Skip to content

Commit 4f6b1de

Browse files
clee-r7clee-r7
committed
Merge branch 'master' into goliath
2 parents 08f10d7 + 34b90ee commit 4f6b1de

38 files changed

+1328
-61
lines changed

‎Gemfile

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -27,6 +27,10 @@ group :development do
2727
'x86-mingw32', 'x64-mingw32',
2828
'x86_64-linux', 'x86-linux',
2929
'darwin'].include?(RUBY_PLATFORM.gsub(/.*darwin.*/, 'darwin'))
30+
gem 'google-protobuf', "3.5.1" if [
31+
'x86-mingw32', 'x64-mingw32',
32+
'x86_64-linux', 'x86-linux',
33+
'darwin'].include?(RUBY_PLATFORM.gsub(/.*darwin.*/, 'darwin'))
3034
end
3135

3236
group :development, :test do

‎Gemfile.lock

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -131,7 +131,7 @@ GEM
131131
multipart-post (>= 1.2, < 3)
132132
filesize (0.1.1)
133133
fivemat (1.3.5)
134-
google-protobuf (3.5.1.2)
134+
google-protobuf (3.5.1)
135135
googleapis-common-protos-types (1.0.1)
136136
google-protobuf (~> 3.0)
137137
googleauth (0.6.2)
@@ -268,7 +268,7 @@ GEM
268268
metasm
269269
rex-arch
270270
rex-text
271-
rex-exploitation (0.1.16)
271+
rex-exploitation (0.1.17)
272272
jsobfu
273273
metasm
274274
rex-arch

