rapid7/metasploit-framework — pull request #4194 by jhart-r7 (2014-11-13 00:51:28+00:00)
Title: Gather Quake server info

I am not a gamer, but this protocol came up during work so I wrote a quick gather module for it.

It should work against any dedicated Quake server. You can find example, public targets at http://www.quakeservers.net/quake3/servers/.

Example usage:

```
msf auxiliary(server_info) > run

[+] 216.231.132.111:27960 found '{"version"=>"Q3 1.32c linux-i386 May 8 2009", "sv_hostname"=>"Lightning CTF", "gamename"=>"baseq3"}'
[*] Scanned 1 of 1 hosts (100% complete)
[*] Auxiliary module execution completed
msf auxiliary(server_info) > set ACTION info
ACTION => info
msf auxiliary(server_info) > run

[+] 216.231.132.111:27960 found '{"hostname"=>"Lightning CTF"}'
set VERBOSE true
set ACTION status
[*] Scanned 1 of 1 hosts (100% complete)
[*] Auxiliary module execution completed
msf auxiliary(server_info) > set VERBOSE true
VERBOSE => true
msf auxiliary(server_info) > set ACTION status
ACTION => status
msf auxiliary(server_info) > run

[*] Sending probes to 216.231.132.111->216.231.132.111 (1 hosts)
[+] 216.231.132.111:27960 found '{"sv_maxclients"=>"32", "sv_privateClients"=>"0", "version"=>"Q3 1.32c linux-i386 May 8 2009", "com_protocol"=>"71", "protocol"=>"68", "dmflags"=>"0", "fraglimit"=>"20", "timelimit"=>"20", "g_gametype"=>"4", "mapname"=>"q3ctf1", "sv_hostname"=>"Lightning CTF", "sv_minRate"=>"0", "sv_maxRate"=>"25000", "sv_dlRate"=>"1000", "sv_minPing"=>"0", "sv_maxPing"=>"0", "sv_floodProtect"=>"1", "sv_allowDownload"=>"1", "bot_minplayers"=>"2", " Administrator"=>"Jordon", " E-mail"=>"admin@matchlessgaming.com", " Location"=>"Chicago, IL", " Website"=>"matchlessgaming.com", "g_maxGameClients"=>"0", "capturelimit"=>"8", "gamename"=>"baseq3", "g_needpass"=>"0", "Score_Time"=>"10:17", "Score_Blue"=>"5", "Score_Red"=>"2\n56 17 \"^1+.+\n35 39 \"^8k^7o^8s\n66 115 \"danimad\n56 24 \"^2ro^3M^2eP\n39 33 \"^1DECAP\n0 70 \"^8Firestorm\n39 74 \"DontShootMe\n0 28 \"AttAckA\n0 13 \"^3[^5GI^3]^4Ronin\n56 47 \"^4-^5=^7PDG^5=^4-^7FuB^0^\n66 21 \"gooy\n66 39 \"Gun-Shy^1!!!!!!!\n0 70 \"^0Shadow^1-^9Death\n66 100 \"DarkWarrior\n23 55 \"Nadia\n39 12 \"Tilman\n0 66 \"ExcessivePlayer\n67 34 \"maracas\n66 80 \"DaZe\n66 21 \"Lord ^4Br^7iti^1sh\n0 15 \"^0DevilScream\n39 93 \"^3ffm^5cobalt\n9 55 \"^0Mary Poppins\n0 67 \"ter\n2 30 \"THErAPIST"}'
[*] Scanned 1 of 1 hosts (100% complete)
[*] Auxiliary module execution completed
msf auxiliary(server_info) > services

Services
========

host port proto name state info
---- ---- ----- ---- ----- ----
216.231.132.111 27960 udp quake open ---
- '{"sv_maxclients"=>"32", "sv_privateClients"=>"0", "version"=>"Q3 1.32c linux-i386
May 8 2009", "com_protocol"=>"71", "protocol"=>"68", "dmflags"=>"0", "fraglimit"=>"20",
"timelimit"=>"20", "g_gametype"=>"4", "mapname"=>"q3ctf1", "sv_hostname"=>"Lightning
CTF", "sv_minRate"=>"0", "sv_maxRate"=>"25000", "sv_dlRate"=>"1000", "sv_minPing"=>"0",
"sv_maxPing"=>"0", "sv_floodProtect"=>"1", "sv_allowDownload"=>"1", "bot_minplayers"=>"2",
" Administrator"=>"Jordon", " E-mail"=>"admin@matchlessgaming.com", " Location"=>"Chicago,
IL", " Website"=>"matchlessgaming.com", "g_maxGameClients"=>"0", "capturelimit"=>"8",
"gamename"=>"baseq3", "g_needpass"=>"0", "Score_Time"=>"10:17", "Score_Blue"=>"5",
"Score_Red"=>"2\n56 17 \"^1+.+\n35 39 \"^8k^7o^8s\n66 115 \"danimad\n56 24 \"^2ro^3M^2eP\n39
33 \"^1DECAP\n0 70 \"^8Firestorm\n39 74 \"DontShootMe\n0 28 \"AttAckA\n0 13 \"^3[^5GI^3]^4Ronin\n56
47 \"^4-^5=^7PDG^5=^4-^7FuB^0^\n66 21 \"gooy\n66 39 \"Gun-Shy^1!!!!!!!\n0 70 \"^0Shadow^1-^9Death\n66
100 \"DarkWarrior\n23 55 \"Nadia\n39 12 \"Tilman\n0 66 \"ExcessivePlayer\n67 34
\"maracas\n66 80 \"DaZe\n66 21 \"Lord ^4Br^7iti^1sh\n0 15 \"^0DevilScream\n39 93
\"^3ffm^5cobalt\n9 55 \"^0Mary Poppins\n0 67 \"ter\n2 30 \"THErAPIST"}'

```