6
6
require 'msf/core'
7
7
8
8
class Metasploit3 < Msf ::Auxiliary
9
-
10
9
include Msf ::Exploit ::Remote ::SunRPC
11
10
include Msf ::Auxiliary ::Report
12
11
include Msf ::Auxiliary ::Scanner
13
12
14
13
def initialize
15
14
super (
16
- 'Name' => 'SunRPC Portmap Program Enumerator' ,
17
- 'Description' => %q{
18
- This module calls the target portmap service and enumerates all
19
- program entries and their running port numbers.
20
- } ,
21
- 'Author' => [ '<tebo[at]attackresearch.com>' ] ,
22
- 'References' =>
15
+ 'Name' => 'SunRPC Portmap Program Enumerator' ,
16
+ 'Description' => '
17
+ This module calls the target portmap service and enumerates all program
18
+ entries and their running port numbers.
19
+ ' ,
20
+ 'Author' => [ '<tebo[at]attackresearch.com>' ] ,
21
+ 'References' =>
23
22
[
24
- [ 'URL' , 'http://www.ietf.org/rfc/rfc1057.txt' ] ,
23
+ [ 'URL' , 'http://www.ietf.org/rfc/rfc1057.txt' ]
25
24
] ,
26
25
'License' => MSF_LICENSE
27
26
)
@@ -37,29 +36,28 @@ def run_host(ip)
37
36
procedure = 4
38
37
39
38
sunrpc_create ( 'udp' , program , progver )
40
- sunrpc_authnull ( )
39
+ sunrpc_authnull
41
40
resp = sunrpc_call ( procedure , "" )
42
41
43
- progs = resp [ 3 , 1 ] . unpack ( 'C' ) [ 0 ]
42
+ progs = resp [ 3 , 1 ] . unpack ( 'C' ) [ 0 ]
44
43
maps = [ ]
45
44
if ( progs == 0x01 )
46
- while XDR . decode_int! ( resp ) == 1 do
47
- map = XDR . decode! ( resp , Integer , Integer , Integer , Integer )
48
- maps << map
45
+ while XDR . decode_int! ( resp ) == 1
46
+ maps << XDR . decode! ( resp , Integer , Integer , Integer , Integer )
49
47
end
50
48
end
51
49
sunrpc_destroy
52
50
return if maps . empty?
53
51
print_good ( "#{ peer } - Found #{ maps . size } programs available" )
54
52
55
53
table = Rex ::Ui ::Text ::Table . new (
56
- 'Header' => "SunRPC Programs for #{ ip } . " ,
54
+ 'Header' => "SunRPC Programs for #{ ip } " ,
57
55
'Indent' => 1 ,
58
56
'Columns' => %w( Name Number Version Port Protocol )
59
57
)
60
58
61
59
maps . each do |map |
62
- prog , vers , prot_num , port = map [ 0 , 4 ]
60
+ prog , vers , prot_num , port = map [ 0 , 4 ]
63
61
thing = "RPC Program ##{ prog } v#{ vers } on port #{ port } w/ protocol #{ prot_num } "
64
62
if prot_num == 0x06
65
63
proto = 'tcp'
@@ -73,17 +71,16 @@ def run_host(ip)
73
71
resolved = progresolv ( prog )
74
72
table << [ resolved , prog , vers , port , proto ]
75
73
report_service (
76
- : host => ip ,
77
- : port => port ,
78
- : proto => proto ,
79
- : name => resolved ,
80
- : info => "Prog: #{ prog } Version: #{ vers } - via portmapper"
74
+ host : ip ,
75
+ port : port ,
76
+ proto : proto ,
77
+ name : resolved ,
78
+ info : "Prog: #{ prog } Version: #{ vers } - via portmapper"
81
79
)
82
80
end
83
81
84
82
print_good ( table . to_s )
85
83
rescue ::Rex ::Proto ::SunRPC ::RPCTimeout
86
84
end
87
85
end
88
-
89
86
end
0 commit comments