CoCalc provides the best real-time collaborative environment for Jupyter Notebooks, LaTeX documents, and SageMath, scalable from individual users to large groups and classes!

1
require 'metasploit/framework/telnet/client'
2
require 'metasploit/framework/login_scanner/base'
3
require 'metasploit/framework/login_scanner/rex_socket'
4

5
module Metasploit
6
  module Framework
7
    module LoginScanner
8
      # This is the LoginScanner class for dealing with Telnet remote terminals.
9
      # It is responsible for taking a single target, and a list of credentials
10
      # and attempting them. It then saves the results.
11
      class Telnet
12

13
        include Metasploit::Framework::LoginScanner::Base
14
        include Metasploit::Framework::LoginScanner::RexSocket
15
        include Metasploit::Framework::Telnet::Client
16

17
        CAN_GET_SESSION      = true
18
        DEFAULT_PORT         = 23
19
        LIKELY_PORTS         = [ DEFAULT_PORT ]
20
        LIKELY_SERVICE_NAMES = [ 'telnet' ]
21
        PRIVATE_TYPES        = [ :password ]
22
        REALM_KEY            = nil
23

24
        # @!attribute verbosity
25
        #   The timeout to wait for the telnet banner.
26
        #
27
        #   @return [Integer]
28
        attr_accessor :banner_timeout
29

30
        # @!attribute verbosity
31
        #   The timeout to wait for the response from a telnet command.
32
        #
33
        #   @return [Integer]
34
        attr_accessor :telnet_timeout
35

36
        # @!attribute verbosity
37
        #   Prepend code to call before checking for a user login
38
        #
39
        #   @return [Proc]
40
        attr_accessor :pre_login
41

42
        validates :banner_timeout,
43
                  presence: true,
44
                  numericality: {
45
                      only_integer:             true,
46
                      greater_than_or_equal_to: 1
47
                  }
48

49
        validates :telnet_timeout,
50
                  presence: true,
51
                  numericality: {
52
                      only_integer:             true,
53
                      greater_than_or_equal_to: 1
54
                  }
55

56
        # (see {Base#attempt_login})
57
        def attempt_login(credential)
58
          result_options = {
59
              credential: credential,
60
              host: host,
61
              port: port,
62
              protocol: 'tcp',
63
              service_name: 'telnet'
64
          }
65

66
          begin
67
            if connect_reset_safe == :refused
68
              result_options[:status] = Metasploit::Model::Login::Status::UNABLE_TO_CONNECT
69
            else
70
              if busy_message?
71
                self.sock.close unless self.sock.closed?
72
                result_options[:status] = Metasploit::Model::Login::Status::UNABLE_TO_CONNECT
73
              end
74
            end
75

76
            unless result_options[:status]
77
              if pre_login
78
                pre_login.call(self)
79
              end
80

81
              unless password_prompt?
82
                send_user(credential.public)
83
              end
84

85
              recvd_sample = @recvd.dup
86
              # Allow for slow echos
87
              1.upto(10) do
88
                recv_telnet(self.sock, 0.10) unless @recvd.nil? || password_prompt?(@recvd)
89
              end
90

91
              if password_prompt?(credential.public)
92
                send_pass(credential.private)
93

94
                # Allow for slow echos
95
                1.upto(10) do
96
                  recv_telnet(self.sock, 0.10) if @recvd == recvd_sample
97
                end
98
              end
99

100
              if login_succeeded?
101
                result_options[:status] = Metasploit::Model::Login::Status::SUCCESSFUL
102
              else
103
                result_options[:status] = Metasploit::Model::Login::Status::INCORRECT
104
              end
105

106
            end
107
          rescue ::EOFError, Errno::ECONNRESET, Rex::ConnectionError, Rex::ConnectionTimeout, ::Timeout::Error
108
            result_options[:status] = Metasploit::Model::Login::Status::UNABLE_TO_CONNECT
109
          end
110

111
          ::Metasploit::Framework::LoginScanner::Result.new(result_options)
112
        end
113

114
        private
115

116
        # This method sets the sane defaults for things
117
        # like timeouts and TCP evasion options
118
        def set_sane_defaults
119
          self.connection_timeout ||= 30
120
          self.port               ||= DEFAULT_PORT
121
          self.banner_timeout     ||= 25
122
          self.telnet_timeout     ||= 10
123
          self.pre_login          ||= nil
124
          self.connection_timeout ||= 30
125
          self.max_send_size      ||= 0
126
          self.send_delay         ||= 0
127
          # Shim to set up the ivars from the old Login mixin
128
          create_login_ivars
129
        end
130

131
        def print_error(message)
132
          return unless @parent
133
          @parent.print_error(message)
134
        end
135

136
        alias_method :print_bad, :print_error
137

138
      end
139
    end
140
  end
141
end
142

143