/
rogue_send.rb
67 lines (57 loc) · 1.99 KB
/
rogue_send.rb
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
##
# This module requires Metasploit: https://metasploit.com/download
# Current source: https://github.com/rapid7/metasploit-framework
##
class MetasploitModule < Msf::Auxiliary
include Msf::Exploit::Capture
include Msf::Auxiliary::Scanner
def initialize
super(
'Name' => 'Rogue Gateway Detection: Sender',
'Description' => %q{
This module send a series of TCP SYN and ICMP ECHO requests
to each internal target host, spoofing the source address of an external
system running the rogue_recv module. This allows the system running
the rogue_recv module to determine what external IP a given internal
system is using as its default route.
},
'Author' => 'hdm',
'License' => MSF_LICENSE
)
register_options([
OptAddress.new("EHOST", [true, "The IP address of the machine running rogue_recv"]),
OptPort.new("RPORT", [true, "The destination port for the TCP SYN packet", 80]),
OptPort.new("CPORT", [true, "The source port for the TCP SYN packet", 13832]),
OptInt.new("ECHOID", [true, "The unique ICMP ECHO ID to embed into the packet", 7893]),
])
deregister_options('FILTER','PCAPFILE')
end
def run_host(ip)
open_pcap
pcap = self.capture
capture_sendto(build_tcp_syn(ip), ip) and capture_sendto(build_icmp(ip), ip)
close_pcap
end
def build_tcp_syn(dst)
p = PacketFu::TCPPacket.new
p.ip_saddr = datastore['EHOST']
p.ip_daddr = dst
p.ip_ttl = 255
p.tcp_sport = datastore['CPORT'].to_i
p.tcp_dport = datastore['RPORT'].to_i
p.tcp_flags.syn = 1
p.tcp_seq = Rex::Socket.addr_atoi(dst)
p.recalc
p
end
def build_icmp(dst)
p = PacketFu::ICMPPacket.new
p.ip_saddr = datastore['EHOST']
p.ip_daddr = dst
p.ip_ttl = 255
p.icmp_type = 8
payload = Rex::Socket.addr_aton(dst) + [datastore['ECHOID']].pack('n') + Rex::Text.rand_text(26)
p.payload = capture_icmp_echo_pack(datastore['ECHOID'],1,payload)
p.recalc
end
end