322 lines
8.4 KiB
Ruby
322 lines
8.4 KiB
Ruby
# -*- coding: binary -*-
|
|
|
|
module Msf
|
|
|
|
###
|
|
#
|
|
# This module provides common tools for IPv6
|
|
#
|
|
###
|
|
module Exploit::Remote::Ipv6
|
|
|
|
#
|
|
# Initializes an instance of an exploit module that captures traffic
|
|
#
|
|
def initialize(info = {})
|
|
super
|
|
register_options(
|
|
[
|
|
OptString.new('INTERFACE', [false, 'The name of the interface']),
|
|
OptString.new("SMAC", [ false, "The source MAC address"]),
|
|
OptAddress.new("SHOST", [ false, "The source IPv6 address" ] ),
|
|
OptInt.new("TIMEOUT", [ true, "Timeout when waiting for host response.", 5])
|
|
], Msf::Exploit::Remote::Ipv6
|
|
)
|
|
|
|
begin
|
|
require 'pcaprub'
|
|
@pcaprub_loaded = true
|
|
rescue ::Exception => e
|
|
@pcaprub_loaded = false
|
|
@pcaprub_error = e
|
|
end
|
|
end
|
|
|
|
|
|
#
|
|
# Shortcut method for resolving our local interface name
|
|
#
|
|
def ipv6_interface(opts={})
|
|
opts['INTERFACE'] || datastore['INTERFACE'] || ::Pcap.lookupdev
|
|
end
|
|
|
|
#
|
|
# Shortcut method for determining our link-local address
|
|
#
|
|
def ipv6_link_address(opts={})
|
|
Rex::Socket.ipv6_link_address(ipv6_interface(opts))
|
|
end
|
|
|
|
#
|
|
# Shortcut method for determining our MAC address
|
|
#
|
|
def ipv6_mac(opts={})
|
|
Rex::Socket.ipv6_mac(ipv6_interface(opts))
|
|
end
|
|
|
|
#
|
|
# Opens a pcaprub capture interface to inject packets, and sniff ICMPv6 packets
|
|
#
|
|
|
|
def open_icmp_pcap(opts = {})
|
|
check_pcaprub_loaded
|
|
|
|
dev = ipv6_interface(opts)
|
|
len = 65535
|
|
tim = 0
|
|
@ipv6_icmp6_capture = ::Pcap.open_live(dev, len, true, tim)
|
|
@ipv6_icmp6_capture.setfilter("icmp6")
|
|
end
|
|
|
|
#
|
|
# Close the capture interface
|
|
#
|
|
def close_icmp_pcap()
|
|
check_pcaprub_loaded
|
|
|
|
return if not @ipv6_icmp6_capture
|
|
@ipv6_icmp6_capture = nil
|
|
GC.start()
|
|
end
|
|
|
|
#
|
|
# Send out a ICMPv6 neighbor solicitation, and
|
|
# return the associated MAC address
|
|
#
|
|
def solicit_ipv6_mac(dhost, opts = {})
|
|
check_pcaprub_loaded
|
|
|
|
dhost_intf = dhost + '%' + ipv6_interface(opts)
|
|
|
|
smac = opts['SMAC'] || datastore['SMAC'] || ipv6_mac
|
|
shost = opts['SHOST'] || datastore['SHOST'] || Rex::Socket.source_address(dhost_intf)
|
|
timeout = opts['TIMEOUT'] || datastore['TIMEOUT'] || 3
|
|
|
|
open_icmp_pcap()
|
|
|
|
p2 = PacketFu::IPv6Packet.new
|
|
p2.eth_saddr = smac
|
|
p2.eth_daddr = ipv6_soll_mcast_mac(dhost)
|
|
p2.ipv6_saddr = shost
|
|
p2.ipv6_daddr = ipv6_soll_mcast_addr6(dhost)
|
|
p2.ipv6_hop = 255
|
|
p2.ipv6_next = 0x3a
|
|
p2.payload = ipv6_neighbor_solicitation(
|
|
IPAddr.new(dhost).to_i,
|
|
p2.eth_src
|
|
)
|
|
p2.ipv6_len = p2.payload.size
|
|
ipv6_checksum!(p2)
|
|
|
|
@ipv6_icmp6_capture.inject(p2.to_s)
|
|
|
|
# Wait for a response
|
|
max_epoch = ::Time.now.to_i + timeout
|
|
while(::Time.now.to_i < max_epoch)
|
|
pkt_bytes = @ipv6_icmp6_capture.next()
|
|
next if not pkt_bytes
|
|
pkt = PacketFu::Packet.parse(pkt_bytes) rescue nil
|
|
next unless pkt
|
|
next unless pkt.is_ipv6?
