6.46 在中文Win7上使用Metasploit Framework 3.7.0时udp_sock.sendto()未能发出UDP报文

https://scz.617.cn/network/201105041447.txt

D: scz@nsfocus 2011-05-04 12:43

近日偶然通过wireshark抓包发现，在中文Win7上使用Metasploit Framework 3.7.0
时udp_sock.sendto()未能发出UDP报文:

--------------------------------------------------------------------------
udp_sock    = Rex::Socket::Udp.create( { 'LocalHost' => datastore['CHOST'] || nil, 'Context' => {'Msf' => framework, 'MsfExploit' => self} })
udp_sock.sendto(data, ip, rport, 0)
--------------------------------------------------------------------------

但udp_sock.put()可以发出UDP报文:

--------------------------------------------------------------------------
udp_sock    = Rex::Socket::Udp.create( {
    'LocalHost' => datastore['CHOST'] || nil,
    'PeerHost'  => ip, 'PeerPort' => rport,
    'Context' => {'Msf' => framework, 'MsfExploit' => self}
})
udp_sock.put(data)
--------------------------------------------------------------------------

前者没有connect()，后者connect()过。

--------------------------------------------------------------------------
#
# C:\Program Files\Rapid7\framework\msf3\lib\rex\socket\udp.rb
#
def sendto(gram, peerhost, peerport, flags = 0)
    #
    # Catch unconnected IPv6 sockets talking to IPv4 addresses
    #
    peer    = Rex::Socket.resolv_nbo(peerhost)
    if (peer.length == 4 and self.ipv == 6)
        peerhost    = Rex::Socket.getaddress(peerhost)
        if peerhost[0,7].downcase != '::ffff:'
            peerhost    = '::ffff:' + peerhost
        end
    end
    ...
end
--------------------------------------------------------------------------

sendto()跟IPv6有些纠缠，而我的Win7通过如下设置禁用了IPv6:

--------------------------------------------------------------------------
Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\TCPIP6\Parameters]
"DisabledComponents"=dword:ffffffff
--------------------------------------------------------------------------

用如下代码发现ipv被设为6:

--------------------------------------------------------------------------
print_status( "#{udp_sock.ipv}" )
--------------------------------------------------------------------------

ipv在这里被设置:

--------------------------------------------------------------------------
#
# C:\Program Files\Rapid7\framework\msf3\lib\rex\socket.rb
#
# Initialize general socket parameters.
#
def initsock(params = nil)
    if (params)
        self.peerhost   = params.peerhost
        self.peerport   = params.peerport
        self.localhost  = params.localhost
        self.localport  = params.localport
        self.context    = params.context || {}
        self.ipv        = params.v6 ? 6 : 4
    end
end
--------------------------------------------------------------------------

v6在这里被设置:

--------------------------------------------------------------------------
#
# C:\Program Files\Rapid7\framework\msf3\lib\rex\socket\parameters.rb
#
def initialize(hash)
    ...
    #
    # Whether to force IPv6 addressing
    #
    self.v6 = hash['IPv6'] || false
end
--------------------------------------------------------------------------

对应下面这种用法:

--------------------------------------------------------------------------
udp_sock    = Rex::Socket::Udp.create( { 'LocalHost' => datastore['CHOST'] || nil, 'IPv6' => false, 'Context' => {'Msf' => framework, 'MsfExploit' => self} })
--------------------------------------------------------------------------

参数"IPv6"默认就是false，如果设为true，表示强制使用IPv6地址。但v6在其它地
方会被修改:

--------------------------------------------------------------------------
#
# C:\Program Files\Rapid7\framework\msf3\lib\rex\socket\comm\local.rb
#
# Creates a socket using the supplied Parameter instance.
#
def self.create_by_type(param, type, proto = 0)

