infosecn1nja
/
metasploit-framework
mirror of https://github.com/infosecn1nja/metasploit-framework.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Fixed stack trace bug & verified logic 

- Fixed stack trace bug when value of "packet" is nill.
- Verified logic of Oracle TNS Listener poisoning which requires an ACCEPT response to be marked as vulnerable.
bug/bundler_fix
Interference Security 2016-10-01 15:01:02 +05:30 committed by GitHub
parent 1283580c17
commit 4227cb76a8
1 changed files with 15 additions and 11 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

26
modules/auxiliary/scanner/oracle/tnspoison_checker.rb
View File

@ -42,18 +42,22 @@ class MetasploitModule < Msf::Auxiliary
send_packet = tns_packet("(CONNECT_DATA=(COMMAND=service_register_NSGR))")
sock.put(send_packet)
packet = sock.read(100)
hex_packet = Rex::Text.to_hex(packet, prefix = ':')
split_hex = hex_packet.split(":")
find_packet = /\(ERROR_STACK=\(ERROR=/ === packet
#find_packet == true ? print_error("#{ip}:#{rport} is not vulnerable ") : print_good("#{ip}:#{rport} is vulnerable")
if find_packet == true
print_error("#{ip}:#{rport} is not vulnerable")
elsif split_hex[5] == "02"
print_good("#{ip}:#{rport} is vulnerable")
elsif split_hex[5] == "04"
print_error("#{ip}:#{rport} is not vulnerable")
if packet != nil
hex_packet = Rex::Text.to_hex(packet, prefix = ':')
split_hex = hex_packet.split(":")
find_packet = /\(ERROR_STACK=\(ERROR=/ === packet
#find_packet == true ? print_error("#{ip}:#{rport} is not vulnerable ") : print_good("#{ip}:#{rport} is vulnerable")
if find_packet == true #TNS Packet returned ERROR
print_error("#{ip}:#{rport} is not vulnerable")
elsif split_hex[5] == "02" #TNS Packet Type: ACCEPT
print_good("#{ip}:#{rport} is vulnerable")
elsif split_hex[5] == "04" #TNS Packet Type: REFUSE
print_error("#{ip}:#{rport} is not vulnerable")
else #All other TNS packet types or non-TNS packet type response cannot guarantee vulnerability
print_error("#{ip}:#{rport} might not be vulnerable")
end
else
print_error("#{ip}:#{rport} might not be vulnerable")
print_error("#{ip}:#{rport} is not vulnerable")
end
# TODO: Module should report_vuln if this finding is solid.
rescue ::Rex::ConnectionError, ::Errno::EPIPE