Style

Author: egypt

lib/metasploit/framework/mssql/client.rb

@@ -356,7 +356,7 @@ def mssql_parse_info(data, info)
         #
         def mssql_parse_login_ack(data, info)
           len = data.slice!(0, 2).unpack('v')[0]
-          buff = data.slice!(0, len)
+          _buff = data.slice!(0, len)
           info[:login_ack] = true
         end
 
@@ -584,25 +584,25 @@ def mssql_prelogin(enc_error=false)
 
           instoptdata = "MSSQLServer\0"
 
-          threadid =   "\0\0" + Rex::Text.rand_text(2)
+          threadid = "\0\0" + Rex::Text.rand_text(2)
 
           idx = 21 # size of pkt_data_token
           pkt_data_token << [
-              0x00,     # Token 0 type Version
-              idx ,   # VersionOffset
+              0x00, # Token 0 type Version
+              idx , # VersionOffset
               version.length, # VersionLength
 
-              0x01,             # Token 1 type Encryption
-              idx = idx + version.length,   # EncryptionOffset
-              0x01,             # EncryptionLength
+              0x01, # Token 1 type Encryption
+              idx = idx + version.length, # EncryptionOffset
+              0x01, # EncryptionLength
 
-              0x02,         # Token 2 type InstOpt
-              idx = idx + 1,      # InstOptOffset
-              instoptdata.length,     # InstOptLength
+              0x02, # Token 2 type InstOpt
+              idx = idx + 1, # InstOptOffset
+              instoptdata.length, # InstOptLength
 
-              0x03,         # Token 3 type Threadid
-              idx + instoptdata.length,   # ThreadIdOffset
-              0x04,        # ThreadIdLength
+              0x03, # Token 3 type Threadid
+              idx + instoptdata.length, # ThreadIdOffset
+              0x04, # ThreadIdLength
 
               0xFF
           ].pack("CnnCnnCnnCnnC")
@@ -621,7 +621,7 @@ def mssql_prelogin(enc_error=false)
 
           idx = 0
 
-          while resp and resp[0, 1] != "\xff" and resp.length > 5
+          while resp && resp[0, 1] != "\xff" && resp.length > 5
             token = resp.slice!(0, 5)
             token = token.unpack("Cnn")
             idx -= 5
@@ -670,7 +670,7 @@ def mssql_prelogin(enc_error=false)
 
             idx = 0
 
-            while resp and resp[0, 1] != "\xff" and resp.length > 5
+            while resp && resp[0, 1] != "\xff" && resp.length > 5
               token = resp.slice!(0, 5)
               token = token.unpack("Cnn")
               idx -= 5
@@ -704,12 +704,12 @@ def mssql_send_recv(req, timeout=15, check_status = true)
 
           while(not done)
             head = sock.get_once(8, timeout)
-            if !(head and head.length == 8)
+            if !(head && head.length == 8)
               return false
             end
 
             # Is this the last buffer?
-            if(head[1, 1] == "\x01" or not check_status )
+            if head[1, 1] == "\x01" || !check_status
               done = true
             end
 

lib/msf/core/exploit/mssql.rb

@@ -132,11 +132,11 @@ def mssql_xpcmdshell(cmd, doprint=false, opts={})
     force_enable = false
     begin
       res = mssql_query("EXEC master..xp_cmdshell '#{cmd}'", false, opts)
-      if(res[:errors] and not res[:errors].empty?)
-        if(res[:errors].join =~ /xp_cmdshell/)
-          if(force_enable)
+      if res[:errors] && !res[:errors].empty?
+        if res[:errors].join =~ /xp_cmdshell/
+          if force_enable
             print_error("The xp_cmdshell procedure is not available and could not be enabled")
-            raise  RuntimeError, "Failed to execute command"
+            raise RuntimeError, "Failed to execute command"
           else
             print_status("The server may have xp_cmdshell disabled, trying to enable it...")
             mssql_query(mssql_xpcmdshell_enable())
@@ -150,7 +150,7 @@ def mssql_xpcmdshell(cmd, doprint=false, opts={})
       return res
 
     rescue RuntimeError => e
-      if(e.to_s =~ /xp_cmdshell disabled/)
+      if e.to_s =~ /xp_cmdshell disabled/
         force_enable = true
         retry
       end
@@ -243,7 +243,7 @@ def mssql_send_recv(req, timeout=15, check_status = true)
 
     while(not done)
       head = sock.get_once(8, timeout)
-      if !(head and head.length == 8)
+      if !(head && head.length == 8)
         return false
       end
 
