From 31ef5e03b5897a1e32f6d1425e297fde3fa5becb Mon Sep 17 00:00:00 2001 From: adfoster-r7 Date: Wed, 15 Apr 2026 11:57:01 +0100 Subject: [PATCH] Improve auxiliary check code messages --- .../admin/dcerpc/cve_2020_1472_zerologon.rb | 4 ++-- .../admin/hp/hp_ilo_create_admin_account.rb | 6 +++--- .../admin/http/cisco_ssm_onprem_account.rb | 2 +- .../admin/http/fortinet_fortiweb_create_admin.rb | 2 +- .../hikvision_unauth_pwd_reset_cve_2017_7921.rb | 4 ++-- modules/auxiliary/admin/http/ibm_drm_download.rb | 4 ++-- .../auxiliary/admin/http/idsecure_auth_bypass.rb | 10 +++++----- .../auxiliary/admin/http/intersil_pass_reset.rb | 8 ++++---- modules/auxiliary/admin/http/ivanti_vtm_admin.rb | 4 ++-- .../admin/http/joomla_registration_privesc.rb | 10 +++++----- .../admin/http/manageengine_pmp_privesc.rb | 6 +++--- .../admin/http/mantisbt_password_reset.rb | 6 +++--- .../netgear_pnpx_getsharefolderlist_auth_bypass.rb | 8 ++++---- .../admin/http/netgear_r6700_pass_reset.rb | 4 ++-- .../netgear_r7000_backup_cgi_heap_overflow_rce.rb | 4 ++-- .../admin/http/pfadmin_set_protected_alias.rb | 14 +++++++------- .../admin/http/pihole_domains_api_exec.rb | 10 +++++----- modules/auxiliary/admin/http/tomcat_ghostcat.rb | 2 +- modules/auxiliary/admin/http/whatsup_gold_sqli.rb | 6 +++--- .../admin/http/wp_automatic_plugin_privesc.rb | 4 ++-- .../auxiliary/admin/http/wp_google_maps_sqli.rb | 4 ++-- modules/auxiliary/admin/ldap/bad_successor.rb | 4 ++-- .../admin/networking/cisco_asa_extrabacon.rb | 6 +++--- .../admin/networking/cisco_dcnm_auth_bypass.rb | 6 +++--- .../networking/thinmanager_traversal_delete.rb | 6 +++--- .../networking/thinmanager_traversal_upload.rb | 6 +++--- .../networking/thinmanager_traversal_upload2.rb | 6 +++--- .../admin/sap/cve_2020_6287_ws_add_user.rb | 11 ++++++----- .../scada/advantech_webaccess_dbvisitor_sqli.rb | 4 ++-- .../admin/scada/modicon_password_recovery.rb | 6 +++--- .../admin/scada/moxa_credentials_recovery.rb | 6 +++--- modules/auxiliary/admin/scada/mypro_mgr_creds.rb | 8 ++++---- modules/auxiliary/admin/wemo/crockpot.rb | 2 +- modules/auxiliary/dos/ftp/vsftpd_232.rb | 12 ++++++------ .../auxiliary/dos/http/flexense_http_server_dos.rb | 8 ++++---- .../auxiliary/dos/http/ms15_034_ulonglongadd.rb | 6 +++--- modules/auxiliary/dos/http/nodejs_pipelining.rb | 6 +++--- modules/auxiliary/dos/scada/allen_bradley_pccc.rb | 12 ++++++------ .../gather/cisco_pvc2300_download_config.rb | 2 +- modules/auxiliary/gather/coldfusion_pwd_props.rb | 4 ++-- .../cve_2021_27850_apache_tapestry_hmac_key.rb | 8 ++++---- modules/auxiliary/gather/drupal_openid_xxe.rb | 8 ++++---- .../gather/flash_rosetta_jsonp_url_disclosure.rb | 4 ++-- .../hikvision_info_disclosure_cve_2017_7921.rb | 6 +++--- modules/auxiliary/gather/jenkins_cred_recovery.rb | 4 ++-- .../auxiliary/gather/jetty_web_inf_disclosure.rb | 4 ++-- .../auxiliary/gather/joomla_contenthistory_sqli.rb | 4 ++-- modules/auxiliary/gather/joomla_weblinks_sqli.rb | 8 ++++---- modules/auxiliary/gather/microweber_lfi.rb | 10 +++++----- modules/auxiliary/gather/mybb_db_fingerprint.rb | 8 ++++---- .../gather/netgear_password_disclosure.rb | 4 ++-- .../gather/oats_downloadservlet_traversal.rb | 4 ++-- modules/auxiliary/gather/pacsserver_traversal.rb | 2 +- modules/auxiliary/gather/peplink_bauth_sqli.rb | 4 ++-- .../auxiliary/gather/qnap_backtrace_admin_hash.rb | 6 +++--- modules/auxiliary/gather/qnap_lfi.rb | 6 +++--- .../auxiliary/gather/rails_doubletap_file_read.rb | 8 ++++---- modules/auxiliary/gather/ray_lfi_cve_2023_6020.rb | 10 +++++----- modules/auxiliary/gather/redis_extractor.rb | 2 +- .../auxiliary/gather/saltstack_salt_root_key.rb | 4 ++-- .../solarwinds_servu_fileread_cve_2024_28995.rb | 2 +- .../gather/solarwinds_webhelpdesk_backdoor.rb | 6 +++--- modules/auxiliary/gather/suite_crm_export_sqli.rb | 2 +- .../gather/thinmanager_traversal_download.rb | 4 ++-- modules/auxiliary/gather/upsmon_traversal.rb | 4 ++-- modules/auxiliary/gather/vbulletin_vote_sqli.rb | 6 +++--- .../auxiliary/gather/vmware_vcenter_vmdir_ldap.rb | 2 +- .../wp_bookingpress_category_services_sqli.rb | 2 +- .../gather/wp_depicter_sqli_cve_2025_2011.rb | 2 +- modules/auxiliary/gather/wp_photo_gallery_sqli.rb | 2 +- modules/auxiliary/gather/zabbix_toggleids_sqli.rb | 6 +++--- .../auxiliary/scanner/http/exchange_proxylogon.rb | 8 ++++---- .../auxiliary/scanner/ssh/libssh_auth_bypass.rb | 8 ++++---- .../server/relay/relay_get_naa_credentials.rb | 4 ++-- modules/auxiliary/spoof/dns/bailiwicked_domain.rb | 8 ++++---- modules/auxiliary/spoof/dns/bailiwicked_host.rb | 8 ++++---- .../sqli/dlink/dlink_central_wifimanager_sqli.rb | 4 ++-- .../auxiliary/sqli/openemr/openemr_sqli_dump.rb | 6 +++--- 78 files changed, 221 insertions(+), 220 deletions(-) diff --git a/modules/auxiliary/admin/dcerpc/cve_2020_1472_zerologon.rb b/modules/auxiliary/admin/dcerpc/cve_2020_1472_zerologon.rb index 8f237e71b9..fe1c987e29 100644 --- a/modules/auxiliary/admin/dcerpc/cve_2020_1472_zerologon.rb +++ b/modules/auxiliary/admin/dcerpc/cve_2020_1472_zerologon.rb @@ -101,9 +101,9 @@ class MetasploitModule < Msf::Auxiliary fail_with(Failure::UnexpectedReply, windows_error) end - return Exploit::CheckCode::Detected unless status == 0 + return Exploit::CheckCode::Detected('Target responded but Zerologon exploit did not succeed') unless status == 0 - Exploit::CheckCode::Vulnerable + Exploit::CheckCode::Vulnerable('Zerologon authentication bypass succeeded') end def run diff --git a/modules/auxiliary/admin/hp/hp_ilo_create_admin_account.rb b/modules/auxiliary/admin/hp/hp_ilo_create_admin_account.rb index 87efa3ee03..f9319bee8b 100644 --- a/modules/auxiliary/admin/hp/hp_ilo_create_admin_account.rb +++ b/modules/auxiliary/admin/hp/hp_ilo_create_admin_account.rb @@ -56,14 +56,14 @@ class MetasploitModule < Msf::Auxiliary } }) rescue StandardError - return Exploit::CheckCode::Unknown + return Exploit::CheckCode::Unknown('Failed to connect to the target') end if (res.code == 200) && res.body.include?('"Description":"iLO User Accounts"') - return Exploit::CheckCode::Vulnerable + return Exploit::CheckCode::Vulnerable('Authentication bypass returned iLO User Accounts') end - return Exploit::CheckCode::Safe + return Exploit::CheckCode::Safe('Authentication bypass did not return account data') end def run diff --git a/modules/auxiliary/admin/http/cisco_ssm_onprem_account.rb b/modules/auxiliary/admin/http/cisco_ssm_onprem_account.rb index 8feec1eb91..91943627b8 100644 --- a/modules/auxiliary/admin/http/cisco_ssm_onprem_account.rb +++ b/modules/auxiliary/admin/http/cisco_ssm_onprem_account.rb @@ -143,7 +143,7 @@ class MetasploitModule < Msf::Auxiliary return Exploit::CheckCode::Appears('Password reset was successful, target is vulnerable') end - Exploit::CheckCode::Unknown + Exploit::CheckCode::Unknown('Password reset status could not be determined') end def decode_url(encoded_string) diff --git a/modules/auxiliary/admin/http/fortinet_fortiweb_create_admin.rb b/modules/auxiliary/admin/http/fortinet_fortiweb_create_admin.rb index 4d59da1928..31e5ff28b5 100644 --- a/modules/auxiliary/admin/http/fortinet_fortiweb_create_admin.rb +++ b/modules/auxiliary/admin/http/fortinet_fortiweb_create_admin.rb @@ -77,7 +77,7 @@ class MetasploitModule < Msf::Auxiliary j = JSON.parse(res.body) # Tested against vulnerable FortiWeb versions 8.0.1, 7.4.8, 6.4.3, and 6.3.9 - return Exploit::CheckCode::Appears if j.dig('results', 'errcode') == -56 + return Exploit::CheckCode::Appears('Authentication bypass succeeded on FortiWeb') if j.dig('results', 'errcode') == -56 Exploit::CheckCode::Unknown('Unexpected JSON results') rescue JSON::ParserError diff --git a/modules/auxiliary/admin/http/hikvision_unauth_pwd_reset_cve_2017_7921.rb b/modules/auxiliary/admin/http/hikvision_unauth_pwd_reset_cve_2017_7921.rb index a0f8a95416..eff31a1a9d 100644 --- a/modules/auxiliary/admin/http/hikvision_unauth_pwd_reset_cve_2017_7921.rb +++ b/modules/auxiliary/admin/http/hikvision_unauth_pwd_reset_cve_2017_7921.rb @@ -118,9 +118,9 @@ class MetasploitModule < Msf::Auxiliary user_array.each do |user| print_status("USERNAME:#{user&.at_css('userName')&.content} | ID:#{user&.at_css('id')&.content} | ROLE:#{user&.at_css('userLevel')&.content}") end - return Exploit::CheckCode::Vulnerable + return Exploit::CheckCode::Vulnerable('Unauthenticated access to user credentials succeeded') else - return Exploit::CheckCode::Safe + return Exploit::CheckCode::Safe("Target returned HTTP #{res.code}") end end diff --git a/modules/auxiliary/admin/http/ibm_drm_download.rb b/modules/auxiliary/admin/http/ibm_drm_download.rb index 395fe5541c..af2a0f8e68 100644 --- a/modules/auxiliary/admin/http/ibm_drm_download.rb +++ b/modules/auxiliary/admin/http/ibm_drm_download.rb @@ -75,10 +75,10 @@ class MetasploitModule < Msf::Auxiliary } }) if res && (res.code == 302) - return Exploit::CheckCode::Detected + return Exploit::CheckCode::Detected('IBM DRM web interface detected') end - Exploit::CheckCode::Unknown + Exploit::CheckCode::Unknown('Could not determine if target is IBM DRM') end def create_session_id diff --git a/modules/auxiliary/admin/http/idsecure_auth_bypass.rb b/modules/auxiliary/admin/http/idsecure_auth_bypass.rb index c02aea8c3c..613fbb874b 100644 --- a/modules/auxiliary/admin/http/idsecure_auth_bypass.rb +++ b/modules/auxiliary/admin/http/idsecure_auth_bypass.rb @@ -47,19 +47,19 @@ class MetasploitModule < Msf::Auxiliary 'uri' => normalize_uri(target_uri.path, 'api/util/configUI') }) rescue ::Rex::ConnectionRefused, ::Rex::HostUnreachable, ::Rex::ConnectionTimeout, ::Rex::ConnectionError - return Exploit::CheckCode::Unknown + return Exploit::CheckCode::Unknown('Connection failed') end - return Exploit::CheckCode::Unknown unless res&.code == 401 + return Exploit::CheckCode::Unknown('Target did not return HTTP 401') unless res&.code == 401 data = res.get_json_document version = data['Version'] - return