Class: Rex::Proto::DHCP::Server

Inherits:
Object
  • Object
show all
Includes:
Socket
Defined in:
lib/rex/proto/dhcp/server.rb

Overview

DHCP Server class not completely configurable - written specifically for a PXE server

  • scriptjunkie

extended to support testing/exploiting CVE-2011-0997

Constant Summary

Constants included from Socket

Socket::MATCH_IPV4, Socket::MATCH_IPV4_PRIVATE, Socket::MATCH_IPV6

Instance Attribute Summary collapse

Attributes included from Socket

#ipv, #localhost, #localport, #peerhost, #peerport

Instance Method Summary collapse

Methods included from Socket

addr_atoc, addr_atoi, addr_atoi_list, addr_aton, addr_ctoa, addr_itoa, addr_iton, addr_ntoa, addr_ntoi, bit2netmask, cidr_crack, compress_address, create, create_ip, create_param, create_tcp, create_tcp_server, create_udp, dotted_ip?, #fd, from_sockaddr, getaddress, getaddresses, gethostbyname, #getlocalname, #getpeername, #getsockname, #initsock, ipv6_link_address, ipv6_mac, is_internal?, is_ipv4?, is_ipv6?, net2bitmask, portlist_to_portspec, portspec_crack, portspec_to_portlist, resolv_nbo, resolv_nbo_i, resolv_nbo_i_list, resolv_nbo_list, resolv_to_dotted, source_address, support_ipv6?, tcp_socket_pair, to_sockaddr, #type?, udp_socket_pair

Constructor Details

#initialize(hash, context = {}) ⇒ Server

Returns a new instance of Server.



25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
 
# File 'lib/rex/proto/dhcp/server.rb', line 25

def initialize(hash, context = {})
	self.listen_host = '0.0.0.0' # clients don't already have addresses. Needs to be 0.0.0.0
	self.listen_port = 67 # mandatory (bootps)
	self.context = context
	self.sock = nil

	self.myfilename = hash['FILENAME'] || ""
	self.myfilename << ("\x00" * (128 - self.myfilename.length))

	source = hash['SRVHOST'] || Rex::Socket.source_address
	self.ipstring = Rex::Socket.addr_aton(source)

	ipstart = hash['DHCPIPSTART']
	if ipstart
		self.start_ip = Rex::Socket.addr_atoi(ipstart)
	else
		# Use the first 3 octects of the server's IP to construct the
		# default range of x.x.x.32-254
		self.start_ip = "#{self.ipstring[0..2]}\x20".unpack("N").first
	end
	self.current_ip = start_ip

	ipend = hash['DHCPIPEND']
	if ipend
		self.end_ip = Rex::Socket.addr_atoi(ipend)
	else
		# Use the first 3 octects of the server's IP to construct the
		# default range of x.x.x.32-254
		self.end_ip = "#{self.ipstring[0..2]}\xfe".unpack("N").first
	end

	# netmask
	netmask = hash['NETMASK'] || "255.255.255.0"
	self.netmaskn = Rex::Socket.addr_aton(netmask)

	# router
	router = hash['ROUTER'] || source
	self.router = Rex::Socket.addr_aton(router)

	# dns
	dnsserv = hash['DNSSERVER'] || source
	self.dnsserv = Rex::Socket.addr_aton(dnsserv)

	# broadcast
	if hash['BROADCAST']
		self.broadcasta = Rex::Socket.addr_aton(hash['BROADCAST'])
	else
		self.broadcasta = Rex::Socket.addr_itoa( self.start_ip | (Rex::Socket.addr_ntoi(self.netmaskn) ^ 0xffffffff) )
	end

	self.served = {}
	self.serveOnce = hash.include?('SERVEONCE')

	self.servePXE = (hash.include?('PXE') or hash.include?('FILENAME') or hash.include?('PXEONLY'))
	self.serveOnlyPXE = hash.include?('PXEONLY')

	# Always assume we don't give out hostnames ...
	self.give_hostname = false
	self.served_over = 0
	if (hash['HOSTNAME'])
		self.give_hostname = true
		self.served_hostname = hash['HOSTNAME']
		if ( hash['HOSTSTART'] )
			self.served_over = hash['HOSTSTART'].to_i
		end
	end

	self.leasetime = 600
	self.relayip = "\x00\x00\x00\x00" # relay ip - not currently suported
	self.pxeconfigfile = "update2"
	self.pxealtconfigfile = "update0"
	self.pxepathprefix = ""
	self.pxereboottime = 2000
end

Instance Attribute Details

#broadcasta ⇒ Object

Returns the value of attribute broadcasta.



