Merge remote branch 'origin/bug/fix-double-slashes'

todb · todb · commit 10511e8281b6 · 2012-12-17T13:29:19.000-06:00
Ran the new normalize_uri() specs, all passes, so I'm quite confident in
this change.
diff --git a/lib/msf/core/exploit/http/client.rb b/lib/msf/core/exploit/http/client.rb
@@ -535,6 +535,23 @@ def target_uri
 		end
 	end
 
+	#
+	# Make sure the URI starts with a slash and doesn't end with one
+	#
+	def normalize_uri(str)
+
+		unless str.to_s[0,1] == "/"
+			str = "/" + str.to_s
+		end
+
+		str = str.gsub(/^\/+/, '/')
+		unless str.length == 1
+			str = str.gsub(/\/+$/, '')
+		end
+
+		str
+	end
+
 	#
 	# Returns the target host
 	#
diff --git a/modules/auxiliary/admin/sap/sap_mgmt_con_osexec.rb b/modules/auxiliary/admin/sap/sap_mgmt_con_osexec.rb
@@ -76,7 +76,7 @@ def run_host(ip)
 
 		begin
 			res = send_request_raw({
-				'uri'     => "/#{datastore['URI']}",
+				'uri'     => normalize_uri(datastore['URI']),
 				'method'  => 'POST',
 				'data'    => data,
 				'headers' =>
@@ -141,7 +141,7 @@ def osexecute(rhost, cmd_to_run)
 
 		begin
 			res = send_request_raw({
-				'uri'     => "/#{datastore['URI']}",
+				'uri'     => normalize_uri(datastore['URI']),
 				'method'  => 'POST',
 				'data'    => data,
 				'headers' =>
diff --git a/modules/auxiliary/scanner/http/sap_businessobjects_user_brute.rb b/modules/auxiliary/scanner/http/sap_businessobjects_user_brute.rb
@@ -79,8 +79,8 @@ def enum_user(user='administrator', pass='pass')
 
 		begin
 			res = send_request_raw({
-				'uri'		  => "/#{datastore['URI']}/services/Session",
-				'method'	   => 'POST',
+				'uri'     => normalize_uri(datastore['URI']) + "/services/Session",
+				'method'  => 'POST',
 				'data'	  => data,
 				'headers' =>
 					{
diff --git a/modules/auxiliary/scanner/http/sap_businessobjects_user_enum.rb b/modules/auxiliary/scanner/http/sap_businessobjects_user_enum.rb
@@ -49,8 +49,8 @@ def initialize
 
 	def run_host(ip)
 		res = send_request_cgi({
-			'uri'	 => "/#{datastore['URI']}/services/listServices",
-			'method'  => 'GET',
+			'uri'    => normalize_uri(datastore['URI']) + "/services/listServices",
+			'method' => 'GET',
 				'headers' => {
 					'User-Agent' => datastore['UserAgent']
 				}
@@ -81,9 +81,9 @@ def enum_user(user='administrator', pass='invalid-sap-password-0d03b389-b7a1-4ec
 
 		begin
 			res = send_request_raw({
-				'uri'		  => "/#{datastore['URI']}/services/Session",
-				'method'	   => 'POST',
-				'data'	  => data,
+				'uri'     => normalize_uri(datastore['URI']) + "/services/Session",
+				'method'  => 'POST',
+				'data'    => data,
 				'headers' =>
 					{
 						'Content-Length' => data.length,
diff --git a/modules/auxiliary/scanner/http/sap_businessobjects_version_enum.rb b/modules/auxiliary/scanner/http/sap_businessobjects_version_enum.rb
@@ -48,8 +48,8 @@ def rport
 
 	def run_host(ip)
 		res = send_request_cgi({
-			'uri'	 => "/#{datastore['URI']}/services/listServices",
-			'method'  => 'GET',
+			'uri'    => normalize_uri(datastore['URI']) + "/services/listServices",
+			'method' => 'GET',
 				'headers' => {
 					'User-Agent' => datastore['UserAgent']
 				}
@@ -77,9 +77,9 @@ def enum_version(rhost)
 
 		begin
 			res = send_request_raw({
-				'uri'		  => "/#{datastore['URI']}/services/Session",
-				'method'	   => 'POST',
-				'data'	  => data,
+				'uri'     => normalize_uri(datastore['URI']) + "/services/Session",
+				'method'  => 'POST',
+				'data'    => data,
 				'headers' =>
 					{
 						'Content-Length' => data.length,
diff --git a/modules/auxiliary/scanner/sap/sap_mgmt_con_abaplog.rb b/modules/auxiliary/scanner/sap/sap_mgmt_con_abaplog.rb
@@ -46,7 +46,7 @@ def rport
 
