141 lines
3.1 KiB
Ruby
141 lines
3.1 KiB
Ruby
##
|
|
# $Id$
|
|
##
|
|
|
|
##
|
|
# This file is part of the Metasploit Framework and may be subject to
|
|
# redistribution and commercial restrictions. Please see the Metasploit
|
|
# web site for more information on licensing and terms of use.
|
|
# http://metasploit.com/
|
|
##
|
|
|
|
|
|
require 'msf/core'
|
|
require 'rex/proto/addp'
|
|
|
|
class Metasploit3 < Msf::Auxiliary
|
|
|
|
include Msf::Auxiliary::Report
|
|
include Msf::Auxiliary::Scanner
|
|
|
|
def initialize
|
|
super(
|
|
'Name' => 'Digi ADDP Information Discovery',
|
|
'Version' => '$Revision$',
|
|
'Description' => 'Discover host information through the Digi International ADDP service',
|
|
'Author' => 'hdm',
|
|
'References' =>
|
|
[
|
|
['URL', 'http://qbeukes.blogspot.com/2009/11/advanced-digi-discovery-protocol_21.html'],
|
|
['URL', 'http://www.digi.com/wiki/developer/index.php/Advanced_Device_Discovery_Protocol_%28ADDP%29'],
|
|
],
|
|
'License' => MSF_LICENSE
|
|
)
|
|
|
|
register_options(
|
|
[
|
|
Opt::CHOST,
|
|
OptInt.new('BATCHSIZE', [true, 'The number of hosts to probe in each set', 256]),
|
|
Opt::RPORT(2362)
|
|
], self.class)
|
|
end
|
|
|
|
def run_batch_size
|
|
datastore['BATCHSIZE'].to_i
|
|
end
|
|
|
|
def rport
|
|
datastore['RPORT'].to_i
|
|
end
|
|
|
|
def run_batch(batch)
|
|
|
|
print_status("Sending Digi ADDP probes to #{batch[0]}->#{batch[-1]} (#{batch.length} hosts)")
|
|
|
|
@results = {}
|
|
begin
|
|
udp_sock = nil
|
|
idx = 0
|
|
|
|
# Create an unbound UDP socket if no CHOST is specified, otherwise
|
|
# create a UDP socket bound to CHOST (in order to avail of pivoting)
|
|
udp_sock = Rex::Socket::Udp.create( { 'LocalHost' => datastore['CHOST'] || nil, 'Context' => {'Msf' => framework, 'MsfExploit' => self} })
|
|
add_socket(udp_sock)
|
|
|
|
batch.each do |ip|
|
|
begin
|
|
|
|
# Try all currently-known magic probe values
|
|
Rex::Proto::ADDP.request_config_all.each do |pkt|
|
|
begin
|
|
udp_sock.sendto(pkt, ip, rport, 0)
|
|
rescue ::Errno::ENOBUFS
|
|
print_status("Socket buffers are full, waiting for them to flush...")
|
|
while (r = udp_sock.recvfrom(65535, 0.1) and r[1])
|
|
parse_reply(r)
|
|
end
|
|
select(nil, nil, nil, 0.25)
|
|
retry
|
|
end
|
|
end
|
|
|
|
rescue ::Interrupt
|
|
raise $!
|
|
rescue ::Rex::ConnectionError
|
|
end
|
|
|
|
if (idx % 30 == 0)
|
|
while (r = udp_sock.recvfrom(65535, 0.1) and r[1])
|
|
parse_reply(r)
|
|
end
|
|
end
|
|
|
|
idx += 1
|
|
end
|
|
|
|
while (r = udp_sock.recvfrom(65535, 3) and r[1])
|
|
parse_reply(r)
|
|
end
|
|
|
|
rescue ::Interrupt
|
|
raise $!
|
|
rescue ::Exception => e
|
|
print_error("Unknown error: #{e.class} #{e} #{e.backtrace}")
|
|
end
|
|
end
|
|
|
|
|
|
def parse_reply(pkt)
|
|
# Ignore "empty" packets
|
|
return if not pkt[1]
|
|
|
|
addr = pkt[1]
|
|
if(addr =~ /^::ffff:/)
|
|
addr = addr.sub(/^::ffff:/, '')
|
|
end
|
|
|
|
data = pkt[0]
|
|
|
|
@results[addr] ||= {}
|
|
@results[addr] = Rex::Proto::ADDP.decode_reply(data)
|
|
|
|
return unless @results[addr][:magic] and @results[addr][:mac]
|
|
|
|
inf = Rex::Proto::ADDP.reply_to_string(@results[addr])
|
|
|
|
if inside_workspace_boundary?(addr)
|
|
report_service(
|
|
:host => addr,
|
|
:mac => @results[addr][:mac],
|
|
:port => pkt[2],
|
|
:proto => 'udp',
|
|
:name => 'addp',
|
|
:info => inf
|
|
)
|
|
end
|
|
print_status("#{addr}:#{pkt[2]} #{inf}")
|
|
end
|
|
|
|
|
|
end
|