Skip to content

Commit 35bc1fb

Browse files
committed
Land rapid7#8282, Add module doc for auxiliary/scanner/chargen/chargen_probe
2 parents 5bbb4d7 + 562389d commit 35bc1fb

File tree

1 file changed

+50
-0
lines changed

1 file changed

+50
-0
lines changed
Lines changed: 50 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,50 @@
1+
## Vulnerable Application
2+
3+
Chargen is a debugging and measurement tool and a character generator service. Often `chargen` is included in `xinetd`,
4+
along with `echo`, `time`, `daytime`, and `discard`.
5+
While its possible to run chargen on TCP, the most common implementation is UDP.
6+
7+
The following was done on Kali linux:
8+
9+
1. `apt-get install xinetd`
10+
2. edit `/etc/xinetd.d/chargen` and changed `disabled = yes` to `disabled = no`. The first one is for `TCP` and the second is for `UDP`.
11+
3. Restart the service: `service xinetd restart`
12+
13+
## Verification Steps
14+
15+
1. Install and configure chargen
16+
2. Start msfconsole
17+
3. Do: `use auxiliary/scanner/chargen/chargen_probe`
18+
4. Do: `run`
19+
20+
## Scenarios
21+
22+
A run against the configuration from these docs
23+
24+
```
25+
msf > use auxiliary/scanner/chargen/chargen_probe
26+
msf auxiliary(chargen_probe) > set rhosts 127.0.0.1
27+
rhosts => 127.0.0.1
28+
msf auxiliary(chargen_probe) > set verbose true
29+
verbose => true
30+
msf auxiliary(chargen_probe) > run
31+
32+
[*] 127.0.0.1:19 - Response: !"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\]^_`abcdefgh
33+
"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\]^_`abcdefghi
34+
#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\]^_`abcdefghij
35+
$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\]^_`abcdefghijk
36+
%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\]^_`abcdefghijkl
37+
&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\]^_`abcdefghijklm
38+
'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\]^_`abcdefghijklmn
39+
()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\]^_`abcdefghijklmno
40+
)*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\]^_`abcdefghijklmnop
41+
*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\]^_`abcdefghijklmnopq
42+
+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\]^_`abcdefghijklmnopqr
43+
,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\]^_`abcdefghijklmnopqrs
44+
-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\]^_`abcdefghijklmnopqrst
45+
./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\]^_`abcdefghi
46+
47+
[+] 127.0.0.1:19 answers with 1022 bytes (headers + UDP payload)
48+
[*] Scanned 1 of 1 hosts (100% complete)
49+
[*] Auxiliary module execution completed
50+
```

0 commit comments

Comments
 (0)