Skip to content

Commit a63c947

Browse files
h00dieh00die
committed
gopher proto
1 parent 56e95f1 commit a63c947

File tree

2 files changed

+197
-0
lines changed

2 files changed

+197
-0
lines changed

‎documentation/modules/auxiliary/scanner/gopher/gopher_gophermap.md

Lines changed: 98 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,98 @@
1+
## Vulnerable Application
2+
3+
Any gopher server will work. There seems to only be [a few left](https://en.wikipedia.org/wiki/Gopher_(protocol)#Server_software)
4+
in 2017.
5+
6+
### Ubuntu 16.04 Install
7+
8+
First we need to install the server:
9+
10+
```
11+
sudo apt-get install gopher-server
12+
```
13+
Next, we need to build content for the scanner to find. Gopher works off of a `gophermap`, somewhat similar
14+
to a content index page, where files are listed in a menu type system.
15+
16+
```
17+
echo "<html><h1>hello world</h1></html>" | sudo tee /var/gopher/example.html
18+
echo "foobarbaz" | sudo tee /var/gopher/foobar.txt
19+
sudo mkdir /var/gopher/msf
20+
echo "meterpreter rules" | sudo tee /var/gopher/msf/meterp.txt
21+
sudo wget "https://pbs.twimg.com/profile_images/580131056629735424/2ENTk2K2.png" -O /var/gopher/msf/logo.png
22+
23+
echo -ne "gopher custom gophermap\n\nhHello World\t/example.html\t1.1.1.1\t70\n0Foo File\t/foobar.txt\t1.1.1.1\t70\n1msf\t/msf\t1.1.1.1\t70\nhmetasploit homepage\tURL:http://metasploit.com/\n" | sudo tee /var/gopher/gophermap
24+
sudo chmod +r -R /var/gopher
25+
```
26+
27+
In this case we create an html file, text file, a directory with a text file and png file in it. Enough content so its nice to look at.
28+
Next we write our `gophermap` file. The first line is just an intro. After that, we list our files that the client can access.
29+
30+
The format of these lines is: `XSome text here[TAB]/path/to/content[TAB]example.org[TAB]port`. The first character, `X` is the file type
31+
which can be referenced in the table below. The final address (example.org) and PORT are optional.
32+
33+
The following table contains the file types associated with the characters:
34+
35+
| Itemtype | Content |
36+
|----------|---------------------------------|
37+
| 0 | Text file |
38+
| 1 | Directory |
39+
| 2 | CSO name server |
40+
| 3 | Error |
41+
| 4 | Mac HQX filer |
42+
| 5 | PC binary |
43+
| 6 | UNIX uuencoded file |
44+
| 7 | Search server |
45+
| 8 | Telnet Session |
46+
| 9 | Binary File |
47+
| c | Calendar (not in 2.06) |
48+
| e | Event (not in 2.06) |
49+
| g | GIF image |
50+
| h | HTML, Hypertext Markup Language |
51+
| i | inline text type |
52+
| s | Sound |
53+
| I | Image (other than GIF) |
54+
| M | MIME multipart/mixed message |
55+
| T | TN3270 Session |
56+
57+
## Verification Steps
58+
59+
1. Install the application
60+
2. Start msfconsole
61+
3. Do: ```use auxiliary/scanner/gopher/gopher_gophermap```
62+
4. Do: ```set rhosts [IPs]```
63+
5. Do: ```run```
64+
6. You should see the gophermap file printed in a parsed format
65+
66+
## Options
67+
68+
**PATH**
69+
70+
It is possible to view content within a directory of the gophermap. If the intial run shows directory `Directory: foobar`,
71+
setting **path** to `/foobar` will enumerate the contents of that folder. Default: [empty string].
72+
73+
## Scenarios
74+
75+
### Gopher-server on Ubuntu 16.04
76+
77+
```
78+
msf > use auxiliary/scanner/gopher/gopher_gophermap
79+
msf auxiliary(gopher_gophermap) > set rhosts 192.168.2.137
80+
rhosts => 192.168.2.137
81+
msf auxiliary(gopher_gophermap) > set verbose true
82+
verbose => true
83+
msf auxiliary(gopher_gophermap) > run
84+
85+
[+] 1.1.1.1:70 - gopher custom gophermap
86+
[+] 1.1.1.1:70 -
87+
[+] 1.1.1.1:70 - HTML: Hello World
88+
[+] 1.1.1.1:70 - Path: 1.1.1.1:70/example.html
89+
[+] 1.1.1.1:70 - Text file: Foo File
90+
[+] 1.1.1.1:70 - Path: 1.1.1.1:70/foobar.txt
91+
[+] 1.1.1.1:70 - Directory: msf
92+
[+] 1.1.1.1:70 - Path: 1.1.1.1:70/msf
93+
[+] 1.1.1.1:70 - HTML: metasploit homepage
94+
[+] 1.1.1.1:70 - Path: 1.1.1.1:70/URL:http://metasploit.com/
95+
[*] Scanned 1 of 1 hosts (100% complete)
96+
[*] Auxiliary module execution completed
97+
98+
```

