metassh icon indicating copy to clipboard operation
metassh copied to clipboard

tcp scans trhough metassh session show open ports for non-existent hosts

Open tmc opened this issue 11 years ago • 0 comments

In this case I'm connecting to a host that can see the .10.0/24 subnet and performing a tcp scan after adding it as a route.

Hosts 190 and 191 don't exist let alone have these ports open..


msf > resource /tmp/scan 
[*] Processing /tmp/scan for ERB directives.
resource (/tmp/scan)> hosts -a 192.168.1.116
[*] Time: 2013-02-27 07:46:41 UTC Host: host=192.168.1.116
resource (/tmp/scan)> load metassh/meta_ssh
[+] Added 2 Exploit modules for metaSSH
[+] Added 1 Payload modules for metaSSH
[*] Successfully loaded plugin: metaSSH
resource (/tmp/scan)> set rport 2222
rport => 2222
resource (/tmp/scan)> ssh_open -l root -c toor 192.168.1.116
[+] Running multi/ssh/login_password against 192.168.1.116
[*] metaSSH session 1 opened (127.0.0.1 -> 192.168.1.116:2222) at 2013-02-27 02:04:15 -0600
resource (/tmp/scan)> route add 192.168.10.1 255.255.255.0 1
[*] Route added
resource (/tmp/scan)> use auxiliary/scanner/portscan/tcp
resource (/tmp/scan)> set THREADS 24
THREADS => 24
resource (/tmp/scan)> set ports 21,22,80,443
ports => 21,22,80,443
resource (/tmp/scan)> set rhosts 192.168.10.190-191
rhosts => 192.168.10.190-191
resource (/tmp/scan)> run -j
[*] Auxiliary module running as background job
msf  auxiliary(tcp) > 
[*] 192.168.10.190:80 - TCP OPEN
[*] 192.168.10.191:443 - TCP OPEN
[*] 192.168.10.190:443 - TCP OPEN
[*] 192.168.10.190:22 - TCP OPEN
[*] 192.168.10.191:21 - TCP OPEN
[*] 192.168.10.191:22 - TCP OPEN
[*] 192.168.10.190:21 - TCP OPEN
[*] 192.168.10.191:80 - TCP OPEN
[*] Scanned 1 of 2 hosts (050% complete)
[*] Scanned 2 of 2 hosts (100% complete)

tmc avatar Feb 27 '13 08:02 tmc