CoCalc provides the best real-time collaborative environment for Jupyter Notebooks, LaTeX documents, and SageMath, scalable from individual users to large groups and classes!

1
# -*- coding: binary -*-
2
module Msf
3

4
###
5
#
6
# This module provides methods for Distributed Reflective Denial of Service (DRDoS) attacks
7
#
8
###
9
module Auxiliary::DRDoS
10

11
  def initialize(info = {})
12
    super
13
    register_advanced_options(
14
      [
15
        OptAddress.new('SRCIP', [false, 'Use this source IP']),
16
        OptInt.new('NUM_REQUESTS', [false, 'Number of requests to send', 1]),
17
      ], self.class)
18
  end
19

20
  def setup
21
    super
22
    if spoofed? && datastore['NUM_REQUESTS'].to_i < 1
23
      raise Msf::OptionValidateError.new(
24
        {
25
          'NUM_REQUESTS' => 'The number of requests must be >= 1'
26
        }
27
      )
28
    end
29
  end
30

31
  def prove_amplification(response_map)
32
    vulnerable = false
33
    proofs = []
34
    response_map.each do |request, responses|
35
      responses ||= []
36
      this_proof = ''
37

38
      # compute packet amplification
39
      if responses.size > 1
40
        vulnerable = true
41
        this_proof += "#{responses.size}x packet amplification"
42
      else
43
        this_proof += 'No packet amplification'
44
      end
45

46
      this_proof += ' and '
47

48
      # compute bandwidth amplification
49
      total_size = responses.map(&:size).reduce(:+)
50
      bandwidth_amplification = total_size - request.size
51
      if bandwidth_amplification > 0
52
        vulnerable = true
53
        if request.size == 0
54
          multiplier = total_size
55
        else
56
          multiplier = total_size / request.size
57
        end
58
        this_proof += "a #{multiplier}x, #{bandwidth_amplification}-byte bandwidth amplification"
59
      else
60
        this_proof += 'no bandwidth amplification'
61
      end
62

63
      # TODO (maybe): show the request and responses in more detail?
64
      proofs << this_proof
65
    end
66

67
    [ vulnerable, proofs.join(', ') ]
68
  end
69

70
  def spoofed?
71
    !datastore['SRCIP'].nil?
72
  end
73

74
end
75
end
76

77