{"action":"created","comment":{"url":"https://api.github.com/repos/rapid7/metasploit-framework/pulls/comments/38042822","id":38042822,"diff_hunk":"@@ -0,0 +1,45 @@\n+##\n+# This module requires Metasploit: http://metasploit.com/download\n+# Current source: https://github.com/rapid7/metasploit-framework\n+##\n+\n+require 'msf/core'\n+\n+class Metasploit3 < Msf::Auxiliary\n+  include Msf::Auxiliary::Report\n+  include Msf::Auxiliary::UDPScanner\n+  include Msf::Auxiliary::MDNS\n+\n+  def initialize(info = {})\n+    super(\n+      update_info(\n+        info,\n+        'Name'           => 'mDNS Query',\n+        'Description'    => %q(\n+          This module sends mDNS queries, which are really just normal UDP DNS\n+          queries done (usually) over multicast on a different port, 5353.\n+        ),\n+        'Author'         =>\n+          [\n+            'Jon Hart <jon_hart[at]rapid7.com>'\n+          ],\n+        'License'        => MSF_LICENSE\n+      )\n+    )\n+  end\n+\n+  def scanner_prescan(batch)\n+    print_status(\"Sending mDNS #{query_type_name} #{query_class_name} queries for \" +\n+                 \"#{query_name} to #{batch[0]}->#{batch[-1]} port #{rport} (#{batch.length} hosts)\")\n+    @results = {}\n+  end\n+\n+  def scanner_postscan(_batch)\n+    @results.each_pair do |peer, resps|\n+      resps.each do |resp|\n+        resp_message = Resolv::DNS::Message.decode(resp)\n+        print_good(\"#{peer} responded with #{resp_message.inspect}\")","path":"modules/auxiliary/scanner/mdns/query.rb","position":41,"original_position":41,"commit_id":"c257f8945b888174ce74a9d54985a9198b41b107","original_commit_id":"c257f8945b888174ce74a9d54985a9198b41b107","user":{"login":"hmoore-r7","id":1171392,"avatar_url":"https://avatars.githubusercontent.com/u/1171392?v=3","gravatar_id":"","url":"https://api.github.com/users/hmoore-r7","html_url":"https://github.com/hmoore-r7","followers_url":"https://api.github.com/users/hmoore-r7/followers","following_url":"https://api.github.com/users/hmoore-r7/following{/other_user}","gists_url":"https://api.github.com/users/hmoore-r7/gists{/gist_id}","starred_url":"https://api.github.com/users/hmoore-r7/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/hmoore-r7/subscriptions","organizations_url":"https://api.github.com/users/hmoore-r7/orgs","repos_url":"https://api.github.com/users/hmoore-r7/repos","events_url":"https://api.github.com/users/hmoore-r7/events{/privacy}","received_events_url":"https://api.github.com/users/hmoore-r7/received_events","type":"User","site_admin":false},"body":"Is it worth recording anything into the database here? A report_service() seems useful at the minimum","created_at":"2015-08-26T22:24:42Z","updated_at":"2015-08-26T22:24:42Z","html_url":"https://github.com/rapid7/metasploit-framework/pull/5840#discussion_r38042822","pull_request_url":"https://api.github.com/repos/rapid7/metasploit-framework/pulls/5840","_links":{"self":{"href":"https://api.github.com/repos/rapid7/metasploit-framework/pulls/comments/38042822"},"html":{"href":"https://github.com/rapid7/metasploit-framework/pull/5840#discussion_r38042822"},"pull_request":{"href":"https://api.github.com/repos/rapid7/metasploit-framework/pulls/5840"}}},"pull_request":{"url":"https://api.github.com/repos/rapid7/metasploit-framework/pulls/5840","id":42384905,"html_url":"https://github.com/rapid7/metasploit-framework/pull/5840","diff_url":"https://github.com/rapid7/metasploit-framework/pull/5840.diff","patch_url":"https://github.com/rapid7/metasploit-framework/pull/5840.patch","issue_url":"https://api.github.com/repos/rapid7/metasploit-framework/issues/5840","number":5840,"state":"open","locked":false,"title":"mDNS and LLMNR query