diff --git a/lib/msf/core/exploit/sunrpc.rb b/lib/msf/core/exploit/sunrpc.rb index 92e9af2293..18474bbbeb 100644 --- a/lib/msf/core/exploit/sunrpc.rb +++ b/lib/msf/core/exploit/sunrpc.rb @@ -70,7 +70,12 @@ module Exploit::Remote::SunRPC ret = rpcobj.create raise ::Rex::Proto::SunRPC::RPCError, "#{rhost}:#{rport} - SunRPC - No response to Portmap request" unless ret - arr = Rex::Encoder::XDR.decode!(ret, Integer, Integer, Integer, String, Integer, Integer) + begin + arr = Rex::Encoder::XDR.decode!(ret, Integer, Integer, Integer, String, Integer, Integer) + rescue Rex::ArgumentError + raise Rex::Proto::SunRPC::RPCError, "#{rhost}:#{rport} - SunRPC - XDR decoding failed in #{__callee__}" + end + if arr[1] != MSG_ACCEPTED || arr[4] != SUCCESS || arr[5] == 0 err = "#{rhost}:#{rport} - SunRPC - Portmap request failed: " err << 'Message not accepted' if arr[1] != MSG_ACCEPTED @@ -86,7 +91,12 @@ module Exploit::Remote::SunRPC ret = rpcobj.call(proc, buf, timeout) raise ::Rex::Proto::SunRPC::RPCError, "#{rhost}:#{rport} - SunRPC - No response to SunRPC call for procedure: #{proc}" unless ret - arr = Rex::Encoder::XDR.decode!(ret, Integer, Integer, Integer, String, Integer) + begin + arr = Rex::Encoder::XDR.decode!(ret, Integer, Integer, Integer, String, Integer) + rescue Rex::ArgumentError + raise Rex::Proto::SunRPC::RPCError, "#{rhost}:#{rport} - SunRPC - XDR decoding failed in #{__callee__}" + end + if arr[1] != MSG_ACCEPTED || arr[4] != SUCCESS progname = progresolv(rpcobj.program) err = "SunRPC call for program #{rpcobj.program} [#{progname}], procedure #{proc}, failed: " @@ -127,7 +137,13 @@ module Exploit::Remote::SunRPC # XXX: Incomplete. Just moved from Rex::Proto::SunRPC::Client def portmap_qry() ret = portmap_req() - arr = Rex::Encoder::XDR.decode!(ret, Integer, Integer, Integer, String, Integer) + + begin + arr = Rex::Encoder::XDR.decode!(ret, Integer, Integer, Integer, String, Integer) + rescue Rex::ArgumentError + raise Rex::Proto::SunRPC::RPCError, "#{rhost}:#{rport} - SunRPC - XDR decoding failed in #{__callee__}" + end + if arr[1] != MSG_ACCEPTED || arr[4] != SUCCESS || arr[5] == 0 progname = progresolv(rpcobj.program) err = "Query for program #{rpcobj.program} [#{progname}] failed: "