Auxiliary Module auxiliary/scanner/dcerpc/hidden is not iterating through all endpoints

[bka-dev]

Hello,

I discovered a little bug in module /auxiliary/scanner/dcerpc/hidden

To list hidden RPC endpoints, I tried executing this module against my target system.
Some of the endpoints are available, others are not reachable from my system which would result in a timeout.

Turns out, that the auxiliary module terminates as soon as it hits an endpoint, that is either not reachable, or denies the access to it. Instead of terminating it should try the next discovered endpoint.

Expected behavior

resource (rpc_hidden.conf)> use auxiliary/scanner/dcerpc/hidden
resource (rpc_hidden.conf)> set rhosts TARGET
resource (rpc_hidden.conf)> run
[*] TARGET:         - Connecting to the endpoint mapper service...
[*] TARGET:         - Looking for services on TARGET:49152...
[*] TARGET:         - Remote Management Interface Error: The connection timed out (TARGET:49152).
[*] TARGET:         - Looking for services on TARGET:49159...
[*] TARGET:         - Remote Management Interface Error: The connection timed out (TARGET:49159).
[*] TARGET:         - Looking for services on TARGET:49158...
[*] TARGET:         -     HIDDEN: UUID 00000134-0000-0000-c000-000000000046 v0.0 
[*] TARGET:         -             CONN BIND ERROR=DCERPC FAULT => nca_s_fault_access_denied
[*] TARGET:         -
[*] TARGET:         -     HIDDEN: UUID 18f70770-8e64-11cf-9af1-0020af6e72f4 v0.0 
[*] TARGET:         -             CONN BIND ERROR=DCERPC FAULT => nca_s_fault_access_denied
[*] TARGET:         -
[*] TARGET:         -     HIDDEN: UUID 00000131-0000-0000-c000-000000000046 v0.0 
[*] TARGET:         -             CONN BIND ERROR=DCERPC FAULT => nca_s_fault_access_denied
[*] TARGET:         -
[*] TARGET:         -     HIDDEN: UUID 00000143-0000-0000-c000-000000000046 v0.0 
[*] TARGET:         -             CONN BIND ERROR=DCERPC FAULT => nca_s_fault_access_denied
[*] TARGET:         -
[*] TARGET:         - Looking for services on TARGET:49157...
[*] TARGET:         -     HIDDEN: UUID 41208ee0-e970-11d1-9b9e-00e02c064c39 v1.0 
[*] TARGET:         -             CONN BIND ERROR=DCERPC FAULT => nca_s_fault_access_denied
[*] TARGET:         -
[*] TARGET:         -     HIDDEN: UUID fc13257d-5567-4dea-898d-c6f9c48415a0 v1.0
[*] TARGET:         -             CONN BIND ERROR=DCERPC FAULT => nca_s_fault_access_denied
[*] TARGET:         -
[*] TARGET:         -     HIDDEN: UUID 00000134-0000-0000-c000-000000000046 v0.0
[*] TARGET:         -             CONN BIND ERROR=DCERPC FAULT => nca_s_fault_access_denied
[...]
[*] Scanned 1 of 1 hosts (100% complete)
[*] Auxiliary module execution completed

Current behavior

resource (rpc_hidden.conf)> use auxiliary/scanner/dcerpc/hidden
resource (rpc_hidden.conf)> set rhosts TARGET
rhosts => TARGET
resource (rpc_hidden.conf)> run
[*] TARGET:         - Connecting to the endpoint mapper service...
[*] TARGET:         - Looking for services on TARGET:49152...
[*] TARGET:         - Remote Management Interface Error: The connection timed out (TARGET:49152).
[*] Scanned 1 of 1 hosts (100% complete)
[*] Auxiliary module execution completed

Affected Code Lines

The issue is caused by the following line (hidden.rb:58):

return if not ids

When no interface identifiers are returned for the current endpoint, the function returns, rather than moving to the next discovered endpoint.

Proposed Fix

The affected line above could be replaced by the following line, to move to the next iteration step rather than terminating after the current endpoint threw an error:

next if not ids

Environment

Metasploit version

Framework: 4.16.29-dev-8de760f
Console : 4.16.29-dev-8de760f

OS

Metasploit installed in Docker Container (Alpine Linux 3.4) via git.

References

[1] https://www.rapid7.com/db/modules/auxiliary/scanner/dcerpc/hidden
[2] https://github.com/rapid7/metasploit-framework/blob/master/modules/auxiliary/scanner/dcerpc/hidden.rb#L58

[void-in]

Can you generate a pull request for the fix?

[bka-dev]

Sure, just created the request here: Pull #9359

[bka-dev]

Pull request was merged into master and was therefore closed. So this issue can be closed as well.