CoCalc provides the best real-time collaborative environment for Jupyter Notebooks, LaTeX documents, and SageMath, scalable from individual users to large groups and classes!

1
##
2
# This module requires Metasploit: https://metasploit.com/download
3
# Current source: https://github.com/rapid7/metasploit-framework
4
##
5

6
class MetasploitModule < Msf::Auxiliary
7
  include Msf::Exploit::Remote::Tcp
8
  include Msf::Auxiliary::Report
9
  include Msf::Auxiliary::Scanner
10

11
  def initialize
12
    super(
13
      'Name'        => 'Poison Ivy Command and Control Scanner',
14
      'Description' => %q{
15
        Enumerate Poison Ivy Command and Control (C&C) on ports 3460, 80, 8080 and 443. Adaptation of iTrust Python script.
16
      },
17
      'Author'      => ['SeawolfRN'],
18
      'License'     => MSF_LICENSE
19
    )
20

21
    register_options(
22
    [
23
      OptString.new('PORTS', [true, "Ports to Check","80,8080,443,3460"]),
24
      OptInt.new('TIMEOUT', [true, "The socket connect timeout in milliseconds", 1000]),
25
      OptInt.new('CONCURRENCY', [true, "The number of concurrent ports to check per host", 10])
26
    ])
27

28
    deregister_options('RPORT')
29

30
  end
31

32

33
  def run_host(ip)
34

35
    timeout = datastore['TIMEOUT'].to_i
36

37
    ports = Rex::Socket.portspec_crack(datastore['PORTS'])
38

39
    if ports.empty?
40
      raise Msf::OptionValidateError.new(['PORTS'])
41
    end
42

43
    while(ports.length > 0)
44
      t = []
45
      r = []
46
      begin
47
      1.upto(datastore['CONCURRENCY']) do
48
        this_port = ports.shift
49
        break if not this_port
50
        t << framework.threads.spawn("Module(#{self.refname})-#{ip}:#{this_port}", false, this_port) do |port|
51
          begin
52
            s = connect(false,
53
              {
54
                'RPORT' => port,
55
                'RHOST' => ip,
56
                'ConnectTimeout' => (timeout / 1000.0)
57
              }
58
            )
59
            r << [ip,port,"open",'Unknown']
60
            s.puts("\x00"*0x100,0) #Send 0x100 zeros, wait for answer
61
            data = s.get_once(0x100) || ''
62
            if data.length == 0x100
63
              data = s.get_once(0x4) || ''
64
              if data == "\xD0\x15\x00\x00" #Signature for PIVY C&C
65
                print_status("#{ip}:#{port} - C&C Server Found")
66
                r << [ip,port,"open",'Poison Ivy C&C']
67
              end
68
            end
69
          rescue ::Rex::ConnectionRefused
70
            vprint_status("#{ip}:#{port} - TCP closed")
71
            r << [ip,port,"closed",'']
72
          rescue ::Rex::ConnectionError, ::IOError, ::Timeout::Error
73
          rescue ::Rex::Post::Meterpreter::RequestError
74
            raise $!
75
          ensure
76
            disconnect(s) rescue nil
77
          end
78
        end
79
      end
80
      t.each {|x| x.join }
81

82
      rescue ::Timeout::Error
83
      ensure
84
        t.each {|x| x.kill rescue nil }
85
      end
86

87
      r.each do |res|
88
        report_service(:host => res[0], :port => res[1], :state => res[2], :name=> res[3])
89
      end
90
    end
91
  end
92
end
93

94