1
##
2
# This module requires Metasploit: https://metasploit.com/download
3
# Current source: https://github.com/rapid7/metasploit-framework
4
##
5

6
class MetasploitModule < Msf::Auxiliary
7
  include Msf::Auxiliary::Report
8
  include Msf::Auxiliary::UDPScanner
9

10
  def initialize
11
    super(
12
      'Name' => 'IPMI Information Discovery',
13
      'Description' => 'Discover host information through IPMI Channel Auth probes',
14
      'Author' => [ 'Dan Farmer <zen[at]fish2.com>', 'hdm' ],
15
      'License' => MSF_LICENSE,
16
      'References' => [
17
        ['URL', 'http://fish2.com/ipmi/']
18
      ]
19
    )
20

21
    register_options(
22
      [
23
        Opt::RPORT(623)
24
      ]
25
    )
26
  end
27

28
  def rport
29
    datastore['RPORT']
30
  end
31

32
  def scanner_prescan(batch)
33
    print_status("Sending IPMI requests to #{batch[0]}->#{batch[-1]} (#{batch.length} hosts)")
34
    @res = {}
35
  end
36

37
  def scan_host(ip)
38
    vprint_status "#{ip}:#{rport} - IPMI - Probe sent"
39
    scanner_send(Rex::Proto::IPMI::Utils.create_ipmi_getchannel_probe, ip, rport)
40
  end
41

42
  def scanner_process(data, shost, sport)
43
    info = Rex::Proto::IPMI::Channel_Auth_Reply.new.read(data) rescue nil
44

45
    # Ignore invalid responses
46
    return unless info
47

48
    unless info.ipmi_command == 56
49
      vprint_error "#{shost}:#{rport} - IPMI - Invalid response"
50
      return
51
    end
52

53
    # Ignore duplicate replies
54
    return if @res[shost]
55

56
    @res[shost] ||= info
57

58
    banner = info.to_banner
59

60
    print_good("#{shost}:#{rport} - IPMI - #{banner}")
61

62
    report_service(
63
      :host => shost,
64
      :port => rport,
65
      :proto => 'udp',
66
      :name => 'ipmi',
67
      :info => banner
68
    )
69

70
    # Potential improvements:
71
    # - Report a vulnerability if info.ipmi_user_anonymous has been set
72
    # - Report a vulnerability if ipmi 2.0 and kg is set to default (almost always the case)
73
    # - Report a vulnerability if info.ipmi_user_null has been set (null username)
74
  end
75
end
76

77