##
# This module requires Metasploit: https:\/\/metasploit.com\/download
# Current source: https:\/\/github.com\/rapid7\/metasploit-framework
##<\/p>\n
class MetasploitModule < Msf::Auxiliary
include Msf::Auxiliary::Report
include Msf::Auxiliary::Scanner
include Msf::Exploit::Capture<\/p>\n
def initialize(info = {})
super(update_info(info,
‘Name’ => ‘URGENT\/11 Scanner, Based on Detection Tool by Armis’,
‘Description’ => %q{
This module detects VxWorks and the IPnet IP stack, along with devices
vulnerable to CVE-2019-12258.
},
‘Author’ => [
‘Ben Seri’, # Upstream tool
‘Brent Cook’, # Metasploit module
‘wvu’ # Metasploit module
],
‘References’ => [
[‘CVE’, ‘2019-12258’],
[‘URL’, ‘https:\/\/armis.com\/urgent11’],
[‘URL’, ‘https:\/\/github.com\/ArmisSecurity\/urgent11-detector’]],
‘DisclosureDate’ => ‘2019-08-09’, # NVD entry publication
‘License’ => MSF_LICENSE,
‘Notes’ => {‘Stability’ => [CRASH_SAFE]}
))<\/p>\n
register_options([
OptString.new(‘RPORTS’, required: true, default: “21 22 23 80 443”, desc: ‘Target ports for TCP detections’)
])<\/p>\n
register_advanced_options([
OptInt.new(‘RetransmissionRate’, required: true, default: 3, desc: ‘Send n TCP packets’)
])<\/p>\n
deregister_options(‘PCAPFILE’, ‘FILTER’)
end<\/p>\n
#
# Utility methods
#<\/p>\n
def rports
datastore[‘RPORTS’].split(\/[\\s,]\/).collect{|i| (i.to_i.to_s == i) ? i.to_i : nil}.compact
end<\/p>\n
def filter(ip)
“src host #{ip} and dst host #{Rex::Socket.source_address(ip)}”
end<\/p>\n
#
# Scanner methods
#<\/p>\n
def run_host(ip)
# XXX: Configuring Ethernet and IP headers sends a UDP packet!
@config = PacketFu::Utils.whoami?(target: ip)<\/p>\n
open_pcap
capture.setfilter(filter(ip))<\/p>\n
port_open = false
rports.each do |rport|
port_open |= run_detections(ip, rport)
end
raise RuntimeError.new(“No ports open on #{ip} from #{datastore[‘RPORTS’]}”) if !port_open
rescue RuntimeError => e
fail_with(Failure::BadConfig, e.message)
ensure
close_pcap
end<\/p>\n
def detections
%w[
tcp_dos_detection
tcp_malformed_options_detection
icmp_code_detection
icmp_timestamp_detection
]end<\/p>\n
def run_detections(ip, port)
print_status(“#{ip}:#{port} being checked”)<\/p>\n
final_ipnet_score = 0
final_vxworks_score = 0
affected_vulnerabilities = []\n
begin
sock = Rex::Socket::Tcp.create(
‘PeerHost’ => ip,
‘PeerPort’ => port
)
rescue
vprint_bad(“Could not connect to #{ip}:#{port}, cannot verify vulnerability”)
return false
end<\/p>\n
detections.each do |detection|
@ipnet_score = 0
@vxworks_score = 0
@vulnerable_cves = []\n
detection_name = detection.camelize<\/p>\n
begin
send(detection, sock, ip, port)
rescue StandardError => e
vprint_error(“#{detection_name} failed: #{e.message}”)
next
end<\/p>\n
vprint_status(
“\\t#{detection_name.ljust(30)}” \\
“\\tVxWorks: #{@vxworks_score}” \\
“\\tIPnet: #{@ipnet_score}”
)<\/p>\n
final_ipnet_score += @ipnet_score
final_vxworks_score += @vxworks_score
affected_vulnerabilities += @vulnerable_cves
end<\/p>\n
sock.close<\/p>\n
if final_ipnet_score > 0
vprint_good(“#{ip}:#{port} detected as IPnet”)
elsif final_ipnet_score < 0
vprint_error(“#{ip}:#{port} detected as NOT IPnet”)
end<\/p>\n
if final_vxworks_score > 100
vprint_good(“#{ip}:#{port} detected as VxWorks”)
elsif final_vxworks_score < 0
vprint_error(“#{ip}:#{port} detected as NOT VxWorks”)
end<\/p>\n
affected_vulnerabilities.each do |vuln|
msg = “#{ip}:#{port} affected by #{vuln}”
print_good(msg)
report_vuln(
host: ip,
name: name,
refs: references,
info: msg
)
end
true
end<\/p>\n
#
# TCP detection methods
#<\/p>\n
def tcp_malformed_options_detection(sock, ip, port)
pkt = PacketFu::TCPPacket.new(config: @config)<\/p>\n
# IP destination address
pkt.ip_daddr = ip<\/p>\n
# TCP SYN with malformed options
pkt.tcp_dst = port
pkt.tcp_flags.syn = 1
pkt.tcp_opts = [2, 4, 1460].pack(‘CCn’) + # MSS
[1].pack(‘C’) + # NOP
