scanner/afp/afp_login.rb index 69e229bede..74aa22c26a 100644 --- a/modules/auxiliary/scanner/afp/afp_login.rb +++ b/modules/auxiliary/scanner/afp/afp_login.rb @@ -69,6 +69,12 @@ class Metasploit3 < Msf::Auxiliary send_delay: datastore['TCP::send_delay'], framework: framework, framework_module: self, + ssl: datastore['SSL'], + ssl_version: datastore['SSLVersion'], + ssl_verify_mode: datastore['SSLVerifyMode'], + ssl_cipher: datastore['SSLCipher'], + local_port: datastore['CPORT'], + local_host: datastore['CHOST'] ) scanner.scan! do |result| From 4d8f0a6ec41571490a2407edd6b99cbb5972db1c Mon Sep 17 00:00:00 2001 From: jvazquez-r7 Date: Mon, 28 Sep 2015 14:10:55 -0500 Subject: [PATCH 06/15] Update db2_auth to have into account advanced Tcp options --- modules/auxiliary/scanner/db2/db2_auth.rb | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/modules/auxiliary/scanner/db2/db2_auth.rb b/modules/auxiliary/scanner/db2/db2_auth.rb index 4fb8dfee72..b5afbe1bab 100644 --- a/modules/auxiliary/scanner/db2/db2_auth.rb +++ b/modules/auxiliary/scanner/db2/db2_auth.rb @@ -67,6 +67,12 @@ class Metasploit3 < Msf::Auxiliary send_delay: datastore['TCP::send_delay'], framework: framework, framework_module: self, + ssl: datastore['SSL'], + ssl_version: datastore['SSLVersion'], + ssl_verify_mode: datastore['SSLVerifyMode'], + ssl_cipher: datastore['SSLCipher'], + local_port: datastore['CPORT'], + local_host: datastore['CHOST'] ) scanner.scan! do |result| From a99e44b43a1fc9b9c6926c1ace1a49af5472f0d5 Mon Sep 17 00:00:00 2001 From: jvazquez-r7 Date: Mon, 28 Sep 2015 14:13:08 -0500 Subject: [PATCH 07/15] Update vnc_login to have into account advanced TCP options --- modules/auxiliary/scanner/vnc/vnc_login.rb | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/modules/auxiliary/scanner/vnc/vnc_login.rb b/modules/auxiliary/scanner/vnc/vnc_login.rb index 840fed4561..91ec122893 100644 --- a/modules/auxiliary/scanner/vnc/vnc_login.rb +++ b/modules/auxiliary/scanner/vnc/vnc_login.rb @@ -83,6 +83,12 @@ class Metasploit3 < Msf::Auxiliary send_delay: datastore['TCP::send_delay'], framework: framework, framework_module: self, + ssl: datastore['SSL'], + ssl_version: datastore['SSLVersion'], + ssl_verify_mode: datastore['SSLVerifyMode'], + ssl_cipher: datastore['SSLCipher'], + local_port: datastore['CPORT'], + local_host: datastore['CHOST'] ) scanner.scan! do |result| From df3e4e8afd3cd1856378fbad5f0f8d53372feb40 Mon Sep 17 00:00:00 2001 From: jvazquez-r7 Date: Mon, 28 Sep 2015 14:18:05 -0500 Subject: [PATCH 08/15] Update ftp_login to have into account advanced TCP options --- modules/auxiliary/scanner/ftp/ftp_login.rb | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/modules/auxiliary/scanner/ftp/ftp_login.rb b/modules/auxiliary/scanner/ftp/ftp_login.rb index b5a5bc3352..676ea23753 100644 --- a/modules/auxiliary/scanner/ftp/ftp_login.rb +++ b/modules/auxiliary/scanner/ftp/ftp_login.rb @@ -81,6 +81,12 @@ class Metasploit3 < Msf::Auxiliary connection_timeout: 30, framework: framework, framework_module: self, + ssl: datastore['SSL'], + ssl_version: datastore['SSLVersion'], + ssl_verify_mode: datastore['SSLVerifyMode'], + ssl_cipher: datastore['SSLCipher'], + local_port: datastore['CPORT'], + local_host: