##
# This module requires Metasploit: https:\/\/metasploit.com\/download
# Current source: https:\/\/github.com\/rapid7\/metasploit-framework
##<\/p>\n
class MetasploitModule < Msf::Auxiliary
include Msf::Auxiliary::Report
include Msf::Auxiliary::UDPScanner
include Msf::Auxiliary::DRDoS<\/p>\n
def initialize
super(
‘Name’ => ‘Portmapper Amplification Scanner’,
‘Description’ => %q{
This module can be used to discover Portmapper services which can be used in an
amplification DDoS attack against a third party.
},
‘Author’ => [‘xistence <xistence[at]0x90.nl>’],
‘License’ => MSF_LICENSE,
‘References’ =>
[
[‘CVE’, ‘2013-5211’], # see also scanner\/ntp\/ntp_monlist.rb
[‘URL’, ‘https:\/\/www.cisa.gov\/uscert\/ncas\/alerts\/TA14-017A’],
[‘URL’, ‘http:\/\/blog.level3.com\/security\/a-new-ddos-reflection-attack-portmapper-an-early-warning-to-the-industry\/’]],
)<\/p>\n
register_options( [
Opt::RPORT(111),
])
end<\/p>\n
def rport
datastore[‘RPORT’]end<\/p>\n
def xid_summary
@xid_summary ||= [Rex::Text::rand_text_numeric(8).to_i].pack(‘N’)
end<\/p>\n
def xid_dump
@xid_dump ||= [Rex::Text::rand_text_numeric(8).to_i].pack(‘N’)
end<\/p>\n
def xid_metrics
@xid_metrics ||= [Rex::Text::rand_text_numeric(8).to_i].pack(‘N’)
end<\/p>\n
def setup
super<\/p>\n
# RPC DUMP (Program version: 3) request: rpcinfo -T udp -s <IP>
@portmap_summary = ”
@portmap_summary << xid_summary # Random ID
@portmap_summary << “\\x00\\x00\\x00\\x00” # Message Type: 0 (Call)
@portmap_summary << “\\x00\\x00\\x00\\x02” # RPC Version: 2
@portmap_summary << “\\x00\\x01\\x86\\xa0” # Program: Portmap (10000)
@portmap_summary << “\\x00\\x00\\x00\\x03” # Program version: 3
@portmap_summary << “\\x00\\x00\\x00\\x04” # Procedure: DUMP (4)
@portmap_summary << “\\x00\\x00\\x00\\x00” # Credentials Flavor: AUTH_NULL (0)
@portmap_summary << “\\x00\\x00\\x00\\x00” # Credentials Length: 0
@portmap_summary << “\\x00\\x00\\x00\\x00” # Verifier Flavor: AUTH_NULL (0)
@portmap_summary << “\\x00\\x00\\x00\\x00” # Verifier Length: 0<\/p>\n
# RPC DUMP (Program version: 2) request: rpcinfo -T udp -p <IP>
@portmap_dump = ”
@portmap_dump << xid_dump # Random ID
@portmap_dump << “\\x00\\x00\\x00\\x00” # Message Type: 0 (Call)
@portmap_dump << “\\x00\\x00\\x00\\x02” # RPC Version: 2
@portmap_dump << “\\x00\\x01\\x86\\xa0” # Program: Portmap (10000)
@portmap_dump << “\\x00\\x00\\x00\\x02” # Program version: 2
@portmap_dump << “\\x00\\x00\\x00\\x04” # Procedure: DUMP (4)
@portmap_dump << “\\x00\\x00\\x00\\x00” # Credentials Flavor: AUTH_NULL (0)
@portmap_dump << “\\x00\\x00\\x00\\x00” # Credentials Length: 0
@portmap_dump << “\\x00\\x00\\x00\\x00” # Verifier Flavor: AUTH_NULL (0)
@portmap_dump << “\\x00\\x00\\x00\\x00” # Verifier Length: 0<\/p>\n
# RPC GETSTAT request: rpcinfo -T udp -m <IP>
@portmap_metrics = ”
@portmap_metrics << xid_metrics # Random ID
@portmap_metrics << “\\x00\\x00\\x00\\x00” # Message Type: 0 (Call)
@portmap_metrics << “\\x00\\x00\\x00\\x02” # RPC Version: 2
@portmap_metrics << “\\x00\\x01\\x86\\xa0” # Program: Portmap (10000)
@portmap_metrics << “\\x00\\x00\\x00\\x04” # Program version: 4
@portmap_metrics << “\\x00\\x00\\x00\\x0c” # Procedure: GETSTAT (12)
@portmap_metrics << “\\x00\\x00\\x00\\x00” # Credentials Flavor: AUTH_NULL (0)
@portmap_metrics << “\\x00\\x00\\x00\\x00” # Credentials Length: 0
@portmap_metrics << “\\x00\\x00\\x00\\x00” # Verifier Flavor: AUTH_NULL (0)
@portmap_metrics << “\\x00\\x00\\x00\\x00” # Verifier Length: 0
end<\/p>\n
def scanner_prescan(batch)
print_status(“Sending Portmap RPC probes to #{batch[0]}->#{batch[-1]} (#{batch.length} hosts)”)
@results_summary = {}
@results_dump = {}
@results_metrics = {}
end<\/p>\n
def scan_host(ip)
if spoofed?