 	def run_host(ip)
 		res = send_request_cgi({
-			'uri'     => "/#{datastore['URI']}",
+			'uri'     => normalize_uri(datastore['URI']),
 			'method'  => 'GET',
 			'headers' => {'User-Agent' => datastore['UserAgent']}
 		}, 25)
@@ -83,7 +83,7 @@ def extractabap(rhost)
 
 		begin
 			res = send_request_raw({
-				'uri'     => "/#{datastore['URI']}",
+				'uri'     => normalize_uri(datastore['URI']),
 				'method'  => 'POST',
 				'data'    => data,
 				'headers' =>
diff --git a/modules/auxiliary/scanner/sap/sap_mgmt_con_brute_login.rb b/modules/auxiliary/scanner/sap/sap_mgmt_con_brute_login.rb
@@ -51,7 +51,7 @@ def initialize
 
 	def run_host(ip)
 		res = send_request_cgi({
-			'uri'     => "/#{datastore['URI']}",
+			'uri'     => normalize_uri(datastore['URI']),
 			'method'  => 'GET',
 			'headers' =>
 				{
@@ -114,7 +114,7 @@ def enum_user(user, pass)
 
 		begin
 			res = send_request_raw({
-				'uri'      => "/#{datastore['URI']}",
+				'uri'      => normalize_uri(datastore['URI']),
 				'method'   => 'POST',
 				'data'     => data,
 				'headers'  =>
diff --git a/modules/auxiliary/scanner/sap/sap_mgmt_con_extractusers.rb b/modules/auxiliary/scanner/sap/sap_mgmt_con_extractusers.rb
@@ -49,7 +49,7 @@ def rport
 
 	def run_host(ip)
 		res = send_request_cgi({
-			'uri'     => "/#{datastore['URI']}",
+			'uri'     => normalize_uri(datastore['URI']),
 			'method'  => 'GET',
 			'headers' =>
 				{
@@ -90,7 +90,7 @@ def extractusers(rhost)
 
 		begin
 			res = send_request_raw({
-				'uri'      => "/#{datastore['URI']}",
+				'uri'      => normalize_uri(datastore['URI']),
 				'method'   => 'POST',
 				'data'     => data,
 				'headers'  =>
diff --git a/modules/auxiliary/scanner/sap/sap_mgmt_con_getaccesspoints.rb b/modules/auxiliary/scanner/sap/sap_mgmt_con_getaccesspoints.rb
@@ -49,7 +49,7 @@ def rport
 
 	def run_host(ip)
 		res = send_request_cgi({
-			'uri'      => "/#{datastore['URI']}",
+			'uri'      => normalize_uri(datastore['URI']),
 			'method'   => 'GET',
 			'headers'  =>
 				{
@@ -89,7 +89,7 @@ def getacesspoints(rhost)
 
 		begin
 			res = send_request_raw({
-				'uri'      => "/#{datastore['URI']}",
+				'uri'      => normalize_uri(datastore['URI']),
 				'method'   => 'POST',
 				'data'     => data,
 				'headers'  =>
diff --git a/modules/auxiliary/scanner/sap/sap_mgmt_con_getenv.rb b/modules/auxiliary/scanner/sap/sap_mgmt_con_getenv.rb
@@ -49,7 +49,7 @@ def rport
 
 	def run_host(ip)
 		res = send_request_cgi({
-			'uri'      => "/#{datastore['URI']}",
+			'uri'      => normalize_uri(datastore['URI']),
 			'method'   => 'GET',
 			'headers'  =>
 				{
@@ -89,7 +89,7 @@ def getEnvironment(rhost)
 
 		begin
 			res = send_request_raw({
-				'uri'      => "/#{datastore['URI']}",
+				'uri'      => normalize_uri(datastore['URI']),
 				'method'   => 'POST',
 				'data'     => data,
 				'headers'  =>
diff --git a/modules/auxiliary/scanner/sap/sap_mgmt_con_getlogfiles.rb b/modules/auxiliary/scanner/sap/sap_mgmt_con_getlogfiles.rb
@@ -42,7 +42,7 @@ def initialize
 				OptString.new('URI', [false, 'Path to the SAP Management Console ', '/']),
 				OptString.new('RFILE', [ true, 'The name of the file to download ', 'sapstart.log']),
 				OptString.new('FILETYPE', [true, 'Specify LOGFILE or TRACEFILE', 'TRACEFILE']),
-				OptString.new('GETALL', [ false, 'Download all available files (WARNING: may take long!)', 'false']),
+				OptBool.new('GETALL', [ false, 'Download all available files (WARNING: may take long!)', false]),
 			], self.class)
 		register_autofilter_ports([ 50013 ])
 		deregister_options('RHOST')
@@ -54,15 +54,15 @@ def rport
 