datastore['CHOST'] ) scanner.scan! do |result| From 0abb387c1a8316364acb46667bb16056600ba7e4 Mon Sep 17 00:00:00 2001 From: jvazquez-r7 Date: Mon, 28 Sep 2015 14:22:09 -0500 Subject: [PATCH 09/15] Update mssql_login to have into account advanced TCP options --- modules/auxiliary/scanner/mssql/mssql_login.rb | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/modules/auxiliary/scanner/mssql/mssql_login.rb b/modules/auxiliary/scanner/mssql/mssql_login.rb index b29f8eb7e0..dca6283fb9 100644 --- a/modules/auxiliary/scanner/mssql/mssql_login.rb +++ b/modules/auxiliary/scanner/mssql/mssql_login.rb @@ -58,6 +58,12 @@ class Metasploit3 < Msf::Auxiliary windows_authentication: datastore['USE_WINDOWS_AUTHENT'], framework: framework, framework_module: self, + ssl: datastore['SSL'], + ssl_version: datastore['SSLVersion'], + ssl_verify_mode: datastore['SSLVerifyMode'], + ssl_cipher: datastore['SSLCipher'], + local_port: datastore['CPORT'], + local_host: datastore['CHOST'] ) scanner.scan! do |result| From d02193aaeba6912cd47002c6c412fb98e1ae0356 Mon Sep 17 00:00:00 2001 From: jvazquez-r7 Date: Mon, 28 Sep 2015 14:28:32 -0500 Subject: [PATCH 10/15] Update mysql_login to have into account advanced TCP options --- modules/auxiliary/scanner/mysql/mysql_login.rb | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/modules/auxiliary/scanner/mysql/mysql_login.rb b/modules/auxiliary/scanner/mysql/mysql_login.rb index b7bad07431..97658016c6 100644 --- a/modules/auxiliary/scanner/mysql/mysql_login.rb +++ b/modules/auxiliary/scanner/mysql/mysql_login.rb @@ -66,6 +66,12 @@ class Metasploit3 < Msf::Auxiliary send_delay: datastore['TCP::send_delay'], framework: framework, framework_module: self, + ssl: datastore['SSL'], + ssl_version: datastore['SSLVersion'], + ssl_verify_mode: datastore['SSLVerifyMode'], + ssl_cipher: datastore['SSLCipher'], + local_port: datastore['CPORT'], + local_host: datastore['CHOST'] ) scanner.scan! do |result| From 0eed30ce05383251333cd06f00911b6a1991543a Mon Sep 17 00:00:00 2001 From: jvazquez-r7 Date: Mon, 28 Sep 2015 14:29:50 -0500 Subject: [PATCH 11/15] Update pop3_login to have into account advanced TCP options --- modules/auxiliary/scanner/pop3/pop3_login.rb | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/modules/auxiliary/scanner/pop3/pop3_login.rb b/modules/auxiliary/scanner/pop3/pop3_login.rb index 9e0b75d8ea..33719dfb96 100644 --- a/modules/auxiliary/scanner/pop3/pop3_login.rb +++ b/modules/auxiliary/scanner/pop3/pop3_login.rb @@ -75,6 +75,12 @@ class Metasploit3 < Msf::Auxiliary send_delay: datastore['TCP::send_delay'], framework: framework, framework_module: self, + ssl: datastore['SSL'], + ssl_version: datastore['SSLVersion'], + ssl_verify_mode: datastore['SSLVerifyMode'], + ssl_cipher: datastore['SSLCipher'], + local_port: datastore['CPORT'], + local_host: datastore['CHOST'] ) scanner.scan! do |result| From adb76a9223bf61f86c715278e5ee48efc8104d7f Mon Sep 17 00:00:00 2001 From: jvazquez-r7 Date: Mon, 28 Sep 2015 14:35:58 -0500 Subject: [PATCH 12/15] Update telnet_login to have into account advanced TCP options --- modules/auxiliary/scanner/telnet/telnet_login.rb | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/modules/auxiliary/scanner/telnet/telnet_login.rb