@@ -17,7 +17,7 @@ def initialize
17
17
super (
18
18
'Name' => 'SAPRouter Admin Request' ,
19
19
'Description' => %q{
20
- Display remote route information .
20
+ Display the remote connection table from a SAPRouter .
21
21
} ,
22
22
'References' => [
23
23
[ 'URL' , 'http://labs.mwrinfosecurity.com/tools/2012/04/27/sap-metasploit-modules/' ] ,
@@ -56,6 +56,7 @@ def get_data(size, packet_len)
56
56
end
57
57
58
58
def run_host ( ip )
59
+ host_port = "#{ ip } :#{ datastore [ 'RPORT' ] } "
59
60
type = 'ROUTER_ADM'
60
61
version = 0x26
61
62
cmd = 0x2
@@ -82,21 +83,21 @@ def run_host(ip)
82
83
begin
83
84
connect
84
85
rescue ::Rex ::ConnectionRefused
85
- print_status ( "#{ ip } : #{ datastore [ 'RPORT' ] } - connection refused" )
86
+ print_status ( "#{ host_port } - Connection refused" )
86
87
connected = false
87
88
rescue ::Rex ::ConnectionError , ::IOError , ::Timeout ::Error
88
- print_status ( "#{ ip } : #{ datastore [ 'RPORT' ] } - connection timeout" )
89
+ print_status ( "#{ host_port } - Connection timeout" )
89
90
connected = false
90
91
rescue ::Exception => e
91
- print_error ( "#{ ip } : #{ datastore [ 'RPORT' ] } - exception #{ e . class } #{ e } #{ e . backtrace } " )
92
+ print_error ( "#{ host_port } - Exception #{ e . class } #{ e } #{ e . backtrace } " )
92
93
connected = false
93
94
end
94
95
if connected != false
95
- print_good ( "connected to saprouter" )
96
- print_good ( "sending ROUTER_ADM packet info request" )
96
+ print_good ( "#{ host_port } - Connected to saprouter" )
97
+ print_good ( "#{ host_port } - Sending ROUTER_ADM packet info request" )
97
98
sock . put ( ni_packet )
98
99
packet_len = sock . read ( 4 ) . unpack ( 'H*' ) [ 0 ] . to_i 16
99
- print_good ( "got INFO response" )
100
+ print_good ( "#{ host_port } - Got INFO response" )
100
101
while packet_len !=0
101
102
count += 1
102
103
case count
@@ -122,7 +123,7 @@ def run_host(ip)
122
123
end
123
124
packet_len = sock . recv ( 4 ) . unpack ( 'H*' ) [ 0 ] . to_i 16
124
125
else
125
- print_error ( "no connected clients :'( " )
126
+ print_error ( "#{ host_port } - No connected clients" )
126
127
sock . recv ( packet_len )
127
128
packet_len = sock . recv ( 4 ) . unpack ( 'H*' ) [ 0 ] . to_i 16
128
129
end
@@ -150,6 +151,7 @@ def run_host(ip)
150
151
end
151
152
end
152
153
disconnect
154
+ # TODO: This data should be saved somewhere. A note on the host would be nice.
153
155
print ( saptbl . to_s )
154
156
end
155
157
end
0 commit comments