156
157
158
 
# File 'lib/rex/proto/dhcp/server.rb', line 156

def broadcasta
  @broadcasta
end

#context ⇒ Object

Returns the value of attribute context.



154
155
156
 
# File 'lib/rex/proto/dhcp/server.rb', line 154

def context
  @context
end

#current_ip ⇒ Object

Returns the value of attribute current_ip.



156
157
158
 
# File 'lib/rex/proto/dhcp/server.rb', line 156

def current_ip
  @current_ip
end

#dnsserv ⇒ Object

Returns the value of attribute dnsserv.



154
155
156
 
# File 'lib/rex/proto/dhcp/server.rb', line 154

def dnsserv
  @dnsserv
end

#end_ip ⇒ Object

Returns the value of attribute end_ip.



156
157
158
 
# File 'lib/rex/proto/dhcp/server.rb', line 156

def end_ip
  @end_ip
end

#give_hostname ⇒ Object

Returns the value of attribute give_hostname.



158
159
160
 
# File 'lib/rex/proto/dhcp/server.rb', line 158

def give_hostname
  @give_hostname
end

#ipstring ⇒ Object

Returns the value of attribute ipstring.



155
156
157
 
# File 'lib/rex/proto/dhcp/server.rb', line 155

def ipstring
  @ipstring
end

#leasetime ⇒ Object

Returns the value of attribute leasetime.



154
155
156
 
# File 'lib/rex/proto/dhcp/server.rb', line 154

def leasetime
  @leasetime
end

#listen_host ⇒ Object

Returns the value of attribute listen_host.



154
155
156
 
# File 'lib/rex/proto/dhcp/server.rb', line 154

def listen_host
  @listen_host
end

#listen_port ⇒ Object

Returns the value of attribute listen_port.



154
155
156
 
# File 'lib/rex/proto/dhcp/server.rb', line 154

def listen_port
  @listen_port
end

#myfilename ⇒ Object

Returns the value of attribute myfilename.



155
156
157
 
# File 'lib/rex/proto/dhcp/server.rb', line 155

def myfilename
  @myfilename
end

#netmaskn ⇒ Object

Returns the value of attribute netmaskn.



156
157
158
 
# File 'lib/rex/proto/dhcp/server.rb', line 156

def netmaskn
  @netmaskn
end

#pxealtconfigfile ⇒ Object

Returns the value of attribute pxealtconfigfile.



157
158
159
 
# File 'lib/rex/proto/dhcp/server.rb', line 157

def pxealtconfigfile
  @pxealtconfigfile
end

#pxeconfigfile ⇒ Object

Returns the value of attribute pxeconfigfile.



157
158
159
 
# File 'lib/rex/proto/dhcp/server.rb', line 157

def pxeconfigfile
  @pxeconfigfile
end

#pxepathprefix ⇒ Object

Returns the value of attribute pxepathprefix.



157
158
159
 
# File 'lib/rex/proto/dhcp/server.rb', line 157

def pxepathprefix
  @pxepathprefix
end

#pxereboottime ⇒ Object

Returns the value of attribute pxereboottime.



157
158
159
 
# File 'lib/rex/proto/dhcp/server.rb', line 157

def pxereboottime
  @pxereboottime
end

#relayip ⇒ Object

Returns the value of attribute relayip.



154
155
156
 
# File 'lib/rex/proto/dhcp/server.rb', line 154

def relayip
  @relayip
end

#reporter ⇒ Object

Returns the value of attribute reporter.



