Skip to content

Commit 2281125

Browse files
committed
Fix rapid7#4711 - Errno::EINVA (getpeername(2)) BrowserAutoPwn Fix
This patch fixes rapid7#4711. The problem here is that the browser sometimes will shutdown some of our exploit's connections (in my testing, all Java), and that will cause Ruby to call a rb_sys_fail with "getpeername(2)". The error goes all the way to Rex::IO::StreamServer's monitor_listener method, which triggers a "break" to quit monitoring. And then this causes another chain of reactions that eventually forces BrowserAutoPwn to quit completely (while the JavaScript on the browser is still running)
1 parent 73435c6 commit 2281125

File tree

2 files changed

+12
-1
lines changed

2 files changed

+12
-1
lines changed

lib/rex/socket.rb

Lines changed: 9 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -732,7 +732,15 @@ def getlocalname
732732
# Return peer connection information.
733733
#
734734
def getpeername
735-
return Socket.from_sockaddr(super)
735+
peer_name = nil
736+
begin
737+
peer_name = Socket.from_sockaddr(super)
738+
rescue ::Exception => e
739+
# Ruby's getpeername method may call rb_sys_fail("getpeername(2)")
740+
elog("#{e.message} (#{e.class})#{e.backtrace * "\n"}\n", 'core', LEV_3)
741+
end
742+
743+
return peer_name
736744
end
737745

738746
#

lib/rex/socket/tcp_server.rb

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -56,6 +56,9 @@ def accept(opts = {})
5656

5757
pn = t.getpeername
5858

59+
# We hit a "getpeername(2)" from Ruby
60+
return nil unless pn
61+
5962
t.peerhost = pn[1]
6063
t.peerport = pn[2]
6164
end

0 commit comments

Comments
 (0)