From: michael <michael@82007160-df01-0410-b94d-b575c5fd34c7>
Date: Thu, 28 May 2015 14:57:20 +0000 (+0000)
Subject: - HOPM can now detect Dreamboxes with default root passwords. Patch by Gavin Hanover... 
X-Git-Tag: 1.0.7~31
X-Git-Url: http://git.serene-ircd.net/?a=commitdiff_plain;h=e984667af93fa67a49b599454a925555d656984d;p=hopm.git

- HOPM can now detect Dreamboxes with default root passwords. Patch by Gavin Hanover (EFnet)


git-svn-id: svn://svn.ircd-hybrid.org/svnroot/hopm/branches/1.0.x@5997 82007160-df01-0410-b94d-b575c5fd34c7
---

diff --git a/NEWS b/NEWS
index d584417..7aca2ec 100644
--- a/NEWS
+++ b/NEWS
@@ -1,3 +1,7 @@
+-- Noteworthy changes in version 1.0.7 (2015-??-??)
+o) HOPM can now detect Dreamboxes with default root passwords
+
+
 -- Noteworthy changes in version 1.0.6 (2015-05-27)
 o) HOPM now catches MikroTik HttpProxies
 
diff --git a/doc/reference.conf b/doc/reference.conf
index 7e6b5cd..4319bb3 100644
--- a/doc/reference.conf
+++ b/doc/reference.conf
@@ -476,6 +476,8 @@ scanner {
 	 */
 	protocol = WINGATE:23;
 
+	protocol = DREAMBOX:23;
+
 	/*
 	 * The HTTP POST protocol, often dismissed when writing the access
 	 * controls for proxies, but sadly can still be used to abused.
diff --git a/src/config-lexer.l b/src/config-lexer.l
index 1d17e2d..c5ae27f 100644
--- a/src/config-lexer.l
+++ b/src/config-lexer.l
@@ -192,6 +192,12 @@ ROUTER                  {
                           return PROTOCOLTYPE;
                         }
 
+DREAMBOX                {
+                          yylval.number = OPM_TYPE_DREAMBOX;
+                          return PROTOCOLTYPE;
+                        }
+
+
 
 [0-9]+                  {
                            yylval.number=atoi(yytext);
diff --git a/src/libopm/src/libopm.c b/src/libopm/src/libopm.c
index e91594e..45984bc 100644
--- a/src/libopm/src/libopm.c
+++ b/src/libopm/src/libopm.c
@@ -89,7 +89,8 @@ static OPM_PROTOCOL_T OPM_PROTOCOLS[] =
   { OPM_TYPE_SOCKS5,   libopm_proxy_socks5_write,   NULL },
   { OPM_TYPE_ROUTER,   libopm_proxy_router_write,   NULL },
   { OPM_TYPE_WINGATE,  libopm_proxy_wingate_write,  NULL },
-  { OPM_TYPE_HTTPPOST, libopm_proxy_httppost_write, NULL }
+  { OPM_TYPE_HTTPPOST, libopm_proxy_httppost_write, NULL },
+  { OPM_TYPE_DREAMBOX, libopm_proxy_dreambox_write, NULL }
 };
 
 /* opm_create
diff --git a/src/libopm/src/opm_types.h b/src/libopm/src/opm_types.h
index b83a40a..d01ccaa 100644
--- a/src/libopm/src/opm_types.h
+++ b/src/libopm/src/opm_types.h
@@ -24,6 +24,7 @@
 #define OPM_TYPE_WINGATE         4
 #define OPM_TYPE_ROUTER          5
 #define OPM_TYPE_HTTPPOST        6
+#define OPM_TYPE_DREAMBOX        7
 