    # Whether to use IPv6 addressing
    usev6   = false

    # Detect IPv6 addresses and enable IPv6 accordingly
    if ( Rex::Socket.support_ipv6?())

        # Allow the caller to force IPv6
        if (param.v6)
            usev6   = true
        end

        # Force IPv6 mode for non-connected UDP sockets
        if (type == ::Socket::SOCK_DGRAM and not param.peerhost)
            # FreeBSD allows IPv6 socket creation, but throws an error on sendto()
            if (not Rex::Compat.is_freebsd())
                usev6   = true
            end
        end

        local   = Rex::Socket.resolv_nbo(param.localhost) if param.localhost
        peer    = Rex::Socket.resolv_nbo(param.peerhost) if param.peerhost

        if (local and local.length == 16)
            usev6   = true
        end

        if (peer and peer.length == 16)
            usev6   = true
        end

        if (usev6)
            ...
            param.v6    = true
        end
    else
        # No IPv6 support
        param.v6    = false
    end
    ...
    if (param.v6)
        sock    = ::Socket.new(::Socket::AF_INET6, type, proto)
    else
        sock    = ::Socket.new(::Socket::AF_INET, type, proto)
    end
    ...
    sock
end
--------------------------------------------------------------------------

假设Rex::Socket.support_ipv6?()返回true，对于没有connect()过的UDP套接字，
上述代码强制进入IPv6模式，usev6被设为true，从而导致v6被设为true。

--------------------------------------------------------------------------
#
# C:\Program Files\Rapid7\framework\msf3\lib\rex\socket.rb
#

# Cache our IPv6 support flag
@@support_ipv6  = nil

#
# Determine whether we support IPv6
#
def self.support_ipv6?
    return @@support_ipv6 if not @@support_ipv6.nil?

    @@support_ipv6  = false

    if (::Socket.const_defined?('AF_INET6'))
        begin
            s               = ::Socket.new(::Socket::AF_INET6, ::Socket::SOCK_DGRAM, ::Socket::IPPROTO_UDP)
            s.close
            @@support_ipv6  = true
        rescue
        end
    end

    return @@support_ipv6
end
--------------------------------------------------------------------------

看上去Metasploit认为我的Win7支持IPv6，从而导致sendto()使用IPv6，而我已经禁
用了IPv6，于是sendto()未能发出UDP报文。

我猜DisabledComponents设为0xFFFFFFFF没有彻底、干净地禁用IPv6，这点从如下命
令的输出即可看出:

--------------------------------------------------------------------------
>netstat -na | findstr "::"
  TCP    [::]:135               [::]:0                 LISTENING
  UDP    [::]:500               *:*
  UDP    [::]:4500              *:*

>sc qc tcpip6
[SC] QueryServiceConfig SUCCESS

SERVICE_NAME: tcpip6
        TYPE               : 1  KERNEL_DRIVER
        START_TYPE         : 3   DEMAND_START
        ERROR_CONTROL      : 1   NORMAL
        BINARY_PATH_NAME   : system32\DRIVERS\tcpip.sys
        LOAD_ORDER_GROUP   :
        TAG                : 0
        DISPLAY_NAME       : Microsoft IPv6 Protocol Driver
        DEPENDENCIES       : Tcpip
        SERVICE_START_NAME :

>sc query tcpip6

SERVICE_NAME: tcpip6
        TYPE               : 1  KERNEL_DRIVER
        STATE              : 1  STOPPED
        WIN32_EXIT_CODE    : 1077  (0x435)
        SERVICE_EXIT_CODE  : 0  (0x0)
        CHECKPOINT         : 0x0
        WAIT_HINT          : 0x0
--------------------------------------------------------------------------

或者说Metasploit判断OS是否支持IPv6的办法有缺陷，tcpip6这个驱动并未加载。

2007年12月31日有人反馈，在FreeBSD上存在类似问题，参看:

http://dev.metasploit.com/redmine/issues/172.pdf

后来的修正方案就是前面那个is_freebsd()调用。

这个问题估计很难被发现，因为像我这样变态地配置Win7的人不多，懒得报告这个自
己玩自己导致的BUG了。我的修正方案是:

--------------------------------------------------------------------------
#
# C:\Program Files\Rapid7\framework\msf3\lib\rex\socket.rb
#
# Determine whether we support IPv6
#
def self.support_ipv6?
    return false
end
--------------------------------------------------------------------------

用如下办法测试，用wireshark同步抓包:

--------------------------------------------------------------------------
irb
udp_sock    = Rex::Socket::Udp.create()
udp_sock.sendto("foo", "10.17.255.254", 137, 0)
--------------------------------------------------------------------------