Merge pull request #10 from jhart-r7/pr/fixup-6187

More enum_dns cleanup
bug/bundler_fix
Vex Woo 2016-02-05 00:31:34 +08:00
commit f4c0f66754
1 changed files with 28 additions and 32 deletions

View File

@ -186,7 +186,7 @@ class Metasploit3 < Msf::Auxiliary
filename = nil, info = nil, service = nil)
return unless datastore['STORE_LOOT']
path = store_loot(ltype, ctype, host, data, filename, info, service)
print_good('saved file to: ' + path)
vprint_status("Saved #{ltype} loot to #{path}")
end
def get_ptr(ip)
@ -243,7 +243,7 @@ class Metasploit3 < Msf::Auxiliary
next unless r.class == Net::DNS::RR::NS
records << "#{r.nsdname}"
report_host(host: r.nsdname, name: domain, info: 'NS')
print_good("#{domain}: NS: #{r.nsdname}")
print_good("#{domain} NS: #{r.nsdname}")
end
return if records.blank?
@ -361,40 +361,36 @@ class Metasploit3 < Msf::Auxiliary
def get_srv(domain)
print_status("querying DNS SRV records for #{domain}")
srvs = [
'_gc._tcp.', '_kerberos._tcp.', '_kerberos._udp.', '_ldap._tcp.',
'_test._tcp.', '_sips._tcp.', '_sip._udp.', '_sip._tcp.',
'_aix._tcp.', '_aix._tcp.', '_finger._tcp.', '_ftp._tcp.',
'_http._tcp.', '_nntp._tcp.', '_telnet._tcp.', '_whois._tcp.',
'_h323cs._tcp.', '_h323cs._udp.', '_h323be._tcp.', '_h323be._udp.',
'_h323ls._tcp.', '_h323ls._udp.', '_sipinternal._tcp.',
'_sipinternaltls._tcp.', '_sip._tls.', '_sipfederationtls._tcp.',
'_jabber._tcp.', '_xmpp-server._tcp.', '_xmpp-client._tcp.',
'_imap._tcp.', '_certificates._tcp.', '_crls._tcp.', '_pgpkeys._tcp.',
'_pgprevokations._tcp.', '_cmp._tcp.', '_svcp._tcp.', '_crl._tcp.',
'_ocsp._tcp.', '_PKIXREP._tcp.', '_smtp._tcp.', '_hkp._tcp.',
'_hkps._tcp.', '_jabber._udp.', '_xmpp-server._udp.',
'_xmpp-client._udp.', '_jabber-client._tcp.', '_jabber-client._udp.']
srv_protos = %w(tcp udp tls)
srv_record_types = %w(gc kerberos ldap test sips sip aix finger ftp http
nntp telnet whois h323cs h323be h323ls sipinternal sipinternaltls sip
sipfederationtls jabber jabber-client jabber-server xmpp-server xmpp-client
imap certificates crls pgpkeys pgprevokations cmp svcp crl oscp pkixrep
smtp hkp hkps)
records = []
srvs.each do |srv|
resp = dns_query("#{srv}#{domain}", Net::DNS::SRV)
next if resp.blank? || resp.answer.blank?
resp.answer.each do |r|
next if r.type == Net::DNS::RR::CNAME
srv_records = []
srv_record_types.each do |srv_record_type|
srv_protos.each do |srv_proto|
srv_record = "_#{srv_record_type}._#{srv_proto}.#{domain}"
resp = dns_query(srv_record, Net::DNS::SRV)
next if resp.blank? || resp.answer.blank?
srv_record_hosts = []
resp.answer.each do |r|
next if r.type == Net::DNS::RR::CNAME
host = r.host.gsub(/\.$/, '')
data = "#{host}:#{r.port}, priority #{r.priority}"
print_good("#{srv_record} SRV: #{data}")
srv_record_hosts << srv_record
srv_records << data
end
report_note(
host: domain,
proto: 'udp',
sname: r.host,
port: r.port,
type: 'ENUM_SRV',
data: "#{r.priority}")
print_good("#{domain} : SRV: (Host: #{r.host}, Port: #{r.port}, Priority: #{r.priority})")
type: srv_record,
data: srv_record_hosts
)
end
end
return if records.blank?
save_loot('ENUM_SRV', 'text/plain', domain, "#{records.join(',')}", domain)
records
return if srv_record_hosts.empty?
save_loot('ENUM_SRV', 'text/plain', domain, "#{srv_records.join(',')}", domain)
end
def axfr(domain)