1
##
2
# This module requires Metasploit: https://metasploit.com/download
3
# Current source: https://github.com/rapid7/metasploit-framework
4
##
5

6
class MetasploitModule < Msf::Auxiliary
7
  include Msf::Exploit::Remote::Tcp
8
  include Msf::Auxiliary::Report
9
  include Msf::Auxiliary::Scanner
10

11
  def initialize
12
    super(
13
      'Name' => 'Gopher gophermap Scanner',
14
      'Description' => %q(
15
        This module identifies Gopher servers, and processes the gophermap
16
        file which lists all the files on the server.
17
      ),
18
      'References' => [
19
        ['URL', 'https://sdfeu.org/w/tutorials:gopher']
20
      ],
21
      'Author' => 'h00die',
22
      'License' => MSF_LICENSE
23
    )
24

25
    register_options(
26
      [
27
        Opt::RPORT(70),
28
        OptString.new('PATH', [false, 'Path to enumerate', ''])
29
      ]
30
    )
31
  end
32

33
  TYPE_MAP = {
34
    '0' => 'Text file',
35
    '1' => 'Directory',
36
    '2' => 'CSO name server',
37
    '3' => 'Error',
38
    '4' => 'Mac HQX filer',
39
    '5' => 'PC binary',
40
    '6' => 'UNIX uuencoded file',
41
    '7' => 'Search server',
42
    '8' => 'Telnet Session',
43
    '9' => 'Binary File',
44
    'c' => 'Calendar',
45
    'e' => 'Event',
46
    'g' => 'GIF image',
47
    'h' => 'HTML',
48
    'i' => 'inline text',
49
    's' => 'Sound',
50
    'I' => 'Image',
51
    'M' => 'MIME multipart/mixed message',
52
    'T' => 'TN3270 Session'
53
  }.freeze
54

55
  def get_type(char)
56
    TYPE_MAP.fetch(char.chomp)
57
  end
58

59
  def run_host(ip)
60
    begin
61
      connect
62
      sock.put("#{datastore['path']}\r\n")
63
      gophermap = sock.get_once
64
      if gophermap
65
        gophermap.split("\r\n").each do |line|
66
          line_parts = line.split("\t")
67
          next unless line_parts.length >= 2
68

69
          # syntax: [type_character]description[tab]path[tab, after this is optional]server[tab]port
70
          line_parts = line.split("\t")
71
          desc = line_parts[0]
72
          type_char = desc.slice!(0) # remove first character which is the file type
73
          file_type = get_type(type_char)
74
          if file_type && file_type == 'inline text'
75
            print_good(desc)
76
            next
77
          end
78
          if file_type
79
            print_good("  #{file_type}: #{desc}")
80
          else
81
            print_good("  Invalid File Type (#{type_char}): #{desc}")
82
          end
83
          if line_parts.length >= 3
84
            print_good("    Path: #{line_parts[2]}:#{line_parts[3]}#{line_parts[1]}")
85
          elsif line.length >= 2
86
            print_good("    Path: #{line_parts[2]}#{line_parts[1]}")
87
          else
88
            print_good("    Path: #{line_parts[1]}")
89

90
          end
91
        end
92
        report_service(host: ip, port: rport, service: 'gopher', info: gophermap)
93
      else
94
        print_error('No gophermap')
95
      end
96
    rescue ::Rex::ConnectionError, ::IOError, ::Errno::ECONNRESET
97
    rescue ::Exception => e
98
      print_error("#{ip}: #{e} #{e.backtrace}")
99
    ensure
100
      disconnect
101
    end
102
  end
103
end
104

105