Modules from Matteo Cantoni

git-svn-id: file:///home/svn/framework3/trunk@5524 4d416f70-5f16-0410-b530-b9f4589650da

modules/auxiliary/scanner/ftp/anonymous.rb

@@ -0,0 +1,60 @@
+##
+# This file is part of the Metasploit Framework and may be subject to 
+# redistribution and commercial restrictions. Please see the Metasploit
+# Framework web site for more information on licensing and terms of use.
+# http://metasploit.com/projects/Framework/
+##
+
+
+require 'msf/core'
+
+module Msf
+
+class Auxiliary::Scanner::Ftp::Anonymous < Msf::Auxiliary
+
+	include Exploit::Remote::Ftp
+	include Auxiliary::Scanner
+
+	def initialize
+		super(
+			'Name'        => 'Anonymous FTP Access Detection',
+			'Version'     => '$Revision: $',
+			'Description' => 'Detect anonymous (read/write) FTP server access.',
+			'References'  =>
+				[
+					['URL', 'http://en.wikipedia.org/wiki/File_Transfer_Protocol#Anonymous_FTP'],
+				],
+			'Author'      => 'Matteo Cantoni <goony[at]nothink.org>',
+			'License'     => MSF_LICENSE
+		)
+	
+		register_options(
+			[
+				Opt::RPORT(21),
+			], self.class)
+	end
+
+	def run_host(target_host)
+
+		res = connect_login
+
+		if banner 
+			banner.gsub!(/\n|\r/, "")
+			print_status("#{target_host}:#{rport} [#{banner}]")
+		end
+
+		if res 
+			write_check = send_cmd( ['MKD', "test"] , true)
+
+			if write_check 
+				send_cmd( ['RMD', "test"] , true)
+				print_status("Anonymous read and write access on #{target_host}:#{rport}")
+			else
+				print_status("Anonymous read access on #{target_host}:#{rport}")
+			end
+		end
+
+		disconnect
+	end
+end
+end

modules/auxiliary/scanner/vnc/vnc_none_auth.rb

@@ -0,0 +1,102 @@
+##
+# This file is part of the Metasploit Framework and may be subject to 
+# redistribution and commercial restrictions. Please see the Metasploit
+# Framework web site for more information on licensing and terms of use.
+# http://metasploit.com/projects/Framework/
+##
+
+
+require 'msf/core'
+
+module Msf
+
+class Auxiliary::Scanner::Vnc::Vnc_None_Auth < Msf::Auxiliary
+
+	include Exploit::Remote::Tcp
+	include Auxiliary::Scanner
+	
+	def initialize
+		super(
+			'Name'        => 'VNC Authentication None Detection',
+			'Version'     => '$Revision: $',
+			'Description' => 'Detect VNC server with empty password.',
+			'References'  =>
+				[
+					['URL', 'http://en.wikipedia.org/wiki/RFB'],
+					['URL', 'http://en.wikipedia.org/wiki/Vnc'],
+				],
+			'Author'      => 'Matteo Cantoni <goony[at]nothink.org>',
+			'License'     => MSF_LICENSE
+		)
+
+		register_options(
+		[
+			Opt::RPORT(5900),
+		], self.class)
+	end
+
+	def run_host(target_host)
+		
+		connect
+
+		ver = sock.get_once(50,1)
+		ver,msg = (ver.split(/\n/))
+
+		# RFB Protocol Version 3.3 (1998-01) 
+		# RFB Protocol Version 3.7 (2003-08) 
+		# RFB Protocol Version 3.8 (2007-06) 
+		if (ver =~ /RFB 003.003|RFB 003.007|RFB 003.008/)
+
+			print_status("#{target_host}:#{rport}, VNC server protocol version : #{ver}")
+
+			if msg
+
+				if (msg =~ /Too many security failures/)
+					msg = msg + ". " + "Wait for a moment!"
+				end
+				print_status("#{target_host}:#{rport}, VNC server warning messages : #{msg}") 
+
+			else	
+
+				# send VNC client protocol version
+				cver = ver + "\x0a"
+				sock.put(cver)
+		
+				res = sock.get_once
+
+				# number of security types, security type	
+				a,b,c,d = res.unpack("C*")
+
+				# 0 : invalid
+				# 1 : none
+				# 2 : vnc authentication
+				
+				if (a and b and c and  d)
+					if (a == 0 and b == 0 and c == 0 and d == 2)
+						sec_type = "VNC authentication"
+					end
+					if (a == 0 and b == 0 and c == 0 and d == 0)
+						sec_type = "No response. Try again!"
+					end
+				elsif (a and b)
+					if (a == 0 and b == 0)
+						sec_type = "Invalid"
+					elsif (a == 0 and b == 1 or a == 1 and b == 1)
+						sec_type = "None, free access!"
+					elsif (a == 0 and b == 2 or a == 1 and b == 2)
+						sec_type = "VNC authentication"
+					else
+						sec_type = "Unknown"
+					end
+				end
+
+				print_status("#{target_host}:#{rport}, VNC server security types supported : #{sec_type}")
+			end
+		else
+			print_status("#{target_host}:#{rport}, VNC server protocol version : #{ver}, not supported!")
+		end
+
+		disconnect
+	end
+end
+end