URGENT/11 Scanner, Based On Detection Tool By Armis

### This module requires Metasploit: https://metasploit.com/download# Current source: https://github.com/rapid7/metasploit-framework##class MetasploitModule < Msf::Auxiliary  include Msf::Auxiliary::Report  include Msf::Auxiliary::Scanner  include Msf::Exploit::Capture  def initialize(info = {})    super(update_info(info,      'Name'           => 'URGENT/11 Scanner, Based on Detection Tool by Armis',      'Description'    => %q{        This module detects VxWorks and the IPnet IP stack, along with devices        vulnerable to CVE-2019-12258.      },      'Author'         => [        'Ben Seri',   # Upstream tool        'Brent Cook', # Metasploit module        'wvu'         # Metasploit module      ],      'References'     => [        ['CVE', '2019-12258'],        ['URL', 'https://armis.com/urgent11'],        ['URL', 'https://github.com/ArmisSecurity/urgent11-detector']      ],      'DisclosureDate' => '2019-08-09', # NVD entry publication      'License'        => MSF_LICENSE,      'Notes'          => {'Stability' => [CRASH_SAFE]}    ))    register_options([      OptString.new('RPORTS', required: true, default: "21 22 23 80 443", desc: 'Target ports for TCP detections')    ])    register_advanced_options([      OptInt.new('RetransmissionRate', required: true, default: 3, desc: 'Send n TCP packets')    ])    deregister_options('PCAPFILE', 'FILTER')  end  #  # Utility methods  #  def rports    datastore['RPORTS'].split(/[\s,]/).collect{|i| (i.to_i.to_s == i) ? i.to_i : nil}.compact  end  def filter(ip)    "src host #{ip} and dst host #{Rex::Socket.source_address(ip)}"  end  #  # Scanner methods  #  def run_host(ip)    # XXX: Configuring Ethernet and IP headers sends a UDP packet!    @config = PacketFu::Utils.whoami?(target: ip)    open_pcap    capture.setfilter(filter(ip))    port_open = false    rports.each do |rport|      port_open |= run_detections(ip, rport)    end    raise RuntimeError.new("No ports open on #{ip} from #{datastore['RPORTS']}") if !port_open  rescue RuntimeError => e    fail_with(Failure::BadConfig, e.message)  ensure    close_pcap  end  def detections    %w[      tcp_dos_detection      tcp_malformed_options_detection      icmp_code_detection      icmp_timestamp_detection    ]  end  def run_detections(ip, port)    print_status("#{ip}:#{port} being checked")    final_ipnet_score        = 0    final_vxworks_score      = 0    affected_vulnerabilities = []    begin      sock = Rex::Socket::Tcp.create(        'PeerHost' => ip,        'PeerPort' => port      )    rescue      vprint_bad("Could not connect to #{ip}:#{port}, cannot verify vulnerability")      return false    end    detections.each do |detection|      @ipnet_score     = 0      @vxworks_score   = 0      @vulnerable_cves = []      detection_name = detection.camelize      begin        send(detection, sock, ip, port)      rescue StandardError => e        vprint_error("#{detection_name} failed: #{e.message}")        next      end      vprint_status(        "\t#{detection_name.ljust(30)}" \        "\tVxWorks: #{@vxworks_score}" \        "\tIPnet: #{@ipnet_score}"      )      final_ipnet_score        += @ipnet_score      final_vxworks_score      += @vxworks_score      affected_vulnerabilities += @vulnerable_cves    end    sock.close    if final_ipnet_score > 0      vprint_good("#{ip}:#{port} detected as IPnet")    elsif final_ipnet_score < 0      vprint_error("#{ip}:#{port} detected as NOT IPnet")    end    if final_vxworks_score > 100      vprint_good("#{ip}:#{port} detected as VxWorks")    elsif final_vxworks_score < 0      vprint_error("#{ip}:#{port} detected as NOT VxWorks")    end    affected_vulnerabilities.each do |vuln|      msg = "#{ip}:#{port} affected by #{vuln}"      print_good(msg)      report_vuln(        host: ip,        name: name,        refs: references,        info: msg      )    end    true  end  #  # TCP detection methods  #  def tcp_malformed_options_detection(sock, ip, port)    pkt = PacketFu::TCPPacket.new(config: @config)    # IP destination address    pkt.ip_daddr = ip    # TCP SYN with malformed options    pkt.tcp_dst       = port    pkt.tcp_flags.syn = 1    pkt.tcp_opts      = [2, 4, 1460].pack('CCn') + # MSS                        [1].pack('C') +            # NOP                        [3, 2].pack('CC') +        # WSCALE with invalid length                        [3, 3, 0].pack('CCC')      # WSCALE with valid length    pkt.recalc    res = nil    datastore['RetransmissionRate'].times do      pkt.to_w      res = inject_reply(:tcp)      break unless res    end    unless res      return @vxworks_score = 0,             @ipnet_score   = 50    end    if res.tcp_flags.rst == 1 &&      res.tcp_dst == pkt.tcp_src && res.tcp_dst == pkt.tcp_src      return @vxworks_score = 100,             @ipnet_score   = 100    end    return @vxworks_score = -100,           @ipnet_score   = -100  end  def tcp_dos_detection(sock, ip, port)    pkt = PacketFu::TCPPacket.new(config: @config)    # IP destination address    pkt.ip_daddr = ip    # TCP SYN with malformed (truncated) WS option    pkt.tcp_src       = sock.getlocalname.last    pkt.tcp_dst       = sock.peerport    pkt.tcp_seq       = rand(0xffffffff + 1)    pkt.tcp_ack       = rand(0xffffffff + 1)    pkt.tcp_flags.syn = 1    pkt.tcp_opts      = [3, 2].pack('CC') +    # WSCALE with invalid length                        [1, 0].pack('CC')      # NOP + EOL    pkt.recalc    res = nil    datastore['RetransmissionRate'].times do      pkt.to_w      res = inject_reply(:tcp)      break unless res    end    unless res      return @vxworks_score = 0,             @ipnet_score   = 0    end    if res.tcp_flags.rst == 1 &&      res.tcp_dst == pkt.tcp_src && res.tcp_dst == pkt.tcp_src      return @vxworks_score   = 100,             @ipnet_score     = 100,             @vulnerable_cves = ['CVE-2019-12258']    end    return @vxworks_score = 0,           @ipnet_score   = 0  end  #  # ICMP detection methods  #  def icmp_code_detection(sock, ip, _port = nil)    pkt = PacketFu::ICMPPacket.new(config: @config)    # IP destination address    pkt.ip_daddr = ip    # ICMP echo request with non-zero code    pkt.icmp_type = 8    pkt.icmp_code = rand(0x01..0xff)    pkt.payload   = capture_icmp_echo_pack    pkt.recalc    pkt.to_w    res = inject_reply(:icmp)    unless res      return @ipnet_score = 0    end    # Echo reply with zeroed code    if res.icmp_type == 0 && res.icmp_code == 0      return @ipnet_score = 20    end    @ipnet_score = -20  end  def icmp_timestamp_detection(sock, ip, _port = nil)    pkt = PacketFu::ICMPPacket.new(config: @config)    # IP destination address    pkt.ip_daddr = ip    # Truncated ICMP timestamp request    pkt.icmp_type = 13    pkt.icmp_code = 0    pkt.payload   = "\x00" * 4    pkt.recalc    pkt.to_w    res = inject_reply(:icmp)    unless res      return @ipnet_score = 0    end    # Timestamp reply    if res.icmp_type == 14      return @ipnet_score = 90    end    @ipnet_score = -30  endend