Fix bad use of sock.get() and check() implementations
Many of these modules uses sock.get() when they meant get_once() and their HTTP-based checks were broken in some form. The response to the sock.get() was not being checked against nil, which would lead to stack traces when the service did not reply (a likely case given how malformed the HTTP requests were).bug/bundler_fix
parent
3868348045
commit
6e80481384
|
@ -156,7 +156,7 @@ class Metasploit3 < Msf::Exploit::Remote
|
||||||
# Establishes handshake with the server
|
# Establishes handshake with the server
|
||||||
def handshake
|
def handshake
|
||||||
sock.put(HANDSHAKE)
|
sock.put(HANDSHAKE)
|
||||||
return sock.get(datastore['RESPONSE_TIMEOUT'])
|
return sock.get_once(-1, datastore['RESPONSE_TIMEOUT'])
|
||||||
end
|
end
|
||||||
|
|
||||||
# Forges packet for JDWP protocol
|
# Forges packet for JDWP protocol
|
||||||
|
@ -173,7 +173,7 @@ class Metasploit3 < Msf::Exploit::Remote
|
||||||
|
|
||||||
# Reads packet response for JDWP protocol
|
# Reads packet response for JDWP protocol
|
||||||
def read_reply(timeout = default_timeout)
|
def read_reply(timeout = default_timeout)
|
||||||
response = sock.get(timeout)
|
response = sock.get_once(-1, timeout)
|
||||||
fail_with(Failure::TimeoutExpired, "#{peer} - Not received response") unless response
|
fail_with(Failure::TimeoutExpired, "#{peer} - Not received response") unless response
|
||||||
pktlen, id, flags, errcode = response.unpack('NNCn')
|
pktlen, id, flags, errcode = response.unpack('NNCn')
|
||||||
response.slice!(0..10)
|
response.slice!(0..10)
|
||||||
|
|
|
@ -59,11 +59,11 @@ class Metasploit3 < Msf::Exploit::Remote
|
||||||
buf = "\x20\x20\x201\x20\x20\x20\x20\x20\x201\necho #{sploit}\n"
|
buf = "\x20\x20\x201\x20\x20\x20\x20\x20\x201\necho #{sploit}\n"
|
||||||
|
|
||||||
sock.put(buf)
|
sock.put(buf)
|
||||||
banner = sock.get(3,3)
|
banner = sock.get_once
|
||||||
|
|
||||||
disconnect
|
disconnect
|
||||||
|
|
||||||
if (banner and banner =~ /#{sploit}/)
|
if banner.to_s.index(sploit)
|
||||||
return Exploit::CheckCode::Vulnerable
|
return Exploit::CheckCode::Vulnerable
|
||||||
end
|
end
|
||||||
return Exploit::CheckCode::Safe
|
return Exploit::CheckCode::Safe
|
||||||
|
@ -79,7 +79,7 @@ class Metasploit3 < Msf::Exploit::Remote
|
||||||
buf << "\n"
|
buf << "\n"
|
||||||
|
|
||||||
sock.put(buf)
|
sock.put(buf)
|
||||||
res = sock.get(-1,3)
|
res = sock.get_once
|
||||||
|
|
||||||
print_status(res.to_s)
|
print_status(res.to_s)
|
||||||
|
|
||||||
|
|
|
@ -56,9 +56,9 @@ class Metasploit3 < Msf::Exploit::Remote
|
||||||
|
|
||||||
def check
|
def check
|
||||||
connect
|
connect
|
||||||
banner = sock.get(-1,3)
|
banner = sock.get_once
|
||||||
disconnect
|
disconnect
|
||||||
if (banner =~ /Dream FTP Server/)
|
if (banner.to_s =~ /Dream FTP Server/)
|
||||||
return Exploit::CheckCode::Detected
|
return Exploit::CheckCode::Detected
|
||||||
end
|
end
|
||||||
return Exploit::CheckCode::Safe
|
return Exploit::CheckCode::Safe
|
||||||
|
|
|
@ -68,10 +68,10 @@ class Metasploit3 < Msf::Exploit::Remote
|
||||||
rand = Rex::Text.rand_text_alpha(10)
|
rand = Rex::Text.rand_text_alpha(10)
|
||||||
|
|
||||||
sock.put("GET /amlibweb/webquery.dll?#{rand}= HTTP/1.0\r\n\r\n")
|
sock.put("GET /amlibweb/webquery.dll?#{rand}= HTTP/1.0\r\n\r\n")
|
||||||
res = sock.get(-1,3)
|
res = sock.get_once
|
||||||
disconnect
|
disconnect
|
||||||
|
|
||||||
if (res =~ /<H1>BAD REQUEST<\/H1><P>Your client sent a request that this server didn't understand.<br>Request:\s(\w+)/)
|
if (res.to_s =~ /<H1>BAD REQUEST<\/H1><P>Your client sent a request that this server didn't understand.<br>Request:\s(\w+)/)
|
||||||
if ($1 == rand)
|
if ($1 == rand)
|
||||||
return Exploit::CheckCode::Vulnerable
|
return Exploit::CheckCode::Vulnerable
|
||||||
end
|
end
|
||||||
|
|
|
@ -59,10 +59,10 @@ class Metasploit3 < Msf::Exploit::Remote
|
||||||
|
|
||||||
def check
|
def check
|
||||||
connect
|
connect
|
||||||
sock.put("HEAD / HTTP/1.0\r\n\r\n\r\n")
|
sock.put("HEAD / HTTP/1.0\r\nHost: #{rhost}\r\n\r\n")
|
||||||
banner = sock.get(-1,3)
|
banner = sock.get_once
|
||||||
|
|
||||||
if (banner =~ /GET and POST methods are the only methods supported at this time/) # Unique?
