Path: blob/master/modules/auxiliary/scanner/misc/sunrpc_portmapper.rb
19516 views
##1# This module requires Metasploit: https://metasploit.com/download2# Current source: https://github.com/rapid7/metasploit-framework3##45class MetasploitModule < Msf::Auxiliary6include Msf::Exploit::Remote::SunRPC7include Msf::Auxiliary::Report8include Msf::Auxiliary::Scanner910def initialize11super(12'Name' => 'SunRPC Portmap Program Enumerator',13'Description' => '14This module calls the target portmap service and enumerates all program15entries and their running port numbers.16',17'Author' => ['<tebo[at]attackresearch.com>'],18'References' => [19['URL', 'https://www.ietf.org/rfc/rfc1057.txt']20],21'License' => MSF_LICENSE22)2324register_options([25OptEnum.new('PROTOCOL', [true, 'Protocol to use', 'tcp', %w[tcp udp]]),26])27end2829def run_host(ip)30peer = "#{ip}:#{rport}"31proto = datastore['PROTOCOL']32vprint_status "SunRPC - Enumerating programs"3334begin35program = 10000036progver = 237procedure = 43839sunrpc_create(proto, program, progver)40sunrpc_authnull41resp = sunrpc_call(procedure, "")4243progs = resp[3, 1].unpack('C')[0]44maps = []45if (progs == 0x01)46while Rex::Encoder::XDR.decode_int!(resp) == 147maps << Rex::Encoder::XDR.decode!(resp, Integer, Integer, Integer, Integer)48end49end50sunrpc_destroy51return if maps.empty?5253vprint_good("Found #{maps.size} programs available")5455table = Rex::Text::Table.new(56'Header' => "SunRPC Programs for #{ip}",57'Indent' => 1,58'Columns' => %w(Name Number Version Port Protocol)59)6061maps.each do |map|62prog, vers, prot_num, port = map[0, 4]63thing = "RPC Program ##{prog} v#{vers} on port #{port} w/ protocol #{prot_num}"64if prot_num == 0x0665proto = 'tcp'66elsif prot_num == 0x1167proto = 'udp'68else69print_error("#{peer}: unknown protocol number for #{thing}")70next71end7273resolved = progresolv(prog)74table << [ resolved, prog, vers, port, proto ]75report_service(76host: ip,77port: port,78proto: proto,79name: resolved,80info: "Prog: #{prog} Version: #{vers} - via portmapper"81)82end8384print_good(table.to_s)85rescue ::Rex::Proto::SunRPC::RPCTimeout, ::Rex::Proto::SunRPC::RPCError => e86vprint_error(e.to_s)87end88end89end909192