lunes, 15 de agosto de 2011

PCAPrub y metasploit!

Es probable que el modulo pcaprub requerido por algunos modulos de metasploit sea un dolor de cabeza. El resultado es algo como lo que aparece abajo:



msf > use auxiliary/scanner/ip/ipidseq
msf auxiliary(ipidseq) > show options

Module options (auxiliary/scanner/ip/ipidseq):

Name Current Setting Required Description
---- --------------- -------- -----------
INTERFACE no The name of the interface
RHOSTS yes The target address range or CIDR identifier
RPORT 80 yes The target port
SNAPLEN 65535 yes The number of bytes to capture
THREADS 1 yes The number of concurrent threads
TIMEOUT 500 yes The reply read timeout in milliseconds

msf auxiliary(ipidseq) > set RHOSTS 192.168.1.0/24
RHOSTS => 192.168.1.0/24
msf auxiliary(ipidseq) > set THREADS 50
THREADS => 50
msf auxiliary(ipidseq) > run

[*] The Pcaprub module is not available: no such file to load -- pcaprub
[*] The Pcaprub module is not available: no such file to load -- pcaprub
[*] The Pcaprub module is not available: no such file to load -- pcaprub
[*] The Pcaprub module is not available: no such file to load -- pcaprub
[*] The Pcaprub module is not available: no such file to load -- pcaprub
[*] The Pcaprub module is not available: no such file to load -- pcaprub
[*] The Pcaprub module is not available: no such file to load -- pcaprub
[*] The Pcaprub module is not available: no such file to load -- pcaprub
[*] The Pcaprub module is not available: no such file to load -- pcaprub
[*] The Pcaprub module is not available: no such file to load -- pcaprub
[*] The Pcaprub module is not available: no such file to load -- pcaprub
[*] The Pcaprub module is not available: no such file to load -- pcaprub
[*] The Pcaprub module is not available: no such file to load -- pcaprub
[*] The Pcaprub module is not available: no such file to load -- pcaprub
[*] The Pcaprub module is not available: no such file to load -- pcaprub
[*] The Pcaprub module is not available: no such file to load -- pcaprub
[*] The Pcaprub module is not available: no such file to load -- pcaprub
[*] The Pcaprub module is not available: no such file to load -- pcaprub
[*] The Pcaprub module is not available: no such file to load -- pcaprub
[*] The Pcaprub module is not available: no such file to load -- pcaprub
[*] The Pcaprub module is not available: no such file to load -- pcaprub
[*] The Pcaprub module is not available: no such file to load -- pcaprub
[*] The Pcaprub module is not available: no such file to load -- pcaprub
[*] The Pcaprub module is not available: no such file to load -- pcaprub
[-] Auxiliary failed: RuntimeError Pcaprub not available
[-] Call stack:
[-] /opt/framework3/msf3/lib/msf/core/exploit/capture.rb:379:in `check_pcaprub_loaded'
[-] /opt/framework3/msf3/lib/msf/core/exploit/capture.rb:75:in `open_pcap'
[-] (eval):68:in `run_host'
[-] /opt/framework3/msf3/lib/msf/core/auxiliary/scanner.rb:92:in `block in run'
[-] /opt/framework3/msf3/lib/msf/core/thread_manager.rb:64:in `call'
[-] /opt/framework3/msf3/lib/msf/core/thread_manager.rb:64:in `block in spawn'
[*] Auxiliary module execution completed


Para solucionarlo, es muy simple:

Primero se debe compilar el modulo pcaprub almacenado en msf3/external.

Algo asi como:

# ruby extconf.rb && make && make install

Luego, en 32 bits hacemos:

cp /usr/local/lib/site_ruby/1.9.2/i486-linux/pcaprub.so /opt/framework3/ruby/lib/ruby/site_ruby/1.9.1/i686-linux/

En 64 bits hacemos:

cp /usr/local/lib/site_ruby/1.9.2/x86_64-linux/pcaprub.so /opt/framework3/ruby/lib/ruby/site_ruby/1.9.1/x86_64-linux


Es necesario volver a lanzar msfconsole.

Y... ya :)