infosecn1nja
/
metasploit-framework
mirror of https://github.com/infosecn1nja/metasploit-framework.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Land jvazquez-r7/metasploit-framework#14, @todb-r7's fixes

unstable
jvazquez-r7 2014-06-10 10:42:34 -05:00
parent 9b55f5143a 521284253f
commit 9aa2978589
No known key found for this signature in database
GPG Key ID: 38D99152B9352D83
1 changed files with 10 additions and 7 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

17
modules/auxiliary/scanner/ssl/openssl_ccs.rb
View File

@ -77,11 +77,14 @@ class Metasploit3 < Msf::Auxiliary
def initialize def initialize
super( super(
'Name' => 'OpenSSL CCS Injection Scanner', 'Name' => 'OpenSSL Server-Side ChangeCipherSpec Injection Scanner',
'Description' => %q{ 'Description' => %q{
This module allows to check for the OpenSSL CCS Injection attack. The problem This module checks for the OpenSSL ChageCipherSpec (CCS)
exists in the handling of early ChangeCipherSpec messages, with OpenSSL Injection vulnerability. The problem exists in the handling of early
accepting them. CCS messages during session negotation. Vulnerable installations of OpenSSL accepts
them, while later implementations do not. If successful, an attacker can leverage this
vulnerability to perform a man-in-the-middle (MITM) attack by downgrading the cipher spec
between a client and server. This issue was first reported in early June, 2014.
}, },
'Author' => [ 'Author' => [
'Masashi Kikuchi', # Vulnerability discovery 'Masashi Kikuchi', # Vulnerability discovery
@ -128,12 +131,12 @@ class Metasploit3 < Msf::Auxiliary
sock.put(ccs) sock.put(ccs)
alert = sock.get_once(-1, response_timeout) alert = sock.get_once(-1, response_timeout)
if alert.blank? if alert.blank?
print_good("#{peer} - No Alert after invalid CSS message, probably vulnerable") print_good("#{peer} - No alert after invalid CSS message, probably vulnerable")
report report
elsif alert.unpack("C").first == ALERT_RECORD_TYPE elsif alert.unpack("C").first == ALERT_RECORD_TYPE
vprint_error("#{peer} - Alert record as response to the invalid CCS Message") vprint_error("#{peer} - Alert record as response to the invalid CCS Message, probably not vulnerable")
elsif alert elsif alert
vprint_warning("#{peer} - Unexpected response...") vprint_warning("#{peer} - Unexpected response.")
end end
end end