modules","user":{"login":"jhart-r7","id":3869433,"avatar_url":"https://avatars.githubusercontent.com/u/3869433?v=3","gravatar_id":"","url":"https://api.github.com/users/jhart-r7","html_url":"https://github.com/jhart-r7","followers_url":"https://api.github.com/users/jhart-r7/followers","following_url":"https://api.github.com/users/jhart-r7/following{/other_user}","gists_url":"https://api.github.com/users/jhart-r7/gists{/gist_id}","starred_url":"https://api.github.com/users/jhart-r7/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/jhart-r7/subscriptions","organizations_url":"https://api.github.com/users/jhart-r7/orgs","repos_url":"https://api.github.com/users/jhart-r7/repos","events_url":"https://api.github.com/users/jhart-r7/events{/privacy}","received_events_url":"https://api.github.com/users/jhart-r7/received_events","type":"User","site_admin":false},"body":"This was the start of some research I had started last year (despite the commit history) and never really completed.  Today I cleaned it up, did some basic re-testing and figure it is good enough for now and I'd rather get this out than let it stagnate.\r\n\r\nSo, basically this introduces two new modules for querying mDNS and LLMNR endpoints.  \r\n\r\n# Concerns\r\n\r\nThere are some issues with this that I can't figure out yet, or I can't figure out if they matter or not:\r\n\r\n 1. These send to multicast addresses by default, but perhaps not in ways that'll play nice on all networks.  For example, if the sending host wasn't already joined to the multicast group, it may not get responses.\r\n 2. Similarly, some hosts depending on how they are configured/implemented will only respond when contacted through the multicast address.  Others will only respond when contacted directly.  Others will respond regardless of multicast/direct.  \r\n 3.  Similarly, there when using the default `RHOSTS` multicast address for mDNS of 224.0.0.251, I have a repeatable situation where a host _does_ respond but the module does not see the response.  I feel like something in `UDPScanner` is going awry.  I could likely provide pcaps to anyone willing to help debug this.  I believe something like https://github.com/rapid7/metasploit-framework/blob/ab94f15a604a43524da9db6e3a6d511706cab044/modules/auxiliary/spoof/llmnr/llmnr_response.rb#L181-L195 is what is needed, but that makes using `UDPScanner` harder (right?)\r\n 4. All LLMNR implementations that I've seen will *only* respond when the source address is in the same broadcast domain\r\n 5.  I realize that this may be better off as 4 separate PRs:\r\n  1. New mDNS mixin\r\n  2. mDNS module\r\n  3. LLMNR module\r\n  4. Other cleanup\r\n\r\n I'd rather not split this up now, especially because most of this is wrappers around existing framework code.\r\n  \r\n\r\n# Testing\r\n\r\nTBD\r\n\r\n","created_at":"2015-08-13T18:48:52Z","updated_at":"2015-08-26T22:24:42Z","closed_at":null,"merged_at":null,"merge_commit_sha":"667a2deab09da68e40860df91b106d88990ed5c4","assignee":null,"milestone":null,"commits_url":"https://api.github.com/repos/rapid7/metasploit-framework/pulls/5840/commits","review_comments_url":"https://api.github.com/repos/rapid7/metasploit-framework/pulls/5840/comments","review_comment_url":"https://api.github.com/repos/rapid7/metasploit-framework/pulls/comments{/number}","comments_url":"https://api.github.com/repos/rapid7/metasploit-framework/issues/5840/comments","statuses_url":"https://api.github.com/repos/rapid7/metasploit-framework/statuses/c257f8945b888174ce74a9d54985a9198b41b107","head":{"label":"jhart-r7:llmnr-mdns-query","ref":"llmnr-mdns-query","sha":"c257f8945b888174ce74a9d54985a9198b41b107","user":{"login":"jhart-r7","id":3869433,"avatar_url":"https://avatars.githubusercontent.com/u/3869433?v=3","gravatar_id":"","url":"https://api.github.com/users/jhart-r7","html_url":"https://github.com/jhart-r7","followers_url":"https://api.github.com/users/jhart-r7/followers","following_url":"https://api.github.com/users/jhart-r7/following{/other_user}","gists_url":"https://api.github.com/users/jhart-r7/gists{/gist_id}","starred_url":"https://api.github.com/users/jhart-r7/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/jhart-r7/subscriptions","organizations_url":"https://api.github.com/users