Skip to content

Commit 7a4e129

Browse files
wchen-r7wchen-r7
committed
First little bit at Bug 8498
[FixRM rapid7#8489] rhost/rport modification
2 parents 56b165d + d7513b0 commit 7a4e129

File tree

12 files changed

+116
-71
lines changed

12 files changed

+116
-71
lines changed

‎lib/msf/core/exploit/ftp.rb

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -43,7 +43,7 @@ def initialize(info = {})
4343

4444
#
4545
# This method establishes an FTP connection to host and port specified by
46-
# the RHOST and RPORT options, respectively. After connecting, the banner
46+
# the 'rhost' and 'rport' methods. After connecting, the banner
4747
# message is read in and stored in the 'banner' attribute.
4848
#
4949
def connect(global = true, verbose = nil)

‎lib/msf/core/exploit/http/client.rb

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -164,7 +164,7 @@ def connect(opts={})
164164

165165
# Configure the HTTP client with the supplied parameter
166166
nclient.set_config(
167-
'vhost' => opts['vhost'] || self.vhost(),
167+
'vhost' => opts['vhost'] || opts['rhost'] || self.vhost(),
168168
'agent' => datastore['UserAgent'],
169169
'uri_encode_mode' => datastore['HTTP::uri_encode_mode'],
170170
'uri_full_url' => datastore['HTTP::uri_full_url'],

‎modules/auxiliary/admin/misc/wol.rb

Lines changed: 12 additions & 18 deletions
Original file line numberDiff line numberDiff line change
@@ -36,14 +36,6 @@ def initialize(info = {})
3636
deregister_options('RHOST', 'RPORT')
3737
end
3838

39-
#
40-
# Restore the original rhost:rport
41-
#
42-
def cleanup
43-
datastore['RHOST'] = @last_rhost
44-
datastore['RPORT'] = @last_rport
45-
end
46-
4739
#
4840
# Convert the MAC option to binary format
4941
#
@@ -85,6 +77,14 @@ def parse_password
8577
nil
8678
end
8779

80+
def wol_rhost
81+
datastore['IPV6'] ? "ff:ff:ff:ff:ff:ff" : "255.255.255.255"
82+
end
83+
84+
def wol_rport
85+
9
86+
end
87+
8888
def run
8989
# If the MAC is bad, no point to continue
9090
mac = get_mac_addr
@@ -94,23 +94,17 @@ def run
9494
pass = parse_password
9595
return if pass.nil?
9696

97-
# Save the original rhost:rport settings so we can restore them
98-
# later once the module is done running
99-
@last_rhost = rhost
100-
@last_rport = rport
101-
102-
# Config to broadcast
103-
datastore['RHOST'] = datastore['IPV6'] ? "ff:ff:ff:ff:ff:ff" : "255.255.255.255"
104-
datastore['RPORT'] = 9
105-
10697
# Craft the WOL packet
10798
wol_pkt = "\xff" * 6 #Sync stream (magic packet)
10899
wol_pkt << mac * 16 #Mac address
109100
wol_pkt << pass if not pass.empty?
110101

111102
# Send out the packet
112103
print_status("Sending WOL packet...")
113-
connect_udp
104+
connect_udp( true, {
105+
'RHOST' => wol_rhost,
106+
'RPORT' => wol_rport
107+
})
114108
udp_sock.put(wol_pkt)
115109
disconnect_udp
116110
end

‎modules/auxiliary/gather/corpwatch_lookup_id.rb

Lines changed: 20 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -28,7 +28,7 @@ def initialize(info = {})
2828
register_options(
2929
[
3030
OptString.new('CW_ID', [ true, "The CorpWatch ID of the company", ""]),
31-
OptInt.new('YEAR', [ false, "Year to look up"]),
31+
OptInt.new('YEAR', [ false, "Year to look up", Time.now.year-1]),
3232
OptBool.new('GET_LOCATIONS', [ false, "Get locations for company", true]),
3333
OptBool.new('GET_NAMES', [ false, "Get all registered names ofr the company", true]),
3434
OptBool.new('GET_FILINGS', [ false, "Get all filings", false ]),
@@ -40,26 +40,24 @@ def initialize(info = {})
4040
deregister_options('RHOST', 'RPORT', 'VHOST', 'Proxies')
4141
end
4242

43-
def cleanup
44-
datastore['RHOST'] = @old_rhost
45-
datastore['RPORT'] = @old_rport
43+
def rhost_corpwatch
44+
'api.corpwatch.org'
4645
end
4746

48-
def run
49-
# Save the original rhost/rport in case the user was exploiting something else
50-
@old_rhost = datastore['RHOST']
51-
@old_rport = datastore['RPORT']
47+
def rport_corpwatch
48+
80
49+
end
5250

