Skip to content

Commit f5374d1

Browse files
author
Andrew Morris
committed
Added report_service method for database support, added port number in the print_status output, removed arbitrary comments, fixed some spacing. Ready for another review from msf devs
1 parent 7afa87f commit f5374d1

File tree

1 file changed

+5
-3
lines changed

1 file changed

+5
-3
lines changed

modules/auxiliary/scanner/ssh/detect_kippo.rb

Lines changed: 5 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -4,6 +4,7 @@ class Metasploit3 < Msf::Auxiliary
44

55
include Msf::Exploit::Remote::Tcp
66
include Msf::Auxiliary::Scanner
7+
include Msf::Auxiliary::Report
78

89
def initialize
910
super(
@@ -28,9 +29,10 @@ def run_host(ip)
2829
connect
2930
banner = sock.get_once(1024)
3031
sock.put(banner+"\n"*8)
31-
response = sock.get(1024) # Not sure what the difference is between get and recv, but updated. Will look into.
32-
if response == "Protocol mismatch.\n" or response.include? "bad packet length 168430090" # I know this is ugly
33-
print_status("#{ip} - Kippo honeypot detected!") # Currently reading the report_* documentation trying to figure out how to implement properly
32+
response = sock.get(1024)
33+
if response == "Protocol mismatch.\n" or response.include? "bad packet length 168430090"
34+
print_status("#{ip}:#{rport} - Kippo honeypot detected!")
35+
report_service(:host => rhost, :port => rport, :name => "ssh", :info => "Kippo SSH Honeypot")
3436
end
3537
end
3638
end

0 commit comments

Comments
 (0)