Fix #6445, Unexpected HttpServer terminations

Fix #6445

Problem:
When an HttpServer instance is trying to register a resource that
is already taken, it causes all HttpServers to terminate, which
is not a desired behavior.

Root Cause:
It appears the Msf::Exploit::Remote::TcpServer#stop_service method
is causing the problem. When the service is being detected as an
HttpServer, the #stop method used actually causes all servers to
stop, not just for a specific one. This stopping route was
introduced in 04772c8946, when Juan
noticed that the java_rmi_server exploit could not be run again
after the first time.

Solution:
Special case the stopping routine on the module's level, and not
universal.
bug/bundler_fix
wchen-r7 2016-01-07 16:55:41 -06:00
parent eb0b66a4cf
commit 6a2b4c2530
2 changed files with 17 additions and 4 deletions

View File

@ -162,10 +162,6 @@ module Exploit::Remote::TcpServer
self.service.stop
end
if service.kind_of?(Rex::Proto::Http::Server)
service.stop
end
self.service = nil
rescue ::Exception
end

View File

@ -187,6 +187,23 @@ class Metasploit3 < Msf::Exploit::Remote
end
end
def cleanup
# Normally service termination should not be managed on the module's level, but this is a
# special case.
#
# Originally this special service termination routine was implemented in
# Exploit::Remote::TcpServer#stop_service, but that would actually cause all HttpServers to stop
# if one of them attempts to register a resource that is already taken, which seems to be a
# harsh punishment. This is why the fix is moved here.
#
# See references:
# https://github.com/rapid7/metasploit-framework/pull/4203
# https://github.com/rapid7/metasploit-framework/issues/6445
service.stop if service
super
end
def autofilter
return true
end