@@ -18,25 +18,24 @@ class MetasploitModule < Msf::Auxiliary
1818
1919 def initialize
2020 super (
21- 'Name' => 'SMB Session Pipe DCERPC Auditor' ,
21+ 'Name' => 'SMB Session Pipe DCERPC Auditor' ,
2222 'Description' => 'Determine what DCERPC services are accessible over a SMB pipe' ,
23- 'Author' => 'hdm' ,
24- 'License' => MSF_LICENSE ,
23+ 'Author' => 'hdm' ,
24+ 'License' => MSF_LICENSE ,
2525 )
2626
2727 register_options (
2828 [
29- OptString . new ( 'SMBPIPE' , [ true , "The pipe name to use (BROWSER)" , 'BROWSER' ] ) ,
30- ] )
29+ OptString . new ( 'SMBPIPE' , [ true , 'The pipe name to use (BROWSER)' , 'BROWSER' ] ) ,
30+ ]
31+ )
3132 end
3233
3334 def connect ( *args , **kwargs )
3435 super ( *args , **kwargs , direct : @smb_direct )
3536 end
3637
37- def rport
38- @rport
39- end
38+ attr_reader :rport
4039
4140 @@target_uuids = [
4241 [ '00000131-0000-0000-c000-000000000046' , '0.0' ] ,
@@ -255,8 +254,7 @@ def rport
255254 [ 'fdb3a030-065f-11d1-bb9b-00a024ea5525' , '1.0' ] ,
256255 [ 'ffe561b8-bf15-11cf-8c5e-08002bb49649' , '2.0' ]
257256
258-
259- ]
257+ ]
260258
261259 # Fingerprint a single host
262260 def run_host ( ip )
@@ -265,7 +263,7 @@ def run_host(ip)
265263 client = session . client
266264 @rport = datastore [ 'RPORT' ] = session . port
267265 self . simple = ::Rex ::Proto ::SMB ::SimpleClient . new ( client . dispatcher . tcp_socket , client : client )
268- self . simple . connect ( "\\ \\ #{ simple . address } \\ IPC$" ) # smb_login connects to this share for some reason and it doesn't work unless we do too
266+ simple . connect ( "\\ \\ #{ simple . address } \\ IPC$" ) # smb_login connects to this share for some reason and it doesn't work unless we do too
269267 check_uuids ( ip )
270268 else
271269 if datastore [ 'RPORT' ] . blank? || datastore [ 'RPORT' ] == 0
@@ -282,7 +280,7 @@ def run_host(ip)
282280 smb_services . each do |smb_service |
283281 @rport = smb_service [ :port ]
284282 @smb_direct = smb_service [ :direct ]
285-
283+
286284 begin
287285 connect
288286 smb_login
@@ -291,31 +289,28 @@ def run_host(ip)
291289 rescue ::Exception
292290 print_line ( $!. to_s )
293291 end
294-
295292 end
296293 end
297-
298294 end
299295
300296 def check_uuids ( ip )
301297 @@target_uuids . each do |uuid |
302-
303298 handle = dcerpc_handle_target (
304299 uuid [ 0 ] , uuid [ 1 ] ,
305- 'ncacn_np' , [ "\\ #{ datastore [ 'SMBPIPE' ] } " ] , self . simple . address
300+ 'ncacn_np' , [ "\\ #{ datastore [ 'SMBPIPE' ] } " ] , simple . address
306301 )
307302
308303 begin
309304 dcerpc_bind ( handle )
310305 print_line ( "UUID #{ uuid [ 0 ] } #{ uuid [ 1 ] } OPEN VIA #{ datastore [ 'SMBPIPE' ] } " )
311306 # Add Report
312307 report_note (
313- : host => ip ,
314- : proto => 'tcp' ,
315- : sname => 'smb' ,
316- : port => rport ,
317- : type => "UUID #{ uuid [ 0 ] } #{ uuid [ 1 ] } " ,
318- : data => "UUID #{ uuid [ 0 ] } #{ uuid [ 1 ] } OPEN VIA #{ datastore [ 'SMBPIPE' ] } "
308+ host : ip ,
309+ proto : 'tcp' ,
310+ sname : 'smb' ,
311+ port : rport ,
312+ type : "UUID #{ uuid [ 0 ] } #{ uuid [ 1 ] } " ,
313+ data : "UUID #{ uuid [ 0 ] } #{ uuid [ 1 ] } OPEN VIA #{ datastore [ 'SMBPIPE' ] } "
319314 )
320315 rescue ::Rex ::Proto ::SMB ::Exceptions ::ErrorCode => e
321316 print_line ( "UUID #{ uuid [ 0 ] } #{ uuid [ 1 ] } ERROR 0x%.8x" % e . error_code )
0 commit comments