77 lines
2.3 KiB
Ruby
77 lines
2.3 KiB
Ruby
##
|
|
# This module requires Metasploit: https://metasploit.com/download
|
|
# Current source: https://github.com/rapid7/metasploit-framework
|
|
##
|
|
class MetasploitModule < Msf::Auxiliary
|
|
include Msf::Exploit::Remote::HttpClient
|
|
include Msf::Auxiliary::Report
|
|
def initialize(info = {})
|
|
super(
|
|
update_info(
|
|
info,
|
|
'Name' => 'Shodan Host Port',
|
|
'Description' => %q{
|
|
This module uses the shodan API to return all port information found on a given host IP.
|
|
},
|
|
'Author' => [ 'natto97' ],
|
|
'License' => MSF_LICENSE,
|
|
'References' => [
|
|
[ 'URL', 'https://honeyscore.shodan.io/']
|
|
],
|
|
'Notes' => {
|
|
'Stability' => [],
|
|
'SideEffects' => [],
|
|
'Reliability' => []
|
|
}
|
|
)
|
|
)
|
|
register_options(
|
|
[
|
|
OptString.new('SHODAN_APIKEY', [true, 'The SHODAN API key'])
|
|
]
|
|
)
|
|
deregister_options('SSL')
|
|
deregister_options('RPORT')
|
|
deregister_options('VHOST')
|
|
end
|
|
|
|
def run
|
|
# check our API key is somewhat sane
|
|
unless /^[a-z\d]{32}$/i.match?(datastore['SHODAN_APIKEY'])
|
|
fail_with(Failure::BadConfig, 'Shodan API key should be 32 characters a-z,A-Z,0-9.')
|
|
end
|
|
key = datastore['SHODAN_APIKEY']
|
|
# Check the length of the key (should be 32 chars)
|
|
if key.length != 32
|
|
fail_with(Failure::BadConfig, 'Invalid API key (Not long enough)')
|
|
end
|
|
cli = Rex::Proto::Http::Client.new('api.shodan.io', 443, {}, true)
|
|
cli.connect
|
|
req = cli.request_cgi({
|
|
'uri' => "/shodan/host/#{rhost}?key=#{key}&minify=true",
|
|
'method' => 'GET'
|
|
})
|
|
res = cli.send_recv(req)
|
|
cli.close
|
|
if res.nil?
|
|
fail_with(Failure::Unreachable, 'Unable to connect to shodan')
|
|
end
|
|
if res.body =~ /No information available for that IP/
|
|
print_error('The target IP address has not been scanned by Shodan!')
|
|
return
|
|
end
|
|
if res.code != 200
|
|
fail_with(Failure::UnexpectedReply, 'Shodan did not respond in an expected way. Check your api key')
|
|
end
|
|
json = res.get_json_document
|
|
if !json.nil? && !json['ports'].nil? && !json['ports'].empty?
|
|
json['ports'].each do |post|
|
|
print_good("#{rhost}:#{post}")
|
|
report_service(host: rhost, port: post, name: 'shodan')
|
|
end
|
|
else
|
|
print_error("Shodan did not return any open ports for #{rhost}!")
|
|
end
|
|
end
|
|
end
|