1
##
2
# This module requires Metasploit: https://metasploit.com/download
3
# Current source: https://github.com/rapid7/metasploit-framework
4
##
5

6
class MetasploitModule < Msf::Auxiliary
7
  include Msf::Auxiliary::Report
8
  include Msf::Auxiliary::Scanner
9
  include Msf::Exploit::Remote::Udp
10

11
  def initialize
12
    super(
13
      'Name' => 'DB2 Discovery Service Detection',
14
      'Description' => 'This module simply queries the DB2 discovery service for information.',
15
      'Author' => [ 'MC' ],
16
      'License' => MSF_LICENSE,
17
      'Notes' => {
18
        'Stability' => [CRASH_SAFE],
19
        'SideEffects' => [],
20
        'Reliability' => []
21
      }
22
    )
23

24
    register_options([Opt::RPORT(523),])
25
  end
26

27
  def run_host(ip)
28
    pkt = 'DB2GETADDR' + "\x00" + 'SQL05000' + "\x00"
29

30
    connect_udp
31
    udp_sock.put(pkt)
32
    res = udp_sock.read(1024)
33

34
    unless res
35
      print_error("Unable to determine version info for #{ip}")
36
      return
37
    end
38

39
    res = res.split(/\x00/)
40

41
    product_id = res[1]
42
    node_name = res[2]
43

44
    report_note(
45
      host: ip,
46
      proto: 'udp',
47
      port: datastore['RPORT'],
48
      type: 'SERVICE_INFO',
49
      data: { service_info: "#{node_name}_#{product_id}" }
50
    )
51

52
    report_service(
53
      host: ip,
54
      port: datastore['RPORT'],
55
      proto: 'udp',
56
      name: 'ibm-db2',
57
      info: "#{node_name}_#{product_id}"
58
    )
59

60
    print_good("Host #{ip} node name is #{node_name} with a product id of #{product_id}")
61
  rescue ::Rex::ConnectionError => e
62
    vprint_error(e.message)
63
  rescue ::Errno::EPIPE => e
64
    vprint_error(e.message)
65
  ensure
66
    disconnect_udp
67
  end
68
end
69

70