Skip to content

Commit 5a62e77

Browse files
committed
Land rapid7#8954, fix internal usage of bindata objects when generating NTP messages
2 parents faeffc3 + a7a17c6 commit 5a62e77

File tree

1 file changed

+3
-2
lines changed

1 file changed

+3
-2
lines changed

modules/auxiliary/fuzzers/ntp/ntp_protocol_fuzzer.rb

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -98,7 +98,7 @@ def fuzz_control(host)
9898
@versions.each do |version|
9999
print_status("#{host}:#{rport} fuzzing version #{version} control messages (mode 6)")
100100
@mode_6_operations.each do |op|
101-
request = Rex::Proto::NTP.ntp_control(version, op)
101+
request = Rex::Proto::NTP.ntp_control(version, op).to_binary_s
102102
what = "#{request.size}-byte version #{version} mode 6 op #{op} message"
103103
vprint_status("#{host}:#{rport} probing with #{request.size}-byte #{what}")
104104
responses = probe(host, datastore['RPORT'].to_i, request)
@@ -114,7 +114,7 @@ def fuzz_private(host)
114114
print_status("#{host}:#{rport} fuzzing version #{version} private messages (mode 7)")
115115
@mode_7_implementations.each do |implementation|
116116
@mode_7_request_codes.each do |request_code|
117-
request = Rex::Proto::NTP.ntp_private(version, implementation, request_code, "\0" * 188)
117+
request = Rex::Proto::NTP.ntp_private(version, implementation, request_code, "\0" * 188).to_binary_s
118118
what = "#{request.size}-byte version #{version} mode 7 imp #{implementation} req #{request_code} message"
119119
vprint_status("#{host}:#{rport} probing with #{request.size}-byte #{what}")
120120
responses = probe(host, datastore['RPORT'].to_i, request)
@@ -164,6 +164,7 @@ def fuzz_version_mode(host, short)
164164
# TODO: is there a better way to pick this size? Should more than one be tried?
165165
request.payload = SecureRandom.random_bytes(16)
166166
end
167+
request = request.to_binary_s
167168
what = "#{request.size}-byte #{short ? 'short ' : nil}version #{version} mode #{mode} message"
168169
vprint_status("#{host}:#{rport} probing with #{what}")
169170
responses = probe(host, datastore['RPORT'].to_i, request)

0 commit comments

Comments
 (0)