[3, 2].pack(‘CC’) + # WSCALE with invalid length
[3, 3, 0].pack(‘CCC’) # WSCALE with valid length
pkt.recalc<\/p>\n
res = nil<\/p>\n
datastore[‘RetransmissionRate’].times do
pkt.to_w
res = inject_reply(:tcp)<\/p>\n
break unless res
end<\/p>\n
unless res
return @vxworks_score = 0,
@ipnet_score = 50
end<\/p>\n
if res.tcp_flags.rst == 1 &&
res.tcp_dst == pkt.tcp_src && res.tcp_dst == pkt.tcp_src<\/p>\n
return @vxworks_score = 100,
@ipnet_score = 100
end<\/p>\n
return @vxworks_score = -100,
@ipnet_score = -100
end<\/p>\n
def tcp_dos_detection(sock, ip, port)
pkt = PacketFu::TCPPacket.new(config: @config)<\/p>\n
# IP destination address
pkt.ip_daddr = ip<\/p>\n
# TCP SYN with malformed (truncated) WS option
pkt.tcp_src = sock.getlocalname.last
pkt.tcp_dst = sock.peerport
pkt.tcp_seq = rand(0xffffffff + 1)
pkt.tcp_ack = rand(0xffffffff + 1)
pkt.tcp_flags.syn = 1
pkt.tcp_opts = [3, 2].pack(‘CC’) + # WSCALE with invalid length
[1, 0].pack(‘CC’) # NOP + EOL
pkt.recalc<\/p>\n
res = nil<\/p>\n
datastore[‘RetransmissionRate’].times do
pkt.to_w
res = inject_reply(:tcp)<\/p>\n
break unless res
end<\/p>\n
unless res
return @vxworks_score = 0,
@ipnet_score = 0
end<\/p>\n
if res.tcp_flags.rst == 1 &&
res.tcp_dst == pkt.tcp_src && res.tcp_dst == pkt.tcp_src<\/p>\n
return @vxworks_score = 100,
@ipnet_score = 100,
@vulnerable_cves = [‘CVE-2019-12258’]end<\/p>\n
return @vxworks_score = 0,
@ipnet_score = 0
end<\/p>\n
#
# ICMP detection methods
#<\/p>\n
def icmp_code_detection(sock, ip, _port = nil)
pkt = PacketFu::ICMPPacket.new(config: @config)<\/p>\n
# IP destination address
pkt.ip_daddr = ip<\/p>\n
# ICMP echo request with non-zero code
pkt.icmp_type = 8
pkt.icmp_code = rand(0x01..0xff)
pkt.payload = capture_icmp_echo_pack
pkt.recalc<\/p>\n
pkt.to_w
res = inject_reply(:icmp)<\/p>\n
unless res
return @ipnet_score = 0
end<\/p>\n
# Echo reply with zeroed code
if res.icmp_type == 0 && res.icmp_code == 0
return @ipnet_score = 20
end<\/p>\n
@ipnet_score = -20
end<\/p>\n
def icmp_timestamp_detection(sock, ip, _port = nil)
pkt = PacketFu::ICMPPacket.new(config: @config)<\/p>\n
# IP destination address
pkt.ip_daddr = ip<\/p>\n
# Truncated ICMP timestamp request
pkt.icmp_type = 13
pkt.icmp_code = 0
pkt.payload = “\\x00” * 4
pkt.recalc<\/p>\n
pkt.to_w
res = inject_reply(:icmp)<\/p>\n
unless res
return @ipnet_score = 0
end<\/p>\n
# Timestamp reply
if res.icmp_type == 14
return @ipnet_score = 90
end<\/p>\n
@ipnet_score = -30
end<\/p>\n
end<\/p>\n","protected":false},"excerpt":{"rendered":"
### This module requires Metasploit: https:\/\/metasploit.com\/download# Current source: https:\/\/github.com\/rapid7\/metasploit-framework## class MetasploitModule < Msf::Auxiliaryinclude Msf::Auxiliary::Reportinclude Msf::Auxiliary::Scannerinclude Msf::Exploit::Capture def initialize(info = {})super(update_info(info,‘Name’ => ‘URGENT\/11 Scanner, Based on Detection Tool by Armis’,‘Description’ => %q{This module detects VxWorks and the IPnet IP stack, along with devicesvulnerable to CVE-2019-12258.},‘Author’ => [‘Ben Seri’, # Upstream tool‘Brent Cook’, # Metasploit module‘wvu’ # …<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[26],"tags":[],"class_list":["post-59336","post","type-post","status-publish","format-standard","hentry","category-vulnerability"],"_links":{"self":[{"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/posts\/59336","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/comments?post=59336"}],"version-history":[{"count":0,"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/posts\/59336\/revisions"}],"wp:attachment":[{"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/media?parent=59336"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/categories?post=59336"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/tags?post=59336"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}