Skip to content

Commit 42cd288

Browse files
wchen-r7wchen-r7
committed
Land rapid7#4057 - Bring back TCP::max_send_size and TCP::send_delay options
Fix rapid7#3967
2 parents e479a63 + 0ea03c0 commit 42cd288

File tree

31 files changed

+139
-101
lines changed

31 files changed

+139
-101
lines changed

‎lib/metasploit/framework/ftp/client.rb

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -4,6 +4,7 @@ module Metasploit
44
module Framework
55
module Ftp
66
module Client
7+
extend ActiveSupport::Concern
78
include Metasploit::Framework::Tcp::Client
89

910
#

‎lib/metasploit/framework/login_scanner/base.rb

Lines changed: 9 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -88,6 +88,7 @@ def check_setup
8888

8989
def each_credential
9090
cred_details.each do |raw_cred|
91+
9192
# This could be a Credential object, or a Credential Core, or an Attempt object
9293
# so make sure that whatever it is, we end up with a Credential.
9394
credential = raw_cred.to_credential
@@ -101,6 +102,11 @@ def each_credential
101102
credential.realm_key = self.class::REALM_KEY
102103
yield credential
103104
elsif credential.realm.blank? && self.class::REALM_KEY.present? && self.class::DEFAULT_REALM.present?
105+
# XXX: This is messing up the display for mssql when not using
106+
# Windows authentication, e.g.:
107+
# [+] 10.0.0.53:1433 - LOGIN SUCCESSFUL: WORKSTATION\sa:msfadmin
108+
# Realm gets ignored in that case, so it still functions, it
109+
# just gives the user bogus info
104110
credential.realm_key = self.class::REALM_KEY
105111
credential.realm = self.class::DEFAULT_REALM
106112
yield credential
@@ -144,8 +150,10 @@ def scan!
144150
successful_users = Set.new
145151

146152
each_credential do |credential|
147-
# For Pro bruteforce Reuse and Guess we need to note that we skipped an attempt.
153+
# Skip users for whom we've have already found a password
148154
if successful_users.include?(credential.public)
155+
# For Pro bruteforce Reuse and Guess we need to note that we
156+
# skipped an attempt.
149157
if credential.parent.respond_to?(:skipped)
150158
credential.parent.skipped = true
151159
credential.parent.save!

‎lib/metasploit/framework/login_scanner/http.rb

Lines changed: 0 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -139,8 +139,6 @@ def config_client(client)
139139
# like timeouts and TCP evasion options
140140
def set_sane_defaults
141141
self.connection_timeout ||= 20
142-
self.max_send_size = 0 if self.max_send_size.nil?
143-
self.send_delay = 0 if self.send_delay.nil?
144142
self.uri = '/' if self.uri.blank?
145143
self.method = 'GET' if self.method.blank?
146144

‎lib/metasploit/framework/login_scanner/rex_socket.rb

Lines changed: 0 additions & 21 deletions
Original file line numberDiff line numberDiff line change
@@ -12,34 +12,13 @@ module RexSocket
1212

1313
included do
1414

15-
# @!attribute max_send_size
16-
# @return [Fixnum] The max size of the data to encapsulate in a single packet
17-
attr_accessor :max_send_size
18-
# @!attribute send_delay
19-
# @return [Fixnum] The delay between sending packets
20-
attr_accessor :send_delay
2115
# @!attribute ssl
2216
# @return [Boolean] Whether the socket should use ssl
2317
attr_accessor :ssl
2418
# @!attribute ssl_version
2519
# @return [String] The version of SSL to implement
2620
attr_accessor :ssl_version
2721

28-
validates :max_send_size,
29-
presence: true,
30-
numericality: {
31-
only_integer: true,
32-
greater_than_or_equal_to: 0
33-
}
34-
35-
validates :send_delay,
36-
presence: true,
37-
numericality: {
38-
only_integer: true,
39-
greater_than_or_equal_to: 0
40-
}
41-
42-
4322
private
4423

