jenkins-metasploit
1481 lines
102 KiB
HTML
1481 lines
102 KiB
HTML
<!DOCTYPE html>
|
|
<html>
|
|
<head>
|
|
<meta charset="utf-8">
|
|
<meta name="viewport" content="width=device-width, initial-scale=1.0">
|
|
<title>
|
|
Module: Msf::Exploit::Remote::AFP
|
|
|
|
— Documentation by YARD 0.9.37
|
|
|
|
</title>
|
|
|
|
<link rel="stylesheet" href="../../../css/style.css" type="text/css" />
|
|
|
|
<link rel="stylesheet" href="../../../css/common.css" type="text/css" />
|
|
|
|
<script type="text/javascript">
|
|
pathId = "Msf::Exploit::Remote::AFP";
|
|
relpath = '../../../';
|
|
</script>
|
|
|
|
|
|
<script type="text/javascript" charset="utf-8" src="../../../js/jquery.js"></script>
|
|
|
|
<script type="text/javascript" charset="utf-8" src="../../../js/app.js"></script>
|
|
|
|
|
|
</head>
|
|
<body>
|
|
<div class="nav_wrap">
|
|
<iframe id="nav" src="../../../class_list.html?1"></iframe>
|
|
<div id="resizer"></div>
|
|
</div>
|
|
|
|
<div id="main" tabindex="-1">
|
|
<div id="header">
|
|
<div id="menu">
|
|
|
|
<a href="../../../_index.html">Index (A)</a> »
|
|
<span class='title'><span class='object_link'><a href="../../../Msf.html" title="Msf (module)">Msf</a></span></span> » <span class='title'><span class='object_link'><a href="../../Exploit.html" title="Msf::Exploit (class)">Exploit</a></span></span> » <span class='title'><span class='object_link'><a href="../Remote.html" title="Msf::Exploit::Remote (class)">Remote</a></span></span>
|
|
»
|
|
<span class="title">AFP</span>
|
|
|
|
</div>
|
|
|
|
<div id="search">
|
|
|
|
<a class="full_list_link" id="class_list_link"
|
|
href="../../../class_list.html">
|
|
|
|
<svg width="24" height="24">
|
|
<rect x="0" y="4" width="24" height="4" rx="1" ry="1"></rect>
|
|
<rect x="0" y="12" width="24" height="4" rx="1" ry="1"></rect>
|
|
<rect x="0" y="20" width="24" height="4" rx="1" ry="1"></rect>
|
|
</svg>
|
|
</a>
|
|
|
|
</div>
|
|
<div class="clear"></div>
|
|
</div>
|
|
|
|
<div id="content"><h1>Module: Msf::Exploit::Remote::AFP
|
|
|
|
|
|
|
|
</h1>
|
|
<div class="box_info">
|
|
|
|
|
|
|
|
|
|
|
|
|
|
<dl>
|
|
<dt>Includes:</dt>
|
|
<dd><span class='object_link'><a href="Tcp.html" title="Msf::Exploit::Remote::Tcp (module)">Tcp</a></span></dd>
|
|
</dl>
|
|
|
|
|
|
|
|
|
|
|
|
|
|
<dl>
|
|
<dt>Defined in:</dt>
|
|
<dd>lib/msf/core/exploit/remote/afp.rb</dd>
|
|
</dl>
|
|
|
|
</div>
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
<h2>Instance Attribute Summary</h2>
|
|
|
|
<h3 class="inherited">Attributes included from <span class='object_link'><a href="Tcp.html" title="Msf::Exploit::Remote::Tcp (module)">Tcp</a></span></h3>
|
|
<p class="inherited"><span class='object_link'><a href="Tcp.html#sock-instance_method" title="Msf::Exploit::Remote::Tcp#sock (method)">#sock</a></span></p>
|
|
|
|
|
|
|
|
<h2>
|
|
Instance Method Summary
|
|
<small><a href="#" class="summary_toggle">collapse</a></small>
|
|
</h2>
|
|
|
|
<ul class="summary">
|
|
|
|
<li class="public ">
|
|
<span class="summary_signature">
|
|
|
|
<a href="#close_session-instance_method" title="#close_session (instance method)">#<strong>close_session</strong> ⇒ Object </a>
|
|
|
|
|
|
|
|
</span>
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
<span class="summary_desc"><div class='inline'></div></span>
|
|
|
|
</li>
|
|
|
|
|
|
<li class="public ">
|
|
<span class="summary_signature">
|
|
|
|
<a href="#get_body-instance_method" title="#get_body (instance method)">#<strong>get_body</strong>(packet, body_length) ⇒ Object </a>
|
|
|
|
|
|
|
|
</span>
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
<span class="summary_desc"><div class='inline'></div></span>
|
|
|
|
</li>
|
|
|
|
|
|
<li class="public ">
|
|
<span class="summary_signature">
|
|
|
|
<a href="#get_info-instance_method" title="#get_info (instance method)">#<strong>get_info</strong> ⇒ Object </a>
|
|
|
|
|
|
|
|
</span>
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
<span class="summary_desc"><div class='inline'></div></span>
|
|
|
|
</li>
|
|
|
|
|
|
<li class="public ">
|
|
<span class="summary_signature">
|
|
|
|
<a href="#initialize-instance_method" title="#initialize (instance method)">#<strong>initialize</strong>(info = {}) ⇒ Object </a>
|
|
|
|
|
|
|
|
</span>
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
<span class="summary_desc"><div class='inline'></div></span>
|
|
|
|
</li>
|
|
|
|
|
|
<li class="public ">
|
|
<span class="summary_signature">
|
|
|
|
<a href="#login-instance_method" title="#login (instance method)">#<strong>login</strong>(user, pass) ⇒ Object </a>
|
|
|
|
|
|
|
|
</span>
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
<span class="summary_desc"><div class='inline'></div></span>
|
|
|
|
</li>
|
|
|
|
|
|
<li class="public ">
|
|
<span class="summary_signature">
|
|
|
|
<a href="#no_user_authent_login-instance_method" title="#no_user_authent_login (instance method)">#<strong>no_user_authent_login</strong> ⇒ Object </a>
|
|
|
|
|
|
|
|
</span>
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
<span class="summary_desc"><div class='inline'></div></span>
|
|
|
|
</li>
|
|
|
|
|
|
<li class="public ">
|
|
<span class="summary_signature">
|
|
|
|
<a href="#open_session-instance_method" title="#open_session (instance method)">#<strong>open_session</strong> ⇒ Object </a>
|
|
|
|
|
|
|
|
</span>
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
<span class="summary_desc"><div class='inline'></div></span>
|
|
|
|
</li>
|
|
|
|
|
|
<li class="public ">
|
|
<span class="summary_signature">
|
|
|
|
<a href="#parse_flags-instance_method" title="#parse_flags (instance method)">#<strong>parse_flags</strong>(flags) ⇒ Object </a>
|
|
|
|
|
|
|
|
</span>
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
<span class="summary_desc"><div class='inline'></div></span>
|
|
|
|
</li>
|
|
|
|
|
|
<li class="public ">
|
|
<span class="summary_signature">
|
|
|
|
<a href="#parse_header-instance_method" title="#parse_header (instance method)">#<strong>parse_header</strong>(packet) ⇒ Object </a>
|
|
|
|
|
|
|
|
</span>
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
<span class="summary_desc"><div class='inline'></div></span>
|
|
|
|
</li>
|
|
|
|
|
|
<li class="public ">
|
|
<span class="summary_signature">
|
|
|
|
<a href="#parse_info_response-instance_method" title="#parse_info_response (instance method)">#<strong>parse_info_response</strong>(response) ⇒ Object </a>
|
|
|
|
|
|
|
|
</span>
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
<span class="summary_desc"><div class='inline'></div></span>
|
|
|
|
</li>
|
|
|
|
|
|
<li class="public ">
|
|
<span class="summary_signature">
|
|
|
|
<a href="#parse_login_response_add_send_login_count-instance_method" title="#parse_login_response_add_send_login_count (instance method)">#<strong>parse_login_response_add_send_login_count</strong>(response, data) ⇒ Object </a>
|
|
|
|
|
|
|
|
</span>
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
<span class="summary_desc"><div class='inline'></div></span>
|
|
|
|
</li>
|
|
|
|
|
|
<li class="public ">
|
|
<span class="summary_signature">
|
|
|
|
<a href="#parse_network_addresses-instance_method" title="#parse_network_addresses (instance method)">#<strong>parse_network_addresses</strong>(network_addresses) ⇒ Object </a>
|
|
|
|
|
|
|
|
</span>
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
<span class="summary_desc"><div class='inline'></div></span>
|
|
|
|
</li>
|
|
|
|
|
|
<li class="public ">
|
|
<span class="summary_signature">
|
|
|
|
<a href="#parse_open_session_response-instance_method" title="#parse_open_session_response (instance method)">#<strong>parse_open_session_response</strong>(response) ⇒ Object </a>
|
|
|
|
|
|
|
|
</span>
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
<span class="summary_desc"><div class='inline'></div></span>
|
|
|
|
</li>
|
|
|
|
|
|
<li class="public ">
|
|
<span class="summary_signature">
|
|
|
|
<a href="#read_array-instance_method" title="#read_array (instance method)">#<strong>read_array</strong>(str, offset, afp_network_address = false) ⇒ Object </a>
|
|
|
|
|
|
|
|
</span>
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
<span class="summary_desc"><div class='inline'></div></span>
|
|
|
|
</li>
|
|
|
|
|
|
<li class="public ">
|
|
<span class="summary_signature">
|
|
|
|
<a href="#read_pascal_string-instance_method" title="#read_pascal_string (instance method)">#<strong>read_pascal_string</strong>(str, offset) ⇒ Object </a>
|
|
|
|
|
|
|
|
</span>
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
<span class="summary_desc"><div class='inline'></div></span>
|
|
|
|
</li>
|
|
|
|
|
|
<li class="public ">
|
|
<span class="summary_signature">
|
|
|
|
<a href="#read_utf8_pascal_string-instance_method" title="#read_utf8_pascal_string (instance method)">#<strong>read_utf8_pascal_string</strong>(str, offset) ⇒ Object </a>
|
|
|
|
|
|
|
|
</span>
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
<span class="summary_desc"><div class='inline'></div></span>
|
|
|
|
</li>
|
|
|
|
|
|
</ul>
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
<h3 class="inherited">Methods included from <span class='object_link'><a href="Tcp.html" title="Msf::Exploit::Remote::Tcp (module)">Tcp</a></span></h3>
|
|
<p class="inherited"><span class='object_link'><a href="Tcp.html#chost-instance_method" title="Msf::Exploit::Remote::Tcp#chost (method)">#chost</a></span>, <span class='object_link'><a href="Tcp.html#cleanup-instance_method" title="Msf::Exploit::Remote::Tcp#cleanup (method)">#cleanup</a></span>, <span class='object_link'><a href="Tcp.html#connect-instance_method" title="Msf::Exploit::Remote::Tcp#connect (method)">#connect</a></span>, <span class='object_link'><a href="Tcp.html#connect_timeout-instance_method" title="Msf::Exploit::Remote::Tcp#connect_timeout (method)">#connect_timeout</a></span>, <span class='object_link'><a href="Tcp.html#cport-instance_method" title="Msf::Exploit::Remote::Tcp#cport (method)">#cport</a></span>, <span class='object_link'><a href="Tcp.html#disconnect-instance_method" title="Msf::Exploit::Remote::Tcp#disconnect (method)">#disconnect</a></span>, <span class='object_link'><a href="Tcp.html#handler-instance_method" title="Msf::Exploit::Remote::Tcp#handler (method)">#handler</a></span>, <span class='object_link'><a href="Tcp.html#lhost-instance_method" title="Msf::Exploit::Remote::Tcp#lhost (method)">#lhost</a></span>, <span class='object_link'><a href="Tcp.html#lport-instance_method" title="Msf::Exploit::Remote::Tcp#lport (method)">#lport</a></span>, <span class='object_link'><a href="Tcp.html#peer-instance_method" title="Msf::Exploit::Remote::Tcp#peer (method)">#peer</a></span>, <span class='object_link'><a href="Tcp.html#print_prefix-instance_method" title="Msf::Exploit::Remote::Tcp#print_prefix (method)">#print_prefix</a></span>, <span class='object_link'><a href="Tcp.html#proxies-instance_method" title="Msf::Exploit::Remote::Tcp#proxies (method)">#proxies</a></span>, <span class='object_link'><a href="Tcp.html#replicant-instance_method" title="Msf::Exploit::Remote::Tcp#replicant (method)">#replicant</a></span>, <span class='object_link'><a href="Tcp.html#rhost-instance_method" title="Msf::Exploit::Remote::Tcp#rhost (method)">#rhost</a></span>, <span class='object_link'><a href="Tcp.html#rport-instance_method" title="Msf::Exploit::Remote::Tcp#rport (method)">#rport</a></span>, <span class='object_link'><a href="Tcp.html#set_tcp_evasions-instance_method" title="Msf::Exploit::Remote::Tcp#set_tcp_evasions (method)">#set_tcp_evasions</a></span>, <span class='object_link'><a href="Tcp.html#shutdown-instance_method" title="Msf::Exploit::Remote::Tcp#shutdown (method)">#shutdown</a></span>, <span class='object_link'><a href="Tcp.html#ssl-instance_method" title="Msf::Exploit::Remote::Tcp#ssl (method)">#ssl</a></span>, <span class='object_link'><a href="Tcp.html#ssl_cipher-instance_method" title="Msf::Exploit::Remote::Tcp#ssl_cipher (method)">#ssl_cipher</a></span>, <span class='object_link'><a href="Tcp.html#ssl_verify_mode-instance_method" title="Msf::Exploit::Remote::Tcp#ssl_verify_mode (method)">#ssl_verify_mode</a></span>, <span class='object_link'><a href="Tcp.html#ssl_version-instance_method" title="Msf::Exploit::Remote::Tcp#ssl_version (method)">#ssl_version</a></span>, <span class='object_link'><a href="Tcp.html#sslkeylogfile-instance_method" title="Msf::Exploit::Remote::Tcp#sslkeylogfile (method)">#sslkeylogfile</a></span></p>
|
|
|
|
|
|
<div id="instance_method_details" class="method_details_list">
|
|
<h2>Instance Method Details</h2>
|
|
|
|
|
|
<div class="method_details first">
|
|
<h3 class="signature first" id="close_session-instance_method">
|
|
|
|
#<strong>close_session</strong> ⇒ <tt>Object</tt>
|
|
|
|
|
|
|
|
|
|
|
|
</h3><table class="source_code">
|
|
<tr>
|
|
<td>
|
|
<pre class="lines">
|
|
|
|
|
|
103
|
|
104
|
|
105
|
|
106
|
|
107
|
|
108
|
|
109
|
|
110
|
|
111
|
|
112
|
|
113</pre>
|
|
</td>
|
|
<td>
|
|
<pre class="code"><span class="info file"># File 'lib/msf/core/exploit/remote/afp.rb', line 103</span>
|
|
|
|
<span class='kw'>def</span> <span class='id identifier rubyid_close_session'>close_session</span>
|
|
