Proposed fix for #4305

[jhart-r7]

Instead of sending a probe to a random host in 177/8 to attempt to see what the source and destination MACs are (and, in turn, what the Capture module should use when using capture_sendto), this PR makes this process send a random UDP probe to www.metasploit.com but with a TTL of 1, thereby ensuring that it shouldn't make it past the first hop, if at all. It also makes the probe host and port configurable, and cleans up the "secret".

Note that this is a diff against master but has the fix for #4306 from #4311 merged in. Once #4311 is landed this should update.

Defect and Fix Validation

Note that these steps can be used to both confirm that the defect is fixed but also to demonstrate the defect in the first place by running against a parent revision:

• use exploits/multi/ids/snort_dce_rpc, set an RHOST for a live host in the same broadcast domain. Run. Confirm that no UDP traffic is sent to 177/8 and that the only traffic caused by this module is an ARP lookup for the RHOST followed by a single 139/TCP packet, and that the source MAC is from the system running msf and that the destination MAC is RHOST's.
• `use exploits/multi/ids/snort_dce_rpc, set anRHOST`` for a live host NOT in the same broadcast domain. Run. Confirm that no UDP traffic is sent to 177/8. Confirm that a random UDP datagram is sent to www.metasploit.com with a TTL of 1, and that the source MAC is from the system running msf and that the destination MAC is the default gateway's.
• Redo test #1 and Add osvdb ref #2 but with an explicitly set INTERFACE on a system with multiple interfaces. Overkill?

[todb-r7]

Oops:

todb@mazikeen:~/git/rapid7/metasploit-framework$ ./msfconsole -L
/home/todb/git/rapid7/metasploit-framework/lib/msf/core/exploit/mixins.rb:69:in `require': /home/todb/git/rapid7/metasploit-framework/lib/msf/core/exploit/capture.rb:46: syntax error, unexpected tCONSTANT, expecting ']' (SyntaxError)
            OptPort.new('GATEWAY_PROBE_PORT',
                   ^

One sec @jhart-r7

[todb-r7]

Hmm that's no bueno:

msf > use exploits/multi/ids/snort_dce_rpc
msf exploit(snort_dce_rpc) > set RHOST 10.x.x.x
RHOST => 10.x.x.x
msf exploit(snort_dce_rpc) > show missing

Module options (exploit/multi/ids/snort_dce_rpc):

   Name  Current Setting  Required  Description
   ----  ---------------  --------  -----------

msf exploit(snort_dce_rpc) > exploit

[-] Exploit failed: The following options failed to validate: SECRET.
msf exploit(snort_dce_rpc) > 

Wonder what's wrong with SECRET...

[jhart-r7]

Sorry for that, @todb-r7. I made the changes in 52851d5 with only a reload. They have been fixed.

[todb-r7]

ah you got it @jhart-r7

[todb-r7]

Looks good, verified with tcpdump command tcpdump -nXXvvi wlan0 host 208.118.227.10 or host 208.118.237.137 or net 177.0.0.0/8