‎documentation/modules/auxiliary/scanner/dcerpc/endpoint_mapper.md

Lines changed: 117 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,117 @@
1+
## Description
2+
3+
The endpoint_mapper module queries the EndPoint Mapper service of a remote system to determine what services are available. In the information gathering stage, this can provide some very valuable information.
4+
5+
## Verification Steps
6+
7+
1. Do: ```use auxiliary/scanner/dcerpc/endpoint_mapper```
8+
2. Do: ```set RHOSTS [IP]```
9+
3. Do: ```set THREADS [number of threads]```
10+
4. Do: ```run```
11+
12+
### Example Windows 2003, and Windows 7 Targets
13+
14+
```
15+
msf > use auxiliary/scanner/dcerpc/endpoint_mapper
16+
msf auxiliary(endpoint_mapper) > set RHOSTS 192.168.1.200-254
17+
RHOSTS => 192.168.1.200-254
18+
msf auxiliary(endpoint_mapper) > set THREADS 55
19+
threads => 55
20+
msf auxiliary(endpoint_mapper) > run
21+
[*] Connecting to the endpoint mapper service...
22+
[*] Connecting to the endpoint mapper service...
23+
[*] Connecting to the endpoint mapper service...
24+
...snip...
25+
[*] Connecting to the endpoint mapper service...
26+
[*] Connecting to the endpoint mapper service...
27+
[*] 3c4728c5-f0ab-448b-bda1-6ce01eb0a6d5 v1.0 LRPC (dhcpcsvc) [DHCP Client LRPC Endpoint]
28+
[*] 3473dd4d-2e88-4006-9cba-22570909dd10 v5.0 LRPC (W32TIME_ALT) [WinHttp Auto-Proxy Service]
29+
[*] 3473dd4d-2e88-4006-9cba-22570909dd10 v5.0 PIPE (\PIPE\W32TIME_ALT) \\XEN-2K3-BARE [WinHttp Auto-Proxy Service]
30+
[*] 906b0ce0-c70b-1067-b317-00dd010662da v1.0 LRPC (LRPC00000408.00000001)
31+
[*] 906b0ce0-c70b-1067-b317-00dd010662da v1.0 LRPC (LRPC00000408.00000001)
32+
[*] 906b0ce0-c70b-1067-b317-00dd010662da v1.0 LRPC (LRPC00000408.00000001)
33+
[*] 906b0ce0-c70b-1067-b317-00dd010662da v1.0 LRPC (LRPC00000408.00000001)
34+
[*] Could not connect to the endpoint mapper service
35+
[*] 12345778-1234-abcd-ef00-0123456789ac v1.0 PIPE (\PIPE\lsass) \\XEN-2K3-BARE
36+
[*] 12345778-1234-abcd-ef00-0123456789ac v1.0 LRPC (audit)
37+
[*] Connecting to the endpoint mapper service...
38+
[*] 12345778-1234-abcd-ef00-0123456789ac v1.0 LRPC (securityevent)
39+
[*] 12345778-1234-abcd-ef00-0123456789ac v1.0 LRPC (protected_storage)
40+
[*] 12345778-1234-abcd-ef00-0123456789ac v1.0 PIPE (\PIPE\protected_storage) \\XEN-2K3-BARE
41+
[*] 12345778-1234-abcd-ef00-0123456789ac v1.0 LRPC (dsrole)
42+
[*] 12345778-1234-abcd-ef00-0123456789ac v1.0 TCP (1025) 192.168.1.204
43+
[*] 12345678-1234-abcd-ef00-0123456789ab v1.0 PIPE (\PIPE\lsass) \\XEN-2K3-BARE [IPSec Policy agent endpoint]
44+
[*] 12345678-1234-abcd-ef00-0123456789ab v1.0 LRPC (audit) [IPSec Policy agent endpoint]
45+
[*] 12345678-1234-abcd-ef00-0123456789ab v1.0 LRPC (securityevent) [IPSec Policy agent endpoint]
46+
[*] 12345678-1234-abcd-ef00-0123456789ab v1.0 LRPC (protected_storage) [IPSec Policy agent endpoint]
47+
[*] 12345678-1234-abcd-ef00-0123456789ab v1.0 PIPE (\PIPE\protected_storage) \\XEN-2K3-BARE [IPSec Policy agent endpoint]
