|
1 | 1 | # -*- coding: binary -*-
|
2 | 2 | require 'rex/proto/kerberos'
|
3 | 3 |
|
4 |
| -module Msf::Exploit::Remote::Kerberos |
5 |
| - module Client |
6 |
| - require 'msf/core/exploit/kerberos/client/base' |
7 |
| - require 'msf/core/exploit/kerberos/client/as_request' |
8 |
| - require 'msf/core/exploit/kerberos/client/as_response' |
9 |
| - require 'msf/core/exploit/kerberos/client/tgs_request' |
10 |
| - require 'msf/core/exploit/kerberos/client/tgs_response' |
11 |
| - require 'msf/core/exploit/kerberos/client/pac' |
12 |
| - require 'msf/core/exploit/kerberos/client/cache_credential' |
13 |
| - |
14 |
| - include Msf::Exploit::Remote::Kerberos::Client::Base |
15 |
| - include Msf::Exploit::Remote::Kerberos::Client::AsRequest |
16 |
| - include Msf::Exploit::Remote::Kerberos::Client::AsResponse |
17 |
| - include Msf::Exploit::Remote::Kerberos::Client::TgsRequest |
18 |
| - include Msf::Exploit::Remote::Kerberos::Client::TgsResponse |
19 |
| - include Msf::Exploit::Remote::Kerberos::Client::Pac |
20 |
| - include Msf::Exploit::Remote::Kerberos::Client::CacheCredential |
21 |
| - |
22 |
| - # @!attribute client |
23 |
| - # @return [Rex::Proto::Kerberos::Client] The kerberos client |
24 |
| - attr_accessor :client |
25 |
| - |
26 |
| - def initialize(info = {}) |
27 |
| - super |
28 |
| - |
29 |
| - register_options( |
30 |
| - [ |
31 |
| - Opt::RHOST, |
32 |
| - Opt::RPORT(88), |
33 |
| - OptInt.new('Timeout', [true, 'The TCP timeout to establish connection and read data', 10]) |
34 |
| - ], self.class |
35 |
| - ) |
36 |
| - end |
37 |
| - |
38 |
| - # Returns the target host |
39 |
| - # |
40 |
| - # @return [String] |
41 |
| - def rhost |
42 |
| - datastore['RHOST'] |
43 |
| - end |
44 |
| - |
45 |
| - # Returns the remote port |
46 |
| - # |
47 |
| - # @return [Fixnum] |
48 |
| - def rport |
49 |
| - datastore['RPORT'] |
50 |
| - end |
51 |
| - |
52 |
| - # Returns the TCP timeout |
53 |
| - # |
54 |
| - # @return [Fixnum] |
55 |
| - def timeout |
56 |
| - datastore['Timeout'] |
57 |
| - end |
58 |
| - |
59 |
| - # Returns the kdc peer |
60 |
| - # |
61 |
| - # @return [String] |
62 |
| - def peer |
63 |
| - "#{rhost}:#{rport}" |
64 |
| - end |
65 |
| - |
66 |
| - # Creates a kerberos connection |
67 |
| - # |
68 |
| - # @param opts [Hash{Symbol => <String, Fixnum>}] |
69 |
| - # @option opts [String] :rhost |
70 |
| - # @option opts [<String, Fixnum>] :rport |
71 |
| - # @return [Rex::Proto::Kerberos::Client] |
72 |
| - def connect(opts={}) |
73 |
| - kerb_client = Rex::Proto::Kerberos::Client.new( |
74 |
| - host: opts[:rhost] || rhost, |
75 |
| - port: (opts[:rport] || rport).to_i, |
76 |
| - timeout: (opts[:timeout] || timeout).to_i, |
77 |
| - context: |
78 |
| - { |
79 |
| - 'Msf' => framework, |
80 |
| - 'MsfExploit' => self, |
81 |
| - }, |
82 |
| - protocol: 'tcp' |
83 |
| - ) |
84 |
| - |
85 |
| - disconnect if client |
86 |
| - self.client = kerb_client |
87 |
| - |
88 |
| - kerb_client |
89 |
| - end |
90 |
| - |
91 |
| - # Disconnects the Kerberos client |
92 |
| - # |
93 |
