rapid7/metasploit-framework — pull request #2680 by mcantoni (2013-11-23 15:58:43+00:00)
Title: Identifies Open Chargen Service Checking The Answer

Description: Chargen is a debugging and measurement tool and a character generator service. A character generator service simply sends data without regard to the input. Chargen is susceptible to spoofing the source of transmissions as well as use in a reflection attack vector. The misuse of the testing features of the Chargen service may allow attackers to craft malicious network payloads and reflect them by spoofing the transmission source to effectively direct it to a target. This can result in traffic loops and service degradation with large amounts of network traffic.

+ Msftidy check: 0 errors, 0 warnings

+ Demo:

msf > use auxiliary/scanner/chargen/chargen_probe
msf auxiliary(chargen_probe) > set RHOSTS 1.2.3.4
RHOSTS => 1.2.3.4
msf auxiliary(chargen_probe) > run

[+] 1.2.3.4:19 answers with 1093 bytes (headers + UDP payload)
[*] Scanned 1 of 1 hosts (100% complete)
[*] Auxiliary module execution completed
msf auxiliary(chargen_probe) > set DEBUG true
DEBUG => true
msf auxiliary(chargen_probe) > run

[*] DEBUG: ["=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}!\"\#$%&'\r\n>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}!\"\#$%&'(\r\n?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}!\"\#$%&'()\r\n@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}!\"\#$%&'()*\r\nABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}!\"\#$%&'()*+\r\nBCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}!\"\#$%&'()*+,\r\nCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}!\"\#$%&'()*+,-\r\nDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}!\"\#$%&'()*+,-.\r\nEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}!\"\#$%&'()*+,-./\r\nFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}!\"\#$%&'()*+,-./0\r\nGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}!\"\#$%&'()*+,-./01\r\nHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}!\"\#$%&'()*+,-./012\r\nIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}!\"\#$%&'()*+,-./0123\r\nJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}!\"\#$%&'(\r\n", "127.0.0.1", 19]
[+] 1.2.3.4:19 answers with 1115 bytes (headers + UDP payload)
[*] Scanned 1 of 1 hosts (100% complete)