Exploit::CheckCode::Unknown if version.nil? + return Exploit::CheckCode::Unknown('Could not determine IDSecure version') if version.nil? print_status('Got version: ' + version) - return Exploit::CheckCode::Safe unless Rex::Version.new(version) <= Rex::Version.new('4.7.43.0') + return Exploit::CheckCode::Safe("IDSecure version #{version} is not vulnerable") unless Rex::Version.new(version) <= Rex::Version.new('4.7.43.0') - return Exploit::CheckCode::Appears + return Exploit::CheckCode::Appears("IDSecure version #{version} is vulnerable") end def run diff --git a/modules/auxiliary/admin/http/intersil_pass_reset.rb b/modules/auxiliary/admin/http/intersil_pass_reset.rb index b5db2eb29f..6fdfbaa38e 100644 --- a/modules/auxiliary/admin/http/intersil_pass_reset.rb +++ b/modules/auxiliary/admin/http/intersil_pass_reset.rb @@ -58,16 +58,16 @@ class MetasploitModule < Msf::Auxiliary if res && (m = res.headers['Server'].match(%r{Boa/(.*)})) vprint_status("Boa Version Detected: #{m[1]}") - return Exploit::CheckCode::Safe if (m[1][0].ord - 48 > 0) # boa server wrong version - return Exploit::CheckCode::Safe if (m[1][3].ord - 48 > 4) + return Exploit::CheckCode::Safe("Boa version #{m[1]} is not vulnerable") if (m[1][0].ord - 48 > 0) # boa server wrong version + return Exploit::CheckCode::Safe("Boa version #{m[1]} is not vulnerable") if (m[1][3].ord - 48 > 4) - return Exploit::CheckCode::Vulnerable + return Exploit::CheckCode::Vulnerable("Boa version #{m[1]} is vulnerable") end return Exploit::CheckCode::Safe('Not a Boa Server!') rescue Rex::ConnectionRefused print_error('Connection refused by server.') - return Exploit::CheckCode::Safe + return Exploit::CheckCode::Safe('Connection refused by server') end def run diff --git a/modules/auxiliary/admin/http/ivanti_vtm_admin.rb b/modules/auxiliary/admin/http/ivanti_vtm_admin.rb index 3952793192..5bc4542fbb 100644 --- a/modules/auxiliary/admin/http/ivanti_vtm_admin.rb +++ b/modules/auxiliary/admin/http/ivanti_vtm_admin.rb @@ -61,10 +61,10 @@ class MetasploitModule < Msf::Auxiliary version = match[1] return Exploit::CheckCode::Appears("Version: #{version}") if Rex::Version.new(version) <= Rex::Version.new('22.7R1') else - return Exploit::CheckCode::Safe + return Exploit::CheckCode::Safe('Could not detect Ivanti vTM version') end - Exploit::CheckCode::Safe + Exploit::CheckCode::Safe('Ivanti vTM version is not vulnerable') end def run diff --git a/modules/auxiliary/admin/http/joomla_registration_privesc.rb b/modules/auxiliary/admin/http/joomla_registration_privesc.rb index 5a3b125cc5..febf029c90 100644 --- a/modules/auxiliary/admin/http/joomla_registration_privesc.rb +++ b/modules/auxiliary/admin/http/joomla_registration_privesc.rb @@ -52,28 +52,28 @@ class MetasploitModule < Msf::Auxiliary unless res vprint_error('Unable to connect to target') - return Exploit::CheckCode::Unknown + return Exploit::CheckCode::Unknown('Unable to connect to target') end unless joomla_and_online? vprint_error('Unable to detect Joomla') - return Exploit::CheckCode::Safe + return Exploit::CheckCode::Safe('Target does not appear to be Joomla') end version = Rex::Version.new(joomla_version) unless version vprint_error('Unable to detect Joomla version') - return Exploit::CheckCode::Detected + return Exploit::CheckCode::Detected('Joomla detected but version could not be determined') end vprint_status("Detected Joomla version #{version}") if version.between?