/jhart-r7/orgs","repos_url":"https://api.github.com/users/jhart-r7/repos","events_url":"https://api.github.com/users/jhart-r7/events{/privacy}","received_events_url":"https://api.github.com/users/jhart-r7/received_events","type":"User","site_admin":false},"repo":{"id":9270398,"name":"metasploit-framework","full_name":"jhart-r7/metasploit-framework","owner":{"login":"jhart-r7","id":3869433,"avatar_url":"https://avatars.githubusercontent.com/u/3869433?v=3","gravatar_id":"","url":"https://api.github.com/users/jhart-r7","html_url":"https://github.com/jhart-r7","followers_url":"https://api.github.com/users/jhart-r7/followers","following_url":"https://api.github.com/users/jhart-r7/following{/other_user}","gists_url":"https://api.github.com/users/jhart-r7/gists{/gist_id}","starred_url":"https://api.github.com/users/jhart-r7/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/jhart-r7/subscriptions","organizations_url":"https://api.github.com/users/jhart-r7/orgs","repos_url":"https://api.github.com/users/jhart-r7/repos","events_url":"https://api.github.com/users/jhart-r7/events{/privacy}","received_events_url":"https://api.github.com/users/jhart-r7/received_events","type":"User","site_admin":false},"private":false,"html_url":"https://github.com/jhart-r7/metasploit-framework","description":"Metasploit Framework","fork":true,"url":"https://api.github.com/repos/jhart-r7/metasploit-framework","forks_url":"https://api.github.com/repos/jhart-r7/metasploit-framework/forks","keys_url":"https://api.github.com/repos/jhart-r7/metasploit-framework/keys{/key_id}","collaborators_url":"https://api.github.com/repos/jhart-r7/metasploit-framework/collaborators{/collaborator}","teams_url":"https://api.github.com/repos/jhart-r7/metasploit-framework/teams","hooks_url":"https://api.github.com/repos/jhart-r7/metasploit-framework/hooks","issue_events_url":"https://api.github.com/repos/jhart-r7/metasploit-framework/issues/events{/number}","events_url":"https://api.github.com/repos/jhart-r7/metasploit-framework/events","assignees_url":"https://api.github.com/repos/jhart-r7/metasploit-framework/assignees{/user}","branches_url":"https://api.github.com/repos/jhart-r7/metasploit-framework/branches{/branch}","tags_url":"https://api.github.com/repos/jhart-r7/metasploit-framework/tags","blobs_url":"https://api.github.com/repos/jhart-r7/metasploit-framework/git/blobs{/sha}","git_tags_url":"https://api.github.com/repos/jhart-r7/metasploit-framework/git/tags{/sha}","git_refs_url":"https://api.github.com/repos/jhart-r7/metasploit-framework/git/refs{/sha}","trees_url":"https://api.github.com/repos/jhart-r7/metasploit-framework/git/trees{/sha}","statuses_url":"https://api.github.com/repos/jhart-r7/metasploit-framework/statuses/{sha}","languages_url":"https://api.github.com/repos/jhart-r7/metasploit-framework/languages","stargazers_url":"https://api.github.com/repos/jhart-r7/metasploit-framework/stargazers","contributors_url":"https://api.github.com/repos/jhart-r7/metasploit-framework/contributors","subscribers_url":"https://api.github.com/repos/jhart-r7/metasploit-framework/subscribers","subscription_url":"https://api.github.com/repos/jhart-r7/metasploit-framework/subscription","commits_url":"https://api.github.com/repos/jhart-r7/metasploit-framework/commits{/sha}","git_commits_url":"https://api.github.com/repos/jhart-r7/metasploit-framework/git/commits{/sha}","comments_url":"https://api.github.com/repos/jhart-r7/metasploit-framework/comments{/number}","issue_comment_url":"https://api.github.com/repos/jhart-r7/metasploit-framework/issues/comments{/number}","contents_url":"https://api.github.com/repos/jhart-r7/metasploit-framework/contents/{+path}","compare_url":"https://api.github.com/repos/jhart-r7/metasploit-framework/compare/{base}...