Add references
This commit is contained in:
parent
a2760b219d
commit
f8e3119215
|
@ -0,0 +1,123 @@
|
|||
##
|
||||
# $Id$
|
||||
##
|
||||
|
||||
##
|
||||
# This file is part of the Metasploit Framework and may be subject to
|
||||
# redistribution and commercial restrictions. Please see the Metasploit
|
||||
# Framework web site for more information on licensing and terms of use.
|
||||
# http://metasploit.com/framework/
|
||||
##
|
||||
|
||||
require 'msf/core'
|
||||
|
||||
class Metasploit3 < Msf::Auxiliary
|
||||
|
||||
include Msf::Exploit::Remote::Telnet
|
||||
include Msf::Auxiliary::Scanner
|
||||
include Msf::Auxiliary::Report
|
||||
|
||||
def initialize
|
||||
super(
|
||||
'Name' => 'Telnet Service Encyption Key ID Overflow Detection',
|
||||
'Version' => '$Revision$',
|
||||
'Description' => 'Detect telnet services vulnerable to the encrypt option Key ID overflow (BSD-derived telnetd)',
|
||||
'Author' => [ 'Jaime Penalba Estebanez <jpenalbae[at]gmail.com>', 'hdm' ],
|
||||
'License' => MSF_LICENSE,
|
||||
'References' =>
|
||||
[
|
||||
['BID', '51182'],
|
||||
['CVE', '2011-4862'],
|
||||
['URL', 'http://www.exploit-db.com/exploits/18280/']
|
||||
]
|
||||
)
|
||||
register_options(
|
||||
[
|
||||
Opt::RPORT(23),
|
||||
OptInt.new('TIMEOUT', [true, 'Timeout for the Telnet probe', 30])
|
||||
], self.class)
|
||||
end
|
||||
|
||||
def to
|
||||
return 30 if datastore['TIMEOUT'].to_i.zero?
|
||||
datastore['TIMEOUT'].to_i
|
||||
end
|
||||
|
||||
def run_host(ip)
|
||||
begin
|
||||
::Timeout.timeout(to) do
|
||||
res = connect
|
||||
|
||||
# This makes db_services look a lot nicer.
|
||||
banner_sanitized = Rex::Text.to_hex_ascii(banner.to_s)
|
||||
report_service(:host => rhost, :port => rport, :name => "telnet", :info => banner_sanitized)
|
||||
|
||||
# Check for encryption option ( IS(0) DES_CFB64(1) )
|
||||
sock.put("\xff\xfa\x26\x00\x01\x01\x12\x13\x14\x15\x16\x17\x18\x19\xff\xf0")
|
||||
|
||||
loop do
|
||||
data = sock.get_once(-1, to) rescue nil
|
||||
if not data
|
||||
print_status("#{ip}:#{rport} Does not support encryption: #{banner_sanitized} #{data.to_s.unpack("H*")[0]}")
|
||||
return
|
||||
end
|
||||
break if data.index("\xff\xfa\x26\x02\x01")
|
||||
end
|
||||
|
||||
|
||||
buff_good = "\xff\xfa\x26" + "\x07" + "\x00" + ("X" * 63) + "\xff\xf0"
|
||||
buff_long = "\xff\xfa\x26" + "\x07" + "\x00" + ("X" * 64) + "\xff\xf0"
|
||||
|
||||
begin
|
||||
sock.put(buff_good)
|
||||
data = sock.get_once(-1, 5) rescue nil
|
||||
unless data
|
||||
print_status("#{ip}:#{rport} UNKNOWN: No response to the initial probe: #{banner_sanitized}")
|
||||
return
|
||||
end
|
||||
|
||||
unless data.index("\xff\xfa\x26\x08\xff\xf0")
|
||||
print_status("#{ip}:#{rport} UNKNOWN: Invalid reply to Key ID: #{data.unpack("H*")[0]} - #{banner_sanitized}")
|
||||
return
|
||||
end
|
||||
|
||||
sock.put(buff_long)
|
||||
data = sock.get_once(-1, 5) rescue nil
|
||||
unless data
|
||||
print_status("#{ip}:#{rport} NOT VULNERABLE: No reply to 64-byte Key ID: #{banner_sanitized}")
|
||||
return
|
||||
end
|
||||
|
||||
unless data.index("\xff\xfa\x26\x08\xff\xf0")
|
||||
print_status("#{ip}:#{rport} UNKNOWN: Invalid reply to Key ID: #{data.unpack("H*")[0]} - #{banner_sanitized}")
|
||||
return
|
||||
end
|
||||
|
||||
rescue ::EOFError
|
||||
end
|
||||
|
||||
# EOFError or response to 64-byte Key Id indicates vulnerable systems
|
||||
print_good("#{ip}:#{rport} VULNERABLE: #{banner_sanitized}")
|
||||
report_vuln(
|
||||
{
|
||||
:host => ip,
|
||||
:port => rport,
|
||||
:proto => 'tcp',
|
||||
:name => self.fullname,
|
||||
:info => banner_sanitized,
|
||||
:refs => self.references
|
||||
}
|
||||
)
|
||||
|
||||
end
|
||||
rescue ::Rex::ConnectionError
|
||||
rescue Timeout::Error
|
||||
print_error("#{target_host}:#{rport} Timed out after #{to} seconds")
|
||||
rescue ::Exception => e
|
||||
print_error("#{target_host}:#{rport} Error: #{e} #{e.backtrace}")
|
||||
ensure
|
||||
disconnect
|
||||
end
|
||||
end
|
||||
end
|
||||
|
Loading…
Reference in New Issue