33# Current source: https://github.com/rapid7/metasploit-framework
44##
55
6+ require 'English'
67class MetasploitModule < Msf ::Auxiliary
78 include Msf ::Exploit ::Remote ::Tcp
89 include Msf ::Auxiliary ::Scanner
910 include Msf ::Auxiliary ::Report
1011
1112 def initialize
1213 super (
13- 'Name' => 'Energizer DUO Trojan Scanner' ,
14- 'Description' => 'Detect instances of the Energizer DUO trojan horse software on port 7777' ,
15- 'Author' => 'hdm' ,
16- 'References' =>
17- [
18- [ 'CVE' , '2010-0103' ] ,
19- [ 'OSVDB' , '62782' ] ,
20- [ 'US-CERT-VU' , '154421' ]
21- ] ,
22- 'License' => MSF_LICENSE
14+ 'Name' => 'Energizer DUO Trojan Scanner' ,
15+ 'Description' => 'Detect instances of the Energizer DUO trojan horse software on port 7777.' ,
16+ 'Author' => 'hdm' ,
17+ 'References' => [
18+ [ 'CVE' , '2010-0103' ] ,
19+ [ 'OSVDB' , '62782' ] ,
20+ [ 'US-CERT-VU' , '154421' ]
21+ ] ,
22+ 'License' => MSF_LICENSE ,
23+ 'Notes' => {
24+ 'Stability' => [ CRASH_SAFE ] ,
25+ 'SideEffects' => [ ] ,
26+ 'Reliability' => [ ]
27+ }
2328 )
2429
2530 register_options (
2631 [
2732 Opt ::RPORT ( 7777 ) ,
28- ] )
33+ ]
34+ )
2935 end
3036
3137 def trojan_encode ( str )
32- str . unpack ( "C*" ) . map { |c | c ^ 0xE5 } . pack ( "C*" )
38+ str . unpack ( 'C*' ) . map { |c | c ^ 0xE5 } . pack ( 'C*' )
3339 end
3440
3541 def trojan_command ( cmd )
36- cid = ""
42+ cid = ''
3743
3844 case cmd
3945 when :exec
40- cid = " {8AF1C164-EBD6-4b2b-BC1F-64674E98A710}"
46+ cid = ' {8AF1C164-EBD6-4b2b-BC1F-64674E98A710}'
4147 when :dir
42- cid = " {0174D2FC-7CB6-4a22-87C7-7BB72A32F19F}"
48+ cid = ' {0174D2FC-7CB6-4a22-87C7-7BB72A32F19F}'
4349 when :write
44- cid = " {98D958FC-D0A2-4f1c-B841-232AB357E7C8}"
50+ cid = ' {98D958FC-D0A2-4f1c-B841-232AB357E7C8}'
4551 when :read
46- cid = " {F6C43E1A-1551-4000-A483-C361969AEC41}"
52+ cid = ' {F6C43E1A-1551-4000-A483-C361969AEC41}'
4753 when :nop
48- cid = " {783EACBF-EF8B-498e-A059-F0B5BD12641E}"
54+ cid = ' {783EACBF-EF8B-498e-A059-F0B5BD12641E}'
4955 when :find
50- cid = " {EA7A2EB7-1E49-4d5f-B4D8-D6645B7440E3}"
56+ cid = ' {EA7A2EB7-1E49-4d5f-B4D8-D6645B7440E3}'
5157 when :yes
52- cid = " {E2AC5089-3820-43fe-8A4D-A7028FAD8C28}"
58+ cid = ' {E2AC5089-3820-43fe-8A4D-A7028FAD8C28}'
5359 when :runonce
54- cid = " {384EBE2C-F9EA-4f6b-94EF-C9D2DA58FD13}"
60+ cid = ' {384EBE2C-F9EA-4f6b-94EF-C9D2DA58FD13}'
5561 when :delete
56- cid = " {4F4F0D88-E715-4b1f-B311-61E530C2C8FC}"
62+ cid = ' {4F4F0D88-E715-4b1f-B311-61E530C2C8FC}'
5763 end
5864
5965 trojan_encode (
60- [ 0x27 ] . pack ( "V" ) + cid + "\x00 "
66+ [ 0x27 ] . pack ( 'V' ) + cid + "\x00 "
6167 )
6268 end
6369
6470 def run_host ( ip )
65-
66- begin
67-
6871 connect
6972 sock . put ( trojan_command ( :dir ) )
7073 sock . put (
7174 trojan_encode (
72- [ 4 ] . pack ( "V" ) + "C:\\ \x00 \x00 "
75+ [ 4 ] . pack ( 'V' ) + "C:\\ \x00 \x00 "
7376 )
7477 )
7578
7679 lbuff = sock . get_once ( 4 , 5 )
77- if ( not lbuff )
80+ if ! lbuff
7881 print_error ( "#{ ip } :#{ rport } UNKNOWN: No response to the directory listing request" )
7982 disconnect
8083 return
8184 end
8285
83- len = trojan_encode ( lbuff ) . unpack ( "V" ) [ 0 ]
86+ len = trojan_encode ( lbuff ) . unpack ( 'V' ) [ 0 ]
8487 dbuff = sock . get_once ( len , 30 )
85- data = trojan_encode ( dbuff )
86- files = data . split ( "|" ) . map do |x |
87- if x [ 0 , 2 ] == "?1"
88- [ "D" , x [ 2 , x . length - 2 ] ]
88+ data = trojan_encode ( dbuff )
89+ files = data . split ( '|' ) . map do |x |
90+ if x [ 0 , 2 ] == '?1'
91+ [ 'D' , x [ 2 , x . length - 2 ] ]
8992 else
90- [ "F" , x ]
93+ [ 'F' , x ]
9194 end
9295 end
9396
@@ -97,24 +100,22 @@ def run_host(ip)
97100 print_good ( "#{ ip } :#{ rport } FOUND: #{ files . inspect } " )
98101 # Add Vulnerability and Report
99102 report_vuln ( {
100- : host => ip ,
101- : name => " Energizer DUO USB Battery Charger Software Arucer.dll Trojaned Distribution" ,
102- : refs => self . references
103+ host : ip ,
104+ name : ' Energizer DUO USB Battery Charger Software Arucer.dll Trojaned Distribution' ,
105+ refs : references
103106 } )
104107 report_note (
105- : host => ip ,
106- : proto => 'tcp' ,
107- : port => datastore [ 'RPORT' ] ,
108- : sname => " energizer_duo" ,
109- : type => 'Energizer DUO Trojan' ,
110- : data => { : energizer_duo_trojan => files . inspect }
108+ host : ip ,
109+ proto : 'tcp' ,
110+ port : datastore [ 'RPORT' ] ,
111+ sname : ' energizer_duo' ,
112+ type : 'Energizer DUO Trojan' ,
113+ data : { energizer_duo_trojan : files . inspect }
111114 )
112115 disconnect
113-
114- rescue ::Interrupt
115- raise $!
116- rescue ::Rex ::ConnectionError , ::IOError
117- end
118-
116+ rescue ::Interrupt
117+ raise $ERROR_INFO
118+ rescue ::Rex ::ConnectionError , ::IOError => e
119+ vprint_error ( e . message )
119120 end
120121end
0 commit comments