140 lines
4.0 KiB
Ruby
140 lines
4.0 KiB
Ruby
require 'rex/proto/sunrpc'
|
|
|
|
module Msf
|
|
|
|
###
|
|
#
|
|
# This mixin provides utility methods for interacting with a SunRPC service on
|
|
# a remote machine. These methods may generally be useful in the context of
|
|
# exploitation. This mixin extends the Tcp exploit mixin. Only one SunRPC
|
|
# service can be accessed at a time using this class.
|
|
#
|
|
# http://www.ietf.org/rfc/rfc1057.txt
|
|
#
|
|
###
|
|
module Exploit::Remote::SunRPC
|
|
include Exploit::Remote::Tcp
|
|
|
|
XDR = Rex::Encoder::XDR
|
|
|
|
MSG_ACCEPTED = 0
|
|
SUCCESS = 0 # RPC executed successfully
|
|
PROG_UMAVAIL = 1 # Remote hasn't exported program
|
|
PROG_MISMATCH = 2 # Remote can't support version #
|
|
PROC_UNAVAIL = 3 # Program can't support procedure
|
|
GARBAGE_ARGS = 4 # Procedure can't decode params'
|
|
|
|
def initialize(info = {})
|
|
super
|
|
|
|
register_evasion_options(
|
|
[
|
|
OptBool.new('ONCRPC::tcp_request_fragmentation', [false, 'Enable fragmentation of TCP ONC/RPC requests', 'false']),
|
|
], Msf::Exploit::Remote::SunRPC
|
|
)
|
|
|
|
|
|
register_advanced_options(
|
|
[
|
|
# XXX: Use portmapper to do call - Direct portmap to make the request to the program portmap_req
|
|
], Msf::Exploit::Remote::SunRPC)
|
|
|
|
register_options(
|
|
[
|
|
# XXX: XPORT
|
|
Opt::RHOST,
|
|
Opt::RPORT(111),
|
|
], Msf::Exploit::Remote::SunRPC
|
|
)
|
|
end
|
|
|
|
def sunrpc_create(protocol, program, version)
|
|
self.rpcobj = Rex::Proto::SunRPC::Client.new(rhost, rport.to_i, protocol, program, version)
|
|
if datastore['ONCRPC::tcp_request_fragmentation'] == true
|
|
self.rpcobj.should_fragment = 1
|
|
end
|
|
|
|
ret = rpcobj.create
|
|
return print_error("#{rhost} - No response to SunRPC PortMap request") unless ret
|
|
|
|
arr = XDR.decode!(ret, Integer, Integer, Integer, String, Integer, Integer)
|
|
if arr[1] != MSG_ACCEPTED || arr[4] != SUCCESS || arr[5] == 0
|
|
err = "#{rhost} - SunRPC PortMap request failed: "
|
|
err << 'Message not accepted' if arr[1] != MSG_ACCEPTED
|
|
err << 'RPC did not execute' if arr[4] != SUCCESS
|
|
err << 'Program not available' if arr[5] == 0
|
|
print_error(err)
|
|
end
|
|
|
|
rpcobj.pport = arr[5]
|
|
end
|
|
|
|
def sunrpc_call(proc, buf, timeout=60)
|
|
ret = rpcobj.call(proc, buf, timeout)
|
|
return print_error("#{rhost} - No response to SunRPC call for procedure: #{proc}") unless ret
|
|
|
|
arr = Rex::Encoder::XDR.decode!(ret, Integer, Integer, Integer, String, Integer)
|
|
if arr[1] != MSG_ACCEPTED || arr[4] != SUCCESS
|
|
err = "SunRPC call for program #{program} [#{progresolv(program)}], procedure #{procedure}, failed: "
|
|
case arr[4]
|
|
when PROG_UMAVAIL then err << "Program Unavailable"
|
|
when PROG_MISMATCH then err << "Program Version Mismatch"
|
|
when PROC_UNAVAIL then err << "Procedure Unavailable"
|
|
when GARBAGE_ARGS then err << "Garbage Arguments"
|
|
else err << "Unknown Error"
|
|
end
|
|
print_error("#{rhost} - #{err}")
|
|
end
|
|
return ret
|
|
end
|
|
|
|
def sunrpc_destroy
|
|
rpcobj.destroy
|
|
rpcobj = nil
|
|
end
|
|
|
|
def sunrpc_authnull(*args)
|
|
rpcobj.authnull_create(*args)
|
|
end
|
|
|
|
def sunrpc_authunix(*args)
|
|
rpcobj.authunix_create(*args)
|
|
end
|
|
|
|
# XXX: Incomplete. Just moved from Rex::Proto::SunRPC::Client
|
|
def portmap_qry()
|
|
ret = portmap_req()
|
|
arr = Rex::Encoder::XDR.decode!(ret, Integer, Integer, Integer, String, Integer)
|
|
if arr[1] != MSG_ACCEPTED || arr[4] != SUCCESS || arr[5] == 0
|
|
err = "SunRPC call for program #{program} [#{progresolv(program)}], procedure #{procedure}, failed: "
|
|
case arr[4]
|
|
when PROG_UMAVAIL then err << "Program Unavailable"
|
|
when PROG_MISMATCH then err << "Program Version Mismatch"
|
|
when PROC_UNAVAIL then err << "Procedure Unavailable"
|
|
when GARBAGE_ARGS then err << "Garbage Arguments"
|
|
else err << "Unknown Error"
|
|
end
|
|
print_error("#{rhost} - #{err}")
|
|
end
|
|
|
|
return ret
|
|
end
|
|
|
|
def progresolv(number)
|
|
names = File.join(Msf::Config.install_root, "data", "wordlists", "rpc_names.txt")
|
|
File.open(names,"r").each_line do |line|
|
|
next if line.empty? || line =~ /^\s*#/
|
|
|
|
if line =~ /^(\S+?)\s+(\d+)/ && number == $2.to_i
|
|
return $1
|
|
end
|
|
end
|
|
|
|
return "UNKNOWN-#{number}"
|
|
end
|
|
|
|
# Used to track the last SunRPC context
|
|
attr_accessor :rpcobj
|
|
end
|
|
|
|
end |