Skip to content

Commit 035f37c

Browse files
wwebb-r7wwebb-r7
committed
Land rapid7#8144, Add Moxa Device Discovery Scanner Module
2 parents f870f94 + 925088b commit 035f37c

File tree

2 files changed

+192
-0
lines changed

2 files changed

+192
-0
lines changed

‎documentation/modules/auxiliary/scanner/scada/moxa_discover.md

Lines changed: 85 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,85 @@
1+
## Vulnerable Application
2+
3+
The Moxa protocol listens on 4800/UDP and will respond to broadcast
4+
or direct traffic. The service is known to be used on Moxa devices
5+
in the NPort, OnCell, and MGate product lines.
6+
7+
A discovery packet compels a Moxa device to respond to the sender
8+
with some basic device information that is needed for more advanced
9+
functions. The discovery data is 8 bytes in length and is the most
10+
basic example of the Moxa protocol. It may be sent out as a
11+
broadcast (destination 255.255.255.255) or to an individual device.
12+
13+
Devices that respond to this query may be vulnerable to serious
14+
information disclosure vulnerabilities, such as CVE-2016-9361.
15+
16+
The module is the work of Patrick DeSantis of Cisco Talos and is
17+
derived from original work by K. Reid Wightman. Tested and validated
18+
on a Moxa NPort 6250 with firmware versions 1.13 and 1.15.
19+
20+
The discovery request contains the bytes:
21+
22+
`\x01\x00\x00\x08\x00\x00\x00\x00`
23+
24+
Where the function code (first byte) 0x01 is Moxa discovery/identify
25+
and the fourth byte is the length of the full data payload.
26+
27+
The first byte of a response will always be the func code + 0x80
28+
(the most significant bit of the byte is set to 1, so 0b00000001
29+
becomes 0b10000001, or 0x81).
30+
31+
A valid response is 24 bytes, starts with 0x81, and contains the values
32+
0x00, 0x90, 0xe8 (the Moxa OIU) in bytes 14, 15, and 16.
33+
34+
## Verification Steps
35+
36+
1. Start msfconsole
37+
2. Do: ```use auxiliary/scanner/scada/moxa_discover```
38+
3. Do: ```set RHOSTS```
39+
4. Do: ```run```
40+
4. Devices running the Moxa service should respond
41+
42+
## Options
43+
44+
**RHOSTS**
45+
46+
Target(s) to scan; can be single target, a range, or broadcast.
47+
48+
## Scenarios
49+
50+
```
51+
msf > hosts
52+
53+
Hosts
54+
=====
55+
56+
msf > use auxiliary/scanner/scada/moxa_discover
57+
msf auxiliary(moxa_discover) > set RHOSTS 192.168.127.254
58+
RHOSTS => 192.168.127.254
59+
msf auxiliary(moxa_discover) > show options
60+
61+
Module options (auxiliary/scanner/scada/moxa_discover):
62+
63+
Name Current Setting Required Description
64+
---- --------------- -------- -----------
65+
BATCHSIZE 256 yes The number of hosts to probe in each set
66+
RHOSTS 192.168.127.254 yes The target address range or CIDR identifier
67+
RPORT 4800 yes The target port (UDP)
68+
THREADS 10 yes The number of concurrent threads
69+
70+
msf auxiliary(moxa_discover) > run
71+
72+
[+] 192.168.127.254:4800 Moxa Device Found!
73+
[*] Scanned 1 of 1 hosts (100% complete)
74+
[*] Auxiliary module execution completed
75+
msf auxiliary(moxa_discover) > hosts
76+
77+
Hosts
78+
=====
79+
80+
address mac name os_name os_flavor os_sp purpose info comments
81+
------- --- ---- ------- --------- ----- ------- ---- --------
82+
192.168.127.254 Unknown device Moxa Device
83+
84+
msf auxiliary(moxa_discover) >
85+
```

