1
##
2
# This module requires Metasploit: https://metasploit.com/download
3
# Current source: https://github.com/rapid7/metasploit-framework
4
##
5

6
require 'English'
7
class MetasploitModule < Msf::Auxiliary
8

9
  # Exploit mixins should be called first
10
  include Msf::Exploit::Remote::DCERPC
11

12
  include Msf::Auxiliary::Report
13

14
  # Scanner mixin should be near last
15
  include Msf::Auxiliary::Scanner
16

17
  def initialize
18
    super(
19
      'Name' => 'Endpoint Mapper Service Discovery',
20
      'Description' => %q{
21
        This module can be used to obtain information from the
22
        Endpoint Mapper service.
23
      },
24
      'Author' => 'hdm',
25
      'License' => MSF_LICENSE,
26
      'Notes' => {
27
        'Stability' => [CRASH_SAFE],
28
        'SideEffects' => [],
29
        'Reliability' => []
30
      }
31
    )
32

33
    register_options(
34
      [
35
        Opt::RPORT(135)
36
      ]
37
    )
38
  end
39

40
  # Obtain information about a single host
41
  def run_host(ip)
42
    ids = dcerpc_endpoint_list
43
    return unless ids
44

45
    name = nil
46
    ids.each do |id|
47
      next if !id[:prot]
48

49
      line = "#{id[:uuid]} v#{id[:vers]} "
50
      line << "#{id[:prot].upcase} "
51
      line << "(#{id[:port]}) " if id[:port]
52
      line << "(#{id[:pipe]}) " if id[:pipe]
53
      line << "#{id[:host]} " if id[:host]
54
      line << "[#{id[:note]}]" if id[:note]
55
      print_status(line)
56
      if id[:host] && (id[:host][0, 2] == '\\\\')
57
        name = id[:host][2..]
58
      end
59
      next unless (id[:prot].downcase == 'tcp') || (id[:prot].downcase == 'udp')
60

61
      report_service(
62
        host: ip,
63
        port: id[:port],
64
        proto: id[:prot].downcase,
65
        name: 'dcerpc',
66
        info: "#{id[:uuid]} v#{id[:vers]} #{id[:note]}"
67
      )
68
    end
69

70
    report_host(host: ip, name: name) if name
71
    report_service(
72
      host: ip,
73
      port: rport,
74
      proto: 'tcp',
75
      name: 'dcerpc',
76
      info: "Endpoint Mapper (#{ids.length} services)"
77
    )
78
  rescue ::Interrupt
79
    raise $ERROR_INFO
80
  rescue ::Rex::Proto::DCERPC::Exceptions::Fault => e
81
    vprint_error("#{ip}:#{rport} error: #{e}")
82
  rescue StandardError => e
83
    print_error("#{ip}:#{rport} error: #{e}")
84
  end
85
end
86

87