Move protocol and lifetime to mixin, use correct map_target if CHOST

Author: jhart-r7

lib/msf/core/auxiliary/natpmp.rb

@@ -18,7 +18,9 @@ def initialize(info = {})
     register_options(
       [
         Opt::RPORT(Rex::Proto::NATPMP::DefaultPort),
-        Opt::CHOST
+        Opt::CHOST,
+        OptInt.new('LIFETIME', [true, "Time in ms to keep this port forwarded (set to 0 to destroy a mapping)", 3600000]),
+        OptEnum.new('PROTOCOL', [true, "Protocol to forward", 'TCP', %w(TCP UDP)])
       ],
       self.class
     )

modules/auxiliary/admin/natpmp/natpmp_map.rb

@@ -23,9 +23,7 @@ def initialize
     register_options(
       [
         OptString.new('EXTERNAL_PORTS', [true, 'The external ports to foward from (0 to let the target choose)', 0]),
-        OptString.new('INTERNAL_PORTS', [true, 'The internal ports to forward to', '22,135-139,80,443,445']),
-        OptInt.new('LIFETIME', [true, "Time in ms to keep this port forwarded (set to 0 to destroy a mapping)", 3600000]),
-        OptEnum.new('PROTOCOL', [true, "Protocol to forward", 'TCP', %w(TCP UDP)]),
+        OptString.new('INTERNAL_PORTS', [true, 'The internal ports to forward to', '22,135-139,80,443,445'])
       ],
       self.class
     )
@@ -87,7 +85,7 @@ def run_host(host)
                               " -> " +
                               "#{map_target}:#{internal_port}/#{protocol}"
         if actual_ext_port
-          map_target = Rex::Socket.source_address(host)
+          map_target = datastore['CHOST'] ? datastore['CHOST'] : Rex::Socket.source_address(host)
           actual_forwarding = "#{external_address}:#{actual_ext_port}/#{protocol}" +
                                 " -> " +
                                 "#{map_target}:#{internal_port}/#{protocol}"

modules/auxiliary/scanner/natpmp/natpmp_portscan.rb

@@ -23,8 +23,7 @@ def initialize
 
     register_options(
       [
-        OptString.new('PORTS', [true, "Ports to scan (e.g. 22-25,80,110-900)", "1-1000"]),
-        OptEnum.new('PROTOCOL', [true, "Protocol to scan", 'TCP', %w(TCP UDP)]),
+        OptString.new('PORTS', [true, "Ports to scan (e.g. 22-25,80,110-900)", "1-1000"])
       ], self.class)
   end
 
@@ -47,7 +46,7 @@ def run_host(host)
       end
 
       # clear all mappings
-      map_port(udp_sock, host, datastore['RPORT'], 0, 0, Rex::Proto::NATPMP.const_get(protocol), lifetime)
+      map_port(udp_sock, host, datastore['RPORT'], 0, 0, Rex::Proto::NATPMP.const_get(protocol), 0)
 
       Rex::Socket.portspec_crack(datastore['PORTS']).each do |port|
         map_req = map_port_request(port, port, Rex::Proto::NATPMP.const_get(datastore['PROTOCOL']), 1)