-
Notifications
You must be signed in to change notification settings - Fork 13.9k
/
ipmi_version.rb
77 lines (60 loc) · 1.88 KB
/
ipmi_version.rb
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
##
# This module requires Metasploit: https://metasploit.com/download
# Current source: https://github.com/rapid7/metasploit-framework
##
class MetasploitModule < Msf::Auxiliary
include Msf::Auxiliary::Report
include Msf::Auxiliary::UDPScanner
def initialize
super(
'Name' => 'IPMI Information Discovery',
'Description' => 'Discover host information through IPMI Channel Auth probes',
'Author' => [ 'Dan Farmer <zen[at]fish2.com>', 'hdm' ],
'License' => MSF_LICENSE,
'References' =>
[
['URL', 'http://fish2.com/ipmi/']
]
)
register_options(
[
Opt::RPORT(623)
])
end
def rport
datastore['RPORT']
end
def scanner_prescan(batch)
print_status("Sending IPMI requests to #{batch[0]}->#{batch[-1]} (#{batch.length} hosts)")
@res = {}
end
def scan_host(ip)
vprint_status "#{ip}:#{rport} - IPMI - Probe sent"
scanner_send(Rex::Proto::IPMI::Utils.create_ipmi_getchannel_probe, ip, rport)
end
def scanner_process(data, shost, sport)
info = Rex::Proto::IPMI::Channel_Auth_Reply.new.read(data) rescue nil
# Ignore invalid responses
return unless info
unless info.ipmi_command == 56
vprint_error "#{shost}:#{rport} - IPMI - Invalid response"
return
end
# Ignore duplicate replies
return if @res[shost]
@res[shost] ||= info
banner = info.to_banner
print_good("#{shost}:#{rport} - IPMI - #{banner}")
report_service(
:host => shost,
:port => rport,
:proto => 'udp',
:name => 'ipmi',
:info => banner
)
# Potential improvements:
# - Report a vulnerability if info.ipmi_user_anonymous has been set
# - Report a vulnerability if ipmi 2.0 and kg is set to default (almost always the case)
# - Report a vulnerability if info.ipmi_user_null has been set (null username)
end
end