<span class='id identifier rubyid_packet'>packet</span> <span class='op'>=</span> <span class='tstring'><span class='tstring_beg'>"</span><span class='tstring_content'>\00</span><span class='tstring_end'>"</span></span> <span class='comment'># Flag: Request
|
|
</span> <span class='id identifier rubyid_packet'>packet</span> <span class='op'><<</span> <span class='tstring'><span class='tstring_beg'>"</span><span class='tstring_content'>\x01</span><span class='tstring_end'>"</span></span> <span class='comment'># Command: DSICloseSession
|
|
</span> <span class='id identifier rubyid_packet'>packet</span> <span class='op'><<</span> <span class='lbracket'>[</span><span class='ivar'>@id</span><span class='rbracket'>]</span><span class='period'>.</span><span class='id identifier rubyid_pack'>pack</span><span class='lparen'>(</span><span class='tstring'><span class='tstring_beg'>'</span><span class='tstring_content'>n</span><span class='tstring_end'>'</span></span><span class='rparen'>)</span> <span class='comment'># requestID
|
|
</span> <span class='id identifier rubyid_packet'>packet</span> <span class='op'><<</span> <span class='tstring'><span class='tstring_beg'>"</span><span class='tstring_content'>\x00\x00\x00\x00</span><span class='tstring_end'>"</span></span> <span class='comment'>#Data offset
|
|
</span> <span class='id identifier rubyid_packet'>packet</span> <span class='op'><<</span> <span class='tstring'><span class='tstring_beg'>"</span><span class='tstring_content'>\x00\x00\x00\x00</span><span class='tstring_end'>"</span></span> <span class='comment'>#Length
|
|
</span> <span class='id identifier rubyid_packet'>packet</span> <span class='op'><<</span> <span class='tstring'><span class='tstring_beg'>"</span><span class='tstring_content'>\x00\x00\x00\x00</span><span class='tstring_end'>"</span></span> <span class='comment'>#Reserved
|
|
</span>
|
|
<span class='id identifier rubyid_sock'>sock</span><span class='period'>.</span><span class='id identifier rubyid_put'>put</span><span class='lparen'>(</span><span class='id identifier rubyid_packet'>packet</span><span class='rparen'>)</span>
|
|
<span class='ivar'>@id</span> <span class='op'>+=</span> <span class='int'>1</span>
|
|
<span class='kw'>end</span></pre>
|
|
</td>
|
|
</tr>
|
|
</table>
|
|
</div>
|
|
|
|
<div class="method_details ">
|
|
<h3 class="signature " id="get_body-instance_method">
|
|
|
|
#<strong>get_body</strong>(packet, body_length) ⇒ <tt>Object</tt>
|
|
|
|
|
|
|
|
|
|
|
|
</h3><table class="source_code">
|
|
<tr>
|
|
<td>
|
|
<pre class="lines">
|
|
|
|
|
|
250
|
|
251
|
|
252
|
|
253
|
|
254</pre>
|
|
</td>
|
|
<td>
|
|
<pre class="code"><span class="info file"># File 'lib/msf/core/exploit/remote/afp.rb', line 250</span>
|
|
|
|
<span class='kw'>def</span> <span class='id identifier rubyid_get_body'>get_body</span><span class='lparen'>(</span><span class='id identifier rubyid_packet'>packet</span><span class='comma'>,</span> <span class='id identifier rubyid_body_length'>body_length</span><span class='rparen'>)</span>
|
|
<span class='id identifier rubyid_body'>body</span> <span class='op'>=</span> <span class='id identifier rubyid_packet'>packet</span><span class='lbracket'>[</span><span class='int'>16</span><span class='op'>..</span><span class='id identifier rubyid_body_length'>body_length</span> <span class='op'>+</span> <span class='int'>15</span><span class='rbracket'>]</span>
|
|
<span class='id identifier rubyid_raise'>raise</span> <span class='tstring'><span class='tstring_beg'>"</span><span class='tstring_content'>AFP </span><span class='embexpr_beg'>#{</span><span class='id identifier rubyid_rhost'>rhost</span><span class='embexpr_end'>}</span><span class='tstring_content'>:</span><span class='embexpr_beg'>#{</span><span class='id identifier rubyid_rport'>rport</span><span class='embexpr_end'>}</span><span class='tstring_content'> Invalid body length</span><span class='tstring_end'>"</span></span> <span class='kw'>if</span> <span class='id identifier rubyid_body'>body</span><span class='period'>.</span><span class='id identifier rubyid_length'>length</span> <span class='op'>!=</span> <span class='id identifier rubyid_body_length'>body_length</span>
|
|
<span class='kw'>return</span> <span class='id identifier rubyid_body'>body</span>
|
|
<span class='kw'>end</span></pre>
|
|
</td>
|
|
</tr>
|
|
</table>
|
|
</div>
|
|
|
|
<div class="method_details ">
|
|
<h3 class="signature " id="get_info-instance_method">
|
|
|
|
#<strong>get_info</strong> ⇒ <tt>Object</tt>
|
|
|
|
|
|
|
|
|
|
|
|
</h3><table class="source_code">
|
|
<tr>
|
|
<td>
|
|
<pre class="lines">
|
|
|
|
|
|
17
|
|
18
|
|
19
|
|
20
|
|
21
|
|
22
|
|
23
|
|
24
|
|
25
|
|
26
|
|
27
|
|
28
|
|
29
|
|
30</pre>
|
|
</td>
|
|
<td>
|
|
<pre class="code"><span class="info file"># File 'lib/msf/core/exploit/remote/afp.rb', line 17</span>
|
|
|
|
<span class='kw'>def</span> <span class='id identifier rubyid_get_info'>get_info</span>
|
|
<span class='id identifier rubyid_packet'>packet</span> <span class='op'>=</span> <span class='tstring'><span class='tstring_beg'>"</span><span class='tstring_content'>\00</span><span class='tstring_end'>"</span></span> <span class='comment'># Flag: Request
|
|
</span> <span class='id identifier rubyid_packet'>packet</span> <span class='op'><<</span> <span class='tstring'><span class='tstring_beg'>"</span><span class='tstring_content'>\x03</span><span class='tstring_end'>"</span></span> <span class='comment'># Command: FPGetSrvrInfo
|
|
</span> <span class='id identifier rubyid_packet'>packet</span> <span class='op'><<</span> <span class='lbracket'>[</span><span class='ivar'>@id</span><span class='rbracket'>]</span><span class='period'>.</span><span class='id identifier rubyid_pack'>pack</span><span class='lparen'>(</span><span class='tstring'><span class='tstring_beg'>'</span><span class='tstring_content'>n</span><span class='tstring_end'>'</span></span><span class='rparen'>)</span> <span class='comment'># requestID
|
|
</span> <span class='id identifier rubyid_packet'>packet</span> <span class='op'><<</span> <span class='tstring'><span class='tstring_beg'>"</span><span class='tstring_content'>\x00\x00\x00\x00</span><span class='tstring_end'>"</span></span> <span class='comment'>#Data offset
|
|
</span> <span class='id identifier rubyid_packet'>packet</span> <span class='op'><<</span> <span class='tstring'><span class='tstring_beg'>"</span><span class='tstring_content'>\x00\x00\x00\x00</span><span class='tstring_end'>"</span></span> <span class='comment'>#Length
|
|
</span> <span class='id identifier rubyid_packet'>packet</span> <span class='op'><<</span> <span class='tstring'><span class='tstring_beg'>"</span><span class='tstring_content'>\x00\x00\x00\x00</span><span class='tstring_end'>"</span></span> <span class='comment'>#Reserved
|
|
</span>
|
|
<span class='id identifier rubyid_sock'>sock</span><span class='period'>.</span><span class='id identifier rubyid_put'>put</span><span class='lparen'>(</span><span class='id identifier rubyid_packet'>packet</span><span class='rparen'>)</span>
|
|
<span class='ivar'>@id</span> <span class='op'>+=</span> <span class='int'>1</span>
|
|
|
|
<span class='id identifier rubyid_response'>response</span> <span class='op'>=</span> <span class='id identifier rubyid_sock'>sock</span><span class='period'>.</span><span class='id identifier rubyid_timed_read'>timed_read</span><span class='lparen'>(</span><span class='int'>1024</span><span class='rparen'>)</span>
|
|
<span class='kw'>return</span> <span class='id identifier rubyid_parse_info_response'>parse_info_response</span><span class='lparen'>(</span><span class='id identifier rubyid_response'>response</span><span class='rparen'>)</span>
|
|
<span class='kw'>end</span></pre>
|
|
</td>
|
|
</tr>
|
|
</table>
|
|
</div>
|
|
|
|
<div class="method_details ">
|
|
<h3 class="signature " id="initialize-instance_method">
|
|
|
|
#<strong>initialize</strong>(info = {}) ⇒ <tt>Object</tt>
|
|
|
|
|
|
|
|
|
|
|
|
</h3><table class="source_code">
|
|
<tr>
|
|
<td>
|
|
<pre class="lines">
|
|
|
|
|
|
7
|
|
8
|
|
9
|
|
10
|
|
11
|
|
12
|
|
13
|
|
14
|
|
15</pre>
|
|
</td>
|
|
<td>
|
|
<pre class="code"><span class="info file"># File 'lib/msf/core/exploit/remote/afp.rb', line 7</span>
|
|
|
|
<span class='kw'>def</span> <span class='id identifier rubyid_initialize'>initialize</span><span class='lparen'>(</span><span class='id identifier rubyid_info'>info</span><span class='op'>=</span><span class='lbrace'>{</span><span class='rbrace'>}</span><span class='rparen'>)</span>
|
|
<span class='kw'>super</span>
|
|
|
|
<span class='ivar'>@id</span> <span class='op'>=</span> <span class='int'>1</span>
|
|
<span class='id identifier rubyid_register_options'>register_options</span><span class='lparen'>(</span>
|
|
<span class='lbracket'>[</span>
|
|
<span class='const'><span class='object_link'><a href="../../Opt.html" title="Msf::Opt (module)">Opt</a></span></span><span class='op'>::</span><span class='const'><span class='object_link'><a href="../../Opt.html#RPORT-constant" title="Msf::Opt::RPORT (constant)">RPORT</a></span></span><span class='lparen'>(</span><span class='int'>548</span><span class='rparen'>)</span>
|
|
<span class='rbracket'>]</span><span class='comma'>,</span> <span class='const'><span class='object_link'><a href="../../../Msf.html" title="Msf (module)">Msf</a></span></span><span class='op'>::</span><span class='const'><span class='object_link'><a href="../../Exploit.html" title="Msf::Exploit (class)">Exploit</a></span></span><span class='op'>::</span><span class='const'><span class='object_link'><a href="../Remote.html" title="Msf::Exploit::Remote (class)">Remote</a></span></span><span class='op'>::</span><span class='const'><span class='object_link'><a href="" title="Msf::Exploit::Remote::AFP (module)">AFP</a></span></span><span class='rparen'>)</span>
|
|
<span class='kw'>end</span></pre>
|
|
</td>
|
|
</tr>
|
|
</table>
|
|
</div>
|
|
|
|
<div class="method_details ">
|
|
<h3 class="signature " id="login-instance_method">
|
|
|
|
#<strong>login</strong>(user, pass) ⇒ <tt>Object</tt>
|
|
|
|
|
|
|
|
|
|
|
|
</h3><table class="source_code">
|
|
<tr>
|
|
<td>
|
|
<pre class="lines">
|
|
|
|
|
|
50
|
|
51
|
|
52
|
|
53
|
|
54
|
|
55
|
|
56
|
|
57
|
|
58
|
|
59
|
|
60
|
|
61
|
|
62
|
|
63
|
|
64
|
|
65
|
|
66
|
|
67
|
|
68
|
|
69
|
|
70
|
|
71
|
|
72
|
|
73
|
|
74
|
|
75
|
|
76
|
|
77
|
|
78
|
|
79
|
|
80
|
|
81
|
|
82
|
|
83
|
|
84
|
|
85
|
|
86
|
|
87
|
|
88
|
|
89
|
|
90
|
|
91
|
|
92
|
|
93
|
|
94
|
|
95
|
|
96
|
|
97
|
|
98
|
|
99
|
|
100
|
|
101</pre>
|
|
</td>
|
|
<td>
|
|
<pre class="code"><span class="info file"># File 'lib/msf/core/exploit/remote/afp.rb', line 50</span>
|
|
|
|
<span class='kw'>def</span> <span class='id identifier rubyid_login'>login</span><span class='lparen'>(</span><span class='id identifier rubyid_user'>user</span><span class='comma'>,</span> <span class='id identifier rubyid_pass'>pass</span><span class='rparen'>)</span>
|
|
<span class='kw'>if</span> <span class='id identifier rubyid_user'>user</span> <span class='op'>==</span> <span class='tstring'><span class='tstring_beg'>'</span><span class='tstring_end'>'</span></span>
|
|
<span class='kw'>return</span> <span class='id identifier rubyid_no_user_authent_login'>no_user_authent_login</span>
|
|
<span class='kw'>end</span>
|
|
|
|
<span class='id identifier rubyid_p'>p</span> <span class='op'>=</span> <span class='const'>OpenSSL</span><span class='op'>::</span><span class='const'>BN</span><span class='period'>.</span><span class='id identifier rubyid_new'>new</span><span class='lparen'>(</span><span class='tstring'><span class='tstring_beg'>"</span><span class='tstring_content'>BA2873DFB06057D43F2024744CEEE75B</span><span class='tstring_end'>"</span></span><span class='comma'>,</span> <span class='int'>16</span><span class='rparen'>)</span>
|
|
<span class='id identifier rubyid_g'>g</span> <span class='op'>=</span> <span class='const'>OpenSSL</span><span class='op'>::</span><span class='const'>BN</span><span class='period'>.</span><span class='id identifier rubyid_new'>new</span><span class='lparen'>(</span><span class='tstring'><span class='tstring_beg'>"</span><span class='tstring_content'>7</span><span class='tstring_end'>"</span></span><span class='comma'>,</span> <span class='int'>10</span><span class='rparen'>)</span>
|
|
<span class='id identifier rubyid_ra'>ra</span> <span class='op'>=</span> <span class='const'>OpenSSL</span><span class='op'>::</span><span class='const'>BN</span><span class='period'>.</span><span class='id identifier rubyid_new'>new</span><span class='lparen'>(</span><span class='tstring'><span class='tstring_beg'>'</span><span class='tstring_content'>86F6D3C0B0D63E4B11F113A2F9F19E3BBBF803F28D30087A1450536BE979FD42</span><span class='tstring_end'>'</span></span><span class='comma'>,</span> <span class='int'>16</span><span class='rparen'>)</span>
|
|
<span class='id identifier rubyid_ma'>ma</span> <span class='op'>=</span> <span class='id identifier rubyid_g'>g</span><span class='period'>.</span><span class='id identifier rubyid_mod_exp'>mod_exp</span><span class='lparen'>(</span><span class='id identifier rubyid_ra'>ra</span><span class='comma'>,</span> <span class='id identifier rubyid_p'>p</span><span class='rparen'>)</span>
