Add additional timing options to snmp_login scanner

[Meatballs1]

#4718

Set the default retries to 0.
Reduce the timeout to 2s.
Still scan both v1 and v2c, but give the option to scan only one.

[Meatballs1]

Note used 'all' incase v3 is supported in future etc ;)

[hdm]

1s timeout is too low for slow embedded devices over the internet fwiw

[hdm]

The fix for this is probably a rewrite of LoginScanner to format the SNMP by hand, as opposed to using the sluggish SNMP::Manager interface.

[hdm]

It takes almost no time to send 3 probes (v1/v2/v3/etc) to a single host and then listen for any reason at a scan level (via the UDPScanner mixin)

[hdm]

Another issue with the LoginScanner, its Rex::Socket create call doesn't pass in the framework context, which means pivoting is ignored.

[Meatballs1]

I thought UDP pivoting wasn't implemented yet anyway?

Could add it, but framework doesn't exist within the metasploit/framework context, so would have to work out how to go about getting a reference :/

[Meatballs1]

It doesn't look like any login scanner would be Rex proxy compatible:

lib/metasploit/./framework/tcp/client.rb

 84           nsock = Rex::Socket::Tcp.create(
 85               'PeerHost'   =>  opts['RHOST'] || rhost,
 86               'PeerPort'   => (opts['RPORT'] || rport).to_i,
 87               'LocalHost'  =>  opts['CHOST'] || chost || "0.0.0.0",
 88               'LocalPort'  => (opts['CPORT'] || cport || 0).to_i,
 89               'SSL'        =>  dossl,
 90               'SSLVersion' =>  opts['SSLVersion'] || ssl_version,
 91               'Proxies'    => proxies,
 92               'Timeout'    => (opts['ConnectTimeout'] || connection_timeout || 10).to_i
 93               )

[hdm]

Unbound sockets wouldn't be pivotable, but bound ones are and work fine through meterpreter. I filed a ticket for the issue above and will PR something over soon.

[limhoff-r7]

YARD has advised that @!attribute is not meant to be used on attr_*. Use comments directly instead:

# The number of retries
#
# @return [Fixnum]
attr_accessor :retries

[limhoff-r7]

You should separate your attributes from your validations, so that all attributes are first, then all validations as the patten shown here

[wvu]

Any movement on this?

[todb-r7]

Tagging this as jira since the original issue was as well, in that we've had support calls about this module in particular.

[hdm]

This needs a rewrite to get to reasonable performance levels (single socket, multiple sends of community strings in quick succession, detection of valid ones based on replies within a poll period).

[wvu]

88062a5 2bdcc17