53-
# Initial api.corpwatch.org's rhost and rport for HttpClient
54-
datastore['RHOST'] = 'api.corpwatch.org'
55-
datastore['RPORT'] = 80
51+
def run
5652

5753
loot = ""
5854
uri = "/"
5955
uri << (datastore['YEAR']).to_s if datastore['YEAR'].to_s != ""
6056
uri << ("/companies/" + datastore['CW_ID'])
6157

6258
res = send_request_cgi({
59+
'rhost' => rhost_corpwatch,
60+
'rport' => rport_corpwatch,
6361
'uri' => uri + ".xml",
6462
'method' => 'GET'
6563
}, 25)
@@ -85,7 +83,7 @@ def run
8583

8684
elements = root.get_elements("result")
8785

88-
if elements == nil || elements.length == 0
86+
if elements.blank? || elements.length == 0
8987
print_error("No results returned")
9088
return
9189
end
@@ -157,6 +155,8 @@ def run
157155

158156
res = send_request_cgi(
159157
{
158+
'rhost' => rhost_corpwatch,
159+
'rport' => rport_corpwatch,
160160
'uri' => uri + "/locations.xml",
161161
'method' => 'GET'
162162
}, 25)
@@ -227,6 +227,8 @@ def run
227227

228228
res = send_request_cgi(
229229
{
230+
'rhost' => rhost_corpwatch,
231+
'rport' => rport_corpwatch,
230232
'uri' => uri + "/names.xml",
231233
'method' => 'GET'
232234
}, 25)
@@ -287,6 +289,8 @@ def run
287289

288290
res = send_request_cgi(
289291
{
292+
'rhost' => rhost_corpwatch,
293+
'rport' => rport_corpwatch,
290294
'uri' => uri + "/filings.xml",
291295
'method' => 'GET'
292296
}, 25)
@@ -365,6 +369,8 @@ def run
365369

366370
res = send_request_cgi(
367371
{
372+
'rhost' => rhost_corpwatch,
373+
'rport' => rport_corpwatch,
368374
'uri' => child_uri,
369375
'method' => 'GET'
370376
}, 25)
@@ -444,6 +450,8 @@ def run
444450
if datastore['GET_HISTORY']
445451

446452
res = send_request_cgi({
453+
'rhost' => rhost_corpwatch,
454+
'rport' => rport_corpwatch,
447455
'uri' => uri + "/history.xml",
448456
'method' => 'GET'
449457
}, 25)

‎modules/auxiliary/gather/corpwatch_lookup_name.rb

Lines changed: 10 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -31,34 +31,32 @@ def initialize(info = {})
3131
register_options(
3232
[
3333
OptString.new('COMPANY_NAME', [ true, "Search for companies with this name", ""]),
34-
OptInt.new('YEAR', [ false, "Limit results to a specific year"]),
34+
OptInt.new('YEAR', [ false, "Year to look up", Time.now.year-1]),
3535
OptString.new('LIMIT', [ true, "Limit the number of results returned", "5"]),
3636
OptString.new('CORPWATCH_APIKEY', [ false, "Use this API key when getting the data", ""]),
3737
], self.class)
3838

3939
deregister_options('RHOST', 'RPORT', 'Proxies', 'VHOST')
4040
end
4141

42-
def cleanup
43-
datastore['RHOST'] = @old_rhost
44-
datastore['RPORT'] = @old_rport
42+
def rhost_corpwatch
43+
'api.corpwatch.org'
4544
end
4645

47-
def run
48-
# Save the original rhost/rport in case the user was exploiting something else
49-
@old_rhost = datastore['RHOST']
50-
@old_rport = datastore['RPORT']
46+
def rport_corpwatch
47+
80
48+
end
5149

52-
# Initial api.corpwatch.org's rhost and rport for HttpClient
53-
datastore['RHOST'] = 'api.corpwatch.org'
54-
datastore['RPORT'] = 80
50+
def run
5551

5652
uri = "/"
5753
uri << (datastore['YEAR'].to_s + "/") if datastore['YEAR'].to_s != ""
5854
uri << "companies.xml"
5955

6056
res = send_request_cgi(
6157
{
58+
'rhost' => rhost_corpwatch,
59+
'rport' => rport_corpwatch,
6260
'uri' => uri,
6361
'method' => 'GET',
6462
'vars_get' =>
@@ -104,7 +102,7 @@ def run
104102

105103
elements = results.get_elements("companies")
106104

107-
if not elements
105+
if elements.blank?
108106
print_error("No companies returned")
109107
return
110108
end