|
|
|
|
<span class='id identifier rubyid_padded_user'>padded_user</span> <span class='op'>=</span> <span class='lparen'>(</span><span class='id identifier rubyid_user'>user</span><span class='period'>.</span><span class='id identifier rubyid_length'>length</span> <span class='op'>+</span> <span class='int'>1</span><span class='rparen'>)</span> <span class='op'>%</span> <span class='int'>2</span> <span class='op'>!=</span> <span class='int'>0</span> <span class='op'>?</span> <span class='id identifier rubyid_user'>user</span> <span class='op'>+</span> <span class='tstring'><span class='tstring_beg'>"</span><span class='tstring_content'>\x00</span><span class='tstring_end'>"</span></span> <span class='op'>:</span> <span class='id identifier rubyid_user'>user</span>
|
|
<span class='id identifier rubyid_bin_user'>bin_user</span> <span class='op'>=</span> <span class='lbracket'>[</span><span class='id identifier rubyid_padded_user'>padded_user</span><span class='period'>.</span><span class='id identifier rubyid_length'>length</span><span class='comma'>,</span> <span class='id identifier rubyid_padded_user'>padded_user</span><span class='rbracket'>]</span><span class='period'>.</span><span class='id identifier rubyid_pack'>pack</span><span class='lparen'>(</span><span class='tstring'><span class='tstring_beg'>"</span><span class='tstring_content'>Ca*</span><span class='tstring_end'>"</span></span><span class='rparen'>)</span>
|
|
|
|
<span class='id identifier rubyid_length'>length</span> <span class='op'>=</span> <span class='int'>18</span> <span class='op'>+</span> <span class='id identifier rubyid_bin_user'>bin_user</span><span class='period'>.</span><span class='id identifier rubyid_length'>length</span> <span class='op'>+</span> <span class='id identifier rubyid_ma'>ma</span><span class='period'>.</span><span class='id identifier rubyid_to_s'>to_s</span><span class='lparen'>(</span><span class='int'>2</span><span class='rparen'>)</span><span class='period'>.</span><span class='id identifier rubyid_length'>length</span>
|
|
|
|
<span class='id identifier rubyid_packet'>packet</span> <span class='op'>=</span> <span class='tstring'><span class='tstring_beg'>"</span><span class='tstring_content'>\00</span><span class='tstring_end'>"</span></span> <span class='comment'># Flag: Request
|
|
</span> <span class='id identifier rubyid_packet'>packet</span> <span class='op'><<</span> <span class='tstring'><span class='tstring_beg'>"</span><span class='tstring_content'>\x02</span><span class='tstring_end'>"</span></span> <span class='comment'># Command: DSICommand
|
|
</span> <span class='id identifier rubyid_packet'>packet</span> <span class='op'><<</span> <span class='lbracket'>[</span><span class='ivar'>@id</span><span class='rbracket'>]</span><span class='period'>.</span><span class='id identifier rubyid_pack'>pack</span><span class='lparen'>(</span><span class='tstring'><span class='tstring_beg'>'</span><span class='tstring_content'>n</span><span class='tstring_end'>'</span></span><span class='rparen'>)</span> <span class='comment'># requestID
|
|
</span> <span class='id identifier rubyid_packet'>packet</span> <span class='op'><<</span> <span class='tstring'><span class='tstring_beg'>"</span><span class='tstring_content'>\x00\x00\x00\x00</span><span class='tstring_end'>"</span></span> <span class='comment'># Data offset
|
|
</span> <span class='id identifier rubyid_packet'>packet</span> <span class='op'><<</span> <span class='lbracket'>[</span><span class='id identifier rubyid_length'>length</span><span class='rbracket'>]</span><span class='period'>.</span><span class='id identifier rubyid_pack'>pack</span><span class='lparen'>(</span><span class='tstring'><span class='tstring_beg'>'</span><span class='tstring_content'>N</span><span class='tstring_end'>'</span></span><span class='rparen'>)</span> <span class='comment'># Length (42)
|
|
</span> <span class='id identifier rubyid_packet'>packet</span> <span class='op'><<</span> <span class='tstring'><span class='tstring_beg'>"</span><span class='tstring_content'>\x00\x00\x00\x00</span><span class='tstring_end'>"</span></span> <span class='comment'># Reserved
|
|
</span> <span class='id identifier rubyid_packet'>packet</span> <span class='op'><<</span> <span class='tstring'><span class='tstring_beg'>"</span><span class='tstring_content'>\x12</span><span class='tstring_end'>"</span></span> <span class='comment'># AFPCommand: FPLogin (18)
|
|
</span> <span class='id identifier rubyid_packet'>packet</span> <span class='op'><<</span> <span class='tstring'><span class='tstring_beg'>"</span><span class='tstring_content'>\x06\x41\x46\x50\x33\x2e\x31</span><span class='tstring_end'>"</span></span> <span class='comment'># AFPVersion: AFP3.1
|
|
</span> <span class='id identifier rubyid_packet'>packet</span> <span class='op'><<</span> <span class='tstring'><span class='tstring_beg'>"</span><span class='tstring_content'>\x09\x44\x48\x43\x41\x53\x54\x31\x32\x38</span><span class='tstring_end'>"</span></span> <span class='comment'>#UAM: DHCAST128
|
|
</span> <span class='id identifier rubyid_packet'>packet</span> <span class='op'><<</span> <span class='id identifier rubyid_bin_user'>bin_user</span> <span class='comment'># username
|
|
</span> <span class='id identifier rubyid_packet'>packet</span> <span class='op'><<</span> <span class='id identifier rubyid_ma'>ma</span><span class='period'>.</span><span class='id identifier rubyid_to_s'>to_s</span><span class='lparen'>(</span><span class='int'>2</span><span class='rparen'>)</span> <span class='comment'># random number
|
|
</span>
|
|
<span class='id identifier rubyid_sock'>sock</span><span class='period'>.</span><span class='id identifier rubyid_put'>put</span><span class='lparen'>(</span><span class='id identifier rubyid_packet'>packet</span><span class='rparen'>)</span>
|
|
<span class='ivar'>@id</span> <span class='op'>+=</span> <span class='int'>1</span>
|
|
|
|
<span class='kw'>begin</span>
|
|
<span class='id identifier rubyid_start'>start</span> <span class='op'>=</span> <span class='const'>Time</span><span class='period'>.</span><span class='id identifier rubyid_now'>now</span>
|
|
<span class='id identifier rubyid_response'>response</span> <span class='op'>=</span> <span class='id identifier rubyid_sock'>sock</span><span class='period'>.</span><span class='id identifier rubyid_timed_read'>timed_read</span><span class='lparen'>(</span><span class='int'>1024</span><span class='comma'>,</span> <span class='id identifier rubyid_datastore'>datastore</span><span class='lbracket'>[</span><span class='tstring'><span class='tstring_beg'>'</span><span class='tstring_content'>LoginTimeOut</span><span class='tstring_end'>'</span></span><span class='rbracket'>]</span><span class='rparen'>)</span>
|
|
<span class='kw'>rescue</span> <span class='const'>Timeout</span><span class='op'>::</span><span class='const'>Error</span>
|
|
<span class='id identifier rubyid_vprint_error'>vprint_error</span><span class='lparen'>(</span><span class='tstring'><span class='tstring_beg'>"</span><span class='tstring_content'>AFP </span><span class='embexpr_beg'>#{</span><span class='id identifier rubyid_rhost'>rhost</span><span class='embexpr_end'>}</span><span class='tstring_content'>:</span><span class='embexpr_beg'>#{</span><span class='id identifier rubyid_rport'>rport</span><span class='embexpr_end'>}</span><span class='tstring_content'> Login timeout (AFP server delay response for 20 - 22 seconds after 7 incorrect logins)</span><span class='tstring_end'>"</span></span><span class='rparen'>)</span>
|
|
<span class='kw'>return</span> <span class='symbol'>:connection_error</span>
|
|
<span class='kw'>end</span>
|
|
|
|
<span class='id identifier rubyid_flags'>flags</span><span class='comma'>,</span> <span class='id identifier rubyid_command'>command</span><span class='comma'>,</span> <span class='id identifier rubyid_request_id'>request_id</span><span class='comma'>,</span> <span class='id identifier rubyid_error_code'>error_code</span><span class='comma'>,</span> <span class='id identifier rubyid_length'>length</span><span class='comma'>,</span> <span class='id identifier rubyid_reserved'>reserved</span> <span class='op'>=</span> <span class='id identifier rubyid_parse_header'>parse_header</span><span class='lparen'>(</span><span class='id identifier rubyid_response'>response</span><span class='rparen'>)</span>
|
|
|
|
<span class='kw'>case</span> <span class='id identifier rubyid_error_code'>error_code</span>
|
|
<span class='kw'>when</span> <span class='op'>-</span><span class='int'>5001</span> <span class='comment'>#kFPAuthContinue
|
|
</span> <span class='kw'>return</span> <span class='id identifier rubyid_parse_login_response_add_send_login_count'>parse_login_response_add_send_login_count</span><span class='lparen'>(</span><span class='id identifier rubyid_response'>response</span><span class='comma'>,</span> <span class='lbrace'>{</span><span class='symbol'>:p</span> <span class='op'>=></span> <span class='id identifier rubyid_p'>p</span><span class='comma'>,</span> <span class='symbol'>:g</span> <span class='op'>=></span> <span class='id identifier rubyid_g'>g</span><span class='comma'>,</span> <span class='symbol'>:ra</span> <span class='op'>=></span> <span class='id identifier rubyid_ra'>ra</span><span class='comma'>,</span> <span class='symbol'>:ma</span> <span class='op'>=></span> <span class='id identifier rubyid_ma'>ma</span><span class='comma'>,</span>
|
|
<span class='symbol'>:password</span> <span class='op'>=></span> <span class='id identifier rubyid_pass'>pass</span><span class='comma'>,</span> <span class='symbol'>:user</span> <span class='op'>=></span> <span class='id identifier rubyid_user'>user</span><span class='rbrace'>}</span><span class='rparen'>)</span>
|
|
<span class='kw'>when</span> <span class='op'>-</span><span class='int'>5023</span> <span class='comment'>#kFPUserNotAuth (User doesn't exists)
|
|
</span> <span class='id identifier rubyid_print_status'>print_status</span><span class='lparen'>(</span><span class='tstring'><span class='tstring_beg'>"</span><span class='tstring_content'>AFP </span><span class='embexpr_beg'>#{</span><span class='id identifier rubyid_rhost'>rhost</span><span class='embexpr_end'>}</span><span class='tstring_content'>:</span><span class='embexpr_beg'>#{</span><span class='id identifier rubyid_rport'>rport</span><span class='embexpr_end'>}</span><span class='tstring_content'> User </span><span class='embexpr_beg'>#{</span><span class='id identifier rubyid_user'>user</span><span class='embexpr_end'>}</span><span class='tstring_content'> doesn't exists</span><span class='tstring_end'>"</span></span><span class='rparen'>)</span>
|
|
<span class='kw'>return</span> <span class='symbol'>:skip_user</span>
|
|
<span class='kw'>else</span>
|
|
<span class='kw'>return</span> <span class='symbol'>:connection_error</span>
|
|
<span class='kw'>end</span>
|
|
|
|
<span class='kw'>end</span></pre>
|
|
</td>
|
|
</tr>
|
|
</table>
|
|
</div>
|
|
|
|
<div class="method_details ">
|
|
<h3 class="signature " id="no_user_authent_login-instance_method">
|
|
|
|
#<strong>no_user_authent_login</strong> ⇒ <tt>Object</tt>
|
|
|
|
|
|
|
|
|
|
|
|
</h3><table class="source_code">
|
|
<tr>
|
|
<td>
|
|
<pre class="lines">
|
|
|
|
|
|
115
|
|
116
|
|
117
|
|
118
|
|
119
|
|
120
|
|
121
|
|
122
|
|
123
|
|
124
|
|
125
|
|
126
|
|
127
|
|
128
|
|
129
|
|
130
|
|
131
|
|
132
|
|
133
|
|
134
|
|
135
|
|
136
|
|
137
|
|
138
|
|
139
|
|
140
|
|
141
|
|
142
|
|
143</pre>
|
|
</td>
|
|
<td>
|
|
<pre class="code"><span class="info file"># File 'lib/msf/core/exploit/remote/afp.rb', line 115</span>
|
|
|
|
<span class='kw'>def</span> <span class='id identifier rubyid_no_user_authent_login'>no_user_authent_login</span>
|
|
<span class='id identifier rubyid_packet'>packet</span> <span class='op'>=</span> <span class='tstring'><span class='tstring_beg'>"</span><span class='tstring_content'>\00</span><span class='tstring_end'>"</span></span> <span class='comment'># Flag: Request
|
|
</span> <span class='id identifier rubyid_packet'>packet</span> <span class='op'><<</span> <span class='tstring'><span class='tstring_beg'>"</span><span class='tstring_content'>\x02</span><span class='tstring_end'>"</span></span> <span class='comment'># Command: DSICommand
|
|
</span> <span class='id identifier rubyid_packet'>packet</span> <span class='op'><<</span> <span class='lbracket'>[</span><span class='ivar'>@id</span><span class='rbracket'>]</span><span class='period'>.</span><span class='id identifier rubyid_pack'>pack</span><span class='lparen'>(</span><span class='tstring'><span class='tstring_beg'>'</span><span class='tstring_content'>n</span><span class='tstring_end'>'</span></span><span class='rparen'>)</span> <span class='comment'># requestID
|
|
</span> <span class='id identifier rubyid_packet'>packet</span> <span class='op'><<</span> <span class='tstring'><span class='tstring_beg'>"</span><span class='tstring_content'>\x00\x00\x00\x00</span><span class='tstring_end'>"</span></span> <span class='comment'># Data offset
|
|
