Real-time collaboration for Jupyter Notebooks, Linux Terminals, LaTeX, VS Code, R IDE, and more,
all in one place.
Real-time collaboration for Jupyter Notebooks, Linux Terminals, LaTeX, VS Code, R IDE, and more,
all in one place.
Path: blob/master/modules/auxiliary/scanner/gprs/gtp_echo.rb
Views: 11784
##1# This module requires Metasploit: https://metasploit.com/download2# Current source: https://github.com/rapid7/metasploit-framework3##45class MetasploitModule < Msf::Auxiliary6include Msf::Auxiliary::Report7include Msf::Auxiliary::UDPScanner89def initialize10super(11'Name' => 'GTP Echo Scanner',12'Description' => %q{13This module sends UDP GTP (GTP-U) echo requests to the target RHOSTS and14reports on which ones respond, thus identifying General Packet Radio15Service (GPRS) servers. This module does not support scanning with SCTP.16},17'References' =>18[19['URL', 'https://insinuator.net/tag/gtp/'],20['URL', 'https://www.etsi.org/deliver/etsi_ts/129200_129299/129281/08.00.00_60/ts_129281v080000p.pdf']21],22'Author' =>23[24'Daniel Mende', # original gtp-scan.py script25'Spencer McIntyre' # metasploit module26],27'License' => MSF_LICENSE28)2930register_options([31OptEnum.new('VERSION', [ true, 'The GTP version to use', '1', ['1', '2'] ]),32Opt::RPORT(2152)33])34end3536class GTPv1 < BinData::Record37endian :big3839default_parameter version: 140default_parameter protocol_type: 141default_parameter has_next_extension_header: 042default_parameter has_sequence_number: 043default_parameter has_n_pdu_number: 044default_parameter message_type: 045default_parameter data: ""4647# header48bit3 :version, :initial_value => :version49bit1 :protocol_type, :initial_value => :protocol_type50bit1 :reserved51bit1 :has_next_extension_header, :initial_value => :has_next_extension_header52bit1 :has_sequence_number, :initial_value => :has_sequence_number53bit1 :has_n_pdu_number, :initial_value => :has_n_pdu_number54uint8 :message_type, :initial_value => :message_type55uint16 :len, :value => :calc_length56uint32 :teid5758# body59uint16 :sequence_number, onlyif: -> { has_sequence_number.nonzero? }60uint8 :n_pdu_number, onlyif: -> { has_n_pdu_number.nonzero? }61uint8 :next_extension_header_type, onlyif: -> { has_next_extension_header.nonzero? }62string :data, :initial_value => :data, :read_length => :calc_length_read6364def calc_length65length = data.length66length += 2 if has_sequence_number.nonzero?67length += 1 if has_n_pdu_number.nonzero?68length += 1 if has_next_extension_header.nonzero?69length70end7172def calc_length_read73length = len74length -= 2 if has_sequence_number.nonzero?75length -= 1 if has_n_pdu_number.nonzero?76length -= 1 if has_next_extension_header.nonzero?77length78end79end8081class GTPv1EchoRequest < GTPv182default_parameter has_sequence_number: 183default_parameter message_type: 184end8586class GTPv2 < BinData::Record87endian :big8889default_parameter version: 290default_parameter piggybacking: 091default_parameter message_priority: 092default_parameter message_type: 093default_parameter data: ""9495# header96bit3 :version, :initial_value => :version97bit1 :piggybacking, :initial_value => :piggybacking98bit1 :has_teid99bit1 :message_priority, :initial_value => :message_priority100uint8 :message_type, :initial_value => :message_type101uint16 :len, :value => :calc_length102103# body104uint32 :teid, onlyif: -> { has_teid.nonzero? }105uint24 :sequence_number106uint8 :spare107string :data, :initial_value => :data, :read_length => :calc_length_read108109def calc_length110length = data.length + 4111length += 4 if has_teid.nonzero?112length113end114115def calc_length_read116length = len - 4117length -= 4 if has_teid.nonzero?118length119end120end121122class GTPv2EchoRequest < GTPv2123default_parameter message_type: 1124end125126def build_probe127# the tunnel endpoint identifier (TEID) field must be 0 for echo requests128# per the specification129if datastore['VERSION'] == '1'130@probe = GTPv1EchoRequest.new.to_binary_s131else132@probe = GTPv2EchoRequest.new.to_binary_s133end134end135136def scanner_postscan(batch)137@results.each do |rhost, data|138next unless data.length == 1139data = data[0]140141if datastore['VERSION'] == '1'142gtp = GTPv1143else144gtp = GTPv2145end146begin147response = gtp.read(data)148rescue EOFError149next150end151152if datastore['VERSION'] == '1'153next unless response.version == 1154next unless response.teid == 0155else156next unless response.version == 2157next unless response.sequence_number == 0158end159160peer = "#{rhost}:#{rport}"161print_good("GTP v#{datastore['VERSION']} echo response received from: #{peer}")162163report_service(164:host => rhost,165:proto => 'udp',166:port => rport,167:name => 'gtp'168)169end170end171end172173174