@@ -24,17 +24,17 @@ def initialize(info={})
24
24
less noise in the network).
25
25
} ,
26
26
'License' => MSF_LICENSE ,
27
- 'Author' => [ 'Borja Merino <bmerinofe[at]gmail.com>' ] ,
28
- 'Platform' => [ 'win' ] ,
29
- 'SessionTypes' => [ 'meterpreter' ] ,
27
+ 'Author' => 'Borja Merino <bmerinofe[at]gmail.com>' ,
28
+ 'Platform' => 'win' ,
29
+ 'SessionTypes' => [ 'meterpreter' ] ,
30
30
'References' => [
31
- [ 'URL' , 'http://www.shelliscoming.com/2014/11/getting-outbound-filtering-rules-by.html' ]
31
+ [ 'URL' , 'http://www.shelliscoming.com/2014/11/getting-outbound-filtering-rules-by.html' ]
32
32
]
33
33
) )
34
34
35
35
register_options (
36
36
[
37
- OptAddress . new ( " ADDRESS" , [ true , 'Destination IP address.' ] ) ,
37
+ OptAddress . new ( ' ADDRESS' , [ true , 'Destination IP address.' ] ) ,
38
38
OptInt . new ( 'HOPS' , [ true , 'Number of hops to get.' , 3 ] ) ,
39
39
OptInt . new ( 'MIN_TTL' , [ true , 'Starting TTL value.' , 1 ] ) ,
40
40
OptString . new ( 'PORTS' , [ true , 'Ports to test (e.g. 80,443,100-110).' , '80,443' ] ) ,
@@ -45,18 +45,20 @@ def initialize(info={})
45
45
46
46
def icmp_setup
47
47
handler = client . railgun . ws2_32 . socket ( "AF_INET" , "SOCK_RAW" , "IPPROTO_ICMP" )
48
- if handler [ 'GetLastError' ] != 0
48
+ if handler [ 'GetLastError' ] == 0
49
+ vprint_status ( "ICMP raw socket created successfully" )
50
+ else
49
51
print_error ( "There was an error setting the ICMP raw socket; GetLastError: #{ handler [ 'GetLastError' ] } " )
50
52
return nil
51
53
end
52
- vprint_status ( "ICMP raw socket created successfully" )
53
54
54
55
r = client . railgun . ws2_32 . bind ( handler [ 'return' ] , "\x02 \x00 \x00 \x00 " << Rex ::Socket . addr_aton ( session . session_host ) << "\x00 " *8 , 16 )
55
- if r [ 'GetLastError' ] != 0
56
+ if r [ 'GetLastError' ] == 0
57
+ vprint_status ( "ICMP socket successfully bound to #{ session . session_host } " )
58
+ else
56
59
print_error ( "There was an error binding the ICMP socket to #{ session . session_host } ; GetLastError: #{ r [ 'GetLastError' ] } " )
57
60
return nil
58
61
end
59
- vprint_status ( "ICMP socket successfully bound to #{ session . session_host } " )
60
62
61
63
# int WSAIoctl(
62
64
# _In_ SOCKET s,
@@ -71,32 +73,34 @@ def icmp_setup
71
73
# );
72
74
73
75
sio_rcvall = 0x98000001
74
- r = client . railgun . ws2_32 . WSAIoctl ( handler [ 'return' ] , sio_rcvall , "\x01 " , 4 , nil , 0 , 4 , nil , nil )
75
- if r [ 'GetLastError' ] != 0
76
+ r = client . railgun . ws2_32 . WSAIoctl ( handler [ 'return' ] , sio_rcvall , "\x01 " , 4 , nil , 0 , 4 , nil , nil )
77
+ if r [ 'GetLastError' ] == 0
78
+ return handler [ 'return' ]
79
+ else
76
80
print_error ( "There was an error calling WSAIoctl (ICMP raw socket); GetLastError: #{ r [ 'GetLastError' ] } " )
77
81
return nil
78
82
end
79
- return handler [ 'return' ]
80
83
end
81
84
82
85
def tcp_setup ( ttl )
83
- handler = client . railgun . ws2_32 . socket ( "AF_INET" , "SOCK_STREAM" , "IPPROTO_TCP" )
84
- if handler [ 'GetLastError' ] != 0
86
+ handler = client . railgun . ws2_32 . socket ( 'AF_INET' , 'SOCK_STREAM' , 'IPPROTO_TCP' )
87
+ if handler [ 'GetLastError' ] == 0
88
+ vprint_status ( 'TCP socket created successfully' )
89
+ else
85
90
print_error ( "There was an error setting the TCP socket; GetLastError: #{ handler [ 'GetLastError' ] } " )
86
91
return nil
87
92
end
88
- vprint_status ( "TCP socket created successfully" )
89
93
90
94
# 0x8004667E = FIONBIO
91
95
# Enable non-blocking mode when *argp (third parameter in ioctlsocket) is set to a nonzero value
92
-
93
96
cmd = 0x8004667E
94
97