|
if (banner.to_s =~ /GET and POST methods are the only methods supported at this time/) # Unique?
|
||||||
return Exploit::CheckCode::Detected
|
return Exploit::CheckCode::Detected
|
||||||
end
|
end
|
||||||
return Exploit::CheckCode::Safe
|
return Exploit::CheckCode::Safe
|
||||||
|
|
|
@ -66,12 +66,12 @@ class Metasploit3 < Msf::Exploit::Remote
|
||||||
connect
|
connect
|
||||||
|
|
||||||
req = "GET /SITEINFO.INI HTTP/1.0\r\n"
|
req = "GET /SITEINFO.INI HTTP/1.0\r\n"
|
||||||
req << "User-Agent: Mozilla/5.0\r\n"
|
req << "User-Agent: Mozilla/5.0\r\n\r\n"
|
||||||
sock.put(req + "\r\n\r\n")
|
sock.put(req)
|
||||||
|
|
||||||
banner = sock.get(-1,3)
|
banner = sock.get_once
|
||||||
|
|
||||||
if (banner =~ /Spipe\/1\.0/)
|
if banner.to_s =~ /Spipe\/1\.0/
|
||||||
return Exploit::CheckCode::Appears
|
return Exploit::CheckCode::Appears
|
||||||
end
|
end
|
||||||
return Exploit::CheckCode::Safe
|
return Exploit::CheckCode::Safe
|
||||||
|
|
|
@ -68,10 +68,10 @@ class Metasploit3 < Msf::Exploit::Remote
|
||||||
def check
|
def check
|
||||||
connect
|
connect
|
||||||
sock.put("GET / HTTP/1.0\r\n\r\n")
|
sock.put("GET / HTTP/1.0\r\n\r\n")
|
||||||
banner = sock.get(-1,3)
|
banner = sock.get_once
|
||||||
disconnect
|
disconnect
|
||||||
|
|
||||||
if (banner =~ /WDaemon\/6\.8\.[0-5]/)
|
if (banner.to_s =~ /WDaemon\/6\.8\.[0-5]/)
|
||||||
return Exploit::CheckCode::Appears
|
return Exploit::CheckCode::Appears
|
||||||
end
|
end
|
||||||
|
|
||||||
|
|
|
@ -59,8 +59,8 @@ class Metasploit3 < Msf::Exploit::Remote
|
||||||
def check
|
def check
|
||||||
connect
|
connect
|
||||||
sock.put("GET / HTTP/1.0\r\n\r\n")
|
sock.put("GET / HTTP/1.0\r\n\r\n")
|
||||||
banner = sock.get(-1,3)
|
banner = sock.get_once
|
||||||
if (banner =~ /PSO Proxy 0\.9/)
|
if (banner.to_s =~ /PSO Proxy 0\.9/)
|
||||||
return Exploit::CheckCode::Appears
|
return Exploit::CheckCode::Appears
|
||||||
end
|
end
|
||||||
return Exploit::CheckCode::Safe
|
return Exploit::CheckCode::Safe
|
||||||
|
|
|
@ -75,12 +75,12 @@ class Metasploit3 < Msf::Exploit::Remote
|
||||||
def check
|
def check
|
||||||
connect
|
connect
|
||||||
sock.put("\r\n\r\n") # works
|
sock.put("\r\n\r\n") # works
|
||||||
res = sock.get(-1,3)
|
res = sock.get_once
|
||||||
disconnect
|
disconnect
|
||||||
|
|
||||||
if (res =~ /Server: Serv-U\/9\.0\.0\.5/)
|
if (res.to_s =~ /Server: Serv-U\/9\.0\.0\.5/)
|
||||||
return Exploit::CheckCode::Appears
|
return Exploit::CheckCode::Appears
|
||||||
elsif (res =~ /Server: Serv-U/)
|
elsif (res.to_s =~ /Server: Serv-U/)
|
||||||
return Exploit::CheckCode::Detected
