Initial commit

README.md

@@ -0,0 +1,105 @@
+# slpscan - service location protocol scanner
+
+## intro
+
+This is a research tool, created for looking deeper into SLP at the internet.
+Due current events we decided to publish a version of it, to support defenders and researchers tackle the current ESXi exploitation scheme.
+
+## usage
+Show all supported functions  
+```
+./slpscan.py -m ?
+----------------------------------------------------------------------
+SLPv1 Modes                    Operation       Description
+----------------------------------------------------------------------
+svc_req_v1                     1
+svc_reply_v1                   2
+svc_attr_req_v1                6
+svc_attr_reply_v1              7
+svc_type_req_v1                9
+svc_type_reply_v1              10
+----------------------------------------------------------------------
+SLPv2 Modes                    Operation       Description
+----------------------------------------------------------------------
+svc_req_v2                     1
+svc_reply_v2                   2
+svc_attr_req_v2                6
+svc_attr_reply_v2              7
+svc_type_req_v2                9
+svc_type_reply_v2              10
+```
+
+Do slp svc req v2   
+`./slpscan.py -l 192.168.170.50 -m svc_req_v2`
+
+Do slp svc type req v1  
+`./slpscan.py -l 192.168.170.50 -m svc_type_req_v1`
+
+
+Do slp attribute req for vmware v2
+`./slpscan.py -l 192.168.170.50 -m svc_attr_req_v2`
+
+Show supported probes
+```
+./slpscan.py -P?
+
+SLP Request               | Brief                              | Devices      
+-------------------------------------------------------------------------------
+svc_type_req_holder_v1    | example pkt, svc_type_req_v1       |              
+svc_attr_req_holder_v1    | example request, svc_attr_req_v1   |              
+svc_req_holder_v2         | example pkt, svc_req_v2            |              
+svc_type_req_holder_v2    | example pkt, svc_type_req_v2       |              
+svc_attr_req_holder_v2    | example pkt, svc_attr_req_v2       |              
+VMWARE_SVC_Request_https  | service:https                      |          
+
+```
+
+For SLP identification against ESXi Hosts use the probe published within the release:  
+
+```
+./slpscan.py -l <ip> -P VMWARE_SVC_Request_https
+```
+
+If you have a datacenter and need to check a big list of hosts use the -L option. 
+
+If you have a specific probe you can easily add it to the probe json file in the libs directory. There are already several examples to do so.
+
+General help:
+
+```
+usage: slpscan.py [-h] [-l HOST] [-L HOSTLIST] [-p PORT] [-t THRCNT] [-m SLP_MODE]
+                     [-P PROBE_MODE] [-d PKT_DELAY] [-T TIMEOUT] [-o OUTFILE] [-oj OUTFILE_JSON]
+                     [-r UNRANDOM] [-R RANDOMIP]
+
+service location protocol 0.3.7 by dash in published 2023
+
+options:
+  -h, --help            show this help message and exit
+  -l HOST, --host HOST  host to check version
+  -L HOSTLIST, --hostlist HOSTLIST
+                        hostlist to check
+  -p PORT, --port PORT  slp port (default:427)
+  -t THRCNT, --threads THRCNT
+                        how many threads
+  -m SLP_MODE, --slp-mode SLP_MODE
+                        what attack mode to choose, ? for list
+  -P PROBE_MODE, --probe-mode PROBE_MODE
+                        what probe to send, ? for list
+  -d PKT_DELAY, --packet-delay PKT_DELAY
+                        set the delay(in seconds) a packet is sent, delay is per thread (1s and
+                        10 threads, each second 10 threads are working)
+  -T TIMEOUT, --timeout TIMEOUT
+                        timeout of socket recv
+  -o OUTFILE, --outfile OUTFILE
+                        outfile in txt format
+  -oj OUTFILE_JSON, --outfile-json OUTFILE_JSON
+                        outfile in json format
+  -r UNRANDOM, --unrandom UNRANDOM
+                        disable random targetlist
+  -R RANDOMIP, --randomIP RANDOMIP
+                        generate random ips on the fly
+```
+
+# outro
+
+This tool is part of an ongoing research conducted by Marco Lux (ping@curesec.com) and Pedro Umbelino (pedro.umbelino@bitsight.com).