48+
[*] 12345678-1234-abcd-ef00-0123456789ab v1.0 LRPC (dsrole) [IPSec Policy agent endpoint]
49+
[*] 12345678-1234-abcd-ef00-0123456789ab v1.0 TCP (1025) 192.168.1.204 [IPSec Policy agent endpoint]
50+
[*] 1ff70682-0a51-30e8-076d-740be8cee98b v1.0 LRPC (wzcsvc)
51+
[*] 1ff70682-0a51-30e8-076d-740be8cee98b v1.0 LRPC (OLE3B0AF7639CA847BCA879F781582D)
52+
[*] 1ff70682-0a51-30e8-076d-740be8cee98b v1.0 PIPE (\PIPE\atsvc) \\XEN-2K3-BARE
53+
[*] 378e52b0-c0a9-11cf-822d-00aa0051e40f v1.0 LRPC (wzcsvc)
54+
[*] 378e52b0-c0a9-11cf-822d-00aa0051e40f v1.0 LRPC (OLE3B0AF7639CA847BCA879F781582D)
55+
[*] 378e52b0-c0a9-11cf-822d-00aa0051e40f v1.0 PIPE (\PIPE\atsvc) \\XEN-2K3-BARE
56+
[*] 0a74ef1c-41a4-4e06-83ae-dc74fb1cdd53 v1.0 LRPC (wzcsvc)
57+
[*] 0a74ef1c-41a4-4e06-83ae-dc74fb1cdd53 v1.0 LRPC (OLE3B0AF7639CA847BCA879F781582D)
58+
[*] 0a74ef1c-41a4-4e06-83ae-dc74fb1cdd53 v1.0 PIPE (\PIPE\atsvc) \\XEN-2K3-BARE
59+
[*] 3c4728c5-f0ab-448b-bda1-6ce01eb0a6d5 v1.0 LRPC (DNSResolver) [DHCP Client LRPC Endpoint]
60+
[*] d95afe70-a6d5-4259-822e-2c84da1ddb0d v1.0 TCP (49152) 192.168.1.202
61+
[*] 4b112204-0e19-11d3-b42b-0000f81feb9f v1.0 LRPC (LRPC-71ea8d8164d4fa6391)
62+
[*] 76f226c3-ec14-4325-8a99-6a46348418af v1.0 LRPC (WMsgKRpc05FBE22)
63+
[*] 12e65dd8-887f-41ef-91bf-8d816c42c2e7 v1.0 LRPC (WMsgKRpc05FBE22) [Secure Desktop LRPC interface]
64+
[*] b58aa02e-2884-4e97-8176-4ee06d794184 v1.0 LRPC (OLE7A8F68570F354B65A0C8D44DCBE0)
65+
[*] b58aa02e-2884-4e97-8176-4ee06d794184 v1.0 PIPE (\pipe\trkwks) \\XEN-WIN7-BARE
66+
[*] b58aa02e-2884-4e97-8176-4ee06d794184 v1.0 LRPC (trkwks)
67+
[*] b58aa02e-2884-4e97-8176-4ee06d794184 v1.0 LRPC (RemoteDevicesLPC_API)
68+
[*] b58aa02e-2884-4e97-8176-4ee06d794184 v1.0 LRPC (TSUMRPD_PRINT_DRV_LPC_API)
69+
[*] 0767a036-0d22-48aa-ba69-b619480f38cb v1.0 LRPC (OLE7A8F68570F354B65A0C8D44DCBE0) [PcaSvc]
70+
[*] 0767a036-0d22-48aa-ba69-b619480f38cb v1.0 PIPE (\pipe\trkwks) \\XEN-WIN7-BARE [PcaSvc]
71+
[*] 0767a036-0d22-48aa-ba69-b619480f38cb v1.0 LRPC (trkwks) [PcaSvc]
72+
[*] 0767a036-0d22-48aa-ba69-b619480f38cb v1.0 LRPC (RemoteDevicesLPC_API) [PcaSvc]
73+
...snip...
74+
[*] f6beaff7-1e19-4fbb-9f8f-b89e2018337c v1.0 LRPC (eventlog) [Event log TCPIP]
75+
[*] f6beaff7-1e19-4fbb-9f8f-b89e2018337c v1.0 PIPE (\pipe\eventlog) \\XEN-WIN7-BARE [Event log TCPIP]
76+
[*] f6beaff7-1e19-4fbb-9f8f-b89e2018337c v1.0 TCP (49153) 192.168.1.202 [Event log TCPIP]
77+
[*] 30adc50c-5cbc-46ce-9a0e-91914789e23c v1.0 LRPC (eventlog) [NRP server endpoint]
78+
[*] 30adc50c-5cbc-46ce-9a0e-91914789e23c v1.0 PIPE (\pipe\eventlog) \\XEN-WIN7-BARE [NRP server endpoint]
79+
[*] 30adc50c-5cbc-46ce-9a0e-91914789e23c v1.0 TCP (49153) 192.168.1.202 [NRP server endpoint]
80+
[*] 30adc50c-5cbc-46ce-9a0e-91914789e23c v1.0 LRPC (AudioClientRpc) [NRP server endpoint]
81+
[*] 30adc50c-5cbc-46ce-9a0e-91914789e23c v1.0 LRPC (Audiosrv) [NRP server endpoint]
82+