|
|
next unless pkt.ipv6_next == 0x3a
|
|
next unless pkt.payload
|
|
next if pkt.payload.empty?
|
|
next unless pkt.payload[0,1] == "\x88" # Neighbor advertisement
|
|
if(IPAddr.new(pkt.ipv6_daddr).to_i == IPAddr.new(shost).to_i and
|
|
IPAddr.new(pkt.ipv6_saddr).to_i == IPAddr.new(dhost).to_i)
|
|
ipv6opts = pkt.payload[24,pkt.payload.size]
|
|
next unless ipv6opts
|
|
parsed_opts = ipv6_parse_options(ipv6opts)
|
|
parsed_opts.each do |opt|
|
|
if opt[0] == 2
|
|
addr = PacketFu::EthHeader.str2mac(opt.last)
|
|
close_icmp_pcap()
|
|
return(addr)
|
|
end
|
|
end
|
|
close_icmp_pcap
|
|
return(pkt.eth_saddr)
|
|
end
|
|
end
|
|
close_icmp_pcap
|
|
return nil
|
|
end
|
|
|
|
#
|
|
# Send a ICMPv6 Echo Request, and wait for the
|
|
# associated ICMPv6 Echo Response
|
|
#
|
|
def ping6(dhost, opts={})
|
|
check_pcaprub_loaded
|
|
|
|
dhost_intf = dhost + '%' + ipv6_interface(opts)
|
|
|
|
smac = opts['SMAC'] || datastore['SMAC'] || ipv6_mac
|
|
shost = opts['SHOST'] || datastore['SHOST'] || Rex::Socket.source_address(dhost_intf)
|
|
dmac = opts['DMAC'] || solicit_ipv6_mac(dhost)
|
|
timeout = opts['TIMEOUT'] || datastore['TIMEOUT']
|
|
wait = opts['WAIT']
|
|
|
|
|
|
if(wait.eql?(nil))
|
|
wait = true
|
|
end
|
|
|
|
dmac.eql?(nil) and return false
|
|
|
|
open_icmp_pcap()
|
|
|
|
# Create ICMPv6 Request
|
|
p = PacketFu::IPv6Packet.new
|
|
p.eth_saddr = smac
|
|
p.eth_daddr = dmac
|
|
p.ipv6_saddr = shost
|
|
p.ipv6_daddr = dhost
|
|
p.ipv6_next = 0x3a
|
|
icmp_id = rand(65000)
|
|
icmp_seq = 1
|
|
icmp_payload = Rex::Text.rand_text(8)
|
|
p.payload = ipv6_icmpv6_echo_request(icmp_id,icmp_seq,icmp_payload)
|
|
p.ipv6_len = p.payload.to_s.size
|
|
ipv6_checksum!(p)
|
|
|
|
@ipv6_icmp6_capture.inject(p.to_s)
|
|
|
|
if(wait.eql?(true))
|
|
print_status("Waiting for ping reply...")
|
|
print_line("")
|
|
# Wait for a response
|
|
max_epoch = ::Time.now.to_i + timeout
|
|
while(::Time.now.to_i < max_epoch)
|
|
pkt = @ipv6_icmp6_capture.next()
|
|
next if not pkt
|
|
response_pkt = PacketFu::Packet.parse(pkt) rescue nil
|
|
next unless response_pkt
|
|
next unless response_pkt.is_ipv6?
|
|
next unless response_pkt.payload
|
|
next if response_pkt.payload.empty?
|
|
next unless response_pkt.payload[0,1] == "\x81" # Echo reply
|
|
if( response_pkt.ipv6_daddr == p.ipv6_saddr and
|
|
response_pkt.ipv6_saddr == p.ipv6_daddr and
|
|
response_pkt.ipv6_daddr == p.ipv6_saddr and
|
|
response_pkt.payload[4,2] == p.payload[4,2] and # Id
|
|
response_pkt.payload[6,2] == p.payload[6,2] # Seq
|
|
)
|
|
close_icmp_pcap()
|
|
return(true)
|
|
end
|
|
|
|
end # End while
|
|
end
|
|
|
|
close_icmp_pcap()
|
|
return(false)