{head}","merges_url":"https://api.github.com/repos/jhart-r7/metasploit-framework/merges","archive_url":"https://api.github.com/repos/jhart-r7/metasploit-framework/{archive_format}{/ref}","downloads_url":"https://api.github.com/repos/jhart-r7/metasploit-framework/downloads","issues_url":"https://api.github.com/repos/jhart-r7/metasploit-framework/issues{/number}","pulls_url":"https://api.github.com/repos/jhart-r7/metasploit-framework/pulls{/number}","milestones_url":"https://api.github.com/repos/jhart-r7/metasploit-framework/milestones{/number}","notifications_url":"https://api.github.com/repos/jhart-r7/metasploit-framework/notifications{?since,all,participating}","labels_url":"https://api.github.com/repos/jhart-r7/metasploit-framework/labels{/name}","releases_url":"https://api.github.com/repos/jhart-r7/metasploit-framework/releases{/id}","created_at":"2013-04-07T02:59:51Z","updated_at":"2014-12-19T01:21:47Z","pushed_at":"2015-08-20T17:06:27Z","git_url":"git://github.com/jhart-r7/metasploit-framework.git","ssh_url":"git@github.com:jhart-r7/metasploit-framework.git","clone_url":"https://github.com/jhart-r7/metasploit-framework.git","svn_url":"https://github.com/jhart-r7/metasploit-framework","homepage":"http://www.metasploit.com/","size":322847,"stargazers_count":0,"watchers_count":0,"language":"Ruby","has_issues":false,"has_downloads":true,"has_wiki":true,"has_pages":false,"forks_count":0,"mirror_url":null,"open_issues_count":0,"forks":0,"open_issues":0,"watchers":0,"default_branch":"master"}},"base":{"label":"rapid7:master","ref":"master","sha":"677ec341dde050e16ffbf97bf8f0602999cf8c4c","user":{"login":"rapid7","id":1013671,"avatar_url":"https://avatars.githubusercontent.com/u/1013671?v=3","gravatar_id":"","url":"https://api.github.com/users/rapid7","html_url":"https://github.com/rapid7","followers_url":"https://api.github.com/users/rapid7/followers","following_url":"https://api.github.com/users/rapid7/following{/other_user}","gists_url":"https://api.github.com/users/rapid7/gists{/gist_id}","starred_url":"https://api.github.com/users/rapid7/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/rapid7/subscriptions","organizations_url":"https://api.github.com/users/rapid7/orgs","repos_url":"https://api.github.com/users/rapid7/repos","events_url":"https://api.github.com/users/rapid7/events{/privacy}","received_events_url":"https://api.github.com/users/rapid7/received_events","type":"Organization","site_admin":false},"repo":{"id":2293158,"name":"metasploit-framework","full_name":"rapid7/metasploit-framework","owner":{"login":"rapid7","id":1013671,"avatar_url":"https://avatars.githubusercontent.com/u/1013671?v=3","gravatar_id":"","url":"https://api.github.com/users/rapid7","html_url":"https://github.com/rapid7","followers_url":"https://api.github.com/users/rapid7/followers","following_url":"https://api.github.com/users/rapid7/following{/other_user}","gists_url":"https://api.github.com/users/rapid7/gists{/gist_id}","starred_url":"https://api.github.com/users/rapid7/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/rapid7/subscriptions","organizations_url":"https://api.github.com/users/rapid7/orgs","repos_url":"https://api.github.com/users/rapid7/repos","events_url":"https://api.github.com/users/rapid7/events{/privacy}","received_events_url":"https://api.github.com/users/rapid7/received_events","type":"Organization","site_admin":false},"private":false,"html_url":"https://github.com/rapid7/metasploit-framework","description":"Metasploit Framework","fork":false,"url":"https://api.github.com/repos/rapid7/metasploit-framework","forks_url":"https://api.github.com/repos/rapid7/metasploit-framework/forks","keys_url":"https://api.github.com/repos/rapid7/metasploit-framework/keys{/key_id}","collaborators_url":"https://api.github.com/repos/rapid7/metasploit-framework/collaborators{/collaborator}","teams_url":"https://api.github.com/repos/rapid7/metasploit-framework/teams","hooks_url":"https://api.github.com/repos/rapid7/metasploit-framework/hooks","issue_events_url":"https://api.github.com/repos/rapid7/metasploit-framework/issues/events{/number}","events_url":"https://api.github.com/repos/rapid7/metasploit-framework/events","assignees_url":"https://