infosecn1nja
/
metasploit-framework
mirror of https://github.com/infosecn1nja/metasploit-framework.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

added optional DoublePulsar check

bug/bundler_fix
zerosum0x0 2017-08-11 11:36:59 -06:00
parent be926e1d75
commit ecfe3d0235
1 changed files with 18 additions and 11 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

29
modules/auxiliary/scanner/smb/smb_ms17_010.rb
View File

@ -47,6 +47,11 @@ class MetasploitModule < Msf::Auxiliary
],
'License' => MSF_LICENSE
))
register_options(
[
OptBool.new('CHECK_DOPU', [true, 'Check for DOUBLEPULSAR on vulnerable hosts', true])
])
end
# algorithm to calculate the XOR Key for DoublePulsar knocks
@ -80,18 +85,20 @@ class MetasploitModule < Msf::Auxiliary
)
# vulnerable to MS17-010, check for DoublePulsar infection
code, signature1, signature2 = do_smb_doublepulsar_probe(tree_id)
if datastore['CHECK_DOPU']
code, signature1, signature2 = do_smb_doublepulsar_probe(tree_id)
if code == 0x51
xor_key = calculate_doublepulsar_xor_key(signature1).to_s(16).upcase
arch = calculate_doublepulsar_arch(signature2)
print_warning("Host is likely INFECTED with DoublePulsar! - Arch: #{arch}, XOR Key: 0x#{xor_key}")
report_vuln(
host: ip,
name: "MS17-010 DoublePulsar Infection",
refs: self.references,
info: "MultiPlexID += 0x10 on Trans2 request - Arch: #{arch}, XOR Key: 0x#{xor_key}"
)
if code == 0x51
xor_key = calculate_doublepulsar_xor_key(signature1).to_s(16).upcase
arch = calculate_doublepulsar_arch(signature2)
print_warning("Host is likely INFECTED with DoublePulsar! - Arch: #{arch}, XOR Key: 0x#{xor_key}")
report_vuln(
host: ip,
name: "MS17-010 DoublePulsar Infection",
refs: self.references,
info: "MultiPlexID += 0x10 on Trans2 request - Arch: #{arch}, XOR Key: 0x#{xor_key}"
)
end
end
elsif status == "STATUS_ACCESS_DENIED" or status == "STATUS_INVALID_HANDLE"
# STATUS_ACCESS_DENIED (Windows 10) and STATUS_INVALID_HANDLE (others)