[*] 3c4728c5-f0ab-448b-bda1-6ce01eb0a6d5 v1.0 LRPC (eventlog) [DHCP Client LRPC Endpoint]
83+
[*] 3c4728c5-f0ab-448b-bda1-6ce01eb0a6d5 v1.0 PIPE (\pipe\eventlog) \\XEN-WIN7-BARE [DHCP Client LRPC Endpoint]
84+
[*] 3c4728c5-f0ab-448b-bda1-6ce01eb0a6d5 v1.0 TCP (49153) 192.168.1.202 [DHCP Client LRPC Endpoint]
85+
[*] 3c4728c5-f0ab-448b-bda1-6ce01eb0a6d5 v1.0 LRPC (AudioClientRpc) [DHCP Client LRPC Endpoint]
86+
[*] 3c4728c5-f0ab-448b-bda1-6ce01eb0a6d5 v1.0 LRPC (Audiosrv) [DHCP Client LRPC Endpoint]
87+
[*] 3c4728c5-f0ab-448b-bda1-6ce01eb0a6d5 v1.0 LRPC (dhcpcsvc) [DHCP Client LRPC Endpoint]
88+
[*] 3c4728c5-f0ab-448b-bda1-6ce01eb0a6d6 v1.0 LRPC (eventlog) [DHCPv6 Client LRPC Endpoint]
89+
[*] 3c4728c5-f0ab-448b-bda1-6ce01eb0a6d6 v1.0 PIPE (\pipe\eventlog) \\XEN-WIN7-BARE [DHCPv6 Client LRPC Endpoint]
90+
[*] 3c4728c5-f0ab-448b-bda1-6ce01eb0a6d6 v1.0 TCP (49153) 192.168.1.202 [DHCPv6 Client LRPC Endpoint]
91+
[*] 3c4728c5-f0ab-448b-bda1-6ce01eb0a6d6 v1.0 LRPC (AudioClientRpc) [DHCPv6 Client LRPC Endpoint]
92+
[*] 3c4728c5-f0ab-448b-bda1-6ce01eb0a6d6 v1.0 LRPC (Audiosrv) [DHCPv6 Client LRPC Endpoint]
93+
[*] 3c4728c5-f0ab-448b-bda1-6ce01eb0a6d6 v1.0 LRPC (dhcpcsvc) [DHCPv6 Client LRPC Endpoint]
94+
[*] 3c4728c5-f0ab-448b-bda1-6ce01eb0a6d6 v1.0 LRPC (dhcpcsvc6) [DHCPv6 Client LRPC Endpoint]
95+
[*] 06bba54a-be05-49f9-b0a0-30f790261023 v1.0 LRPC (eventlog) [Security Center]
96+
[*] 06bba54a-be05-49f9-b0a0-30f790261023 v1.0 PIPE (\pipe\eventlog) \\XEN-WIN7-BARE [Security Center]
97+
[*] 06bba54a-be05-49f9-b0a0-30f790261023 v1.0 TCP (49153) 192.168.1.202 [Security Center]
98+
[*] 06bba54a-be05-49f9-b0a0-30f790261023 v1.0 LRPC (AudioClientRpc) [Security Center]
99+
[*] 06bba54a-be05-49f9-b0a0-30f790261023 v1.0 LRPC (Audiosrv) [Security Center]
100+
[*] 06bba54a-be05-49f9-b0a0-30f790261023 v1.0 LRPC (dhcpcsvc) [Security Center]
101+
[*] 06bba54a-be05-49f9-b0a0-30f790261023 v1.0 LRPC (dhcpcsvc6) [Security Center]
102+
[*] 06bba54a-be05-49f9-b0a0-30f790261023 v1.0 LRPC (OLE7F5D2071B7D4441897C08153F2A2) [Security Center]
103+
[*] 76f226c3-ec14-4325-8a99-6a46348418af v1.0 LRPC (WMsgKRpc045EC1)
104+
[*] c9ac6db5-82b7-4e55-ae8a-e464ed7b4277 v1.0 LRPC (LRPC-af541be9090579589d) [Impl friendly name]
105+
[*] 76f226c3-ec14-4325-8a99-6a46348418af v1.0 LRPC (WMsgKRpc0441F0)
106+
[*] 76f226c3-ec14-4325-8a99-6a46348418af v1.0 PIPE (\PIPE\InitShutdown) \\XEN-WIN7-BARE
107+
[*] 76f226c3-ec14-4325-8a99-6a46348418af v1.0 LRPC (WindowsShutdown)
108+
[*] d95afe70-a6d5-4259-822e-2c84da1ddb0d v1.0 LRPC (WMsgKRpc0441F0)
109+
[*] d95afe70-a6d5-4259-822e-2c84da1ddb0d v1.0 PIPE (\PIPE\InitShutdown) \\XEN-WIN7-BARE
110+
[*] d95afe70-a6d5-4259-822e-2c84da1ddb0d v1.0 LRPC (WindowsShutdown)
111+
[*] Could not connect to the endpoint mapper service
112+
[*] Scanned 06 of 55 hosts (010% complete)
113+
...snip...
114+
[*] Scanned 55 of 55 hosts (100% complete)
115+
[*] Auxiliary module execution completed
116+
msf auxiliary(endpoint_mapper) >
117+
```

