|
| 1 | +## Vulnerable Application |
| 2 | + |
| 3 | +Chargen is a debugging and measurement tool and a character generator service. Often `chargen` is included in `xinetd`, |
| 4 | +along with `echo`, `time`, `daytime`, and `discard`. |
| 5 | +While its possible to run chargen on TCP, the most common implementation is UDP. |
| 6 | + |
| 7 | +The following was done on Kali linux: |
| 8 | + |
| 9 | + 1. `apt-get install xinetd` |
| 10 | + 2. edit `/etc/xinetd.d/chargen` and changed `disabled = yes` to `disabled = no`. The first one is for `TCP` and the second is for `UDP`. |
| 11 | + 3. Restart the service: `service xinetd restart` |
| 12 | + |
| 13 | +## Verification Steps |
| 14 | + |
| 15 | + 1. Install and configure chargen |
| 16 | + 2. Start msfconsole |
| 17 | + 3. Do: `use auxiliary/scanner/chargen/chargen_probe` |
| 18 | + 4. Do: `run` |
| 19 | + |
| 20 | +## Scenarios |
| 21 | + |
| 22 | + A run against the configuration from these docs |
| 23 | + |
| 24 | + ``` |
| 25 | + msf > use auxiliary/scanner/chargen/chargen_probe |
| 26 | + msf auxiliary(chargen_probe) > set rhosts 127.0.0.1 |
| 27 | + rhosts => 127.0.0.1 |
| 28 | + msf auxiliary(chargen_probe) > set verbose true |
| 29 | + verbose => true |
| 30 | + msf auxiliary(chargen_probe) > run |
| 31 | + |
| 32 | + [*] 127.0.0.1:19 - Response: !"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\]^_`abcdefgh |
| 33 | + "#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\]^_`abcdefghi |
| 34 | + #$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\]^_`abcdefghij |
| 35 | + $%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\]^_`abcdefghijk |
| 36 | + %&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\]^_`abcdefghijkl |
| 37 | + &'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\]^_`abcdefghijklm |
| 38 | + '()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\]^_`abcdefghijklmn |
| 39 | + ()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\]^_`abcdefghijklmno |
| 40 | + )*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\]^_`abcdefghijklmnop |
| 41 | + *+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\]^_`abcdefghijklmnopq |
| 42 | + +,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\]^_`abcdefghijklmnopqr |
| 43 | + ,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\]^_`abcdefghijklmnopqrs |
| 44 | + -./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\]^_`abcdefghijklmnopqrst |
| 45 | + ./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\]^_`abcdefghi |
| 46 | + |
| 47 | + [+] 127.0.0.1:19 answers with 1022 bytes (headers + UDP payload) |
| 48 | + [*] Scanned 1 of 1 hosts (100% complete) |
| 49 | + [*] Auxiliary module execution completed |
| 50 | + ``` |
0 commit comments