|
|
end
|
|
|
|
#
|
|
# Helper methods that haven't made it upstream yet. Mostly packet data
|
|
# packers, also a checksum calculator.
|
|
#
|
|
|
|
def ipv6_icmpv6_echo_request(id,seq,data)
|
|
type = 0x80
|
|
code = 0
|
|
checksum = 0
|
|
id ||= rand(0x10000)
|
|
seq ||= rand(0x10000)
|
|
[type,code,checksum,id,seq,data].pack("CCnnna*")
|
|
end
|
|
|
|
# Simple tlv parser
|
|
def ipv6_parse_options(data)
|
|
pos = 0
|
|
opts = []
|
|
while pos < data.size
|
|
type, len = data[pos,2].unpack("CC")
|
|
this_opt = [type,len]
|
|
this_opt << data[pos+2, (pos-2 + (len * 8))]
|
|
opts << this_opt
|
|
pos += this_opt.pack("CCa*").size
|
|
end
|
|
opts
|
|
end
|
|
|
|
# From Jon Hart's Racket::L3::Misc#linklocaladdr(), which
|
|
# is from Daniele Bellucci
|
|
def ipv6_linklocaladdr(mac)
|
|
mac = mac.split(":")
|
|
mac[0] = (mac[0].to_i(16) ^ (1 << 1)).to_s(16)
|
|
["fe80", "", mac[0,2].join, mac[2,2].join("ff:fe"), mac[4,2].join].join(":")
|
|
end
|
|
|
|
# From Jon Hart's Racket::L3::Misc#soll_mcast_addr6(),
|
|
# which is from DDniele Belluci
|
|
def ipv6_soll_mcast_addr6(addr)
|
|
h = addr.split(':')[-2, 2]
|
|
m = []
|
|
m << 'ff'
|
|
m << (h[0].to_i(16) & 0xff).to_s(16)
|
|
m << ((h[1].to_i(16) & (0xff << 8)) >> 8).to_s(16)
|
|
m << (h[1].to_i(16) & 0xff).to_s(16)
|
|
'ff02::1:' + [m[0,2].join, m[2,2].join].join(':')
|
|
end
|
|
|
|
# From Jon Hart's Racket::L3::Misc#soll_mcast_mac()
|
|
def ipv6_soll_mcast_mac(addr)
|
|
h = addr.split(':')[-2, 2]
|
|
m = []
|
|
m << 'ff'
|
|
m << (h[0].to_i(16) & 0xff).to_s(16)
|
|
m << ((h[1].to_i(16) & (0xff << 8)) >> 8).to_s(16)
|
|
m << (h[1].to_i(16) & 0xff).to_s(16)
|
|
'33:33:' + m.join(':')
|
|
end
|
|
|
|
# Usual ghetto strategy from PacketFu
|
|
def ipv6_checksum!(pkt)
|
|
check_data = pkt.headers.last[:ipv6_src].to_s.unpack("n8")
|
|
check_data << pkt.headers.last[:ipv6_dst].to_s.unpack("n8")
|
|
check_data << pkt.ipv6_len
|
|
check_data << [0,58]
|
|
check_payload = pkt.payload.size % 2 == 0 ? pkt.payload : pkt.payload + "\x00"
|
|
check_data << check_payload.unpack("n*")
|
|
check_data.flatten!
|
|
checksum = check_data.inject(0) {|sum,x| sum += x}
|
|
checksum = checksum % 0xffff
|
|
checksum = 0xffff - checksum
|
|
checksum == 0 ? 0xffff : checksum
|
|
pkt.payload[2,2] = [checksum].pack("n")
|
|
pkt
|
|
end
|
|
|
|
# Takes a neighbor and smac as arguments, The Neighbor
|
|
# value must be an int, while the smac must be a string.
|
|
# Very rudimentary and temporary.
|
|
def ipv6_neighbor_solicitation(neigh,smac)
|
|
target = neigh.to_s(16).scan(/../).map {|x| x.to_i(16)}.pack("C*")
|
|
type = 135
|
|
code = 0
|
|
checksum = 0
|
|
reserved = 0
|
|
opt_type = 1
|
|
opt_len = 1
|
|
[type, code, checksum, reserved,
|
|
target, opt_type, opt_len, smac
|
|
].pack("CCnNa16CCa6")
|
|
end
|
|
|
|
|
|
def check_pcaprub_loaded
|
|
unless @pcaprub_loaded
|
|
print_status("The Pcaprub module is not available: #{@pcaprub_error}")
|
|
raise RuntimeError, "Pcaprub not available"
|
|
else
|
|
true
|
|
end
|
|
|
|
end
|
|
|
|
end
|
|
end
|
|
|