‎documentation/modules/auxiliary/scanner/dcerpc/hidden.md

Lines changed: 62 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,62 @@
1+
## Description
2+
3+
The hidden scanner connects to a given range of IP addresses and tries to locate any RPC services that are not listed in the Endpoint Mapper and determines if anonymous access to the service is allowed.
4+
5+
## Verification Steps
6+
7+
1. Do: ```use auxiliary/scanner/dcerpc/hidden```
8+
2. Do: ```set RHOSTS [IP]```
9+
3. Do: ```set THREADS [number of threads]```
10+
4. Do: ```run```
11+
12+
## Scenarios
13+
14+
```
15+
msf > use auxiliary/scanner/dcerpc/hidden
16+
msf auxiliary(hidden) > set RHOSTS 192.168.1.200-254
17+
RHOSTS => 192.168.1.200-254
18+
msf auxiliary(hidden) > set THREADS 55
19+
THREADS => 55
20+
msf auxiliary(hidden) > run
21+
22+
[*] Connecting to the endpoint mapper service...
23+
[*] Connecting to the endpoint mapper service...
24+
[*] Connecting to the endpoint mapper service...
25+
...snip...
26+
[*] Connecting to the endpoint mapper service...
27+
[*] Connecting to the endpoint mapper service...
28+
[*] Could not obtain the endpoint list: DCERPC FAULT => nca_s_fault_access_denied
29+
[*] Could not contact the endpoint mapper on 192.168.1.203
30+
[*] Could not obtain the endpoint list: DCERPC FAULT => nca_s_fault_access_denied
31+
[*] Could not contact the endpoint mapper on 192.168.1.201
32+
[*] Could not connect to the endpoint mapper service
33+
[*] Could not contact the endpoint mapper on 192.168.1.250
34+
[*] Looking for services on 192.168.1.204:1025...
35+
[*] HIDDEN: UUID 12345778-1234-abcd-ef00-0123456789ab v0.0
36+
[*] Looking for services on 192.168.1.202:49152...
37+
[*] CONN BIND CALL ERROR=DCERPC FAULT => nca_s_fault_ndr
38+
[*]
39+
[*] HIDDEN: UUID c681d488-d850-11d0-8c52-00c04fd90f7e v1.0
40+
[*] CONN BIND CALL ERROR=DCERPC FAULT => nca_s_fault_ndr
41+
[*]
42+
[*] HIDDEN: UUID 11220835-5b26-4d94-ae86-c3e475a809de v1.0
43+
[*] CONN BIND ERROR=DCERPC FAULT => nca_s_fault_access_denied
44+
[*]
45+
[*] HIDDEN: UUID 5cbe92cb-f4be-45c9-9fc9-33e73e557b20 v1.0
46+
[*] CONN BIND ERROR=DCERPC FAULT => nca_s_fault_access_denied
47+
[*]
48+
[*] HIDDEN: UUID 3919286a-b10c-11d0-9ba8-00c04fd92ef5 v0.0
49+
[*] CONN BIND CALL DATA=0000000057000000
50+
[*]
51+
[*] HIDDEN: UUID 1cbcad78-df0b-4934-b558-87839ea501c9 v0.0
52+
[*] CONN BIND ERROR=DCERPC FAULT => nca_s_fault_access_denied
53+
[*]
54+
[*] HIDDEN: UUID c9378ff1-16f7-11d0-a0b2-00aa0061426a v1.0
55+
[*] CONN BIND ERROR=DCERPC FAULT => nca_s_fault_access_denied
56+
[*]
57+
[*] Remote Management Interface Error: The connection timed out (192.168.1.202:49152).
58+
...snip...
59+
[*] Scanned 55 of 55 hosts (100% complete)
60+
[*] Auxiliary module execution completed
61+
msf auxiliary(hidden) >
62+
```