api.github.com/repos/rapid7/metasploit-framework/assignees{/user}","branches_url":"https://api.github.com/repos/rapid7/metasploit-framework/branches{/branch}","tags_url":"https://api.github.com/repos/rapid7/metasploit-framework/tags","blobs_url":"https://api.github.com/repos/rapid7/metasploit-framework/git/blobs{/sha}","git_tags_url":"https://api.github.com/repos/rapid7/metasploit-framework/git/tags{/sha}","git_refs_url":"https://api.github.com/repos/rapid7/metasploit-framework/git/refs{/sha}","trees_url":"https://api.github.com/repos/rapid7/metasploit-framework/git/trees{/sha}","statuses_url":"https://api.github.com/repos/rapid7/metasploit-framework/statuses/{sha}","languages_url":"https://api.github.com/repos/rapid7/metasploit-framework/languages","stargazers_url":"https://api.github.com/repos/rapid7/metasploit-framework/stargazers","contributors_url":"https://api.github.com/repos/rapid7/metasploit-framework/contributors","subscribers_url":"https://api.github.com/repos/rapid7/metasploit-framework/subscribers","subscription_url":"https://api.github.com/repos/rapid7/metasploit-framework/subscription","commits_url":"https://api.github.com/repos/rapid7/metasploit-framework/commits{/sha}","git_commits_url":"https://api.github.com/repos/rapid7/metasploit-framework/git/commits{/sha}","comments_url":"https://api.github.com/repos/rapid7/metasploit-framework/comments{/number}","issue_comment_url":"https://api.github.com/repos/rapid7/metasploit-framework/issues/comments{/number}","contents_url":"https://api.github.com/repos/rapid7/metasploit-framework/contents/{+path}","compare_url":"https://api.github.com/repos/rapid7/metasploit-framework/compare/{base}...{head}","merges_url":"https://api.github.com/repos/rapid7/metasploit-framework/merges","archive_url":"https://api.github.com/repos/rapid7/metasploit-framework/{archive_format}{/ref}","downloads_url":"https://api.github.com/repos/rapid7/metasploit-framework/downloads","issues_url":"https://api.github.com/repos/rapid7/metasploit-framework/issues{/number}","pulls_url":"https://api.github.com/repos/rapid7/metasploit-framework/pulls{/number}","milestones_url":"https://api.github.com/repos/rapid7/metasploit-framework/milestones{/number}","notifications_url":"https://api.github.com/repos/rapid7/metasploit-framework/notifications{?since,all,participating}","labels_url":"https://api.github.com/repos/rapid7/metasploit-framework/labels{/name}","releases_url":"https://api.github.com/repos/rapid7/metasploit-framework/releases{/id}","created_at":"2011-08-30T06:13:20Z","updated_at":"2015-08-26T21:10:25Z","pushed_at":"2015-08-26T22:17:22Z","git_url":"git://github.com/rapid7/metasploit-framework.git","ssh_url":"git@github.com:rapid7/metasploit-framework.git","clone_url":"https://github.com/rapid7/metasploit-framework.git","svn_url":"https://github.com/rapid7/metasploit-framework","homepage":"http://www.metasploit.com/","size":1086136,"stargazers_count":4353,"watchers_count":4353,"language":"Ruby","has_issues":true,"has_downloads":true,"has_wiki":true,"has_pages":true,"forks_count":3359,"mirror_url":null,"open_issues_count":232,"forks":3359,"open_issues":232,"watchers":4353,"default_branch":"master"}},"_links":{"self":{"href":"https://api.github.com/repos/rapid7/metasploit-framework/pulls/5840"},"html":{"href":"https://github.com/rapid7/metasploit-framework/pull/5840"},"issue":{"href":"https://api.github.com/repos/rapid7/metasploit-framework/issues/5840"},"comments":{"href":"https://api.github.com/repos/rapid7/metasploit-framework/issues/5840/comments"},"review_comments":{"href":"https://api.github.com/repos/rapid7/metasploit-framework/pulls/5840/comments"},"review_comment":{"href":"https://api.github.com/repos/rapid7/metasploit-framework/pulls/comments{/number}"},"commits":{"href":"https://api.github.com/repos/rapid7/metasploit-framework/pulls/5840/commits"},"statuses":{"href":"https://api.github.com/repos/rapid7/metasploit-framework/statuses/c257f8945b888174ce74a9d54985a9198b41b107"}}}}