158
159
160
 
# File 'lib/rex/proto/dhcp/server.rb', line 158

def reporter
  @reporter
end

#router ⇒ Object

Returns the value of attribute router.



154
155
156
 
# File 'lib/rex/proto/dhcp/server.rb', line 154

def router
  @router
end

#served ⇒ Object

Returns the value of attribute served.



155
156
157
 
# File 'lib/rex/proto/dhcp/server.rb', line 155

def served
  @served
end

#served_hostname ⇒ Object

Returns the value of attribute served_hostname.



158
159
160
 
# File 'lib/rex/proto/dhcp/server.rb', line 158

def served_hostname
  @served_hostname
end

#served_over ⇒ Object

Returns the value of attribute served_over.



158
159
160
 
# File 'lib/rex/proto/dhcp/server.rb', line 158

def served_over
  @served_over
end

#serveOnce ⇒ Object

Returns the value of attribute serveOnce.



155
156
157
 
# File 'lib/rex/proto/dhcp/server.rb', line 155

def serveOnce
  @serveOnce
end

#serveOnlyPXE ⇒ Object

Returns the value of attribute serveOnlyPXE.



157
158
159
 
# File 'lib/rex/proto/dhcp/server.rb', line 157

def serveOnlyPXE
  @serveOnlyPXE
end

#servePXE ⇒ Object

Returns the value of attribute servePXE.



157
158
159
 
# File 'lib/rex/proto/dhcp/server.rb', line 157

def servePXE
  @servePXE
end

#sock ⇒ Object

Returns the value of attribute sock.



155
156
157
 
# File 'lib/rex/proto/dhcp/server.rb', line 155

def sock
  @sock
end

#start_ip ⇒ Object

Returns the value of attribute start_ip.



156
157
158
 
# File 'lib/rex/proto/dhcp/server.rb', line 156

def start_ip
  @start_ip
end

#thread ⇒ Object

Returns the value of attribute thread.



155
156
157
 
# File 'lib/rex/proto/dhcp/server.rb', line 155

def thread
  @thread
end

Instance Method Details

#report(&block) ⇒ Object 



100
101
102
 
# File 'lib/rex/proto/dhcp/server.rb', line 100

def report(&block)
	self.reporter = block
end

#send_packet(ip, pkt) ⇒ Object

Send a single packet to the specified host



143
144
145
146
147
148
149
150
151
152
 
# File 'lib/rex/proto/dhcp/server.rb', line 143

def send_packet(ip, pkt)
	port = 68 # bootpc
	if ip
		self.sock.sendto( pkt, ip, port )
	else
		if not self.sock.sendto( pkt, '255.255.255.255', port )
			self.sock.sendto( pkt, self.broadcasta, port )
		end
	end
end

#set_option(opts) ⇒ Object

Set an option



126
127
128
129
130
131
132
133
134
135
136
137
138
139
 
# File 'lib/rex/proto/dhcp/server.rb', line 126

def set_option(opts)
	allowed_options = [
		:serveOnce, :pxealtconfigfile, :servePXE, :relayip, :leasetime, :dnsserv,
		:pxeconfigfile, :pxepathprefix, :pxereboottime, :router,
		:give_hostname, :served_hostname, :served_over, :serveOnlyPXE
	]

	opts.each_pair { |k,v|
		next if not v
		if allowed_options.include?(k)
			self.instance_variable_set("@#{k}", v)
		end
	}
end

#start ⇒ Object

Start the DHCP server



105
106
107
108
109
110
111
112
113
114
115
 
# File 'lib/rex/proto/dhcp/server.rb', line 105

def start
	self.sock = Rex::Socket::Udp.create(
		'LocalHost' => listen_host,
		'LocalPort' => listen_port,
		'Context'   => context
	)

	self.thread = Rex::ThreadFactory.spawn("DHCPServerMonitor", false) {
		monitor_socket
	}
end

#stop ⇒ Object

Stop the DHCP server



118
119
120
121
122
 
# File 'lib/rex/proto/dhcp/server.rb', line 118

def stop
	self.thread.kill
	self.served = {}
	self.sock.close rescue nil
end