‎documentation/modules/auxiliary/scanner/dcerpc/management.md

Lines changed: 87 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,87 @@
1+
## Description
2+
3+
The dcerpc/management module scans a range of IP addresses and obtains information from the Remote Management interface of the DCERPC service.
4+
5+
## Verification Steps
6+
7+
1. Do: ```use auxiliary/scanner/dcerpc/management```
8+
2. Do: ```set RHOSTS [IP]```
9+
3. Do: ```set THREADS [number of threads]```
10+
4. Do: ```run```
11+
12+
## Scenarios
13+
14+
### Example Windows 2003, and Windows 7 Targets
15+
16+
```
17+
msf > use auxiliary/scanner/dcerpc/management
18+
msf auxiliary(management) > set RHOSTS 192.168.1.200-254
19+
RHOSTS => 192.168.1.200-254
20+
msf auxiliary(management) > set THREADS 55
21+
THREADS => 55
22+
msf auxiliary(management) > run
23+
24+
[*] Remote Management Interface Error: DCERPC FAULT => nca_s_fault_access_denied
25+
[*] Remote Management Interface Error: DCERPC FAULT => nca_s_fault_access_denied
26+
[*] UUID e1af8308-5d1f-11c9-91a4-08002b14a0fa v3.0
27+
[*] Remote Management Interface Error: DCERPC FAULT => nca_s_fault_access_denied
28+
[*] Remote Management Interface Error: The connection was refused by the remote host (192.168.1.250:135).
29+
[*] Remote Management Interface Error: DCERPC FAULT => nca_s_fault_ndr
30+
[*] listening: 00000000
31+
[*] killed: 00000005
32+
[*] name: 00010000000000000100000000000000d3060000
33+
[*] UUID 0b0a6584-9e0f-11cf-a3cf-00805f68cb1b v1.1
34+
[*] Remote Management Interface Error: DCERPC FAULT => nca_s_fault_ndr
35+
[*] listening: 00000000
36+
[*] killed: 00000005
37+
[*] name: 00010000000000000100000000000000d3060000
38+
[*] UUID 1d55b526-c137-46c5-ab79-638f2a68e869 v1.0
39+
[*] Remote Management Interface Error: DCERPC FAULT => nca_s_fault_ndr
40+
[*] listening: 00000000
41+
[*] killed: 00000005
42+
[*] name: 00010000000000000100000000000000d3060000
43+
[*] UUID e60c73e6-88f9-11cf-9af1-0020af6e72f4 v2.0
44+
[*] Remote Management Interface Error: DCERPC FAULT => nca_s_fault_ndr
45+
[*] listening: 00000000
46+
[*] killed: 00000005
47+
[*] name: 00010000000000000100000000000000d3060000
48+
[*] UUID 99fcfec4-5260-101b-bbcb-00aa0021347a v0.0
49+
[*] Remote Management Interface Error: DCERPC FAULT => nca_s_fault_ndr
50+
[*] listening: 00000000
51+
[*] killed: 00000005
52+
[*] name: 00010000000000000100000000000000d3060000
53+
[*] UUID b9e79e60-3d52-11ce-aaa1-00006901293f v0.2
54+
[*] Remote Management Interface Error: DCERPC FAULT => nca_s_fault_ndr
55+
[*] listening: 00000000
56+
[*] killed: 00000005
57+
[*] name: 00010000000000000100000000000000d3060000
58+
[*] UUID 412f241e-c12a-11ce-abff-0020af6e7a17 v0.2
59+
[*] Remote Management Interface Error: DCERPC FAULT => nca_s_fault_ndr
60+
[*] listening: 00000000
61+
[*] killed: 00000005
62+
[*] name: 00010000000000000100000000000000d3060000
63+
[*] UUID 00000136-0000-0000-c000-000000000046 v0.0
64+
[*] Remote Management Interface Error: DCERPC FAULT => nca_s_fault_ndr
65+
[*] listening: 00000000
66+
[*] killed: 00000005
67+
[*] name: 00010000000000000100000000000000d3060000
68+
[*] UUID c6f3ee72-ce7e-11d1-b71e-00c04fc3111a v1.0
69+
[*] Remote Management Interface Error: DCERPC FAULT => nca_s_fault_ndr
70+
[*] listening: 00000000
71+
[*] killed: 00000005
72+
[*] name: 00010000000000000100000000000000d3060000
73+
[*] UUID 4d9f4ab8-7d1c-11cf-861e-0020af6e7c57 v0.0
74+
[*] Remote Management Interface Error: DCERPC FAULT => nca_s_fault_ndr
75+
[*] listening: 00000000
76+
[*] killed: 00000005
77+
[*] name: 00010000000000000100000000000000d3060000
78+
[*] UUID 000001a0-0000-0000-c000-000000000046 v0.0
79+
[*] Remote Management Interface Error: DCERPC FAULT => nca_s_fault_ndr
80+
[*] listening: 00000000
81+
[*] killed: 00000005
82+
[*] name: 00010000000000000100000000000000d3060000
83+
...snip...
84+
[*] Scanned 55 of 55 hosts (100% complete)
85+
[*] Auxiliary module execution completed
86+
msf auxiliary(management) >
87+
```