| - # @param kerb_client [Rex::Proto::Kerberos::Client] the client to disconnect |
94 |
| - def disconnect(kerb_client = client) |
95 |
| - kerb_client.close if kerb_client |
96 |
| - |
97 |
| - if kerb_client == client |
98 |
| - self.client = nil |
| 4 | +module Msf |
| 5 | + class Exploit |
| 6 | + class Remote |
| 7 | + module Kerberos |
| 8 | + module Client |
| 9 | + require 'msf/core/exploit/kerberos/client/base' |
| 10 | + require 'msf/core/exploit/kerberos/client/as_request' |
| 11 | + require 'msf/core/exploit/kerberos/client/as_response' |
| 12 | + require 'msf/core/exploit/kerberos/client/tgs_request' |
| 13 | + require 'msf/core/exploit/kerberos/client/tgs_response' |
| 14 | + require 'msf/core/exploit/kerberos/client/pac' |
| 15 | + require 'msf/core/exploit/kerberos/client/cache_credential' |
| 16 | + |
| 17 | + include Msf::Exploit::Remote::Kerberos::Client::Base |
| 18 | + include Msf::Exploit::Remote::Kerberos::Client::AsRequest |
| 19 | + include Msf::Exploit::Remote::Kerberos::Client::AsResponse |
| 20 | + include Msf::Exploit::Remote::Kerberos::Client::TgsRequest |
| 21 | + include Msf::Exploit::Remote::Kerberos::Client::TgsResponse |
| 22 | + include Msf::Exploit::Remote::Kerberos::Client::Pac |
| 23 | + include Msf::Exploit::Remote::Kerberos::Client::CacheCredential |
| 24 | + |
| 25 | + # @!attribute client |
| 26 | + # @return [Rex::Proto::Kerberos::Client] The kerberos client |
| 27 | + attr_accessor :client |
| 28 | + |
| 29 | + def initialize(info = {}) |
| 30 | + super |
| 31 | + |
| 32 | + register_options( |
| 33 | + [ |
| 34 | + Opt::RHOST, |
| 35 | + Opt::RPORT(88), |
| 36 | + OptInt.new('Timeout', [true, 'The TCP timeout to establish connection and read data', 10]) |
| 37 | + ], self.class |
| 38 | + ) |
| 39 | + end |
| 40 | + |
| 41 | + # Returns the target host |
| 42 | + # |
| 43 | + # @return [String] |
| 44 | + def rhost |
| 45 | + datastore['RHOST'] |
| 46 | + end |
| 47 | + |
| 48 | + # Returns the remote port |
| 49 | + # |
| 50 | + # @return [Fixnum] |
| 51 | + def rport |
| 52 | + datastore['RPORT'] |
| 53 | + end |
| 54 | + |
| 55 | + # Returns the TCP timeout |
| 56 | + # |
| 57 | + # @return [Fixnum] |
| 58 | + def timeout |
| 59 | + datastore['Timeout'] |
| 60 | + end |
| 61 | + |
| 62 | + # Returns the kdc peer |
| 63 | + # |
| 64 | + # @return [String] |
| 65 | + def peer |
| 66 | + "#{rhost}:#{rport}" |
| 67 | + end |
| 68 | + |
| 69 | + # Creates a kerberos connection |
| 70 | + # |
| 71 | + # @param opts [Hash{Symbol => <String, Fixnum>}] |
| 72 | + # @option opts [String] :rhost |
| 73 | + # @option opts [<String, Fixnum>] :rport |
| 74 | + # @return [Rex::Proto::Kerberos::Client] |
| 75 | + def connect(opts={}) |
| 76 | + kerb_client = Rex::Proto::Kerberos::Client.new( |
| 77 | + host: opts[:rhost] || rhost, |
| 78 | + port: (opts[:rport] || rport).to_i, |
| 79 | + timeout: (opts[:timeout] || timeout).to_i, |
| 80 | + context: |
| 81 | + { |
| 82 | + 'Msf' => framework, |
| 83 | + 'MsfExploit' => self, |
| 84 | + }, |
| 85 | + protocol: 'tcp' |
| 86 | + ) |
| 87 | + |
| 88 | + disconnect if client |