4524
def chost

‎lib/metasploit/framework/login_scanner/telnet.rb

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -105,12 +105,12 @@ def attempt_login(credential)
105105
# like timeouts and TCP evasion options
106106
def set_sane_defaults
107107
self.connection_timeout ||= 30
108-
self.max_send_size ||= 0
109108
self.port ||= DEFAULT_PORT
110-
self.send_delay ||= 0
111109
self.banner_timeout ||= 25
112110
self.telnet_timeout ||= 10
113111
self.connection_timeout ||= 30
112+
self.max_send_size ||= 0
113+
self.send_delay ||= 0
114114
# Shim to set up the ivars from the old Login mixin
115115
create_login_ivars
116116
end

‎lib/metasploit/framework/login_scanner/vnc.rb

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -56,7 +56,6 @@ def attempt_login(credential)
5656
# Create our VNC client overtop of the socket
5757
vnc = Rex::Proto::RFB::Client.new(sock, :allow_none => false)
5858

59-
6059
if vnc.handshake
6160
if vnc_auth(vnc,credential.private)
6261
result_options[:status] = Metasploit::Model::Login::Status::SUCCESSFUL
@@ -77,6 +76,8 @@ def attempt_login(credential)
7776
proof: e.message,
7877
status: Metasploit::Model::Login::Status::UNABLE_TO_CONNECT
7978
)
79+
ensure
80+
disconnect
8081
end
8182

8283
::Metasploit::Framework::LoginScanner::Result.new(result_options)

‎lib/metasploit/framework/mssql/client.rb

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -5,6 +5,7 @@ module Framework
55
module MSSQL
66

77
module Client
8+
extend ActiveSupport::Concern
89
include Metasploit::Framework::Tcp::Client
910

1011
NTLM_CRYPT = Rex::Proto::NTLM::Crypt
@@ -725,4 +726,4 @@ def send_spn
725726

726727
end
727728
end
728-
end
729+
end

‎lib/metasploit/framework/tcp/client.rb

Lines changed: 27 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -40,6 +40,33 @@ def write(buf, opts={})
4040

4141
module Client
4242

43+
extend ActiveSupport::Concern
44+
45+
# @!attribute max_send_size
46+
# @return [Fixnum] The max size of the data to encapsulate in a single packet
47+
attr_accessor :max_send_size
48+
# @!attribute send_delay
49+
# @return [Fixnum] The delay between sending packets
50+
attr_accessor :send_delay
51+
52+
included do
53+
include ActiveModel::Validations
54+
validates :max_send_size,
55+
presence: true,
56+
numericality: {
57+
only_integer: true,
58+
greater_than_or_equal_to: 0
59+
}
60+
61+
validates :send_delay,
62+
presence: true,
63+
numericality: {
64+
only_integer: true,
65+
greater_than_or_equal_to: 0
66+
}
67+
68+
end
69+
4370
#
4471
# Establishes a TCP connection to the specified RHOST/RPORT
4572
#
@@ -64,7 +91,6 @@ def connect(global = true, opts={})
6491
'Proxies' => proxies,
6592
'Timeout' => (opts['ConnectTimeout'] || connection_timeout || 10).to_i
6693
)
67-
6894
# enable evasions on this socket
6995
set_tcp_evasions(nsock)
7096

@@ -121,14 +147,6 @@ def disconnect(nsock = self.sock)
121147
#
122148
##
123149

124-
def max_send_size
125-
raise NotImplementedError
126-
end
127-
128-
def send_delay
129-
raise NotImplementedError
130-
end
131-
132150
#
133151
# Returns the target host
134152
#

‎lib/metasploit/framework/telnet/client.rb

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -4,6 +4,7 @@ module Metasploit
44
module Framework
55
module Telnet
66
module Client
7+
extend ActiveSupport::Concern
78
include Metasploit::Framework::Tcp::Client
89
include Msf::Auxiliary::Login
910

@@ -216,4 +217,4 @@ def telnet_timeout
216217
end
217218
end
218219
end
219-
end
220+
end

‎modules/auxiliary/scanner/afp/afp_login.rb

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -63,7 +63,9 @@ def run_host(ip)
6363
proxies: datastore['PROXIES'],
6464
cred_details: cred_collection,
6565
stop_on_success: datastore['STOP_ON_SUCCESS'],
66-
connection_timeout: 30
66+
connection_timeout: 30,
67+
max_send_size: datastore['TCP::max_send_size'],
68+
send_delay: datastore['TCP::send_delay'],
6769
)
6870

6971
scanner.scan! do |result|

0 commit comments

Comments
 (0)