</span> <span class='id identifier rubyid_packet'>packet</span> <span class='op'><<</span> <span class='tstring'><span class='tstring_beg'>"</span><span class='tstring_content'>\x00\x00\x00\x18</span><span class='tstring_end'>"</span></span> <span class='comment'># Length (24)
|
|
</span> <span class='id identifier rubyid_packet'>packet</span> <span class='op'><<</span> <span class='tstring'><span class='tstring_beg'>"</span><span class='tstring_content'>\x00\x00\x00\x00</span><span class='tstring_end'>"</span></span> <span class='comment'># Reserved
|
|
</span> <span class='id identifier rubyid_packet'>packet</span> <span class='op'><<</span> <span class='tstring'><span class='tstring_beg'>"</span><span class='tstring_content'>\x12</span><span class='tstring_end'>"</span></span> <span class='comment'># AFPCommand: FPLogin (18)
|
|
</span> <span class='id identifier rubyid_packet'>packet</span> <span class='op'><<</span> <span class='tstring'><span class='tstring_beg'>"</span><span class='tstring_content'>\x06\x41\x46\x50\x33\x2e\x31</span><span class='tstring_end'>"</span></span> <span class='comment'>#AFP3.1
|
|
</span> <span class='id identifier rubyid_packet'>packet</span> <span class='op'><<</span> <span class='tstring'><span class='tstring_beg'>"</span><span class='tstring_content'>\x0f\x4e\x6f\x20\x55\x73\x65\x72\x20\x41\x75\x74\x68\x65\x6e\x74</span><span class='tstring_end'>"</span></span> <span class='comment'>#UAM: No User Authent
|
|
</span>
|
|
<span class='id identifier rubyid_sock'>sock</span><span class='period'>.</span><span class='id identifier rubyid_put'>put</span><span class='lparen'>(</span><span class='id identifier rubyid_packet'>packet</span><span class='rparen'>)</span>
|
|
<span class='ivar'>@id</span> <span class='op'>+=</span> <span class='int'>1</span>
|
|
|
|
<span class='kw'>begin</span>
|
|
<span class='id identifier rubyid_response'>response</span> <span class='op'>=</span> <span class='id identifier rubyid_sock'>sock</span><span class='period'>.</span><span class='id identifier rubyid_timed_read'>timed_read</span><span class='lparen'>(</span><span class='int'>1024</span><span class='comma'>,</span> <span class='id identifier rubyid_datastore'>datastore</span><span class='lbracket'>[</span><span class='tstring'><span class='tstring_beg'>'</span><span class='tstring_content'>LoginTimeOut</span><span class='tstring_end'>'</span></span><span class='rbracket'>]</span><span class='rparen'>)</span>
|
|
<span class='kw'>rescue</span> <span class='const'>Timeout</span><span class='op'>::</span><span class='const'>Error</span>
|
|
<span class='id identifier rubyid_vprint_error'>vprint_error</span><span class='lparen'>(</span><span class='tstring'><span class='tstring_beg'>"</span><span class='tstring_content'>AFP </span><span class='embexpr_beg'>#{</span><span class='id identifier rubyid_rhost'>rhost</span><span class='embexpr_end'>}</span><span class='tstring_content'>:</span><span class='embexpr_beg'>#{</span><span class='id identifier rubyid_rport'>rport</span><span class='embexpr_end'>}</span><span class='tstring_content'> Login timeout (AFP server delay response for 20 - 22 seconds after 7 incorrect logins)</span><span class='tstring_end'>"</span></span><span class='rparen'>)</span>
|
|
<span class='kw'>return</span> <span class='symbol'>:connection_error</span>
|
|
<span class='kw'>end</span>
|
|
|
|
<span class='id identifier rubyid_flags'>flags</span><span class='comma'>,</span> <span class='id identifier rubyid_command'>command</span><span class='comma'>,</span> <span class='id identifier rubyid_request_id'>request_id</span><span class='comma'>,</span> <span class='id identifier rubyid_error_code'>error_code</span><span class='comma'>,</span> <span class='id identifier rubyid_length'>length</span><span class='comma'>,</span> <span class='id identifier rubyid_reserved'>reserved</span> <span class='op'>=</span> <span class='id identifier rubyid_parse_header'>parse_header</span><span class='lparen'>(</span><span class='id identifier rubyid_response'>response</span><span class='rparen'>)</span>
|
|
|
|
<span class='kw'>if</span> <span class='id identifier rubyid_error_code'>error_code</span> <span class='op'>==</span> <span class='int'>0</span>
|
|
<span class='kw'>return</span> <span class='symbol'>:true</span>
|
|
<span class='kw'>else</span>
|
|
<span class='kw'>return</span> <span class='kw'>false</span>
|
|
<span class='kw'>end</span>
|
|
<span class='kw'>end</span></pre>
|
|
</td>
|
|
</tr>
|
|
</table>
|
|
</div>
|
|
|
|
<div class="method_details ">
|
|
<h3 class="signature " id="open_session-instance_method">
|
|
|
|
#<strong>open_session</strong> ⇒ <tt>Object</tt>
|
|
|
|
|
|
|
|
|
|
|
|
</h3><table class="source_code">
|
|
<tr>
|
|
<td>
|
|
<pre class="lines">
|
|
|
|
|
|
32
|
|
33
|
|
34
|
|
35
|
|
36
|
|
37
|
|
38
|
|
39
|
|
40
|
|
41
|
|
42
|
|
43
|
|
44
|
|
45
|
|
46
|
|
47
|
|
48</pre>
|
|
</td>
|
|
<td>
|
|
<pre class="code"><span class="info file"># File 'lib/msf/core/exploit/remote/afp.rb', line 32</span>
|
|
|
|
<span class='kw'>def</span> <span class='id identifier rubyid_open_session'>open_session</span>
|
|
<span class='id identifier rubyid_packet'>packet</span> <span class='op'>=</span> <span class='tstring'><span class='tstring_beg'>"</span><span class='tstring_content'>\00</span><span class='tstring_end'>"</span></span> <span class='comment'># Flag: Request
|
|
</span> <span class='id identifier rubyid_packet'>packet</span> <span class='op'><<</span> <span class='tstring'><span class='tstring_beg'>"</span><span class='tstring_content'>\x04</span><span class='tstring_end'>"</span></span> <span class='comment'># Command: DSIOpenSession
|
|
</span> <span class='id identifier rubyid_packet'>packet</span> <span class='op'><<</span> <span class='lbracket'>[</span><span class='ivar'>@id</span><span class='rbracket'>]</span><span class='period'>.</span><span class='id identifier rubyid_pack'>pack</span><span class='lparen'>(</span><span class='tstring'><span class='tstring_beg'>'</span><span class='tstring_content'>n</span><span class='tstring_end'>'</span></span><span class='rparen'>)</span> <span class='comment'># requestID
|
|
</span> <span class='id identifier rubyid_packet'>packet</span> <span class='op'><<</span> <span class='tstring'><span class='tstring_beg'>"</span><span class='tstring_content'>\x00\x00\x00\x00</span><span class='tstring_end'>"</span></span> <span class='comment'>#Data offset
|
|
</span> <span class='id identifier rubyid_packet'>packet</span> <span class='op'><<</span> <span class='tstring'><span class='tstring_beg'>"</span><span class='tstring_content'>\x00\x00\x00\x06</span><span class='tstring_end'>"</span></span> <span class='comment'>#Length
|
|
</span> <span class='id identifier rubyid_packet'>packet</span> <span class='op'><<</span> <span class='tstring'><span class='tstring_beg'>"</span><span class='tstring_content'>\x00\x00\x00\x00</span><span class='tstring_end'>"</span></span> <span class='comment'>#Reserved
|
|
</span> <span class='id identifier rubyid_packet'>packet</span> <span class='op'><<</span> <span class='tstring'><span class='tstring_beg'>"</span><span class='tstring_content'>\x01</span><span class='tstring_end'>"</span></span> <span class='comment'># Attention Quantum
|
|
</span> <span class='id identifier rubyid_packet'>packet</span> <span class='op'><<</span> <span class='tstring'><span class='tstring_beg'>"</span><span class='tstring_content'>\x04</span><span class='tstring_end'>"</span></span> <span class='comment'># Length
|
|
</span> <span class='id identifier rubyid_packet'>packet</span> <span class='op'><<</span> <span class='tstring'><span class='tstring_beg'>"</span><span class='tstring_content'>\x00\x00\x04\x00</span><span class='tstring_end'>"</span></span> <span class='comment'># 1024
|
|
</span>
|
|
<span class='id identifier rubyid_sock'>sock</span><span class='period'>.</span><span class='id identifier rubyid_put'>put</span><span class='lparen'>(</span><span class='id identifier rubyid_packet'>packet</span><span class='rparen'>)</span>
|
|
<span class='ivar'>@id</span> <span class='op'>+=</span> <span class='int'>1</span>
|
|
|
|
<span class='id identifier rubyid_response'>response</span> <span class='op'>=</span> <span class='id identifier rubyid_sock'>sock</span><span class='period'>.</span><span class='id identifier rubyid_timed_read'>timed_read</span><span class='lparen'>(</span><span class='int'>1024</span><span class='rparen'>)</span>
|
|
<span class='kw'>return</span> <span class='id identifier rubyid_parse_open_session_response'>parse_open_session_response</span><span class='lparen'>(</span><span class='id identifier rubyid_response'>response</span><span class='rparen'>)</span>
|
|
<span class='kw'>end</span></pre>
|
|
</td>
|
|
</tr>
|
|
</table>
|
|
</div>
|
|
|
|
<div class="method_details ">
|
|
<h3 class="signature " id="parse_flags-instance_method">
|
|
|
|
#<strong>parse_flags</strong>(flags) ⇒ <tt>Object</tt>
|
|
|
|
|
|
|
|
|
|
|
|
</h3><table class="source_code">
|
|
<tr>
|
|
<td>
|
|
<pre class="lines">
|
|
|
|
|
|
306
|
|
307
|
|
308
|
|
309
|
|
310
|
|
311
|
|
312
|
|
313
|
|
314
|
|
315
|
|
316
|
|
317
|
|
318
|
|
319
|
|
320
|
|
321
|
|
322</pre>
|
|
</td>
|
|
<td>
|
|
<pre class="code"><span class="info file"># File 'lib/msf/core/exploit/remote/afp.rb', line 306</span>
|
|
|
|
<span class='kw'>def</span> <span class='id identifier rubyid_parse_flags'>parse_flags</span><span class='lparen'>(</span><span class='id identifier rubyid_flags'>flags</span><span class='rparen'>)</span>
|
|
<span class='id identifier rubyid_flags'>flags</span> <span class='op'>=</span> <span class='id identifier rubyid_flags'>flags</span><span class='period'>.</span><span class='id identifier rubyid_to_s'>to_s</span><span class='lparen'>(</span><span class='int'>2</span><span class='rparen'>)</span>
|
|
<span class='id identifier rubyid_result'>result</span> <span class='op'>=</span> <span class='lbrace'>{</span><span class='rbrace'>}</span>
|
|
<span class='id identifier rubyid_result'>result</span><span class='lbracket'>[</span><span class='tstring'><span class='tstring_beg'>'</span><span class='tstring_content'>Super Client</span><span class='tstring_end'>'</span></span><span class='rbracket'>]</span> <span class='op'>=</span> <span class='id identifier rubyid_flags'>flags</span><span class='lbracket'>[</span><span class='int'>0</span><span class='comma'>,</span><span class='int'>1</span><span class='rbracket'>]</span> <span class='op'>==</span> <span class='tstring'><span class='tstring_beg'>'</span><span class='tstring_content'>1</span><span class='tstring_end'>'</span></span> <span class='op'>?</span> <span class='kw'>true</span> <span class='op'>:</span> <span class='kw'>false</span>
|
|
<span class='id identifier rubyid_result'>result</span><span class='lbracket'>[</span><span class='tstring'><span class='tstring_beg'>'</span><span class='tstring_content'>UUIDs</span><span class='tstring_end'>'</span></span><span class='rbracket'>]</span> <span class='op'>=</span> <span class='id identifier rubyid_flags'>flags</span><span class='lbracket'>[</span><span class='int'>5</span><span class='comma'>,</span><span class='int'>1</span><span class='rbracket'>]</span> <span class='op'>==</span> <span class='tstring'><span class='tstring_beg'>'</span><span class='tstring_content'>1</span><span class='tstring_end'>'</span></span> <span class='op'>?</span> <span class='kw'>true</span> <span class='op'>:</span> <span class='kw'>false</span>
|
|
<span class='id identifier rubyid_result'>result</span><span class='lbracket'>[</span><span class='tstring'><span class='tstring_beg'>'</span><span class='tstring_content'>UTF8 Server Name</span><span class='tstring_end'>'</span></span><span class='rbracket'>]</span> <span class='op'>=</span> <span class='id identifier rubyid_flags'>flags</span><span class='lbracket'>[</span><span class='int'>6</span><span class='comma'>,</span><span class='int'>1</span><span class='rbracket'>]</span> <span class='op'>==</span> <span class='tstring'><span class='tstring_beg'>'</span><span class='tstring_content'>1</span><span class='tstring_end'>'</span></span> <span class='op'>?</span> <span class='kw'>true</span> <span class='op'>:</span> <span class='kw'>false</span>
|
|
<span class='id identifier rubyid_result'>result</span><span class='lbracket'>[</span><span class='tstring'><span class='tstring_beg'>'</span><span class='tstring_content'>Open Directory</span><span class='tstring_end'>'</span></span><span class='rbracket'>]</span> <span class='op'>=</span> <span class='id identifier rubyid_flags'>flags</span><span class='lbracket'>[</span><span class='int'>7</span><span class='comma'>,</span><span class='int'>1</span><span class='rbracket'>]</span> <span class='op'>==</span> <span class='tstring'><span class='tstring_beg'>'</span><span class='tstring_content'>1</span><span class='tstring_end'>'</span></span> <span class='op'>?</span> <span class='kw'>true</span> <span class='op'>:</span> <span class='kw'>false</span>
|
|
