##
# This module requires Metasploit: https:\/\/metasploit.com\/download
# Current source: https:\/\/github.com\/rapid7\/metasploit-framework
##<\/p>\n
class MetasploitModule < Msf::Auxiliary
include Msf::Auxiliary::DRDoS
include Msf::Auxiliary::Report
include Msf::Auxiliary::UDPScanner<\/p>\n
def initialize
super(
‘Name’ => ‘UDP Amplification Scanner’,
‘Description’ => ‘Detect UDP endpoints with UDP amplification vulnerabilities’,
‘Author’ => ‘Jon Hart <jon_hart[at]rapid7.com>’,
‘License’ => MSF_LICENSE,
‘References’ =>
[
[‘CVE’, ‘2013-5211’], # see also scanner\/ntp\/ntp_monlist.rb
[‘URL’, ‘https:\/\/www.cisa.gov\/uscert\/ncas\/alerts\/TA14-017A’]])<\/p>\n
register_options(
[
OptString.new(‘PORTS’, [true, ‘Ports to probe’]),
OptString.new(‘PROBE’, [false, ‘UDP payload\/probe to send. Unset for an empty UDP datagram, or the `file:\/\/` resource to get content from a local file’])
])<\/p>\n
# RPORT is unused in this scanner module because it supports multiple ports
deregister_options(‘RPORT’)
end<\/p>\n
def setup
super<\/p>\n
unless (@ports = Rex::Socket.portspec_crack(datastore[‘PORTS’]))
fail_with(Failure::BadConfig, “Unable to extract list of ports from #{datastore[‘PORTS’]}”)
end<\/p>\n
@probe = datastore[‘PROBE’] ? datastore[‘PROBE’] : ”
end<\/p>\n
def scanner_prescan(batch)
print_status(“Sending #{@probe.length}-byte probes to #{@ports.length} port(s) on #{batch[0]}->#{batch[-1]} (#{batch.length} hosts)”)
@results ||= {}
end<\/p>\n
def scan_host(ip)
@ports.each do |port|
scanner_send(@probe, ip, port)
end
end<\/p>\n
# Called for each response packet, overriding UDPScanner’s so that we can
# store all responses on a per-host, per-port basis
def scanner_process(data, shost, sport)
@results[shost] ||= {}
@results[shost][sport] ||= []@results[shost][sport] << data
end<\/p>\n
def scanner_postscan(batch)
batch.each do |shost|
next unless @results.key?(shost)
@results[shost].each_pair do |sport, responses|
report_service(host: shost, port: sport, proto: ‘udp’, info: responses.inspect, state: ‘open’)
vulnerable, proof = prove_amplification(@probe => responses)
next unless vulnerable
print_good(“#{shost}:#{sport} – susceptible to UDP amplification: #{proof}”)
report_vuln(
host: shost,
port: sport,
proto: ‘udp’,
name: ‘UDP amplification’,
refs: references
)
end
end
end
end<\/p>\n","protected":false},"excerpt":{"rendered":"
### This module requires Metasploit: https:\/\/metasploit.com\/download# Current source: https:\/\/github.com\/rapid7\/metasploit-framework## class MetasploitModule < Msf::Auxiliaryinclude Msf::Auxiliary::DRDoSinclude Msf::Auxiliary::Reportinclude Msf::Auxiliary::UDPScanner def initializesuper(‘Name’ => ‘UDP Amplification Scanner’,‘Description’ => ‘Detect UDP endpoints with UDP amplification vulnerabilities’,‘Author’ => ‘Jon Hart <jon_hart[at]rapid7.com>’,‘License’ => MSF_LICENSE,‘References’ =>[[‘CVE’, ‘2013-5211’], # see also scanner\/ntp\/ntp_monlist.rb[‘URL’, ‘https:\/\/www.cisa.gov\/uscert\/ncas\/alerts\/TA14-017A’]]) register_options([OptString.new(‘PORTS’, [true, ‘Ports to probe’]),OptString.new(‘PROBE’, [false, ‘UDP payload\/probe to send. Unset for …<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[26],"tags":[],"class_list":["post-59335","post","type-post","status-publish","format-standard","hentry","category-vulnerability"],"_links":{"self":[{"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/posts\/59335","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/comments?post=59335"}],"version-history":[{"count":0,"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/posts\/59335\/revisions"}],"wp:attachment":[{"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/media?parent=59335"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/categories?post=59335"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/tags?post=59335"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}