|
return Exploit::CheckCode::Detected
|
||||||
end
|
end
|
||||||
return Exploit::CheckCode::Safe
|
return Exploit::CheckCode::Safe
|
||||||
|
|
|
@ -60,10 +60,10 @@ class Metasploit3 < Msf::Exploit::Remote
|
||||||
def check
|
def check
|
||||||
connect
|
connect
|
||||||
sock.put("GET / HTTP/1.0\r\n\r\n")
|
sock.put("GET / HTTP/1.0\r\n\r\n")
|
||||||
res = sock.get(-1, 3)
|
res = sock.get_once
|
||||||
disconnect
|
disconnect
|
||||||
|
|
||||||
if (res =~ /Steamcast\/0\.9\.75/)
|
if (res.to_s =~ /Steamcast\/0\.9\.75/)
|
||||||
return Exploit::CheckCode::Appears
|
return Exploit::CheckCode::Appears
|
||||||
end
|
end
|
||||||
return Exploit::CheckCode::Safe
|
return Exploit::CheckCode::Safe
|
||||||
|
|
|
@ -60,11 +60,11 @@ class Metasploit3 < Msf::Exploit::Remote
|
||||||
|
|
||||||
def check
|
def check
|
||||||
connect
|
connect
|
||||||
sock.put("GET / HTTP/1.1\r\n\r\n")
|
sock.put("GET / HTTP/1.1\r\nHost: #{rhost}\r\n\r\n")
|
||||||
banner = sock.get(-1,3)
|
banner = sock.get_once
|
||||||
disconnect
|
disconnect
|
||||||
|
|
||||||
if (banner =~ /Xitami/)
|
if (banner.to_s =~ /Xitami/)
|
||||||
vprint_status("Banner: #{banner}")
|
vprint_status("Banner: #{banner}")
|
||||||
return Exploit::CheckCode::Detected
|
return Exploit::CheckCode::Detected
|
||||||
end
|
end
|
||||||
|
|
|
@ -79,14 +79,14 @@ class Metasploit3 < Msf::Exploit::Remote
|
||||||
|
|
||||||
def check
|
def check
|
||||||
connect
|
connect
|
||||||
sock.put("GET / HTTP/1.1\r\n\r\n")
|
sock.put("GET / HTTP/1.1\r\nHost: #{rhost}\r\n\r\n")
|
||||||
res = sock.get(-1, 3)
|
res = sock.get_once
|
||||||
disconnect
|
disconnect
|
||||||
|
|
||||||
# Can't flag the web server as vulnerable, because it doesn't
|
# Can't flag the web server as vulnerable, because it doesn't
|
||||||
# give us a version
|
# give us a version
|
||||||
vprint_line(res)
|
vprint_line(res.to_s)
|
||||||
if res =~ /3S_WebServer/
|
if res.to_s =~ /3S_WebServer/
|
||||||
return Exploit::CheckCode::Detected
|
return Exploit::CheckCode::Detected
|
||||||
else
|
else
|
||||||
return Exploit::CheckCode::Safe
|
return Exploit::CheckCode::Safe
|
||||||
|
@ -118,7 +118,7 @@ class Metasploit3 < Msf::Exploit::Remote
|
||||||
|
|
||||||
print_status("Trying target #{target.name}...")
|
print_status("Trying target #{target.name}...")
|
||||||
sock.put(sploit)
|
sock.put(sploit)
|
||||||
res = sock.get_once
|
res = sock.get_once(-1, 5)
|
||||||
print_line(res) unless res.nil?
|
print_line(res) unless res.nil?
|
||||||
|
|
||||||
handler
|
handler
|
||||||
|
|
Loading…
Reference in New Issue