<span class='id identifier rubyid_result'>result</span><span class='lbracket'>[</span><span class='tstring'><span class='tstring_beg'>'</span><span class='tstring_content'>Reconnect</span><span class='tstring_end'>'</span></span><span class='rbracket'>]</span> <span class='op'>=</span> <span class='id identifier rubyid_flags'>flags</span><span class='lbracket'>[</span><span class='int'>8</span><span class='comma'>,</span><span class='int'>1</span><span class='rbracket'>]</span> <span class='op'>==</span> <span class='tstring'><span class='tstring_beg'>'</span><span class='tstring_content'>1</span><span class='tstring_end'>'</span></span> <span class='op'>?</span> <span class='kw'>true</span> <span class='op'>:</span> <span class='kw'>false</span>
|
|
<span class='id identifier rubyid_result'>result</span><span class='lbracket'>[</span><span class='tstring'><span class='tstring_beg'>'</span><span class='tstring_content'>Server Notifications</span><span class='tstring_end'>'</span></span><span class='rbracket'>]</span> <span class='op'>=</span> <span class='id identifier rubyid_flags'>flags</span><span class='lbracket'>[</span><span class='int'>9</span><span class='comma'>,</span><span class='int'>1</span><span class='rbracket'>]</span> <span class='op'>==</span> <span class='tstring'><span class='tstring_beg'>'</span><span class='tstring_content'>1</span><span class='tstring_end'>'</span></span> <span class='op'>?</span> <span class='kw'>true</span> <span class='op'>:</span> <span class='kw'>false</span>
|
|
<span class='id identifier rubyid_result'>result</span><span class='lbracket'>[</span><span class='tstring'><span class='tstring_beg'>'</span><span class='tstring_content'>TCP/IP</span><span class='tstring_end'>'</span></span><span class='rbracket'>]</span> <span class='op'>=</span> <span class='id identifier rubyid_flags'>flags</span><span class='lbracket'>[</span><span class='int'>10</span><span class='comma'>,</span><span class='int'>1</span><span class='rbracket'>]</span> <span class='op'>==</span> <span class='tstring'><span class='tstring_beg'>'</span><span class='tstring_content'>1</span><span class='tstring_end'>'</span></span> <span class='op'>?</span> <span class='kw'>true</span> <span class='op'>:</span> <span class='kw'>false</span>
|
|
<span class='id identifier rubyid_result'>result</span><span class='lbracket'>[</span><span class='tstring'><span class='tstring_beg'>'</span><span class='tstring_content'>Server Signature</span><span class='tstring_end'>'</span></span><span class='rbracket'>]</span> <span class='op'>=</span> <span class='id identifier rubyid_flags'>flags</span><span class='lbracket'>[</span><span class='int'>11</span><span class='comma'>,</span><span class='int'>1</span><span class='rbracket'>]</span> <span class='op'>==</span> <span class='tstring'><span class='tstring_beg'>'</span><span class='tstring_content'>1</span><span class='tstring_end'>'</span></span> <span class='op'>?</span> <span class='kw'>true</span> <span class='op'>:</span> <span class='kw'>false</span>
|
|
<span class='id identifier rubyid_result'>result</span><span class='lbracket'>[</span><span class='tstring'><span class='tstring_beg'>'</span><span class='tstring_content'>Server Messages</span><span class='tstring_end'>'</span></span><span class='rbracket'>]</span> <span class='op'>=</span> <span class='id identifier rubyid_flags'>flags</span><span class='lbracket'>[</span><span class='int'>12</span><span class='comma'>,</span><span class='int'>1</span><span class='rbracket'>]</span> <span class='op'>==</span> <span class='tstring'><span class='tstring_beg'>'</span><span class='tstring_content'>1</span><span class='tstring_end'>'</span></span> <span class='op'>?</span> <span class='kw'>true</span> <span class='op'>:</span> <span class='kw'>false</span>
|
|
<span class='id identifier rubyid_result'>result</span><span class='lbracket'>[</span><span class='tstring'><span class='tstring_beg'>'</span><span class='tstring_content'>Password Saving Prohibited</span><span class='tstring_end'>'</span></span><span class='rbracket'>]</span> <span class='op'>=</span> <span class='id identifier rubyid_flags'>flags</span><span class='lbracket'>[</span><span class='int'>13</span><span class='comma'>,</span><span class='int'>1</span><span class='rbracket'>]</span> <span class='op'>==</span> <span class='tstring'><span class='tstring_beg'>'</span><span class='tstring_content'>1</span><span class='tstring_end'>'</span></span> <span class='op'>?</span> <span class='kw'>true</span> <span class='op'>:</span> <span class='kw'>false</span>
|
|
<span class='id identifier rubyid_result'>result</span><span class='lbracket'>[</span><span class='tstring'><span class='tstring_beg'>'</span><span class='tstring_content'>Password Changing</span><span class='tstring_end'>'</span></span><span class='rbracket'>]</span> <span class='op'>=</span> <span class='id identifier rubyid_flags'>flags</span><span class='lbracket'>[</span><span class='int'>14</span><span class='comma'>,</span><span class='int'>1</span><span class='rbracket'>]</span> <span class='op'>==</span> <span class='tstring'><span class='tstring_beg'>'</span><span class='tstring_content'>1</span><span class='tstring_end'>'</span></span> <span class='op'>?</span> <span class='kw'>true</span> <span class='op'>:</span> <span class='kw'>false</span>
|
|
<span class='id identifier rubyid_result'>result</span><span class='lbracket'>[</span><span class='tstring'><span class='tstring_beg'>'</span><span class='tstring_content'>Copy File</span><span class='tstring_end'>'</span></span><span class='rbracket'>]</span> <span class='op'>=</span> <span class='id identifier rubyid_flags'>flags</span><span class='lbracket'>[</span><span class='int'>5</span><span class='comma'>,</span><span class='int'>1</span><span class='rbracket'>]</span> <span class='op'>==</span> <span class='tstring'><span class='tstring_beg'>'</span><span class='tstring_content'>1</span><span class='tstring_end'>'</span></span> <span class='op'>?</span> <span class='kw'>true</span> <span class='op'>:</span> <span class='kw'>false</span>
|
|
<span class='kw'>return</span> <span class='id identifier rubyid_result'>result</span>
|
|
<span class='kw'>end</span></pre>
|
|
</td>
|
|
</tr>
|
|
</table>
|
|
</div>
|
|
|
|
<div class="method_details ">
|
|
<h3 class="signature " id="parse_header-instance_method">
|
|
|
|
#<strong>parse_header</strong>(packet) ⇒ <tt>Object</tt>
|
|
|
|
|
|
|
|
|
|
|
|
</h3><table class="source_code">
|
|
<tr>
|
|
<td>
|
|
<pre class="lines">
|
|
|
|
|
|
245
|
|
246
|
|
247
|
|
248</pre>
|
|
</td>
|
|
<td>
|
|
<pre class="code"><span class="info file"># File 'lib/msf/core/exploit/remote/afp.rb', line 245</span>
|
|
|
|
<span class='kw'>def</span> <span class='id identifier rubyid_parse_header'>parse_header</span><span class='lparen'>(</span><span class='id identifier rubyid_packet'>packet</span><span class='rparen'>)</span>
|
|
<span class='id identifier rubyid_header'>header</span> <span class='op'>=</span> <span class='id identifier rubyid_packet'>packet</span><span class='period'>.</span><span class='id identifier rubyid_unpack'>unpack</span><span class='lparen'>(</span><span class='tstring'><span class='tstring_beg'>'</span><span class='tstring_content'>CCnNNN</span><span class='tstring_end'>'</span></span><span class='rparen'>)</span>
|
|
<span class='kw'>return</span> <span class='id identifier rubyid_header'>header</span>
|
|
<span class='kw'>end</span></pre>
|
|
</td>
|
|
</tr>
|
|
</table>
|
|
</div>
|
|
|
|
<div class="method_details ">
|
|
<h3 class="signature " id="parse_info_response-instance_method">
|
|
|
|
#<strong>parse_info_response</strong>(response) ⇒ <tt>Object</tt>
|
|
|
|
|
|
|
|
|
|
|
|
</h3><table class="source_code">
|
|
<tr>
|
|
<td>
|
|
<pre class="lines">
|
|
|
|
|
|
207
|
|
208
|
|
209
|
|
210
|
|
211
|
|
212
|
|
213
|
|
214
|
|
215
|
|
216
|
|
217
|
|
218
|
|
219
|
|
220
|
|
221
|
|
222
|
|
223
|
|
224
|
|
225
|
|
226
|
|
227
|
|
228
|
|
229
|
|
230
|
|
231
|
|
232
|
|
233
|
|
234
|
|
235
|
|
236
|
|
237
|
|
238
|
|
239
|
|
240
|
|
241
|
|
242
|
|
243</pre>
|
|
</td>
|
|
<td>
|
|
<pre class="code"><span class="info file"># File 'lib/msf/core/exploit/remote/afp.rb', line 207</span>
|
|
|
|
<span class='kw'>def</span> <span class='id identifier rubyid_parse_info_response'>parse_info_response</span><span class='lparen'>(</span><span class='id identifier rubyid_response'>response</span><span class='rparen'>)</span>
|
|
<span class='id identifier rubyid_parsed_data'>parsed_data</span> <span class='op'>=</span> <span class='lbrace'>{</span><span class='rbrace'>}</span>
|
|
|
|
<span class='id identifier rubyid_flags'>flags</span><span class='comma'>,</span> <span class='id identifier rubyid_command'>command</span><span class='comma'>,</span> <span class='id identifier rubyid_request_id'>request_id</span><span class='comma'>,</span> <span class='id identifier rubyid_error_code'>error_code</span><span class='comma'>,</span> <span class='id identifier rubyid_length'>length</span><span class='comma'>,</span> <span class='id identifier rubyid_reserved'>reserved</span> <span class='op'>=</span> <span class='id identifier rubyid_parse_header'>parse_header</span><span class='lparen'>(</span><span class='id identifier rubyid_response'>response</span><span class='rparen'>)</span>
|
|
<span class='id identifier rubyid_raise'>raise</span> <span class='tstring'><span class='tstring_beg'>"</span><span class='tstring_content'>AFP </span><span class='embexpr_beg'>#{</span><span class='id identifier rubyid_rhost'>rhost</span><span class='embexpr_end'>}</span><span class='tstring_content'>:</span><span class='embexpr_beg'>#{</span><span class='id identifier rubyid_rport'>rport</span><span class='embexpr_end'>}</span><span class='tstring_content'> Server response with error</span><span class='tstring_end'>"</span></span> <span class='kw'>if</span> <span class='id identifier rubyid_error_code'>error_code</span> <span class='op'>!=</span> <span class='int'>0</span>
|
|
<span class='id identifier rubyid_body'>body</span> <span class='op'>=</span> <span class='id identifier rubyid_get_body'>get_body</span><span class='lparen'>(</span><span class='id identifier rubyid_response'>response</span><span class='comma'>,</span> <span class='id identifier rubyid_length'>length</span><span class='rparen'>)</span>
|
|
<span class='id identifier rubyid_machine_type_offset'>machine_type_offset</span><span class='comma'>,</span> <span class='id identifier rubyid_afp_versions_offset'>afp_versions_offset</span><span class='comma'>,</span> <span class='id identifier rubyid_uam_count_offset'>uam_count_offset</span><span class='comma'>,</span> <span class='id identifier rubyid_icon_offset'>icon_offset</span><span class='comma'>,</span> <span class='id identifier rubyid_server_flags'>server_flags</span> <span class='op'>=</span>
|
|
<span class='id identifier rubyid_body'>body</span><span class='period'>.</span><span class='id identifier rubyid_unpack'>unpack</span><span class='lparen'>(</span><span class='tstring'><span class='tstring_beg'>'</span><span class='tstring_content'>nnnnn</span><span class='tstring_end'>'</span></span><span class='rparen'>)</span>
|
|
|
|
<span class='id identifier rubyid_server_name_length'>server_name_length</span> <span class='op'>=</span> <span class='id identifier rubyid_body'>body</span><span class='period'>.</span><span class='id identifier rubyid_unpack'>unpack</span><span class='lparen'>(</span><span class='tstring'><span class='tstring_beg'>'</span><span class='tstring_content'>@10C</span><span class='tstring_end'>'</span></span><span class='rparen'>)</span><span class='period'>.</span><span class='id identifier rubyid_first'>first</span>
|
|
<span class='id identifier rubyid_parsed_data'>parsed_data</span><span class='lbracket'>[</span><span class='symbol'>:server_name</span><span class='rbracket'>]</span> <span class='op'>=</span> <span class='id identifier rubyid_body'>body</span><span class='period'>.</span><span class='id identifier rubyid_unpack'>unpack</span><span class='lparen'>(</span><span class='tstring'><span class='tstring_beg'>"</span><span class='tstring_content'>@11A</span><span class='embexpr_beg'>#{</span><span class='id identifier rubyid_server_name_length'>server_name_length</span><span class='embexpr_end'>}</span><span class='tstring_end'>"</span></span><span class='rparen'>)</span><span class='period'>.</span><span class='id identifier rubyid_first'>first</span>
|
|
|
|
<span class='id identifier rubyid_pos'>pos</span> <span class='op'>=</span> <span class='int'>11</span> <span class='op'>+</span> <span class='id identifier rubyid_server_name_length'>server_name_length</span>
|
|
<span class='id identifier rubyid_pos'>pos</span> <span class='op'>+=</span> <span class='int'>1</span> <span class='kw'>if</span> <span class='id identifier rubyid_pos'>pos</span> <span class='op'>%</span> <span class='int'>2</span> <span class='op'>!=</span> <span class='int'>0</span> <span class='comment'>#padding
|
|
</span>
|
|
<span class='id identifier rubyid_server_signature_offset'>server_signature_offset</span><span class='comma'>,</span> <span class='id identifier rubyid_network_addresses_offset'>network_addresses_offset</span><span class='comma'>,</span> <span class='id identifier rubyid_directory_names_offset'>directory_names_offset</span><span class='comma'>,</span>
|
|