(Rex::Version.new('3.4.4'), Rex::Version.new('3.6.3')) - return Exploit::CheckCode::Appears + return Exploit::CheckCode::Appears("Joomla #{version} is in the vulnerable range 3.4.4-3.6.3") end - Exploit::CheckCode::Safe + Exploit::CheckCode::Safe("Joomla #{version} is not in the vulnerable range") end def get_csrf(hidden_fields) diff --git a/modules/auxiliary/admin/http/manageengine_pmp_privesc.rb b/modules/auxiliary/admin/http/manageengine_pmp_privesc.rb index 33e258a84a..c0d584c810 100644 --- a/modules/auxiliary/admin/http/manageengine_pmp_privesc.rb +++ b/modules/auxiliary/admin/http/manageengine_pmp_privesc.rb @@ -211,11 +211,11 @@ class MetasploitModule < Msf::Auxiliary version = get_version case version when 0..7104 - return Exploit::CheckCode::Appears + return Exploit::CheckCode::Appears("ManageEngine PMP build #{version} is in the vulnerable range") when 7105..9998 - return Exploit::CheckCode::Safe + return Exploit::CheckCode::Safe("ManageEngine PMP build #{version} is patched") else - return Exploit::CheckCode::Unknown + return Exploit::CheckCode::Unknown("ManageEngine PMP build #{version} could not be assessed") end end diff --git a/modules/auxiliary/admin/http/mantisbt_password_reset.rb b/modules/auxiliary/admin/http/mantisbt_password_reset.rb index 912ff06a6e..d592903eb9 100644 --- a/modules/auxiliary/admin/http/mantisbt_password_reset.rb +++ b/modules/auxiliary/admin/http/mantisbt_password_reset.rb @@ -52,14 +52,14 @@ class MetasploitModule < Msf::Auxiliary if res && res.body && res.body.include?('Powered by MantisBT') vprint_status('MantisBT detected') - return Exploit::CheckCode::Detected + return Exploit::CheckCode::Detected('MantisBT detected') else vprint_status('Not a MantisBT Instance!') - return Exploit::CheckCode::Safe + return Exploit::CheckCode::Safe('Target does not appear to be MantisBT') end rescue Rex::ConnectionRefused print_error('Connection refused by server.') - return Exploit::CheckCode::Safe + return Exploit::CheckCode::Safe('Connection refused by server') end def run diff --git a/modules/auxiliary/admin/http/netgear_pnpx_getsharefolderlist_auth_bypass.rb b/modules/auxiliary/admin/http/netgear_pnpx_getsharefolderlist_auth_bypass.rb index 55366911a2..db596f4779 100644 --- a/modules/auxiliary/admin/http/netgear_pnpx_getsharefolderlist_auth_bypass.rb +++ b/modules/auxiliary/admin/http/netgear_pnpx_getsharefolderlist_auth_bypass.rb @@ -94,13 +94,13 @@ class MetasploitModule < Msf::Auxiliary # Check version is vulnerable print_status("Target is a #{model_name} router running firmware version #{major_version}_#{minor_version}") if (Rex::Version.new(major_version) >= Rex::Version.new('1.2.0.0')) && (Rex::Version.new(major_version) < Rex::Version.new('1.2.0.88')) - return Exploit::CheckCode::Appears + return Exploit::CheckCode::Appears("Firmware #{major_version} is in the vulnerable range") elsif (Rex::Version.new(major_version) >= Rex::Version.new('1.0.1.0')) && (Rex::Version.new(major_version) < Rex::Version.new('1.0.1.80')) - return Exploit::CheckCode::Appears + return Exploit::CheckCode::Appears("Firmware #{major_version} is in the vulnerable range") elsif (Rex::Version.new(major_version) >= Rex::Version.new('1.1.0.0')) && (Rex::Version.new(major_version) < Rex::Version.new('1.1.0.110')) # Need more work on this as this isn't a good check for affected versions and may overlap with patched versions. - return Exploit::CheckCode::Appears + return Exploit::CheckCode::Appears("Firmware #{major_version} is in the vulnerable range") elsif (Rex::Version.new(major_version) >= Rex::Version.new('1.1.0.0')) && (Rex::Version.new(major_version) < Rex::Version.new('1.1.0.84')) # Need more work on this to make sure we apply this to the correct systems. - return Exploit::CheckCode::Appears + return Exploit::CheckCode::Appears("Firmware #{major_version} is in the vulnerable range") else return Exploit::CheckCode::Safe('Not a vulnerable router version!') end diff --git a/modules/auxiliary/admin/http/netgear_r6700_pass_reset.rb b/modules/auxiliary/admin/http/netgear_r6700_pass_reset.rb index 9ba4af2400..fba89be692 100644 --- a/modules/auxiliary/admin/http/netgear_r6700_pass_reset.rb +++ b/modules/auxiliary/admin/http/netgear_r6700_pass_reset.rb @@ -104,9 +104,9 @@ class MetasploitModule < Msf::Auxiliary target_version = retrieve_version print_status("Target is running firmware version #{target_version}") if (target_version < Rex::Version.new('1.0.4.94')) && (target_version >= Rex::Version.new('1.0.2.62')) - return Exploit::CheckCode::Appears + return Exploit::CheckCode::Appears("NETGEAR R6700 firmware #{target_version} is in the vulnerable range") else - return Exploit::CheckCode::Safe + return Exploit::CheckCode::Safe("NETGEAR R6700 firmware #{target_version} is not vulnerable") end end diff --git a/modules/auxiliary/admin/http/netgear_r7000_backup_cgi_heap_overflow_rce.rb b/modules/auxiliary/admin/http/netgear_r7000_backup_cgi_heap_overflow_rce.rb index dc8023b466..6a6b167769 100644 --- a/modules/auxiliary/admin/http/netgear_r7000_backup_cgi_heap_overflow_rce.rb +++ b/modules/auxiliary/admin/http/netgear_r7000_backup_cgi_heap_overflow_rce.rb @@ -102,13 +102,13 @@ class MetasploitModule < Msf::Auxiliary model = scrape(data, marker_one, marker_two) print_status("Router is a NETGEAR router (#{model})") if model == 'R7000' && check_vuln_firmware - return Exploit::CheckCode::Vulnerable + return Exploit::CheckCode::Vulnerable('NETGEAR R7000 with vulnerable firmware') end else print_error('Router is not a NETGEAR router') end - return Exploit::CheckCode::Safe + return Exploit::CheckCode::Safe('Target does not appear to be a vulnerable NETGEAR router') end def fake_logins_to_ease_heap diff --git a/modules/auxiliary/admin/http/pfadmin_set_protected_alias.rb b/modules/auxiliary/admin/http/pfadmin_set_protected_alias.rb index e402193087..90617ec727 100644 --- a/modules/auxiliary/admin/http/pfadmin_set_protected_alias.rb +++ b/modules/auxiliary/admin/http/pfadmin_set_protected_alias.rb @@ -66,23 +66,23 @@ class MetasploitModule < Msf::Auxiliary def check res = send_request_cgi({ 'uri' => postfixadmin_url_login, 'method' => 'GET' }) - return Exploit::CheckCode::Unknown unless res + return Exploit::CheckCode::Unknown('No response received from the target') unless res - return Exploit::CheckCode::Safe if res.code != 200 + return Exploit::CheckCode::Safe('Target did not return a 200 response') if res.code != 200 if res.body =~ /