‎modules/auxiliary/scanner/gopher/gopher_gophermap.rb

Lines changed: 99 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,99 @@
1+
##
2+
# This module requires Metasploit: https://metasploit.com/download
3+
# Current source: https://github.com/rapid7/metasploit-framework
4+
##
5+
6+
class MetasploitModule < Msf::Auxiliary
7+
include Msf::Exploit::Remote::Tcp
8+
include Msf::Auxiliary::Report
9+
include Msf::Auxiliary::Scanner
10+
11+
def initialize
12+
super(
13+
'Name' => 'Gopher gophermap Scanner',
14+
'Description' => %q{
15+
This module identifies Gopher servers, and processes the gophermap
16+
file which lists all the files on the server.
17+
},
18+
'References' =>
19+
[
20+
['URL', 'https://sdfeu.org/w/tutorials:gopher'],
21+
],
22+
'Author' => 'h00die',
23+
'License' => MSF_LICENSE
24+
)
25+
26+
register_options([
27+
Opt::RPORT(70),
28+
OptString.new('PATH',[false,'Path to enumerate',''])
29+
])
30+
31+
end
32+
33+
def get_type(char)
34+
return {'0' => 'Text file',
35+
'1' => 'Directory',
36+
'2' => 'CSO name server',
37+
'3' => 'Error',
38+
'4' => 'Mac HQX filer',
39+
'5' => 'PC binary',
40+
'6' => 'UNIX uuencoded file',
41+
'7' => 'Search server',
42+
'8' => 'Telnet Session',
43+
'9' => 'Binary File',
44+
'c' => 'Calendar',
45+
'e' => 'Event',
46+
'g' => 'GIF image',
47+
'h' => 'HTML',
48+
'i' => 'inline text',
49+
's' => 'Sound',
50+
'I' => 'Image',
51+
'M' => 'MIME multipart/mixed message',
52+
'T' => 'TN3270 Session'}.fetch(char.chomp)
53+
end
54+
55+
def run_host(ip)
56+
begin
57+
connect
58+
sock.put("#{datastore['path']}\r\n")
59+
gophermap = sock.get_once
60+
if gophermap
61+
gophermap.split("\r\n").each do |line|
62+
if line.split("\t").length >= 2
63+
# syntax: [type_character]description[tab]path[tab, after this is optional]server[tab]port
64+
line = line.split("\t")
65+
desc = line[0]
66+
type_char = desc.slice!(0) #remove first character which is the file type
67+
file_type = get_type(type_char)
68+
if file_type && file_type == 'inline text'
69+
print_good(desc)
70+
next
71+
end
72+
if file_type
73+
print_good(" #{file_type}: #{desc}")
74+
else
75+
print_good(" Invalid File Type (#{type_char}): #{desc}")
76+
end
77+
if line.length >= 3
78+
print_good(" Path: #{line[2]}:#{line[3]}#{line[1]}")
79+
elsif line.length >= 2
80+
print_good(" Path: #{line[2]}#{line[1]}")
81+
else
82+
print_good(" Path: #{line[1]}")
83+
84+
end
85+
end
86+
end
87+
report_service(:host => ip, :port => rport, :name => 'gopher', :info => gophermap)
88+
else
89+
print_error('No gophermap')
90+
end
91+
rescue ::Rex::ConnectionError, ::IOError, ::Errno::ECONNRESET
92+
rescue ::Exception => e
93+
print_error("#{ip}: #{e} #{e.backtrace}")
94+
ensure
95+
disconnect
96+
end
97+
end
98+
99+
end

0 commit comments

Comments
 (0)