<span class='id identifier rubyid_utf8_servername_offset'>utf8_servername_offset</span> <span class='op'>=</span> <span class='id identifier rubyid_body'>body</span><span class='period'>.</span><span class='id identifier rubyid_unpack'>unpack</span><span class='lparen'>(</span><span class='tstring'><span class='tstring_beg'>"</span><span class='tstring_content'>@</span><span class='embexpr_beg'>#{</span><span class='id identifier rubyid_pos'>pos</span><span class='embexpr_end'>}</span><span class='tstring_content'>nnnn</span><span class='tstring_end'>"</span></span><span class='rparen'>)</span>
|
|
|
|
<span class='id identifier rubyid_parsed_data'>parsed_data</span><span class='lbracket'>[</span><span class='symbol'>:machine_type</span><span class='rbracket'>]</span> <span class='op'>=</span> <span class='id identifier rubyid_read_pascal_string'>read_pascal_string</span><span class='lparen'>(</span><span class='id identifier rubyid_body'>body</span><span class='comma'>,</span> <span class='id identifier rubyid_machine_type_offset'>machine_type_offset</span><span class='rparen'>)</span>
|
|
<span class='id identifier rubyid_parsed_data'>parsed_data</span><span class='lbracket'>[</span><span class='symbol'>:versions</span><span class='rbracket'>]</span> <span class='op'>=</span> <span class='id identifier rubyid_read_array'>read_array</span><span class='lparen'>(</span><span class='id identifier rubyid_body'>body</span><span class='comma'>,</span> <span class='id identifier rubyid_afp_versions_offset'>afp_versions_offset</span><span class='rparen'>)</span>
|
|
<span class='id identifier rubyid_parsed_data'>parsed_data</span><span class='lbracket'>[</span><span class='symbol'>:uams</span><span class='rbracket'>]</span> <span class='op'>=</span> <span class='id identifier rubyid_read_array'>read_array</span><span class='lparen'>(</span><span class='id identifier rubyid_body'>body</span><span class='comma'>,</span> <span class='id identifier rubyid_uam_count_offset'>uam_count_offset</span><span class='rparen'>)</span>
|
|
<span class='comment'># skipped icon
|
|
</span> <span class='id identifier rubyid_parsed_data'>parsed_data</span><span class='lbracket'>[</span><span class='symbol'>:server_flags</span><span class='rbracket'>]</span> <span class='op'>=</span> <span class='id identifier rubyid_parse_flags'>parse_flags</span><span class='lparen'>(</span><span class='id identifier rubyid_server_flags'>server_flags</span><span class='rparen'>)</span>
|
|
<span class='id identifier rubyid_parsed_data'>parsed_data</span><span class='lbracket'>[</span><span class='symbol'>:signature</span><span class='rbracket'>]</span> <span class='op'>=</span> <span class='id identifier rubyid_body'>body</span><span class='period'>.</span><span class='id identifier rubyid_unpack'>unpack</span><span class='lparen'>(</span><span class='tstring'><span class='tstring_beg'>"</span><span class='tstring_content'>@</span><span class='embexpr_beg'>#{</span><span class='id identifier rubyid_server_signature_offset'>server_signature_offset</span><span class='embexpr_end'>}</span><span class='tstring_content'>H32</span><span class='tstring_end'>"</span></span><span class='rparen'>)</span><span class='period'>.</span><span class='id identifier rubyid_first'>first</span>
|
|
|
|
<span class='id identifier rubyid_network_addresses'>network_addresses</span> <span class='op'>=</span> <span class='id identifier rubyid_read_array'>read_array</span><span class='lparen'>(</span><span class='id identifier rubyid_body'>body</span><span class='comma'>,</span> <span class='id identifier rubyid_network_addresses_offset'>network_addresses_offset</span><span class='comma'>,</span> <span class='kw'>true</span><span class='rparen'>)</span>
|
|
<span class='id identifier rubyid_parsed_data'>parsed_data</span><span class='lbracket'>[</span><span class='symbol'>:network_addresses</span><span class='rbracket'>]</span> <span class='op'>=</span> <span class='id identifier rubyid_parse_network_addresses'>parse_network_addresses</span><span class='lparen'>(</span><span class='id identifier rubyid_network_addresses'>network_addresses</span><span class='rparen'>)</span>
|
|
<span class='comment'># skipped directory names
|
|
</span> <span class='comment'>#Error catching for offset issues on this field. Need better error handling all through here
|
|
</span> <span class='kw'>begin</span>
|
|
<span class='id identifier rubyid_parsed_data'>parsed_data</span><span class='lbracket'>[</span><span class='symbol'>:utf8_server_name</span><span class='rbracket'>]</span> <span class='op'>=</span> <span class='id identifier rubyid_read_utf8_pascal_string'>read_utf8_pascal_string</span><span class='lparen'>(</span><span class='id identifier rubyid_body'>body</span><span class='comma'>,</span> <span class='id identifier rubyid_utf8_servername_offset'>utf8_servername_offset</span><span class='rparen'>)</span>
|
|
<span class='kw'>rescue</span>
|
|
<span class='id identifier rubyid_parsed_data'>parsed_data</span><span class='lbracket'>[</span><span class='symbol'>:utf8_server_name</span><span class='rbracket'>]</span> <span class='op'>=</span> <span class='tstring'><span class='tstring_beg'>"</span><span class='tstring_content'>N/A</span><span class='tstring_end'>"</span></span>
|
|
<span class='kw'>end</span>
|
|
|
|
<span class='kw'>return</span> <span class='id identifier rubyid_parsed_data'>parsed_data</span>
|
|
<span class='kw'>end</span></pre>
|
|
</td>
|
|
</tr>
|
|
</table>
|
|
</div>
|
|
|
|
<div class="method_details ">
|
|
<h3 class="signature " id="parse_login_response_add_send_login_count-instance_method">
|
|
|
|
#<strong>parse_login_response_add_send_login_count</strong>(response, data) ⇒ <tt>Object</tt>
|
|
|
|
|
|
|
|
|
|
|
|
</h3><table class="source_code">
|
|
<tr>
|
|
<td>
|
|
<pre class="lines">
|
|
|
|
|
|
145
|
|
146
|
|
147
|
|
148
|
|
149
|
|
150
|
|
151
|
|
152
|
|
153
|
|
154
|
|
155
|
|
156
|
|
157
|
|
158
|
|
159
|
|
160
|
|
161
|
|
162
|
|
163
|
|
164
|
|
165
|
|
166
|
|
167
|
|
168
|
|
169
|
|
170
|
|
171
|
|
172
|
|
173
|
|
174
|
|
175
|
|
176
|
|
177
|
|
178
|
|
179
|
|
180
|
|
181
|
|
182
|
|
183
|
|
184
|
|
185
|
|
186
|
|
187
|
|
188
|
|
189
|
|
190
|
|
191
|
|
192
|
|
193
|
|
194
|
|
195
|
|
196
|
|
197
|
|
198
|
|
199
|
|
200</pre>
|
|
</td>
|
|
<td>
|
|
<pre class="code"><span class="info file"># File 'lib/msf/core/exploit/remote/afp.rb', line 145</span>
|
|
|
|
<span class='kw'>def</span> <span class='id identifier rubyid_parse_login_response_add_send_login_count'>parse_login_response_add_send_login_count</span><span class='lparen'>(</span><span class='id identifier rubyid_response'>response</span><span class='comma'>,</span> <span class='id identifier rubyid_data'>data</span><span class='rparen'>)</span>
|
|
<span class='id identifier rubyid_dhx_s2civ'>dhx_s2civ</span> <span class='op'>=</span> <span class='tstring'><span class='tstring_beg'>'</span><span class='tstring_content'>CJalbert</span><span class='tstring_end'>'</span></span>
|
|
<span class='id identifier rubyid_dhx_c2civ'>dhx_c2civ</span> <span class='op'>=</span> <span class='tstring'><span class='tstring_beg'>'</span><span class='tstring_content'>LWallace</span><span class='tstring_end'>'</span></span>
|
|
|
|
<span class='id identifier rubyid_flags'>flags</span><span class='comma'>,</span> <span class='id identifier rubyid_command'>command</span><span class='comma'>,</span> <span class='id identifier rubyid_request_id'>request_id</span><span class='comma'>,</span> <span class='id identifier rubyid_error_code'>error_code</span><span class='comma'>,</span> <span class='id identifier rubyid_length'>length</span><span class='comma'>,</span> <span class='id identifier rubyid_reserved'>reserved</span> <span class='op'>=</span> <span class='id identifier rubyid_parse_header'>parse_header</span><span class='lparen'>(</span><span class='id identifier rubyid_response'>response</span><span class='rparen'>)</span>
|
|
<span class='id identifier rubyid_body'>body</span> <span class='op'>=</span> <span class='id identifier rubyid_get_body'>get_body</span><span class='lparen'>(</span><span class='id identifier rubyid_response'>response</span><span class='comma'>,</span> <span class='id identifier rubyid_length'>length</span><span class='rparen'>)</span>
|
|
<span class='id identifier rubyid_id'>id</span><span class='comma'>,</span> <span class='id identifier rubyid_mb'>mb</span><span class='comma'>,</span> <span class='id identifier rubyid_enc_data'>enc_data</span> <span class='op'>=</span> <span class='id identifier rubyid_body'>body</span><span class='period'>.</span><span class='id identifier rubyid_unpack'>unpack</span><span class='lparen'>(</span><span class='tstring'><span class='tstring_beg'>"</span><span class='tstring_content'>nH32a*</span><span class='tstring_end'>"</span></span><span class='rparen'>)</span>
|
|
|
|
<span class='id identifier rubyid_mb'>mb</span> <span class='op'>=</span> <span class='const'>OpenSSL</span><span class='op'>::</span><span class='const'>BN</span><span class='period'>.</span><span class='id identifier rubyid_new'>new</span><span class='lparen'>(</span><span class='id identifier rubyid_mb'>mb</span><span class='comma'>,</span> <span class='int'>16</span><span class='rparen'>)</span>
|
|
<span class='id identifier rubyid_k'>k</span> <span class='op'>=</span> <span class='id identifier rubyid_mb'>mb</span><span class='period'>.</span><span class='id identifier rubyid_mod_exp'>mod_exp</span><span class='lparen'>(</span><span class='id identifier rubyid_data'>data</span><span class='lbracket'>[</span><span class='symbol'>:ra</span><span class='rbracket'>]</span><span class='comma'>,</span> <span class='id identifier rubyid_data'>data</span><span class='lbracket'>[</span><span class='symbol'>:p</span><span class='rbracket'>]</span> <span class='rparen'>)</span>
|
|
|
|
<span class='id identifier rubyid_cipher'>cipher</span> <span class='op'>=</span> <span class='const'>OpenSSL</span><span class='op'>::</span><span class='const'>Cipher</span><span class='period'>.</span><span class='id identifier rubyid_new'>new</span><span class='lparen'>(</span><span class='tstring'><span class='tstring_beg'>'</span><span class='tstring_content'>cast5-cbc</span><span class='tstring_end'>'</span></span><span class='rparen'>)</span><span class='period'>.</span><span class='id identifier rubyid_decrypt'>decrypt</span>
|
|
<span class='id identifier rubyid_cipher'>cipher</span><span class='period'>.</span><span class='id identifier rubyid_key'>key</span> <span class='op'>=</span> <span class='id identifier rubyid_k'>k</span><span class='period'>.</span><span class='id identifier rubyid_to_s'>to_s</span><span class='lparen'>(</span><span class='int'>2</span><span class='rparen'>)</span>
|
|
<span class='id identifier rubyid_cipher'>cipher</span><span class='period'>.</span><span class='id identifier rubyid_iv'>iv</span> <span class='op'>=</span> <span class='id identifier rubyid_dhx_s2civ'>dhx_s2civ</span>
|
|
<span class='id identifier rubyid_cipher'>cipher</span><span class='period'>.</span><span class='id identifier rubyid_padding'>padding</span> <span class='op'>=</span> <span class='int'>0</span>
|
|
|
|
<span class='id identifier rubyid_nonce'>nonce</span> <span class='op'>=</span> <span class='id identifier rubyid_cipher'>cipher</span><span class='period'>.</span><span class='id identifier rubyid_update'>update</span><span class='lparen'>(</span><span class='id identifier rubyid_enc_data'>enc_data</span><span class='rparen'>)</span>
|
|
<span class='id identifier rubyid_nonce'>nonce</span> <span class='op'><<</span> <span class='id identifier rubyid_cipher'>cipher</span><span class='period'>.</span><span class='id identifier rubyid_final'>final</span>
|
|
<span class='id identifier rubyid_nonce'>nonce</span> <span class='op'>=</span> <span class='id identifier rubyid_nonce'>nonce</span><span class='lbracket'>[</span><span class='int'>0</span><span class='op'>..</span><span class='int'>15</span><span class='rbracket'>]</span>
|
|
<span class='id identifier rubyid_nonce'>nonce</span> <span class='op'>=</span> <span class='const'>OpenSSL</span><span class='op'>::</span><span class='const'>BN</span><span class='period'>.</span><span class='id identifier rubyid_new'>new</span><span class='lparen'>(</span><span class='id identifier rubyid_nonce'>nonce</span><span class='comma'>,</span> <span class='int'>2</span><span class='rparen'>)</span> <span class='op'>+</span> <span class='int'>1</span>
|
|
|
|
<span class='id identifier rubyid_plain_text'>plain_text</span> <span class='op'>=</span> <span class='id identifier rubyid_nonce'>nonce</span><span class='period'>.</span><span class='id identifier rubyid_to_s'>to_s</span><span class='lparen'>(</span><span class='int'>2</span><span class='rparen'>)</span> <span class='op'>+</span> <span class='id identifier rubyid_data'>data</span><span class='lbracket'>[</span><span class='symbol'>:password</span><span class='rbracket'>]</span><span class='period'>.</span><span class='id identifier rubyid_ljust'>ljust</span><span class='lparen'>(</span><span class='int'>64</span><span class='comma'>,</span> <span class='tstring'><span class='tstring_beg'>"</span><span class='tstring_content'>\x00</span><span class='tstring_end'>"</span></span><span class='rparen'>)</span>