‎documentation/modules/auxiliary/scanner/dcerpc/tcp_dcerpc_auditor.md

Lines changed: 43 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,43 @@
1+
## Description
2+
3+
The dcerpc/tcp_dcerpc_auditor module scans a range of IP addresses to determine what DCERPC services are available over a TCP port.
4+
5+
## Verification Steps
6+
7+
1. Do: ```use auxiliary/scanner/dcerpc/tcp_dcerpc_auditor```
8+
2. Do: ```set RHOSTS [IP]```
9+
3. Do: ```set THREADS [number of threads]```
10+
4. Do: ```run```
11+
12+
## Scenarios
13+
14+
### Example Windows 2003, and Windows 7 Targets
15+
16+
```
17+
msf > use auxiliary/scanner/dcerpc/tcp_dcerpc_auditor
18+
msf auxiliary(tcp_dcerpc_auditor) > set RHOSTS 192.168.1.200-254
19+
RHOSTS => 192.168.1.200-254
20+
msf auxiliary(tcp_dcerpc_auditor) > set THREADS 55
21+
THREADS => 55
22+
msf auxiliary(tcp_dcerpc_auditor) > run
23+
24+
The connection was refused by the remote host (192.168.1.250:135).
25+
The host (192.168.1.210:135) was unreachable.
26+
...snip...
27+
The host (192.168.1.200:135) was unreachable.
28+
[*] Scanned 38 of 55 hosts (069% complete)
29+
...snip...
30+
The host (192.168.1.246:135) was unreachable.
31+
192.168.1.203 - UUID 99fcfec4-5260-101b-bbcb-00aa0021347a 0.0 OPEN VIA 135 ACCESS GRANTED 00000000000000000000000000000000000000000000000005000000
32+
192.168.1.201 - UUID 99fcfec4-5260-101b-bbcb-00aa0021347a 0.0 OPEN VIA 135 ACCESS GRANTED 00000000000000000000000000000000000000000000000005000000
33+
192.168.1.204 - UUID 99fcfec4-5260-101b-bbcb-00aa0021347a 0.0 OPEN VIA 135 ACCESS GRANTED 00000000000000000000000000000000000000000000000076070000
34+
192.168.1.202 - UUID 99fcfec4-5260-101b-bbcb-00aa0021347a 0.0 OPEN VIA 135 ACCESS GRANTED 00000000000000000000000000000000000000000000000005000000
35+
192.168.1.204 - UUID afa8bd80-7d8a-11c9-bef4-08002b102989 1.0 OPEN VIA 135 ACCESS GRANTED 000002000b0000000b00000004000200080002000c0002001000020014000200180002001c0002002000020024000200280002002c0002000883afe11f5dc91191a408002b14a0fa0300000084650a0b0f9ecf11a3cf00805f68cb1b0100010026b5551d37c1c546ab79638f2a68e86901000000e6730ce6f988cf119af10020af6e72f402000000c4fefc9960521b10bbcb00aa0021347a00000000609ee7b9523dce11aaa100006901293f000002001e242f412ac1ce11abff0020af6e7a17000002003601000000000000c0000000000000460000000072eef3c67eced111b71e00c04fc3111a01000000b84a9f4d1c7dcf11861e0020af6e7c5700000000a001000000000000c0000000000000460000000000000000
36+
192.168.1.204 - UUID e1af8308-5d1f-11c9-91a4-08002b14a0fa 3.0 OPEN VIA 135 ACCESS GRANTED d8060000
37+
[*] Scanned 52 of 55 hosts (094% complete)
38+
[*] Scanned 54 of 55 hosts (098% complete)
39+
The connection timed out (192.168.1.205:135).
40+
[*] Scanned 55 of 55 hosts (100% complete)
41+
[*] Auxiliary module execution completed
42+
msf auxiliary(tcp_dcerpc_auditor) >
43+
```