@@ -285,77 +285,77 @@ def mssql_prelogin(enc_error=false)
     pkt_data = ""
 
 
-      pkt_hdr =  [
-          TYPE_PRE_LOGIN_MESSAGE, #type
-          STATUS_END_OF_MESSAGE, #status
-          0x0000, #length
-          0x0000, # SPID
-          0x00, # PacketID
-          0x00 #Window
-          ]
+    pkt_hdr =  [
+      TYPE_PRE_LOGIN_MESSAGE, #type
+      STATUS_END_OF_MESSAGE, #status
+      0x0000, #length
+      0x0000, # SPID
+      0x00, # PacketID
+      0x00 #Window
+    ]
 
-      version = [0x55010008, 0x0000].pack("Vv")
-      encryption = ENCRYPT_NOT_SUP # off
-      instoptdata = "MSSQLServer\0"
+    version = [0x55010008, 0x0000].pack("Vv")
+    encryption = ENCRYPT_NOT_SUP # off
+    instoptdata = "MSSQLServer\0"
 
-      threadid =   "\0\0" + Rex::Text.rand_text(2)
+    threadid =   "\0\0" + Rex::Text.rand_text(2)
 
-      idx = 21 # size of pkt_data_token
-      pkt_data_token <<  [
-            0x00,     # Token 0 type Version
-            idx ,   # VersionOffset
-            version.length, # VersionLength
+    idx = 21 # size of pkt_data_token
+    pkt_data_token <<  [
+      0x00, # Token 0 type Version
+      idx, # VersionOffset
+      version.length, # VersionLength
 
-            0x01,             # Token 1 type Encryption
-            idx = idx + version.length,   # EncryptionOffset
-            0x01,             # EncryptionLength
+      0x01, # Token 1 type Encryption
+      idx = idx + version.length, # EncryptionOffset
+      0x01, # EncryptionLength
 
-            0x02,         # Token 2 type InstOpt
-            idx = idx + 1,      # InstOptOffset
-            instoptdata.length,     # InstOptLength
+      0x02, # Token 2 type InstOpt
+      idx = idx + 1, # InstOptOffset
+      instoptdata.length, # InstOptLength
 
-            0x03,         # Token 3 type Threadid
-            idx + instoptdata.length,   # ThreadIdOffset
-            0x04,        # ThreadIdLength
+      0x03, # Token 3 type Threadid
+      idx + instoptdata.length, # ThreadIdOffset
+      0x04, # ThreadIdLength
 
-            0xFF
-            ].pack("CnnCnnCnnCnnC")
+      0xFF
+    ].pack("CnnCnnCnnCnnC")
 
-      pkt_data    <<  pkt_data_token
-      pkt_data    <<  version
-      pkt_data    <<  encryption
-      pkt_data    <<  instoptdata
-      pkt_data    <<  threadid
+    pkt_data << pkt_data_token
+    pkt_data << version
+    pkt_data << encryption
+    pkt_data << instoptdata
+    pkt_data << threadid
 
-      pkt_hdr[2]  =   pkt_data.length + 8
+    pkt_hdr[2] = pkt_data.length + 8
 
-      pkt     =    pkt_hdr.pack("CCnnCC") + pkt_data
+    pkt = pkt_hdr.pack("CCnnCC") + pkt_data
 
-      resp = mssql_send_recv(pkt)
-
-      idx = 0
+    resp = mssql_send_recv(pkt)
 
-      while resp and resp[0, 1] != "\xff" and resp.length > 5
-        token = resp.slice!(0, 5)
-        token = token.unpack("Cnn")
-        idx -= 5
-        if token[0] == 0x01
+    idx = 0
 