 	def run_host(ip)
 		res = send_request_cgi({
-			'uri'      => "/#{datastore['URI']}",
+			'uri'      => normalize_uri(datastore['URI']),
 			'method'   => 'GET'
 		}, 25)
 
 		if not res
 			print_error("#{rhost}:#{rport} [SAP] Unable to connect")
 			return
 		end
-		if "#{datastore['GETALL']}" == 'true'
+		if datastore['GETALL']
 			listfiles(ip)
 		else
 			gettfiles(rhost,"#{datastore['RFILE']}",'')
@@ -78,7 +78,7 @@ def listfiles(rhost)
 		xs = 'http://www.w3.org/2001/XMLSchema'
 		sapsess = 'http://www.sap.com/webas/630/soap/features/session/'
 
-		case "#{datastore['FILETYPE']}"
+		case datastore['FILETYPE'].to_s
 		when /^LOG/i
 			ns1 = 'ns1:ListLogFiles'
 		when /^TRACE/i
@@ -102,7 +102,7 @@ def listfiles(rhost)
 
 		begin
 			res = send_request_raw({
-				'uri'      => "/#{datastore['URI']}",
+				'uri'      => normalize_uri(datastore['URI']),
 				'method'   => 'POST',
 				'data'     => data,
 				'headers'  =>
@@ -167,7 +167,7 @@ def gettfiles(rhost,logfile,filelen)
 		xs = 'http://www.w3.org/2001/XMLSchema'
 		sapsess = 'http://www.sap.com/webas/630/soap/features/session/'
 
-		case "#{datastore['FILETYPE']}"
+		case datastore['FILETYPE'].to_s
 		when /^LOG/i
 			ns1 = 'ns1:ReadLogFile'
 		when /^TRACE/i
@@ -191,7 +191,7 @@ def gettfiles(rhost,logfile,filelen)
 
 		begin
 			res = send_request_raw({
-				'uri'      => "/#{datastore['URI']}",
+				'uri'      => normalize_uri(datastore['URI']),
 				'method'   => 'POST',
 				'data'     => data,
 				'headers'  =>
diff --git a/modules/auxiliary/scanner/sap/sap_mgmt_con_getprocesslist.rb b/modules/auxiliary/scanner/sap/sap_mgmt_con_getprocesslist.rb
@@ -47,7 +47,7 @@ def rport
 
 	def run_host(ip)
 		res = send_request_cgi({
-			'uri'      => "/#{datastore['URI']}",
+			'uri'      => normalize_uri(datastore['URI']),
 			'method'   => 'GET'
 		}, 25)
 
@@ -83,7 +83,7 @@ def getprocesslist(rhost)
 
 		begin
 			res = send_request_raw({
-				'uri'      => "/#{datastore['URI']}",
+				'uri'      => normalize_uri(datastore['URI']),
 				'method'   => 'POST',
 				'data'     => data,
 				'headers'  =>
diff --git a/modules/auxiliary/scanner/sap/sap_mgmt_con_getprocessparameter.rb b/modules/auxiliary/scanner/sap/sap_mgmt_con_getprocessparameter.rb
@@ -50,7 +50,7 @@ def rport
 
 	def run_host(ip)
 		res = send_request_cgi({
-			'uri'      => "/#{datastore['URI']}",
+			'uri'      => normalize_uri(datastore['URI']),
 			'method'   => 'GET',
 			'headers'  =>
 				{
@@ -90,7 +90,7 @@ def getprocparam(rhost)
 
 		begin
 			res = send_request_raw({
-				'uri'      => "/#{datastore['URI']}",
+				'uri'      => normalize_uri(datastore['URI']),
 				'method'   => 'POST',
 				'data'     => data,
 				'headers'  =>
diff --git a/modules/auxiliary/scanner/sap/sap_mgmt_con_instanceproperties.rb b/modules/auxiliary/scanner/sap/sap_mgmt_con_instanceproperties.rb
@@ -49,7 +49,7 @@ def rport
 
 	def run_host(ip)
 		res = send_request_cgi({
-			'uri'      => "/#{datastore['URI']}",
+			'uri'      => normalize_uri(datastore['URI']),
 			'method'   => 'GET',
 			'headers' =>
 				{
@@ -89,7 +89,7 @@ def enum_instance(rhost)
 
