1
##
2
# This module requires Metasploit: https://metasploit.com/download
3
# Current source: https://github.com/rapid7/metasploit-framework
4
##
5

6
class MetasploitModule < Msf::Auxiliary
7
  include Msf::Exploit::Remote::Tcp
8
  include Msf::Auxiliary::Report
9
  include Msf::Auxiliary::Scanner
10

11
  def initialize
12
    super(
13
      'Name' => 'Poison Ivy Command and Control Scanner',
14
      'Description' => %q{
15
        Enumerate Poison Ivy Command and Control (C&C) on ports 3460, 80, 8080 and 443. Adaptation of iTrust Python script.
16
      },
17
      'Author' => ['SeawolfRN'],
18
      'License' => MSF_LICENSE
19
    )
20

21
    register_options(
22
      [
23
        OptString.new('PORTS', [true, "Ports to Check", "80,8080,443,3460"]),
24
        OptInt.new('TIMEOUT', [true, "The socket connect timeout in milliseconds", 1000]),
25
        OptInt.new('CONCURRENCY', [true, "The number of concurrent ports to check per host", 10])
26
      ]
27
    )
28

29
    deregister_options('RPORT')
30
  end
31

32
  def run_host(ip)
33
    timeout = datastore['TIMEOUT'].to_i
34

35
    ports = Rex::Socket.portspec_crack(datastore['PORTS'])
36

37
    if ports.empty?
38
      raise Msf::OptionValidateError.new(['PORTS'])
39
    end
40

41
    while (ports.length > 0)
42
      t = []
43
      r = []
44
      begin
45
        1.upto(datastore['CONCURRENCY']) do
46
          this_port = ports.shift
47
          break if not this_port
48

49
          t << framework.threads.spawn("Module(#{self.refname})-#{ip}:#{this_port}", false, this_port) do |port|
50
            begin
51
              s = connect(false,
52
                          {
53
                            'RPORT' => port,
54
                            'RHOST' => ip,
55
                            'ConnectTimeout' => (timeout / 1000.0)
56
                          })
57
              r << [ip, port, "open", 'Unknown']
58
              s.puts("\x00" * 0x100, 0) # Send 0x100 zeros, wait for answer
59
              data = s.get_once(0x100) || ''
60
              if data.length == 0x100
61
                data = s.get_once(0x4) || ''
62
                if data == "\xD0\x15\x00\x00" # Signature for PIVY C&C
63
                  print_status("#{ip}:#{port} - C&C Server Found")
64
                  r << [ip, port, "open", 'Poison Ivy C&C']
65
                end
66
              end
67
            rescue ::Rex::ConnectionRefused
68
              vprint_status("#{ip}:#{port} - TCP closed")
69
              r << [ip, port, "closed", '']
70
            rescue ::Rex::ConnectionError, ::IOError, ::Timeout::Error
71
            rescue ::Rex::Post::Meterpreter::RequestError
72
              raise $!
73
            ensure
74
              disconnect(s) rescue nil
75
            end
76
          end
77
        end
78
        t.each { |x| x.join }
79
      rescue ::Timeout::Error
80
      ensure
81
        t.each { |x| x.kill rescue nil }
82
      end
83

84
      r.each do |res|
85
        report_service(:host => res[0], :port => res[1], :state => res[2], :name => res[3])
86
      end
87
    end
88
  end
89
end
90

91