rapid7/metasploit-framework — pull request #3705 by xistence (2014-08-26 05:58:36+00:00)
Title: Add UPnP SSDP ssdp:all Amplification Scanner

This module scans for UPnP SSDP open ports and tests for amplification possibilities.

I found this issue somewhere back in mid 2013, but it seems other people have found this now and are starting to actively scan and abuse this issue. (https://isc.sans.edu/port.html?port=1900, http://packetstormsecurity.com/files/127994/SSDP-Amplification-Scanner.html)
That's why I release this module to the public, so that people can test their networks and block access to this in their firewalls/IPS.

The issue is in UDP port 1900 (SSDP). Using the "ssdp:all" search request (search for all devices and services behind UPnP) will trigger a lot of UDP response packets and thus create an amplification attack when the source IP is spoofed.

As this option is defined in the RFC, it seems like every UPnP piece of software is vulnerable to this. According to Shodan (http://www.shodanhq.com/search?q=port%3A1900), about 87 MILLION IP addresses have an accessable open SSDP port and might thus all be used for amplification attacks.

How to replicate:

Setup an Ubuntu 14.04 VM and install miniupnpd:

apt-get install miniupnpd

Modify the /etc/default/miniupnpd file so that it looks like this:

START_DAEMON=1
MiniUPnPd_EXTERNAL_INTERFACE=eth0
MiniUPnPd_LISTENING_IP=0.0.0.0/0

Start miniupnpd

/etc/init.d/miniupnpd restart

Fire up Metasploit console

msf > use auxiliary/scanner/upnp/ssdp_amp
msf auxiliary(ssdp_amp) > set RHOSTS 192.168.2.22
RHOSTS => 192.168.2.22
msf auxiliary(ssdp_amp) > exploit

[*] Sending 132 bytes SSDP probes to 192.168.2.22->192.168.2.22 (1 hosts)
[+] 192.168.2.22:1900 - Response is 5133 bytes in 12 packets [38.89x Amplification]
[*] Scanned 1 of 1 hosts (100% complete)
[*] Auxiliary module execution completed
msf auxiliary(ssdp_amp) >

Many devices also support a shorter request, which creates an even higher amplifier

To scan for this, you have to set the "SHORT" option to "true"

msf auxiliary(ssdp_amp) > set SHORT true
SHORT => true
msf auxiliary(ssdp_amp) > exploit

[*] Sending 97 bytes SSDP probes to 192.168.2.22->192.168.2.22 (1 hosts)
[+] 192.168.2.22:1900 - Response is 5133 bytes in 12 packets [52.92x Amplification]
[*] Scanned 1 of 1 hosts (100% complete)
[*] Auxiliary module execution completed