 /* States */
 #define OPM_STATE_UNESTABLISHED  1
diff --git a/src/libopm/src/proxy.c b/src/libopm/src/proxy.c
index 92a770f..e69a622 100644
--- a/src/libopm/src/proxy.c
+++ b/src/libopm/src/proxy.c
@@ -239,3 +239,34 @@ libopm_proxy_httppost_write(OPM_T *scanner, OPM_SCAN_T *scan, OPM_CONNECTION_T *
 
   return OPM_SUCCESS;
 }
+
+/*
+ * Dreambox scanning
+ *
+ * Some dreambox machines have 'dreambox' as the password, and would allow
+ * full root access to telnet or install bouncers.
+ */
+int
+libopm_proxy_dreambox_write(OPM_T *scanner, OPM_SCAN_T *scan, OPM_CONNECTION_T *conn)
+{
+  size_t len;
+  int scan_port;
+  char *scan_ip;
+
+  scan_ip = (char *)libopm_config(scanner->config, OPM_CONFIG_SCAN_IP);
+  scan_port = *(int *)libopm_config(scanner->config, OPM_CONFIG_SCAN_PORT);
+
+  len = snprintf(SENDBUF, SENDBUFLEN, "root\r\n");
+  send(conn->fd, SENDBUF, len, 0);
+
+  len = snprintf(SENDBUF, SENDBUFLEN, "dreambox\r\n");
+  send(conn->fd, SENDBUF, len, 0);
+
+  len = snprintf(SENDBUF, SENDBUFLEN, "telnet %s %d\r\n", scan_ip, scan_port);
+  send(conn->fd, SENDBUF, len, 0);
+
+  len = snprintf(SENDBUF, SENDBUFLEN, "nc %s %d\r\n", scan_ip, scan_port);
+  send(conn->fd, SENDBUF, len, 0);
+
+  return OPM_SUCCESS;
+}
diff --git a/src/libopm/src/proxy.h b/src/libopm/src/proxy.h
index dae8bc3..4fbc1e8 100644
--- a/src/libopm/src/proxy.h
+++ b/src/libopm/src/proxy.h
@@ -9,4 +9,5 @@ int libopm_proxy_socks5_write(OPM_T *, OPM_SCAN_T *, OPM_CONNECTION_T *);
 int libopm_proxy_wingate_write(OPM_T *, OPM_SCAN_T *, OPM_CONNECTION_T *);
 int libopm_proxy_router_write(OPM_T *, OPM_SCAN_T *, OPM_CONNECTION_T *);
 int libopm_proxy_httppost_write(OPM_T *, OPM_SCAN_T *, OPM_CONNECTION_T *);
+int libopm_proxy_dreambox_write(OPM_T *, OPM_SCAN_T *, OPM_CONNECTION_T *);
 #endif /* PROXY_H */
diff --git a/src/scan.c b/src/scan.c
index 5faf222..1e9df65 100644
--- a/src/scan.c
+++ b/src/scan.c
@@ -150,7 +150,8 @@ scan_gettype(int protocol)
     { OPM_TYPE_SOCKS4,   "SOCKS4"   },
     { OPM_TYPE_SOCKS5,   "SOCKS5"   },
     { OPM_TYPE_WINGATE,  "WINGATE"  },
-    { OPM_TYPE_ROUTER,   "ROUTER"   }
+    { OPM_TYPE_ROUTER,   "ROUTER"   },
+    { OPM_TYPE_DREAMBOX, "DREAMBOX" }
   };
 
   for (unsigned int i = 0; i < (sizeof(protocols) / sizeof(struct protocol_assoc)); ++i)
diff --git a/src/stats.c b/src/stats.c
index 1f490b6..3bb096b 100644
--- a/src/stats.c
+++ b/src/stats.c
@@ -52,7 +52,8 @@ static struct StatsHash STATS_PROXIES[] =
   { OPM_TYPE_SOCKS4,   0, "SOCKS4"   },
   { OPM_TYPE_SOCKS5,   0, "SOCKS5"   },
   { OPM_TYPE_ROUTER,   0, "ROUTER"   },
-  { OPM_TYPE_WINGATE,  0, "WINGATE"  }
+  { OPM_TYPE_WINGATE,  0, "WINGATE"  },
+  { OPM_TYPE_DREAMBOX, 0, "DREAMBOX" }
 };