datastore[‘ScannerRecvWindow’] = 0
scanner_spoof_send(@portmap_summary, ip, rport, datastore[‘SRCIP’], datastore[‘NUM_REQUESTS’])
scanner_spoof_send(@portmap_dump, ip, rport, datastore[‘SRCIP’], datastore[‘NUM_REQUESTS’])
scanner_spoof_send(@portmap_metrics, ip, rport, datastore[‘SRCIP’], datastore[‘NUM_REQUESTS’])
else
scanner_send(@portmap_summary, ip, rport)
scanner_send(@portmap_dump, ip, rport)
scanner_send(@portmap_metrics, ip, rport)
end
end<\/p>\n
def scanner_process(data, shost, sport)
if data =~ \/#{@xid_summary}\\x00\\x00\\x00\\x01\/
@results_summary[shost] ||= []@results_summary[shost] << data
elsif data =~ \/#{@xid_metrics}\\x00\\x00\\x00\\x01\/
@results_metrics[shost] ||= []@results_metrics[shost] << data
elsif data =~ \/#{@xid_dump}\\x00\\x00\\x00\\x01\/
@results_dump[shost] ||= []@results_dump[shost] << data
else
vprint_error(“Skipping #{data.size}-byte non-Portmap response from #{shost}:#{sport}”)
end
end<\/p>\n
# Called after the scan block
def scanner_postscan(batch)
@results_summary.keys.each do |k|
response_map_summary = { @portmap_summary => @results_summary[k] }
what = ‘Portmap RPC DUMP (Program version: 3) amplification’
report_result(k, what, response_map_summary)
end<\/p>\n
@results_dump.keys.each do |k|
response_map_dump = { @portmap_dump => @results_dump[k] }
what = ‘Portmap RPC DUMP (Program version: 2) amplification’
report_result(k, what, response_map_dump)
end<\/p>\n
@results_metrics.keys.each do |k|
response_map_metrics = { @portmap_summary => @results_metrics[k] }
what = ‘Portmap RPC GETSTAT amplification’
report_result(k, what, response_map_metrics)
end
end<\/p>\n
def report_result(host, attack, map)
report_service(
host: host,
proto: ‘udp’,
port: rport,
name: ‘portmap’
)<\/p>\n
peer = “#{host}:#{rport}”
vulnerable, proof = prove_amplification(map)
if vulnerable
print_good(“#{peer} – Vulnerable to #{attack}: #{proof}”)
report_vuln(
host: host,
port: rport,
proto: ‘udp’,
name: attack,
refs: references
)
else
vprint_status(“#{peer} – Not vulnerable to #{attack}: #{proof}”)
end
end
end<\/p>\n","protected":false},"excerpt":{"rendered":"
### This module requires Metasploit: https:\/\/metasploit.com\/download# Current source: https:\/\/github.com\/rapid7\/metasploit-framework## class MetasploitModule < Msf::Auxiliaryinclude Msf::Auxiliary::Reportinclude Msf::Auxiliary::UDPScannerinclude Msf::Auxiliary::DRDoS def initializesuper(‘Name’ => ‘Portmapper Amplification Scanner’,‘Description’ => %q{This module can be used to discover Portmapper services which can be used in anamplification DDoS attack against a third party.},‘Author’ => [‘xistence <xistence[at]0x90.nl>’],‘License’ => MSF_LICENSE,‘References’ =>[[‘CVE’, ‘2013-5211’], # see also scanner\/ntp\/ntp_monlist.rb[‘URL’, …<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[26],"tags":[],"class_list":["post-59379","post","type-post","status-publish","format-standard","hentry","category-vulnerability"],"_links":{"self":[{"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/posts\/59379","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/comments?post=59379"}],"version-history":[{"count":0,"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/posts\/59379\/revisions"}],"wp:attachment":[{"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/media?parent=59379"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/categories?post=59379"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/tags?post=59379"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}