diff --git a/lib/msf/core/exploit/http/server.rb b/lib/msf/core/exploit/http/server.rb index 24a74eb2f6..f436073282 100644 --- a/lib/msf/core/exploit/http/server.rb +++ b/lib/msf/core/exploit/http/server.rb @@ -61,43 +61,43 @@ module Exploit::Remote::HttpServer # :category: print_* overrides # Prepends client and module name if inside a thread with a #cli - def print_line(msg) + def print_line(msg='') (cli) ? super("#{cli.peerhost.ljust(16)} #{self.shortname} - #{msg}") : super end # :category: print_* overrides # Prepends client and module name if inside a thread with a #cli - def print_status(msg) + def print_status(msg='') (cli) ? super("#{cli.peerhost.ljust(16)} #{self.shortname} - #{msg}") : super end # :category: print_* overrides # Prepends client and module name if inside a thread with a #cli - def print_error(msg) + def print_error(msg='') (cli) ? super("#{cli.peerhost.ljust(16)} #{self.shortname} - #{msg}") : super end # :category: print_* overrides # Prepends client and module name if inside a thread with a #cli - def print_debug(msg) + def print_debug(msg='') (cli) ? super("#{cli.peerhost.ljust(16)} #{self.shortname} - #{msg}") : super end # :category: print_* overrides # Prepends client and module name if inside a thread with a #cli - def vprint_line(msg) + def vprint_line(msg='') (cli) ? super("#{cli.peerhost.ljust(16)} #{self.shortname} - #{msg}") : super end # :category: print_* overrides # Prepends client and module name if inside a thread with a #cli - def vprint_status(msg) + def vprint_status(msg='') (cli) ? super("#{cli.peerhost.ljust(16)} #{self.shortname} - #{msg}") : super end # :category: print_* overrides # Prepends client and module name if inside a thread with a #cli - def vprint_error(msg) + def vprint_error(msg='') (cli) ? super("#{cli.peerhost.ljust(16)} #{self.shortname} - #{msg}") : super end # :category: print_* overrides # Prepends client and module name if inside a thread with a #cli - def vprint_debug(msg) + def vprint_debug(msg='') (cli) ? super("#{cli.peerhost.ljust(16)} #{self.shortname} - #{msg}") : super end @@ -123,6 +123,8 @@ module Exploit::Remote::HttpServer use_zlib end + ## + # :category: Exploit::Remote::TcpServer overrides # # This mixin starts the HTTP server listener. This routine takes a few # different hash parameters: @@ -187,6 +189,21 @@ module Exploit::Remote::HttpServer add_resource(uopts) end + # + # Return a Hash containing a best guess at the actual browser and operating + # system versions, based on the User-Agent header. + # + # Keys in the returned hash are similar to those expected of + # Report#report_client, and Report#report_host namely: + # +:ua_name+:: a brief identifier for the client, e.g. "Firefox" + # +:ua_ver+:: the version number of the client, e.g. "3.0.11" + # +:os_name+:: one of the Msf::OperatingSystems constants + # +:os_flavor+:: something like "XP" or "Gentoo" + # +:os_lang+:: something like "English", "French", or "en-US" + # +:arch+:: one of the ARCH_* constants + # + # Unknown values may be nil. + # def fingerprint_user_agent(ua_str) fp = { :ua_string => ua_str } @@ -323,6 +340,9 @@ module Exploit::Remote::HttpServer # Proc => The procedure to call when the URI is requested. # LongCall => Indicates that the request is a long call. # + # NOTE: Calling #add_resource will change the results of subsequent calls + # to #get_resource! + # def add_resource(opts) @service_path = opts['Path'] service.add_resource(opts['Path'], opts) @@ -380,12 +400,11 @@ module Exploit::Remote::HttpServer # All of this will be for naught in the case of a user behind NAT using a # bind payload but there's nothing we can do about it. # - # NOTE: The address will be incorrect when - # a) LHOST is pointed at a multi/handler on some other box. - # or - # b) SRVHOST has a value of '0.0.0.0', the user is behind NAT, and we're - # using a bind payload. In that case, we don't have an LHOST and - # the source address will be internal. + # NOTE: The address will be *incorrect* in the following two situations: + # 1) LHOST is pointed at a multi/handler on some other box. + # 2) SRVHOST has a value of '0.0.0.0', the user is behind NAT, and we're + # using a bind payload. In that case, we don't have an LHOST and + # the source address will be internal. # # This can potentially be dealt with in a module by using the Host header # from a request if such a header exists. @@ -876,15 +895,17 @@ module Exploit::Remote::HttpServer::PHPInclude true end + ## + # :category: Exploit::Remote::TcpServer overrides # # Override exploit() to handle service start/stop # # Disables SSL for the service since we always want to serve our evil PHP # files from a non-ssl server. There are two reasons for this: - # a) https is only supported on PHP versions after 4.3.0 and only if + # 1. https is only supported on PHP versions after 4.3.0 and only if # the OpenSSL extension is compiled in, a non-default configuration on # most systems - # b) somewhat less importantly, the SSL option would conflict with the + # 2. somewhat less importantly, the SSL option would conflict with the # option for our client connecting to the vulnerable server # def exploit @@ -926,6 +947,8 @@ module Exploit::Remote::HttpServer::PHPInclude send_response(cli, body, headers) end + ## + # :category: Event Handlers # # Handle an incoming PHP code request #