Skip to content

Commit 4790d8d

Browse files
author
jvazquez-r7
committed
Land rapid7#2256, @wchen-r7's patch for [FixRM rapid7#8316]
2 parents 9d53ff4 + 5366453 commit 4790d8d

File tree

5 files changed

+8
-8
lines changed

5 files changed

+8
-8
lines changed

modules/auxiliary/admin/cisco/vpn_3000_ftp_bypass.rb

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -63,7 +63,7 @@ def run
6363
print_status("\tAttempting to delete directory: RMD #{test}")
6464
sock.put("RMD #{test}\r\n")
6565
res = sock.get(-1,5)
66-
if (res =~ /250 RMD command successful./)
66+
if (res =~ /250 RMD command successful\./)
6767
print_status("\tDirectory #{test} reportedly deleted. Verifying with SIZE #{test}")
6868
sock.put("SIZE #{test}\r\n")
6969
res = sock.get(-1,5)

modules/auxiliary/admin/http/dlink_dir_645_password_extractor.rb

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -54,7 +54,7 @@ def run
5454
})
5555

5656
return if res.nil?
57-
return if (res.headers['Server'].nil? or res.headers['Server'] !~ /DIR-645 Ver 1.0/)
57+
return if (res.headers['Server'].nil? or res.headers['Server'] !~ /DIR-645 Ver 1\.0/)
5858
return if (res.code == 404)
5959

6060
if res.body =~ /<password>(.*)<\/password>/

modules/auxiliary/admin/http/typo3_sa_2009_001.rb

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -67,12 +67,12 @@ def run
6767
case datastore['RFILE']
6868
when nil
6969
# Nothing
70-
when /localconf.php$/i
70+
when /localconf\.php$/i
7171
jumpurl = "#{datastore['RFILE']}%00/."
7272
jumpurl_len = (jumpurl.length) -2 #Account for difference in length with null byte
7373
jumpurl_enc = jumpurl.sub("%00", "\00") #Replace %00 with \00 to correct null byte format
7474
print_status("Adding padding to end of #{datastore['RFILE']} to avoid TYPO3 security filters")
75-
when /^..(\/|\\)/i
75+
when /^\.\.(\/|\\)/i
7676
print_error("Directory traversal detected... you might want to start that with a /.. or \\..")
7777
else
7878
jumpurl_len = (datastore['RFILE'].length)

modules/auxiliary/admin/http/typo3_sa_2010_020.rb

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -53,9 +53,9 @@ def run
5353
case datastore['RFILE']
5454
when nil
5555
# Nothing
56-
when /localconf.php$/i
56+
when /localconf\.php$/i
5757
jumpurl = "#{datastore['RFILE']}%00/."
58-
when /^..(\/|\\)/i
58+
when /^\.\.(\/|\\)/i
5959
print_error("Directory traversal detected... you might want to start that with a /.. or \\..")
6060
else
6161
jumpurl = "#{datastore['RFILE']}"

modules/auxiliary/admin/http/typo3_winstaller_default_enc_keys.rb

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -71,12 +71,12 @@ def run
7171
case datastore['RFILE']
7272
when nil
7373
# Nothing
74-
when /localconf.php$/i
74+
when /localconf\.php$/i
7575
jumpurl = "#{datastore['RFILE']}%00/."
7676
jumpurl_len = (jumpurl.length) -2 #Account for difference in length with null byte
7777
jumpurl_enc = jumpurl.sub("%00", "\00") #Replace %00 with \00 to correct null byte format
7878
print_status("Adding padding to end of #{datastore['RFILE']} to avoid TYPO3 security filters")
79-
when /^..(\/|\\)/i
79+
when /^\.\.(\/|\\)/i
8080
print_error("Directory traversal detected... you might want to start that with a /.. or \\..")
8181
else
8282
jumpurl_len = (datastore['RFILE'].length)

0 commit comments

Comments
 (0)