rapid7/metasploit-framework — pull request #4187 by BorjaMerino (2014-11-12 16:55:16+00:00)
Title: Add post-exploitation module to get FW filtering rules

This module makes some kind of TCP traceroute to get outbound-filtering rules. It will try to make a TCP connection to a certain public IP address (this IP does not need to be under your control) using different TTL incremental values. This way if you get an ICMP "time exceeded" from a public device you can deduce that the port is not filtered. Example:

msf post(outbound_ports) > exploit

[*] ICMP firewall IN rule established: Aceptar

[*] Testing port 4444...
[+] 1 192.168.144.1
[-] 2 *
[+] 3 81.46.0.157
[+] 4 94.142.103.157
[+] 5 213.140.38.113
[+] 6 213.140.38.114
[+] 7 84.16.15.250
[+] 8 213.140.38.221
[+] 9 84.16.15.81
[+] 10 94.142.122.253
[*] Testing port 8080...
[+] 1 192.168.144.1
[-] 2 *
[+] 3 81.46.0.157
[+] 4 94.142.103.157
[+] 5 213.140.38.113
[+] 6 213.140.38.114
[+] 7 84.16.15.250
[+] 8 213.140.38.157
[+] 9 94.142.124.58
[+] 10 94.142.123.1
[*] Post module execution completed

If you set the STOP option to true when a public IP responds with an ICMP packet, the script will not continue launching more connections (generating minimum noise).

msf post(outbound_ports) > set stop true
stop => true
msf post(outbound_ports) > exploit

[*] ICMP firewall IN rule established: Aceptar

[*] Testing port 4444...
[+] 1 192.168.144.1
[-] 2 *
[+] 3 81.46.0.157
[+] Public IP reached. The port 4444 is not filtered
[*] Testing port 8080...
[+] 1 192.168.144.1
[+] 2 81.46.0.157
[+] Public IP reached. The port 8080 is not filtered
[*] Post module execution completed