 		begin
 			res = send_request_raw({
-				'uri'      => "/#{datastore['URI']}",
+				'uri'      => normalize_uri(datastore['URI']),
 				'method'   => 'POST',
 				'data'     => data,
 				'headers'  =>
diff --git a/modules/auxiliary/scanner/sap/sap_mgmt_con_listlogfiles.rb b/modules/auxiliary/scanner/sap/sap_mgmt_con_listlogfiles.rb
@@ -51,7 +51,7 @@ def rport
 
 	def run_host(ip)
 		res = send_request_cgi({
-			'uri'      => "/#{datastore['URI']}",
+			'uri'      => normalize_uri(datastore['URI']),
 			'method'   => 'GET',
 			'headers'  =>
 				{
@@ -96,7 +96,7 @@ def listfiles(rhost)
 
 		begin
 			res = send_request_raw({
-				'uri'      => "/#{datastore['URI']}",
+				'uri'      => normalize_uri(datastore['URI']),
 				'method'   => 'POST',
 				'data'     => data,
 				'headers'  =>
diff --git a/modules/auxiliary/scanner/sap/sap_mgmt_con_startprofile.rb b/modules/auxiliary/scanner/sap/sap_mgmt_con_startprofile.rb
@@ -49,7 +49,7 @@ def rport
 
 	def run_host(ip)
 		res = send_request_cgi({
-			'uri'      => "/#{datastore['URI']}",
+			'uri'      => normalize_uri(datastore['URI']),
 			'method'   => 'GET',
 			'headers' => {
 					'User-Agent' => datastore['UserAgent']
@@ -87,7 +87,7 @@ def getStartProfile(rhost)
 
 		begin
 			res = send_request_raw({
-				'uri'      => "/#{datastore['URI']}",
+				'uri'      => normalize_uri(datastore['URI']),
 				'method'   => 'POST',
 				'data'     => data,
 				'headers'  =>
diff --git a/modules/auxiliary/scanner/sap/sap_mgmt_con_version.rb b/modules/auxiliary/scanner/sap/sap_mgmt_con_version.rb
@@ -49,7 +49,7 @@ def rport
 
 	def run_host(ip)
 		res = send_request_cgi({
-			'uri'	 => "/#{datastore['URI']}",
+			'uri'	 => normalize_uri(datastore['URI']),
 			'method'  => 'GET',
 				'headers' => {
 					'User-Agent' => datastore['UserAgent']
@@ -87,7 +87,7 @@ def enum_version(rhost)
 
 		begin
 			res = send_request_raw({
-				'uri'      => "/#{datastore['URI']}",
+				'uri'      => normalize_uri(datastore['URI']),
 				'method'   => 'POST',
 				'data'     => data,
 				'headers'  =>
diff --git a/modules/exploits/multi/http/axis2_deployer.rb b/modules/exploits/multi/http/axis2_deployer.rb
@@ -259,11 +259,7 @@ def cleanup_instructions(rpath, name)
 	def exploit
 		user = datastore['USERNAME']
 		pass = datastore['PASSWORD']
-		rpath = datastore['PATH']
-		# ensure rpath has an initial /
-		if not rpath =~ /^\//
-			rpath = '/' + rpath
-		end
+		rpath = normalize_uri(datastore['PATH'])
 
 		success = false
 		srvhdr = '?'
diff --git a/modules/exploits/windows/http/apache_mod_rewrite_ldap.rb b/modules/exploits/windows/http/apache_mod_rewrite_ldap.rb
@@ -93,7 +93,7 @@ def exploit
 
 		print_status("Sending payload.")
 		send_request_raw({
-				'uri'     => '/' + datastore['REWRITEPATH'] + trigger + payload.encoded,
+				'uri'     => normalize_uri(datastore['REWRITEPATH']) + trigger + payload.encoded,
 				'version' => '1.0',
 				}, 2)
 		handler
diff --git a/modules/exploits/windows/http/sap_mgmt_con_osexec_payload.rb b/modules/exploits/windows/http/sap_mgmt_con_osexec_payload.rb
@@ -119,7 +119,7 @@ def execute_command(cmd, opts)
 
 			begin
 				res = send_request_raw({
-					'uri'     => "/#{datastore['URI']}",
+					'uri'     => normalize_uri(datastore['URI']),
 					'method'  => 'POST',
 					'data'    => data,
 					'headers' =>
diff --git a/modules/exploits/windows/http/xampp_webdav_upload_php.rb b/modules/exploits/windows/http/xampp_webdav_upload_php.rb
diff --git a/spec/lib/msf/core/exploit/http/client_spec.rb b/spec/lib/msf/core/exploit/http/client_spec.rb
diff --git a/spec/spec_helper.rb b/spec/spec_helper.rb
