rapid7/metasploit-framework — pull request #2791 by morisson (2013-12-21 00:31:06+00:00)
Title: Module sap_router_portscanner update: resolve hostnames on saprouter

SAPRouters can resolve hostnames in requested connections. This update allows for deciding where to resolve hostnames in the RHOSTS, whether on the local system, ou the remote saprouter.
This allows for scanning hosts internal to the saprouter without ever knowing their IP addresses, just by knowing (typically guessing) hostnames, since the saprouter will give enough detail to understand if the failure to connect was due to timeout, unknown host, connection refused, timeout, and so on.

Example usage:

```
msf auxiliary(sap_router_portscanner) > set RHOSTS sap,sap1,sap2
RHOSTS => sap,sap1,sap2
msf auxiliary(sap_router_portscanner) > set RESOLVE remote
RESOLVE => remote
msf auxiliary(sap_router_portscanner) > set PORTS 80,443
PORTS => 80,443
msf auxiliary(sap_router_portscanner) > set SAPROUTER_HOST 192.168.56.101
SAPROUTER_HOST => 192.168.56.101
msf auxiliary(sap_router_portscanner) > set VERBOSE true
VERBOSE => true
msf auxiliary(sap_router_portscanner) > run

[*] Scanning sap
[-] sap:80 - unknown host
[-] sap:443 - unknown host
[!] Warning: Service info could be innacurated
[*] Scanning sap1
[-] sap1:443 - TCP closed
[-] sap1:80 - connection timed out
[!] Warning: Service info could be innacurated

Portscan Results
================

Host Port State Info
---- ---- ----- ----
sap1 443 closed

[*] Scanning sap2
[-] sap2:80 - host unreachable
[-] sap2:443 - host unreachable
[!] Warning: Service info could be innacurated
[*] Auxiliary module execution completed
```

We see from the above output that the host "sap" does not exist, "sap1" has TCP 443 closed and TCP 80 filtered, and "sap2" exists, but is unreachable.

Changes:
=======

- I stopped using the scanner mixin, but kept all the same syntax/usage (e.g., RHOSTS);
- By dropping the scanner mixin, the module no longer takes advantage of threading between RHOSTS entries based on THREADS;
- RHOSTS can be a comma separated list of hostnames or IP address ranges/CIDR;
- Only saving results when RESOLVE is local. report_service() fails when it can't resolve the host, and that happens when resolving remotely on the saprouter. Can't find a way to make it work...