Module: Msf::Auxiliary::MDNS

Included in:
LLMNR
Defined in:
lib/msf/core/auxiliary/mdns.rb

Overview

This module provides methods for working with mDNS

Instance Method Summary collapse

Instance Method Details

#build_probeObject


27
28
29
30
31
32
# File 'lib/msf/core/auxiliary/mdns.rb', line 27

def build_probe
  @probe ||= ::Net::DNS::Packet.new(query_name, query_type_num, query_class_num).data
  # TODO: support QU vs QM probes
  #+ @probe[@probe.size-2] = [0x80].pack('C')
  #+ @probe
end

#describe_response(response) ⇒ Object


70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
# File 'lib/msf/core/auxiliary/mdns.rb', line 70

def describe_response(response)
  decoded = Resolv::DNS::Message.decode(response)
  answers = decoded.answer

  if answers.empty? # not sure this will ever happen...
    "no answers"
  else
    # there are often many answers for the same RR, so group them
    grouped_answers = answers.group_by { |name, _, _| name }
    # now summarize each group by noting the resource type and the notable
    # part(s) of that RR
    summarized_answers = grouped_answers.map do |name, these_answers|
      summarized_group = these_answers.map do |_, _, data|
        case data
        when Resolv::DNS::Resource::IN::A
          "A #{data.address}"
        when Resolv::DNS::Resource::IN::AAAA
          "AAAA #{data.address}"
        when Resolv::DNS::Resource::IN::PTR
          "PTR #{data.name}"
        when Resolv::DNS::Resource::IN::SRV
          "SRV #{data.target}"
        when Resolv::DNS::Resource::IN::TXT
          "TXT #{data.strings.join(',')}"
        else
          data.inspect
        end
      end
      "#{name}: (#{summarized_group.join(", ")})"
    end
    summarized_answers.join(', ')
  end
end

#initialize(info = {}) ⇒ Object

Initializes an instance of an auxiliary module that uses mDNS


8
9
10
11
12
13
14
15
16
17
18
19
20
# File 'lib/msf/core/auxiliary/mdns.rb', line 8

def initialize(info = {})
  super
  register_options(
    [
      OptAddressRange.new('RHOSTS', [true, 'The multicast address or CIDR range of targets to query', '224.0.0.251']),
      Opt::RPORT(5353),
      OptString.new('NAME', [true, 'The name to query', '_services._dns-sd._udp.local']),
      OptString.new('TYPE', [true, 'The query type (name, # or TYPE#)', 'PTR']),
      OptString.new('CLASS', [true, 'The query class (name, # or CLASS#)', 'IN'])
    ],
    self.class
  )
end

#query_classObject


34
35
36
37
38
39
40
# File 'lib/msf/core/auxiliary/mdns.rb', line 34

def query_class
  if datastore['CLASS'] =~ /^\d+$/
    datastore['CLASS'].to_i
  else
    datastore['CLASS'].upcase
  end
end

#query_class_nameObject


42
43
44
# File 'lib/msf/core/auxiliary/mdns.rb', line 42

def query_class_name
  Net::DNS::RR::Classes.new(query_class).to_s
end

#query_class_numObject


46
47
48
# File 'lib/msf/core/auxiliary/mdns.rb', line 46

def query_class_num
  Net::DNS::RR::Classes.new(query_class).to_i
end

#query_nameObject


58
59
60
# File 'lib/msf/core/auxiliary/mdns.rb', line 58

def query_name
  datastore['NAME']
end

#query_typeObject


50
51
52
53
54
55
56
# File 'lib/msf/core/auxiliary/mdns.rb', line 50

def query_type
  if datastore['TYPE'] =~ /^\d+$/
    datastore['TYPE'].to_i
  else
    datastore['TYPE'].upcase
  end
end

#query_type_nameObject


62
63
64
# File 'lib/msf/core/auxiliary/mdns.rb', line 62

def query_type_name
  Net::DNS::RR::Types.new(query_type).to_s
end

#query_type_numObject


66
67
68
# File 'lib/msf/core/auxiliary/mdns.rb', line 66

def query_type_num
  Net::DNS::RR::Types.new(query_type).to_i
end

#request_infoObject


104
105
106
# File 'lib/msf/core/auxiliary/mdns.rb', line 104

def request_info
  "#{query_name} #{query_class}/#{query_type}"
end

#setupObject


22
23
24
25
# File 'lib/msf/core/auxiliary/mdns.rb', line 22

def setup
  query_class_name
  query_type_name
end