r = client . railgun . ws2_32 . ioctlsocket ( handler [ 'return' ] , cmd , 1 )
95
- if r [ 'GetLastError' ] != 0
98
+ if r [ 'GetLastError' ] == 0
99
+ vprint_status ( 'TCP socket successfully configured in non-blocking mode' )
100
+ else
96
101
print_error ( "There was an error setting the TCP socket in non-blocking mode; GetLastError: #{ r [ 'GetLastError' ] } " )
97
102
return nil
98
103
end
99
- vprint_status ( "TCP socket successfully configured in non-blocking mode" )
100
104
101
105
# int setsockopt(
102
106
# _In_ SOCKET s,
@@ -105,28 +109,32 @@ def tcp_setup(ttl)
105
109
# _In_ const char *optval,
106
110
#_In_ int optlen
107
111
# );
108
-
109
112
ipproto_ip = 0
110
113
ip_ttl = 4
111
114
r = client . railgun . ws2_32 . setsockopt ( handler [ 'return' ] , ipproto_ip , ip_ttl , [ ttl ] . pack ( 'C' ) , 4 )
112
- if r [ 'GetLastError' ] != 0
115
+ if r [ 'GetLastError' ] == 0
116
+ vprint_status ( "TTL value successfully set to #{ ttl } " )
117
+ return handler [ 'return' ]
118
+ else
113
119
print_error ( "There was an error setting the TTL value; GetLastError: #{ r [ 'GetLastError' ] } " )
114
120
return nil
115
121
end
116
- vprint_status ( "TTL value successfully set to #{ ttl } " )
117
- return handler [ 'return' ]
118
122
end
119
123
120
124
def connections ( remote , dst_port , h_icmp , h_tcp , to )
121
- r = client . railgun . ws2_32 . connect ( h_tcp , "\x02 \x00 " << [ dst_port ] . pack ( "n" ) << Rex ::Socket . addr_aton ( remote ) << "\x00 " *8 , 16 )
125
+ sock_addr = "\x02 \x00 "
126
+ sock_addr << [ dst_port ] . pack ( 'n' )
127
+ sock_addr << Rex ::Socket . addr_aton ( remote )
128
+ sock_addr << "\x00 " * 8
129
+ r = client . railgun . ws2_32 . connect ( h_tcp , sock_addr , 16 )
122
130
123
131
# A GetLastError == 1035 is expected since the socket is set to non-blocking mode
124
- if r [ 'GetLastError' ] ! = 10035
132
+ unless r [ 'GetLastError' ] = = 10035
125
133
print_error ( "There was an error creating the connection to the peer #{ remote } ; GetLastError: #{ r [ 'GetLastError' ] } " )
126
134
return
127
135
end
128
136
129
- from = " " * 16
137
+ from = ' ' * 16
130
138
131
139
begin
132
140
::Timeout . timeout ( to ) do
@@ -137,7 +145,6 @@ def connections(remote, dst_port, h_icmp, h_tcp, to)
137
145
rescue ::Timeout ::Error
138
146
return nil
139
147
end
140
-
141
148
end
142
149
143
150
def run
@@ -163,27 +170,27 @@ def run
163
170
ports . each do |dport |
164
171
pub_ip = false
165
172
print_status ( "Testing port #{ dport } ..." )
166
- 0 . upto ( datastore [ 'HOPS' ] - 1 ) { |i |
173
+ 0 . upto ( datastore [ 'HOPS' ] - 1 ) do |i |
167
174
i = i + datastore [ 'MIN_TTL' ]
168
175
h_icmp = icmp_setup
169
176
return if h_icmp . nil?
170
177
h_tcp = tcp_setup ( i )
171
- return if h_tcp . nil?
178
+ return if h_tcp . nil?
172
179
173
180
hop = connections ( remote , dport , h_icmp , h_tcp , to )
174
- if hop != nil
181
+ if hop . nil?
182
+ print_error ( "#{ i } *" )
183
+ else
175
184
print_good ( "#{ i } #{ hop } " )
176
- if ! Rex ::Socket . is_internal? ( hop )
185
+ unless Rex ::Socket . is_internal? ( hop )
177
186
pub_ip = true
178
- break if datastore [ 'STOP' ] == true
187
+ break if datastore [ 'STOP' ]
179
188
end
180
- else
181
- print_error ( "#{ i } *" )
182
189
end
183
190
client . railgun . ws2_32 . closesocket ( h_tcp )
184
191
client . railgun . ws2_32 . closesocket ( h_icmp )
185
- }
186
- print_good ( "Public IP reached. The TCP port #{ dport } is not filtered" ) if pub_ip == true
192
+ end
193
+ print_good ( "Public IP reached. The TCP port #{ dport } is not filtered" ) if pub_ip
187
194
end
188
195
end
189
196
end
0 commit comments