b/modules/auxiliary/scanner/telnet/telnet_login.rb index e9315b7ba4..63dda3f8ab 100644 --- a/modules/auxiliary/scanner/telnet/telnet_login.rb +++ b/modules/auxiliary/scanner/telnet/telnet_login.rb @@ -72,6 +72,12 @@ class Metasploit3 < Msf::Auxiliary telnet_timeout: datastore['TelnetTimeout'], framework: framework, framework_module: self, + ssl: datastore['SSL'], + ssl_version: datastore['SSLVersion'], + ssl_verify_mode: datastore['SSLVerifyMode'], + ssl_cipher: datastore['SSLCipher'], + local_port: datastore['CPORT'], + local_host: datastore['CHOST'] ) scanner.scan! do |result| From 2f46335c90d481c02bfa6c1e57c75f77aa4a9998 Mon Sep 17 00:00:00 2001 From: jvazquez-r7 Date: Mon, 28 Sep 2015 14:36:23 -0500 Subject: [PATCH 13/15] Update brocade_enbale_login to have into account advanced TCP options --- modules/auxiliary/scanner/telnet/brocade_enable_login.rb | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/modules/auxiliary/scanner/telnet/brocade_enable_login.rb b/modules/auxiliary/scanner/telnet/brocade_enable_login.rb index 95decddd85..c5beadbe05 100644 --- a/modules/auxiliary/scanner/telnet/brocade_enable_login.rb +++ b/modules/auxiliary/scanner/telnet/brocade_enable_login.rb @@ -116,6 +116,12 @@ class Metasploit4 < Msf::Auxiliary pre_login: lambda { |s| raw_send("enable\r\n", s.sock) }, framework: framework, framework_module: self, + ssl: datastore['SSL'], + ssl_version: datastore['SSLVersion'], + ssl_verify_mode: datastore['SSLVerifyMode'], + ssl_cipher: datastore['SSLCipher'], + local_port: datastore['CPORT'], + local_host: datastore['CHOST'] ) scanner.scan! do |result| From 269641a0fffc946b75d19f5e68f3e2ae7dfd908a Mon Sep 17 00:00:00 2001 From: jvazquez-r7 Date: Mon, 28 Sep 2015 14:38:35 -0500 Subject: [PATCH 14/15] Update vmauthd_login to have into account advanced TCP options --- modules/auxiliary/scanner/vmware/vmauthd_login.rb | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/modules/auxiliary/scanner/vmware/vmauthd_login.rb b/modules/auxiliary/scanner/vmware/vmauthd_login.rb index 10adb080d7..5844222e6c 100644 --- a/modules/auxiliary/scanner/vmware/vmauthd_login.rb +++ b/modules/auxiliary/scanner/vmware/vmauthd_login.rb @@ -78,6 +78,12 @@ class Metasploit3 < Msf::Auxiliary send_delay: datastore['TCP::send_delay'], framework: framework, framework_module: self, + ssl: datastore['SSL'], + ssl_version: datastore['SSLVersion'], + ssl_verify_mode: datastore['SSLVerifyMode'], + ssl_cipher: datastore['SSLCipher'], + local_port: datastore['CPORT'], + local_host: datastore['CHOST'] ) scanner.scan! do |result| From 19ada4b84210d89c683e540b5393628e70425f7d Mon Sep 17 00:00:00 2001 From: jvazquez-r7 Date: Mon, 28 Sep 2015 14:44:48 -0500 Subject: [PATCH 15/15] Revert "Add debug message" This reverts commit 983bedeb85169c5f5c606f820b5e5fd1ca089b30. --- lib/rex/socket/tcp.rb | 1 - 1 file changed, 1 deletion(-) diff --git a/lib/rex/socket/tcp.rb b/lib/rex/socket/tcp.rb index 361b231a71..b334f0f167 100644 --- a/lib/rex/socket/tcp.rb +++ b/lib/rex/socket/tcp.rb @@ -25,7 +25,6 @@ module Rex::Socket::Tcp # @see Rex::Socket::Parameters.from_hash def self.create(hash = {}) hash['Proto'] = 'tcp' - puts "parameters: #{hash.inspect}" self.create_param(Rex::Socket::Parameters.from_hash(hash)) end