|
|
<span class='id identifier rubyid_cipher'>cipher</span> <span class='op'>=</span> <span class='const'>OpenSSL</span><span class='op'>::</span><span class='const'>Cipher</span><span class='period'>.</span><span class='id identifier rubyid_new'>new</span><span class='lparen'>(</span><span class='tstring'><span class='tstring_beg'>'</span><span class='tstring_content'>cast5-cbc</span><span class='tstring_end'>'</span></span><span class='rparen'>)</span><span class='period'>.</span><span class='id identifier rubyid_encrypt'>encrypt</span>
|
|
<span class='id identifier rubyid_cipher'>cipher</span><span class='period'>.</span><span class='id identifier rubyid_key'>key</span> <span class='op'>=</span> <span class='id identifier rubyid_k'>k</span><span class='period'>.</span><span class='id identifier rubyid_to_s'>to_s</span><span class='lparen'>(</span><span class='int'>2</span><span class='rparen'>)</span>
|
|
<span class='id identifier rubyid_cipher'>cipher</span><span class='period'>.</span><span class='id identifier rubyid_iv'>iv</span> <span class='op'>=</span> <span class='id identifier rubyid_dhx_c2civ'>dhx_c2civ</span>
|
|
<span class='id identifier rubyid_auth_response'>auth_response</span> <span class='op'>=</span> <span class='id identifier rubyid_cipher'>cipher</span><span class='period'>.</span><span class='id identifier rubyid_update'>update</span><span class='lparen'>(</span><span class='id identifier rubyid_plain_text'>plain_text</span><span class='rparen'>)</span>
|
|
<span class='id identifier rubyid_auth_response'>auth_response</span> <span class='op'><<</span> <span class='id identifier rubyid_cipher'>cipher</span><span class='period'>.</span><span class='id identifier rubyid_final'>final</span>
|
|
|
|
<span class='id identifier rubyid_packet'>packet</span> <span class='op'>=</span> <span class='tstring'><span class='tstring_beg'>"</span><span class='tstring_content'>\00</span><span class='tstring_end'>"</span></span> <span class='comment'># Flag: Request
|
|
</span> <span class='id identifier rubyid_packet'>packet</span> <span class='op'><<</span> <span class='tstring'><span class='tstring_beg'>"</span><span class='tstring_content'>\x02</span><span class='tstring_end'>"</span></span> <span class='comment'># Command: DSICommand
|
|
</span> <span class='id identifier rubyid_packet'>packet</span> <span class='op'><<</span> <span class='lbracket'>[</span><span class='ivar'>@id</span><span class='rbracket'>]</span><span class='period'>.</span><span class='id identifier rubyid_pack'>pack</span><span class='lparen'>(</span><span class='tstring'><span class='tstring_beg'>'</span><span class='tstring_content'>n</span><span class='tstring_end'>'</span></span><span class='rparen'>)</span> <span class='comment'># requestID
|
|
</span> <span class='id identifier rubyid_packet'>packet</span> <span class='op'><<</span> <span class='tstring'><span class='tstring_beg'>"</span><span class='tstring_content'>\x00\x00\x00\x00</span><span class='tstring_end'>"</span></span> <span class='comment'># Data offset
|
|
</span> <span class='id identifier rubyid_packet'>packet</span> <span class='op'><<</span> <span class='lbracket'>[</span><span class='id identifier rubyid_auth_response'>auth_response</span><span class='period'>.</span><span class='id identifier rubyid_length'>length</span> <span class='op'>+</span> <span class='int'>2</span><span class='rbracket'>]</span><span class='period'>.</span><span class='id identifier rubyid_pack'>pack</span><span class='lparen'>(</span><span class='tstring'><span class='tstring_beg'>"</span><span class='tstring_content'>N</span><span class='tstring_end'>"</span></span><span class='rparen'>)</span> <span class='comment'># Length
|
|
</span> <span class='id identifier rubyid_packet'>packet</span> <span class='op'><<</span> <span class='tstring'><span class='tstring_beg'>"</span><span class='tstring_content'>\x00\x00\x00\x00</span><span class='tstring_end'>"</span></span> <span class='comment'># Reserved
|
|
</span> <span class='id identifier rubyid_packet'>packet</span> <span class='op'><<</span> <span class='tstring'><span class='tstring_beg'>"</span><span class='tstring_content'>\x13</span><span class='tstring_end'>"</span></span> <span class='comment'># AFPCommand: FPLoginCont (19)
|
|
</span> <span class='id identifier rubyid_packet'>packet</span> <span class='op'><<</span> <span class='tstring'><span class='tstring_beg'>"</span><span class='tstring_content'>\x00</span><span class='tstring_end'>"</span></span>
|
|
<span class='id identifier rubyid_packet'>packet</span> <span class='op'><<</span> <span class='lbracket'>[</span><span class='id identifier rubyid_id'>id</span><span class='rbracket'>]</span><span class='period'>.</span><span class='id identifier rubyid_pack'>pack</span><span class='lparen'>(</span><span class='tstring'><span class='tstring_beg'>'</span><span class='tstring_content'>n</span><span class='tstring_end'>'</span></span><span class='rparen'>)</span>
|
|
<span class='id identifier rubyid_packet'>packet</span> <span class='op'><<</span> <span class='id identifier rubyid_auth_response'>auth_response</span>
|
|
|
|
<span class='id identifier rubyid_sock'>sock</span><span class='period'>.</span><span class='id identifier rubyid_put'>put</span><span class='lparen'>(</span><span class='id identifier rubyid_packet'>packet</span><span class='rparen'>)</span>
|
|
<span class='ivar'>@id</span> <span class='op'>+=</span> <span class='int'>1</span>
|
|
|
|
<span class='kw'>begin</span>
|
|
<span class='id identifier rubyid_response'>response</span> <span class='op'>=</span> <span class='id identifier rubyid_sock'>sock</span><span class='period'>.</span><span class='id identifier rubyid_timed_read'>timed_read</span><span class='lparen'>(</span><span class='int'>1024</span><span class='comma'>,</span> <span class='id identifier rubyid_datastore'>datastore</span><span class='lbracket'>[</span><span class='tstring'><span class='tstring_beg'>'</span><span class='tstring_content'>LoginTimeOut</span><span class='tstring_end'>'</span></span><span class='rbracket'>]</span><span class='rparen'>)</span>
|
|
<span class='kw'>rescue</span> <span class='const'>Timeout</span><span class='op'>::</span><span class='const'>Error</span>
|
|
<span class='id identifier rubyid_vprint_error'>vprint_error</span><span class='lparen'>(</span><span class='tstring'><span class='tstring_beg'>"</span><span class='tstring_content'>AFP </span><span class='embexpr_beg'>#{</span><span class='id identifier rubyid_rhost'>rhost</span><span class='embexpr_end'>}</span><span class='tstring_content'>:</span><span class='embexpr_beg'>#{</span><span class='id identifier rubyid_rport'>rport</span><span class='embexpr_end'>}</span><span class='tstring_content'> Login timeout (AFP server delay response for 20 - 22 seconds after 7 incorrect logins)</span><span class='tstring_end'>"</span></span><span class='rparen'>)</span>
|
|
<span class='kw'>return</span> <span class='symbol'>:connection_error</span>
|
|
<span class='kw'>end</span>
|
|
|
|
<span class='id identifier rubyid_flags'>flags</span><span class='comma'>,</span> <span class='id identifier rubyid_command'>command</span><span class='comma'>,</span> <span class='id identifier rubyid_request_id'>request_id</span><span class='comma'>,</span> <span class='id identifier rubyid_error_code'>error_code</span><span class='comma'>,</span> <span class='id identifier rubyid_length'>length</span><span class='comma'>,</span> <span class='id identifier rubyid_reserved'>reserved</span> <span class='op'>=</span> <span class='id identifier rubyid_parse_header'>parse_header</span><span class='lparen'>(</span><span class='id identifier rubyid_response'>response</span><span class='rparen'>)</span>
|
|
<span class='kw'>if</span> <span class='id identifier rubyid_error_code'>error_code</span> <span class='op'>==</span> <span class='int'>0</span>
|
|
<span class='kw'>return</span> <span class='kw'>true</span>
|
|
<span class='kw'>else</span>
|
|
<span class='kw'>return</span> <span class='kw'>false</span>
|
|
<span class='kw'>end</span>
|
|
<span class='kw'>end</span></pre>
|
|
</td>
|
|
</tr>
|
|
</table>
|
|
</div>
|
|
|
|
<div class="method_details ">
|
|
<h3 class="signature " id="parse_network_addresses-instance_method">
|
|
|
|
#<strong>parse_network_addresses</strong>(network_addresses) ⇒ <tt>Object</tt>
|
|
|
|
|
|
|
|
|
|
|
|
</h3><table class="source_code">
|
|
<tr>
|
|
<td>
|
|
<pre class="lines">
|
|
|
|
|
|
279
|
|
280
|
|
281
|
|
282
|
|
283
|
|
284
|
|
285
|
|
286
|
|
287
|
|
288
|
|
289
|
|
290
|
|
291
|
|
292
|
|
293
|
|
294
|
|
295
|
|
296
|
|
297
|
|
298
|
|
299
|
|
300
|
|
301
|
|
302
|
|
303
|
|
304</pre>
|
|
</td>
|
|
<td>
|
|
<pre class="code"><span class="info file"># File 'lib/msf/core/exploit/remote/afp.rb', line 279</span>
|
|
|
|
<span class='kw'>def</span> <span class='id identifier rubyid_parse_network_addresses'>parse_network_addresses</span><span class='lparen'>(</span><span class='id identifier rubyid_network_addresses'>network_addresses</span><span class='rparen'>)</span>
|
|
<span class='id identifier rubyid_parsed_addreses'>parsed_addreses</span> <span class='op'>=</span> <span class='lbracket'>[</span><span class='rbracket'>]</span>
|
|
<span class='id identifier rubyid_network_addresses'>network_addresses</span><span class='period'>.</span><span class='id identifier rubyid_each'>each</span> <span class='kw'>do</span> <span class='op'>|</span><span class='id identifier rubyid_address'>address</span><span class='op'>|</span>
|
|
<span class='kw'>case</span> <span class='id identifier rubyid_address'>address</span><span class='period'>.</span><span class='id identifier rubyid_unpack'>unpack</span><span class='lparen'>(</span><span class='tstring'><span class='tstring_beg'>'</span><span class='tstring_content'>C</span><span class='tstring_end'>'</span></span><span class='rparen'>)</span><span class='period'>.</span><span class='id identifier rubyid_first'>first</span>
|
|
<span class='kw'>when</span> <span class='int'>0</span> <span class='comment'>#Reserved
|
|
</span> <span class='kw'>next</span>
|
|
<span class='kw'>when</span> <span class='int'>1</span> <span class='comment'># Four-byte IP address
|
|
</span> <span class='id identifier rubyid_parsed_addreses'>parsed_addreses</span> <span class='op'><<</span> <span class='const'>IPAddr</span><span class='period'>.</span><span class='id identifier rubyid_ntop'>ntop</span><span class='lparen'>(</span><span class='id identifier rubyid_address'>address</span><span class='lbracket'>[</span><span class='int'>1</span><span class='op'>..</span><span class='int'>4</span><span class='rbracket'>]</span><span class='rparen'>)</span><span class='period'>.</span><span class='id identifier rubyid_to_s'>to_s</span>
|
|
<span class='kw'>when</span> <span class='int'>2</span> <span class='comment'># Four-byte IP address followed by a two-byte port number
|
|
</span> <span class='id identifier rubyid_parsed_addreses'>parsed_addreses</span> <span class='op'><<</span> <span class='tstring'><span class='tstring_beg'>"</span><span class='embexpr_beg'>#{</span><span class='const'>IPAddr</span><span class='period'>.</span><span class='id identifier rubyid_ntop'>ntop</span><span class='lparen'>(</span><span class='id identifier rubyid_address'>address</span><span class='lbracket'>[</span><span class='int'>1</span><span class='op'>..</span><span class='int'>4</span><span class='rbracket'>]</span><span class='rparen'>)</span><span class='embexpr_end'>}</span><span class='tstring_content'>:</span><span class='embexpr_beg'>#{</span><span class='id identifier rubyid_address'>address</span><span class='lbracket'>[</span><span class='int'>5</span><span class='op'>..</span><span class='int'>6</span><span class='rbracket'>]</span><span class='period'>.</span><span class='id identifier rubyid_unpack'>unpack</span><span class='lparen'>(</span><span class='tstring'><span class='tstring_beg'>"</span><span class='tstring_content'>n</span><span class='tstring_end'>"</span></span><span class='rparen'>)</span><span class='period'>.</span><span class='id identifier rubyid_first'>first</span><span class='embexpr_end'>}</span><span class='tstring_end'>"</span></span>
|
|
<span class='kw'>when</span> <span class='int'>3</span> <span class='comment'># DDP address (deprecated)
|
|
</span> <span class='kw'>next</span>
|
|
<span class='kw'>when</span> <span class='int'>4</span> <span class='comment'># DNS name (maximum of 254 bytes)
|
|
</span> <span class='id identifier rubyid_parsed_addreses'>parsed_addreses</span> <span class='op'><<</span> <span class='id identifier rubyid_address'>address</span><span class='lbracket'>[</span><span class='int'>1</span><span class='op'>..</span><span class='id identifier rubyid_address'>address</span><span class='period'>.</span><span class='id identifier rubyid_length'>length</span> <span class='op'>-</span> <span class='int'>1</span><span class='rbracket'>]</span>
|
|
<span class='kw'>when</span> <span class='int'>5</span> <span class='comment'># This functionality is deprecated.
