-
Notifications
You must be signed in to change notification settings - Fork 13.8k
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Add ye olde NIS ypserv map dumper #9368
Conversation
9f87fbe
to
6b9cc26
Compare
To assist in your goal to find a more elegant solution, you can def parse_map(res)
map = {}
# We steal TIMEOUT from the mixin
Timeout.timeout(datastore['TIMEOUT']) do
loop do
begin
# XXX: res is modified in place
_, status, value, key = Rex::Encoder::XDR.decode!(
res,
Integer, # More: Yes
Integer, # Status: YP_TRUE (1)
String, # Value: [redacted]
String # Key: [redacted]
)
map[key] = value if status == 1
rescue Rex::ArgumentError
vprint_status("Finished XDR decoding at #{res.inspect}")
return map
end
end
end
map
rescue Timeout::Error
print_error('XDR decoding timed out (try increasing TIMEOUT?)')
return
end |
You may wish to rescue these errors: RPC with
RPC with
|
Seems a
|
If you're keen for a game of code golf, this would save a variable deceleration and a couple of lines, while maintaining readability: def nick_to_map(nick)
{
'ethers' => 'ethers.byname',
'aliases' => 'mail.aliases',
'services' => 'services.byname',
'protocols' => 'protocols.bynumber',
'hosts' => 'hosts.byname',
'networks' => 'networks.byaddr',
'group' => 'group.byname',
'passwd' => 'passwd.byname'
}[nick] || nick
end |
Bummer I missed |
I was keeping with the documentation for |
Do we care to make this a scanner? I beefed up the error handling already. |
I don't see why this couldn't be a scanner. It would be trivial to bail out upon connection failure or Is there an easy way to disclose the |
I didn't think it was particularly conducive to a scanner due to the requirement of knowing the NIS domain name, which is kinda like a password before security was cool. |
Yes, you can disclose the domain name through |
But it has to be running on the same server |
Yeah I guess leave it as a gather module, unless you can integrate |
I know SunRPC doesn't get much love, but I still see things like NFS all over the place. Our implementation isn't terribly robust or used by many modules. I'd like to change that. |
I have a couple Solaris VMs for testing if need be. |
For the longest time, I wanted to see an RPC grinder in Metasploit, but I think Nmap's Edit: superior because port scanning is a necessity, and feeding a list of open ports to Metasploit is lame. |
Looks good to me, OK. |
Release NotesThis adds a module to dump a specified map from an NIS database. Yes, that NIS. |
@wvu-r7 hah well done 👍 haven't seen that in awhile. |
@sho-luv @aushack @h00die
use auxiliary/gather/nis_ypserv_map
set rhost
to your NIS serverset domain
to your NIS domainset map
if desiredrun