-          idx += token[1]
-          break
-        end
-      end
-      if idx > 0
-        encryption_mode = resp[idx, 1].unpack("C")[0]
-      else
-        #force to ENCRYPT_NOT_SUP and hope for the best
-        encryption_mode = ENCRYPT_NOT_SUP
+    while resp && resp[0, 1] != "\xff" && resp.length > 5
+      token = resp.slice!(0, 5)
+      token = token.unpack("Cnn")
+      idx -= 5
+      if token[0] == 0x01
+        idx += token[1]
+        break
       end
+    end
 
-      if encryption_mode != ENCRYPT_NOT_SUP and enc_error
-        raise RuntimeError,"Encryption is not supported"
-      end
-      encryption_mode
+    if idx > 0
+      encryption_mode = resp[idx, 1].unpack("C")[0]
+    else
+      # force to ENCRYPT_NOT_SUP and hope for the best
+      encryption_mode = ENCRYPT_NOT_SUP
+    end
+
+    if encryption_mode != ENCRYPT_NOT_SUP && enc_error
+      raise RuntimeError,"Encryption is not supported"
+    end
+    encryption_mode
   end
 
   #
@@ -415,13 +415,12 @@ def mssql_login(user='sa', pass='', db='')
       dname = Rex::Text.to_unicode( db )
 
       workstation_name = Rex::Text.rand_text_alpha(rand(8)+1)
-      domain_name = datastore['DOMAIN']
 
       ntlm_client = ::Net::NTLM::Client.new(
         user,
         pass,
         workstation: workstation_name,
-        domain: domain_name,
+        domain: datastore['DOMAIN'],
       )
       type1 = ntlm_client.init_context
       # SQL 2012, at least, does not support KEY_EXCHANGE
@@ -653,17 +652,17 @@ def mssql_print_reply(info)
 
     print_status("SQL Query: #{info[:sql]}")
 
-    if(info[:done] and info[:done][:rows].to_i > 0)
+    if info[:done] && info[:done][:rows].to_i > 0
       print_status("Row Count: #{info[:done][:rows]} (Status: #{info[:done][:status]} Command: #{info[:done][:cmd]})")
     end
 
-    if(info[:errors] and not info[:errors].empty?)
+    if info[:errors] && !info[:errors].empty?
       info[:errors].each do |err|
         print_error(err)
       end
     end
 
-    if(info[:rows] and not info[:rows].empty?)
+    if info[:rows] && !info[:rows].empty?
 
       tbl = Rex::Ui::Text::Table.new(
         'Indent'    => 1,
@@ -749,7 +748,7 @@ def mssql_parse_tds_reply(data, info)
 
       col[:msg_len] = data.slice!(0, 1).unpack('C')[0]
 
-      if(col[:msg_len] and col[:msg_len] > 0)
+      if col[:msg_len] && col[:msg_len] > 0
         col[:name] = data.slice!(0, col[:msg_len] * 2).gsub("\x00", '')
       end
       info[:colnames] << (col[:name] || 'NULL')
@@ -808,15 +807,15 @@ def mssql_parse_tds_row(data, info)
       when :hex
         str = ""
         len = data.slice!(0, 2).unpack('v')[0]
-        if(len > 0 and len < 65535)
+        if len > 0 && len < 65535
           str << data.slice!(0, len)
         end
         row << str.unpack("H*")[0]
 
       when :string
         str = ""
         len = data.slice!(0, 2).unpack('v')[0]
-        if(len > 0 and len < 65535)
+        if len > 0 && len < 65535
           str << data.slice!(0, len)
         end
         row << str.gsub("\x00", '')
@@ -842,12 +841,12 @@ def mssql_parse_tds_row(data, info)
       when :image
         str = ''
         len = data.slice!(0, 1).unpack('C')[0]
-        str = data.slice!(0, len) if (len and len > 0)
+        str = data.slice!(0, len) if len && len > 0
         row << str.unpack("H*")[0]
 
       when :int
         len = data.slice!(0, 1).unpack("C")[0]
-        raw = data.slice!(0, len) if (len and len > 0)
+        raw = data.slice!(0, len) if len && len > 0
 
         case len
         when 0, 255