|
|
</span> <span class='kw'>next</span>
|
|
<span class='kw'>when</span> <span class='int'>6</span> <span class='comment'># IPv6 address (16 bytes)
|
|
</span> <span class='id identifier rubyid_parsed_addreses'>parsed_addreses</span> <span class='op'><<</span> <span class='tstring'><span class='tstring_beg'>"</span><span class='tstring_content'>[</span><span class='embexpr_beg'>#{</span><span class='const'>IPAddr</span><span class='period'>.</span><span class='id identifier rubyid_ntop'>ntop</span><span class='lparen'>(</span><span class='id identifier rubyid_address'>address</span><span class='lbracket'>[</span><span class='int'>1</span><span class='op'>..</span><span class='int'>16</span><span class='rbracket'>]</span><span class='rparen'>)</span><span class='embexpr_end'>}</span><span class='tstring_content'>]</span><span class='tstring_end'>"</span></span>
|
|
<span class='kw'>when</span> <span class='int'>7</span> <span class='comment'># IPv6 address (16 bytes) followed by a two-byte port number
|
|
</span> <span class='id identifier rubyid_parsed_addreses'>parsed_addreses</span> <span class='op'><<</span> <span class='tstring'><span class='tstring_beg'>"</span><span class='tstring_content'>[</span><span class='embexpr_beg'>#{</span><span class='const'>IPAddr</span><span class='period'>.</span><span class='id identifier rubyid_ntop'>ntop</span><span class='lparen'>(</span><span class='id identifier rubyid_address'>address</span><span class='lbracket'>[</span><span class='int'>1</span><span class='op'>..</span><span class='int'>16</span><span class='rbracket'>]</span><span class='rparen'>)</span><span class='embexpr_end'>}</span><span class='tstring_content'>]:</span><span class='embexpr_beg'>#{</span><span class='id identifier rubyid_address'>address</span><span class='lbracket'>[</span><span class='int'>17</span><span class='op'>..</span><span class='int'>18</span><span class='rbracket'>]</span><span class='period'>.</span><span class='id identifier rubyid_unpack'>unpack</span><span class='lparen'>(</span><span class='tstring'><span class='tstring_beg'>"</span><span class='tstring_content'>n</span><span class='tstring_end'>"</span></span><span class='rparen'>)</span><span class='period'>.</span><span class='id identifier rubyid_first'>first</span><span class='embexpr_end'>}</span><span class='tstring_end'>"</span></span>
|
|
<span class='kw'>else</span> <span class='comment'># Something wrong?
|
|
</span> <span class='id identifier rubyid_raise'>raise</span> <span class='tstring'><span class='tstring_beg'>"</span><span class='tstring_content'>Error parsing network addresses</span><span class='tstring_end'>"</span></span>
|
|
<span class='kw'>end</span>
|
|
<span class='kw'>end</span>
|
|
<span class='kw'>return</span> <span class='id identifier rubyid_parsed_addreses'>parsed_addreses</span>
|
|
<span class='kw'>end</span></pre>
|
|
</td>
|
|
</tr>
|
|
</table>
|
|
</div>
|
|
|
|
<div class="method_details ">
|
|
<h3 class="signature " id="parse_open_session_response-instance_method">
|
|
|
|
#<strong>parse_open_session_response</strong>(response) ⇒ <tt>Object</tt>
|
|
|
|
|
|
|
|
|
|
|
|
</h3><table class="source_code">
|
|
<tr>
|
|
<td>
|
|
<pre class="lines">
|
|
|
|
|
|
202
|
|
203
|
|
204
|
|
205</pre>
|
|
</td>
|
|
<td>
|
|
<pre class="code"><span class="info file"># File 'lib/msf/core/exploit/remote/afp.rb', line 202</span>
|
|
|
|
<span class='kw'>def</span> <span class='id identifier rubyid_parse_open_session_response'>parse_open_session_response</span><span class='lparen'>(</span><span class='id identifier rubyid_response'>response</span><span class='rparen'>)</span>
|
|
<span class='id identifier rubyid_flags'>flags</span><span class='comma'>,</span> <span class='id identifier rubyid_command'>command</span><span class='comma'>,</span> <span class='id identifier rubyid_request_id'>request_id</span><span class='comma'>,</span> <span class='id identifier rubyid_error_code'>error_code</span><span class='comma'>,</span> <span class='id identifier rubyid_length'>length</span><span class='comma'>,</span> <span class='id identifier rubyid_reserved'>reserved</span> <span class='op'>=</span> <span class='id identifier rubyid_parse_header'>parse_header</span><span class='lparen'>(</span><span class='id identifier rubyid_response'>response</span><span class='rparen'>)</span>
|
|
<span class='kw'>return</span> <span class='id identifier rubyid_error_code'>error_code</span> <span class='op'>==</span> <span class='int'>0</span> <span class='op'>?</span> <span class='kw'>true</span> <span class='op'>:</span> <span class='kw'>false</span>
|
|
<span class='kw'>end</span></pre>
|
|
</td>
|
|
</tr>
|
|
</table>
|
|
</div>
|
|
|
|
<div class="method_details ">
|
|
<h3 class="signature " id="read_array-instance_method">
|
|
|
|
#<strong>read_array</strong>(str, offset, afp_network_address = false) ⇒ <tt>Object</tt>
|
|
|
|
|
|
|
|
|
|
|
|
</h3><table class="source_code">
|
|
<tr>
|
|
<td>
|
|
<pre class="lines">
|
|
|
|
|
|
266
|
|
267
|
|
268
|
|
269
|
|
270
|
|
271
|
|
272
|
|
273
|
|
274
|
|
275
|
|
276
|
|
277</pre>
|
|
</td>
|
|
<td>
|
|
<pre class="code"><span class="info file"># File 'lib/msf/core/exploit/remote/afp.rb', line 266</span>
|
|
|
|
<span class='kw'>def</span> <span class='id identifier rubyid_read_array'>read_array</span><span class='lparen'>(</span><span class='id identifier rubyid_str'>str</span><span class='comma'>,</span> <span class='id identifier rubyid_offset'>offset</span><span class='comma'>,</span> <span class='id identifier rubyid_afp_network_address'>afp_network_address</span><span class='op'>=</span><span class='kw'>false</span><span class='rparen'>)</span>
|
|
<span class='id identifier rubyid_size'>size</span> <span class='op'>=</span> <span class='id identifier rubyid_str'>str</span><span class='period'>.</span><span class='id identifier rubyid_unpack'>unpack</span><span class='lparen'>(</span><span class='tstring'><span class='tstring_beg'>"</span><span class='tstring_content'>@</span><span class='embexpr_beg'>#{</span><span class='id identifier rubyid_offset'>offset</span><span class='embexpr_end'>}</span><span class='tstring_content'>C</span><span class='tstring_end'>"</span></span><span class='rparen'>)</span><span class='period'>.</span><span class='id identifier rubyid_first'>first</span>
|
|
<span class='id identifier rubyid_pos'>pos</span> <span class='op'>=</span> <span class='id identifier rubyid_offset'>offset</span> <span class='op'>+</span> <span class='int'>1</span>
|
|
|
|
<span class='id identifier rubyid_result'>result</span> <span class='op'>=</span> <span class='lbracket'>[</span><span class='rbracket'>]</span>
|
|
<span class='id identifier rubyid_size'>size</span><span class='period'>.</span><span class='id identifier rubyid_times'>times</span> <span class='kw'>do</span>
|
|
<span class='id identifier rubyid_result'>result</span> <span class='op'><<</span> <span class='id identifier rubyid_read_pascal_string'>read_pascal_string</span><span class='lparen'>(</span><span class='id identifier rubyid_str'>str</span><span class='comma'>,</span> <span class='id identifier rubyid_pos'>pos</span><span class='rparen'>)</span>
|
|
<span class='id identifier rubyid_pos'>pos</span> <span class='op'>+=</span> <span class='id identifier rubyid_str'>str</span><span class='period'>.</span><span class='id identifier rubyid_unpack'>unpack</span><span class='lparen'>(</span><span class='tstring'><span class='tstring_beg'>"</span><span class='tstring_content'>@</span><span class='embexpr_beg'>#{</span><span class='id identifier rubyid_pos'>pos</span><span class='embexpr_end'>}</span><span class='tstring_content'>C</span><span class='tstring_end'>"</span></span><span class='rparen'>)</span><span class='period'>.</span><span class='id identifier rubyid_first'>first</span>
|
|
<span class='id identifier rubyid_pos'>pos</span> <span class='op'>+=</span> <span class='int'>1</span> <span class='kw'>unless</span> <span class='id identifier rubyid_afp_network_address'>afp_network_address</span>
|
|
<span class='kw'>end</span>
|
|
<span class='kw'>return</span> <span class='id identifier rubyid_result'>result</span>
|
|
<span class='kw'>end</span></pre>
|
|
</td>
|
|
</tr>
|
|
</table>
|
|
</div>
|
|
|
|
<div class="method_details ">
|
|
<h3 class="signature " id="read_pascal_string-instance_method">
|
|
|
|
#<strong>read_pascal_string</strong>(str, offset) ⇒ <tt>Object</tt>
|
|
|
|
|
|
|
|
|
|
|
|
</h3><table class="source_code">
|
|
<tr>
|
|
<td>
|
|
<pre class="lines">
|
|
|
|
|
|
256
|
|
257
|
|
258
|
|
259</pre>
|
|
</td>
|
|
<td>
|
|
<pre class="code"><span class="info file"># File 'lib/msf/core/exploit/remote/afp.rb', line 256</span>
|
|
|
|
<span class='kw'>def</span> <span class='id identifier rubyid_read_pascal_string'>read_pascal_string</span><span class='lparen'>(</span><span class='id identifier rubyid_str'>str</span><span class='comma'>,</span> <span class='id identifier rubyid_offset'>offset</span><span class='rparen'>)</span>
|
|
<span class='id identifier rubyid_length'>length</span> <span class='op'>=</span> <span class='id identifier rubyid_str'>str</span><span class='period'>.</span><span class='id identifier rubyid_unpack'>unpack</span><span class='lparen'>(</span><span class='tstring'><span class='tstring_beg'>"</span><span class='tstring_content'>@</span><span class='embexpr_beg'>#{</span><span class='id identifier rubyid_offset'>offset</span><span class='embexpr_end'>}</span><span class='tstring_content'>C</span><span class='tstring_end'>"</span></span><span class='rparen'>)</span><span class='period'>.</span><span class='id identifier rubyid_first'>first</span>
|
|
<span class='kw'>return</span> <span class='id identifier rubyid_str'>str</span><span class='period'>.</span><span class='id identifier rubyid_unpack'>unpack</span><span class='lparen'>(</span><span class='tstring'><span class='tstring_beg'>"</span><span class='tstring_content'>@</span><span class='embexpr_beg'>#{</span><span class='id identifier rubyid_offset'>offset</span> <span class='op'>+</span> <span class='int'>1</span><span class='embexpr_end'>}</span><span class='tstring_content'>A</span><span class='embexpr_beg'>#{</span><span class='id identifier rubyid_length'>length</span><span class='embexpr_end'>}</span><span class='tstring_end'>"</span></span><span class='rparen'>)</span><span class='period'>.</span><span class='id identifier rubyid_first'>first</span>
|
|
<span class='kw'>end</span></pre>
|
|
</td>
|
|
</tr>
|
|
</table>
|
|
</div>
|
|
|
|
<div class="method_details ">
|
|
<h3 class="signature " id="read_utf8_pascal_string-instance_method">
|
|
|
|
#<strong>read_utf8_pascal_string</strong>(str, offset) ⇒ <tt>Object</tt>
|
|
|
|
|
|
|
|
|
|
|
|
</h3><table class="source_code">
|
|
<tr>
|
|
<td>
|
|
<pre class="lines">
|
|
|
|
|
|
261
|
|
262
|
|
263
|
|
264</pre>
|
|
</td>
|
|
<td>
|
|
<pre class="code"><span class="info file"># File 'lib/msf/core/exploit/remote/afp.rb', line 261</span>
|
|
|
|
<span class='kw'>def</span> <span class='id identifier rubyid_read_utf8_pascal_string'>read_utf8_pascal_string</span><span class='lparen'>(</span><span class='id identifier rubyid_str'>str</span><span class='comma'>,</span> <span class='id identifier rubyid_offset'>offset</span><span class='rparen'>)</span>
|
|
<span class='id identifier rubyid_length'>length</span> <span class='op'>=</span> <span class='id identifier rubyid_str'>str</span><span class='period'>.</span><span class='id identifier rubyid_unpack'>unpack</span><span class='lparen'>(</span><span class='tstring'><span class='tstring_beg'>"</span><span class='tstring_content'>@</span><span class='embexpr_beg'>#{</span><span class='id identifier rubyid_offset'>offset</span><span class='embexpr_end'>}</span><span class='tstring_content'>n</span><span class='tstring_end'>"</span></span><span class='rparen'>)</span><span class='period'>.</span><span class='id identifier rubyid_first'>first</span>
|
|
<span class='kw'>return</span> <span class='id identifier rubyid_str'>str</span><span class='lbracket'>[</span><span class='id identifier rubyid_offset'>offset</span> <span class='op'>+</span> <span class='int'>2</span><span class='op'>..</span><span class='id identifier rubyid_offset'>offset</span> <span class='op'>+</span> <span class='id identifier rubyid_length'>length</span> <span class='op'>+</span> <span class='int'>1</span><span class='rbracket'>]</span>
|
|
<span class='kw'>end</span></pre>
|
|
</td>
|
|
</tr>
|
|
</table>
|
|
</div>
|
|
|
|
</div>
|
|
|
|
</div>
|
|
|
|
<div id="footer">
|
|
Generated on Fri May 8 17:01:22 2026 by
|
|
<a href="https://yardoc.org" title="Yay! A Ruby Documentation Tool" target="_parent">yard</a>
|
|
0.9.37 (ruby-3.1.5).
|
|
</div>
|
|
|
|
</div>
|
|
</body>
|
|
</html> |