| 89 | + self.client = kerb_client |
| 90 | + |
| 91 | + kerb_client |
| 92 | + end |
| 93 | + |
| 94 | + # Disconnects the Kerberos client |
| 95 | + # |
| 96 | + # @param kerb_client [Rex::Proto::Kerberos::Client] the client to disconnect |
| 97 | + def disconnect(kerb_client = client) |
| 98 | + kerb_client.close if kerb_client |
| 99 | + |
| 100 | + if kerb_client == client |
| 101 | + self.client = nil |
| 102 | + end |
| 103 | + end |
| 104 | + |
| 105 | + # Performs cleanup as necessary, disconnecting the Kerberos client |
| 106 | + # if it's still established. |
| 107 | + def cleanup |
| 108 | + super |
| 109 | + disconnect |
| 110 | + end |
| 111 | + |
| 112 | + # Sends a kerberos AS request and reads the response |
| 113 | + # |
| 114 | + # @param opts [Hash] |
| 115 | + # @return [Rex::Proto::Kerberos::Model::KdcResponse] |
| 116 | + # @see Msf::Kerberos::Client::AsRequest#build_as_request |
| 117 | + # @see Rex::Proto::Kerberos::Model::KdcResponse |
| 118 | + def send_request_as(opts = {}) |
| 119 | + connect(opts) |
| 120 | + req = build_as_request(opts) |
| 121 | + res = client.send_recv(req) |
| 122 | + disconnect |
| 123 | + res |
| 124 | + end |
| 125 | + |
| 126 | + # Sends a kerberos AS request and reads the response |
| 127 | + # |
| 128 | + # @param opts [Hash] |
| 129 | + # @return [Rex::Proto::Kerberos::Model::KdcResponse] |
| 130 | + # @see Msf::Kerberos::Client::TgsRequest#build_tgs_request |
| 131 | + # @see Rex::Proto::Kerberos::Model::KdcResponse |
| 132 | + def send_request_tgs(opts = {}) |
| 133 | + connect(opts) |
| 134 | + req = build_tgs_request(opts) |
| 135 | + res = client.send_recv(req) |
| 136 | + disconnect |
| 137 | + res |
| 138 | + end |
| 139 | + end |
99 | 140 | end
|
100 | 141 | end
|
101 |
| - |
102 |
| - # Performs cleanup as necessary, disconnecting the Kerberos client |
103 |
| - # if it's still established. |
104 |
| - def cleanup |
105 |
| - super |
106 |
| - disconnect |
107 |
| - end |
108 |
| - |
109 |
| - # Sends a kerberos AS request and reads the response |
110 |
| - # |
111 |
| - # @param opts [Hash] |
112 |
| - # @return [Rex::Proto::Kerberos::Model::KdcResponse] |
113 |
| - # @see Msf::Kerberos::Client::AsRequest#build_as_request |
114 |
| - # @see Rex::Proto::Kerberos::Model::KdcResponse |
115 |
| - def send_request_as(opts = {}) |
116 |
| - connect(opts) |
117 |
| - req = build_as_request(opts) |
118 |
| - res = client.send_recv(req) |
119 |
| - disconnect |
120 |
| - res |
121 |
| - end |
122 |
| - |
123 |
| - # Sends a kerberos AS request and reads the response |
124 |
| - # |
125 |
| - # @param opts [Hash] |
126 |
| - # @return [Rex::Proto::Kerberos::Model::KdcResponse] |
127 |
| - # @see Msf::Kerberos::Client::TgsRequest#build_tgs_request |
128 |
| - # @see Rex::Proto::Kerberos::Model::KdcResponse |
129 |
| - def send_request_tgs(opts = {}) |
130 |
| - connect(opts) |
131 |
| - req = build_tgs_request(opts) |
132 |
| - res = client.send_recv(req) |
133 |
| - disconnect |
134 |
| - res |
135 |
| - end |
136 | 142 | end
|
137 | 143 | end
|
0 commit comments