Don't run_host unless check returns vulnerable; report_service

bug/bundler_fix
Jon Hart 2015-12-09 18:33:40 -08:00
parent 624e5aeffa
commit 4cc7853ad8
No known key found for this signature in database
GPG Key ID: 2FA9F0A3AFA8E9D3
1 changed files with 15 additions and 2 deletions

View File

@ -104,13 +104,24 @@ class Metasploit3 < Msf::Auxiliary
connect
data = send_command(['INFO'])
disconnect
if data && data.include?('redis_mode')
if data && /redis_version:(?<redis_version>\S+)/ =~ data
report_redis(redis_version)
Exploit::CheckCode::Vulnerable
else
Exploit::CheckCode::Safe
end
end
def report_redis(version)
report_service(
host: rhost,
port: rport,
proto: 'tcp',
name: 'redis',
info: "version #{version}"
)
end
def peer
"#{rhost}:#{rport}"
end
@ -119,7 +130,9 @@ class Metasploit3 < Msf::Auxiliary
@upload_content = "\n\n#{IO.read(datastore['LocalFile'])}\n\n\n"
end
def run_host(ip)
def run_host(_ip)
return unless check == Exploit::CheckCode::Vulnerable
connect
unless (res = send_command(['PING']))
vprint_error("#{peer} -- did not respond to our redis PING")