‎documentation/modules/auxiliary/scanner/discovery/ipv6_neighbor.md

Lines changed: 50 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,50 @@
1+
## Description
2+
3+
This auxiliary module probes the local network for IPv6 hosts that respond to Neighbor Solicitations with a link-local address. This module, like the arp_sweep one, will generally only work within the attacking machine’s broadcast domain. It serves the dual-purpose of showing what hosts are online similar to arp_sweep and then performs the IPv6 Neighbor Discovery.
4+
5+
## Verification Steps
6+
7+
1. Do: ```use auxiliary/scanner/discovery/ipv6_neighbor```
8+
2. Do: ```set RHOSTS [IP]```
9+
3. Do: ```set SHOST [IP]```
10+
4. Do: ```set SMAC [MAC]```
11+
5. Do: ```set THREADS [number of threads]```
12+
6. Do: ```run```
13+
14+
## Scenarios
15+
16+
```
17+
msf > use auxiliary/scanner/discovery/ipv6_neighbor
18+
msf auxiliary(ipv6_neighbor) > set RHOSTS 192.168.1.2-254
19+
RHOSTS => 192.168.1.200-254
20+
msf auxiliary(ipv6_neighbor) > set SHOST 192.168.1.101
21+
SHOST => 192.168.1.101
22+
msf auxiliary(ipv6_neighbor) > set SMAC d6:46:a7:38:15:65
23+
SMAC => d6:46:a7:38:15:65
24+
msf auxiliary(ipv6_neighbor) > set THREADS 55
25+
THREADS => 55
26+
msf auxiliary(ipv6_neighbor) > run
27+
28+
[*] IPv4 Hosts Discovery
29+
[*] 192.168.1.10 is alive.
30+
[*] 192.168.1.11 is alive.
31+
[*] 192.168.1.2 is alive.
32+
[*] 192.168.1.69 is alive.
33+
[*] 192.168.1.109 is alive.
34+
[*] 192.168.1.150 is alive.
35+
[*] 192.168.1.61 is alive.
36+
[*] 192.168.1.201 is alive.
37+
[*] 192.168.1.203 is alive.
38+
[*] 192.168.1.205 is alive.
39+
[*] 192.168.1.206 is alive.
40+
[*] 192.168.1.99 is alive.
41+
[*] 192.168.1.97 is alive.
42+
[*] 192.168.1.250 is alive.
43+
[*] IPv6 Neighbor Discovery
44+
[*] 192.168.1.69 maps to IPv6 link local address fe80::5a55:caff:fe14:1e61
45+
[*] 192.168.1.99 maps to IPv6 link local address fe80::5ab0:35ff:fe6a:4ecc
46+
[*] 192.168.1.97 maps to IPv6 link local address fe80::7ec5:37ff:fef9:a96a
47+
[*] Scanned 253 of 253 hosts (100% complete)
48+
[*] Auxiliary module execution completed
49+
msf auxiliary(ipv6_neighbor) >
50+
```

0 commit comments

Comments
 (0)