##
# This module requires Metasploit: https://metasploit.com/download
# Current source: https://github.com/rapid7/metasploit-framework
##

class MetasploitModule < Msf::Auxiliary
  include Msf::Exploit::Remote::Tcp
  include Msf::Auxiliary::Scanner
  include Msf::Auxiliary::Report

  def initialize
    super(
      'Name' => 'PcAnywhere TCP Service Discovery',
      'Description' => 'Discover active pcAnywhere services through TCP',
      'Author' => 'hdm',
      'License' => MSF_LICENSE
    )

    register_options(
      [
        Opt::RPORT(5631)
      ]
    )
  end

  def run_host(ip)
    begin
      connect
      sock.put("\x00\x00\x00\x00")
      res = sock.get_once(-1, 15)
      if not (res and res.index("Please press <Enter>"))
        disconnect
        return
      end

=begin
      sock.put( "\x6f\x06\xfe" )
      res = sock.get_once(-1, 15)

      sock.put("\x6f\x61\xff\x09\x00\x07\x00\x00\x01\xff\x00\x00\x07\x00")
      res = sock.get_once(-1, 15)

      sock.put("\x6f\x62\x00\x02\x00\x00\x00")
      res = sock.get_once(-1, 15)
      print_status(Rex::Text.to_hex_dump(res))
=end

      report_service(:host => rhost, :port => rport, :name => "pcanywhere_data", :info => "")
      print_good("#{Rex::Socket.to_authority(rhost, rport)} pcAnywhere data service")
    rescue ::Rex::ConnectionError, ::EOFError, ::Errno::ECONNRESET
    rescue ::Exception => e
      print_error("#{Rex::Socket.to_authority(rhost, rport)} Error: #{e.class} #{e} #{e.backtrace}")
    end
  end
end