‎modules/auxiliary/scanner/scada/moxa_discover.rb

Lines changed: 107 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,107 @@
1+
##
2+
# This module requires Metasploit: http://metasploit.com/download
3+
# Current source: https://github.com/rapid7/metasploit-framework
4+
##
5+
6+
require 'msf/core'
7+
8+
class MetasploitModule < Msf::Auxiliary
9+
10+
include Msf::Auxiliary::Report
11+
include Msf::Auxiliary::UDPScanner
12+
13+
def initialize(info = {})
14+
super(
15+
update_info(
16+
info,
17+
'Name' => 'Moxa UDP Device Discovery',
18+
'Description' => %q(
19+
The Moxa protocol listens on 4800/UDP and will respond to broadcast
20+
or direct traffic. The service is known to be used on Moxa devices
21+
in the NPort, OnCell, and MGate product lines.
22+
23+
A discovery packet compels a Moxa device to respond to the sender
24+
with some basic device information that is needed for more advanced
25+
functions. The discovery data is 8 bytes in length and is the most
26+
basic example of the Moxa protocol. It may be sent out as a
27+
broadcast (destination 255.255.255.255) or to an individual device.
28+
29+
Devices that respond to this query may be vulnerable to serious
30+
information disclosure vulnerabilities, such as CVE-2016-9361.
31+
32+
The module is the work of Patrick DeSantis of Cisco Talos and is
33+
derived from original work by K. Reid Wightman. Tested and validated
34+
on a Moxa NPort 6250 with firmware versions 1.13 and 1.15.
35+
),
36+
'Author' => 'Patrick DeSantis <p[at]t-r10t.com>',
37+
'License' => MSF_LICENSE,
38+
'References' =>
39+
[
40+
[ 'URL', 'https://www.digitalbond.com/blog/2016/10/25/serial-killers/'],
41+
[ 'URL', 'http://www.moxa.com/support/faq/faq_detail.aspx?id=646' ],
42+
]
43+
)
44+
)
45+
46+
register_options(
47+
[
48+
# Moxa protocol listens on 4800/UDP by default
49+
Opt::RPORT(4800)
50+
], self.class)
51+
end
52+
53+
# The data to be sent via UDP
54+
def build_probe
55+
# Function Code (first byte) 0x01: Moxa discovery/identify
56+
# The fourth byte is the length of the full data payload
57+
@probe ||= "\x01\x00\x00\x08\x00\x00\x00\x00"
58+
end
59+
60+
# Called for each response packet
61+
def scanner_process(response, src_host, _src_port)
62+
# The first byte of a response will always be the func code + 0x80
63+
# (the most significant bit of the byte is set to 1, so 0b00000001
64+
# becomes 0b10000001, or 0x81).
65+
# A valid response is 24 bytes, starts with 0x81, and contains the values
66+
# 0x00, 0x90, 0xe8 (the Moxa OIU) in bytes 14, 15, and 16.
67+
return unless response[0] == "\x81" && response[14..16] == "\x00\x90\xe8" && response.length == 24
68+
@results[src_host] ||= []
69+
@results[src_host] << response
70+
end
71+
72+
# Called after the scan block
73+
def scanner_postscan(_batch)
74+
@results.each_pair do |host, response|
75+
peer = "#{host}:#{rport}"
76+
77+
# Report the host
78+
report_host(
79+
:host => host,
80+
:info => "Moxa Device",
81+
)
82+
83+
# Report the service
84+
report_service(
85+
host: host,
86+
proto: 'udp',
87+
port: rport,
88+
name: 'Moxa Protocol',
89+
)
90+
91+
if response.empty?
92+
vprint_status("#{peer} No Moxa Devices Found.")
93+
else
94+
print_good("#{peer} Moxa Device Found!")
95+
96+
# Report vuln
97+
report_vuln(
98+
host: host,
99+
port: rport,
100+
proto: 'udp',
101+
name: 'Moxa Protocol Use',
102+
refs: references
103+
)
104+
end
105+
end
106+
end
107+
end

0 commit comments

Comments
 (0)