‎modules/auxiliary/gather/shodan_search.rb

Lines changed: 16 additions & 16 deletions
Original file line numberDiff line numberDiff line change
@@ -60,6 +60,9 @@ def shodan_query(query, apikey, page)
6060
uri = "/api/search?&q=" + Rex::Text.uri_encode(query) + "&key=" + apikey + "&page=" + page.to_s
6161
res = send_request_raw(
6262
{
63+
'rhost' => shodan_rhost,
64+
'rport' => shodan_rport,
65+
'vhost' => vhost,
6366
'method' => 'GET',
6467
'uri' => uri
6568
}, 25)
@@ -80,29 +83,26 @@ def save_output(data)
8083
print_status("Save results in #{datastore['OUTFILE']}")
8184
end
8285

83-
def cleanup
84-
datastore['RHOST'] = @old_rhost
85-
datastore['RPORT'] = @old_rport
86+
def shodan_rhost
87+
@res = Net::DNS::Resolver.new()
88+
dns_query = @res.query("#{datastore['VHOST']}", "A")
89+
if dns_query.answer.length == 0
90+
print_error("Could not resolve #{datastore['VHOST']}")
91+
raise ::Rex::ConnectError(vhost, shodan_port)
92+
end
93+
dns_query.answer[0].to_s.split(/[\s,]+/)[4]
94+
end
95+
96+
def shodan_rport
97+
80
8698
end
8799

88100
def run
101+
89102
# create our Shodan request parameters
90103
query = datastore['QUERY']
91104
apikey = datastore['SHODAN_APIKEY']
92105

93-
@res = Net::DNS::Resolver.new()
94-
dns_query = @res.query("#{datastore['VHOST']}", "A")
95-
if dns_query.answer.length == 0
96-
print_error("Could not resolve #{datastore['VHOST']}")
97-
return
98-
else
99-
# Make a copy of the original rhost
100-
@old_rhost = datastore['RHOST']
101-
@old_rport = datastore['RPORT']
102-
datastore['RHOST'] = dns_query.answer[0].to_s.split(/[\s,]+/)[4]
103-
datastore['RPORT'] = 80
104-
end
105-
106106
page = 1
107107

108108
# results gets our results from shodan_query

‎modules/auxiliary/scanner/portscan/ftpbounce.rb

Lines changed: 9 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -17,9 +17,7 @@ def initialize
1717
'Name' => 'FTP Bounce Port Scanner',
1818
'Description' => %q{
1919
Enumerate TCP services via the FTP bounce PORT/LIST
20-
method, which can still come in handy every once in
21-
a while (I know of a server that still allows this
22-
just fine...).
20+
method.
2321
},
2422
'Author' => 'kris katterjohn',
2523
'License' => MSF_LICENSE
@@ -39,16 +37,21 @@ def support_ipv6?
3937
false
4038
end
4139

40+
def rhost
41+
datastore['BOUNCEHOST']
42+
end
43+
44+
def rport
45+
datastore['BOUNCEPORT']
46+
end
47+
4248
def run_host(ip)
4349
ports = Rex::Socket.portspec_crack(datastore['PORTS'])
4450

4551
if ports.empty?
4652
raise Msf::OptionValidateError.new(['PORTS'])
4753
end
4854

49-
datastore['RHOST'] = datastore['BOUNCEHOST']
50-
datastore['RPORT'] = datastore['BOUNCEPORT']
51-
5255
return if not connect_login
5356

5457
ports.each do |port|

‎modules/exploits/multi/browser/java_atomicreferencearray.rb

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -123,7 +123,7 @@ def on_request_uri( cli, request )
123123
vprint_status("Sending java reverse shell")
124124
else
125125
port = datastore['LPORT']
126-
datastore['RHOST'] = cli.peerhost
126+
host = cli.peerhost
127127
vprint_status( "Java bind shell" )
128128
end
129129
if jar

‎modules/exploits/multi/browser/java_calendar_deserialize.rb

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -119,7 +119,7 @@ def on_request_uri( cli, request )
119119
print_status("Payload will be a Java reverse shell")
120120
else
121121
port = datastore['LPORT']
122-
datastore['RHOST'] = cli.peerhost
122+
host = cli.peerhost
123123
print_status("Payload will be a Java bind shell")
124124
end
125125
if jar

‎modules/exploits/multi/browser/java_verifier_field_access.rb

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -122,7 +122,7 @@ def on_request_uri( cli, request )
122122
vprint_status("Sending java reverse shell")
123123
else
124124
port = datastore['LPORT']
125-
datastore['RHOST'] = cli.peerhost
125+
host = cli.peerhost
126126
vprint_status( "Java bind shell" )
127127
end
128128
if jar

0 commit comments

Comments
 (0)