6
6
##
7
7
8
8
##
9
- # This module is based on, inspired by, or is a port of a plugin available in
10
- # the Onapsis Bizploit Opensource ERP Penetration Testing framework -
9
+ # This module is based on, inspired by, or is a port of a plugin available in
10
+ # the Onapsis Bizploit Opensource ERP Penetration Testing framework -
11
11
# http://www.onapsis.com/research-free-solutions.php.
12
- # Mariano Nuñez (the author of the Bizploit framework) helped me in my efforts
12
+ # Mariano Nunez (the author of the Bizploit framework) helped me in my efforts
13
13
# in producing the Metasploit modules and was happy to share his knowledge and
14
- # experience - a very cool guy. I'd also like to thank Chris John Riley,
15
- # Ian de Villiers and Joris van de Vis who have Beta tested the modules and
14
+ # experience - a very cool guy. I'd also like to thank Chris John Riley,
15
+ # Ian de Villiers and Joris van de Vis who have Beta tested the modules and
16
16
# provided excellent feedback. Some people just seem to enjoy hacking SAP :)
17
17
##
18
18
@@ -23,16 +23,15 @@ class Metasploit4 < Msf::Auxiliary
23
23
include Msf ::Auxiliary ::Report
24
24
include Msf ::Auxiliary ::Scanner
25
25
include Msf ::Exploit ::Remote ::Tcp
26
-
26
+
27
27
def initialize
28
28
super (
29
29
'Name' => 'SAPRouter Admin Request' ,
30
- 'Version' => '$Revision$' ,
31
30
'Description' => %q{
32
31
SAPRouter Admin Request (display remote route information).
33
32
http://help.sap.com/saphelp_nw70ehp3/helpdata/en/48/6c68b01d5a350ce10000000a42189d/content.htm
34
33
} ,
35
- 'References' => [ [ 'URL' , 'http://labs.mwrinfosecurity.com' ] ] ,
34
+ 'References' => [ [ 'URL' , 'http://labs.mwrinfosecurity.com/tools/2012/04/27/sap-metasploit-modules/ ' ] ] ,
36
35
'Author' => [ 'nmonkee' ] ,
37
36
'License' => BSD_LICENSE
38
37
)
@@ -41,23 +40,23 @@ def initialize
41
40
Opt ::RPORT ( 3299 )
42
41
] , self . class )
43
42
end
44
-
43
+
45
44
def get_data ( size , packet_len )
46
45
info = ''
47
- for i in 1 .. size
46
+ 1 . upto ( size ) do | i |
48
47
data = sock . recv ( 1 )
49
48
packet_len -= 1
50
49
if data == "\x00 "
51
50
sock . recv ( size - i )
52
51
packet_len -= size - i
53
52
return info , packet_len
54
53
break
55
- elsif
54
+ else
56
55
info << data
57
56
end
58
57
end
59
58
end
60
-
59
+
61
60
def run_host ( ip )
62
61
type = 'ROUTER_ADM'
63
62
version = 0x26
@@ -86,15 +85,15 @@ def run_host(ip)
86
85
connect
87
86
rescue ::Rex ::ConnectionRefused
88
87
print_status ( "#{ ip } :#{ datastore [ 'RPORT' ] } - connection refused" )
89
- connected == ' false'
88
+ connected = false
90
89
rescue ::Rex ::ConnectionError , ::IOError , ::Timeout ::Error
91
90
print_status ( "#{ ip } :#{ datastore [ 'RPORT' ] } - connection timeout" )
92
- connected == ' false'
91
+ connected = false
93
92
rescue ::Exception => e
94
93
print_error ( "#{ ip } :#{ datastore [ 'RPORT' ] } - exception #{ e . class } #{ e } #{ e . backtrace } " )
95
- connected == ' false'
94
+ connected = false
96
95
end
97
- if connected != ' false'
96
+ if connected != false
98
97
print_good ( "connected to saprouter" )
99
98
print_good ( "sending ROUTER_ADM packet info request" )
100
99
sock . put ( ni_packet )
@@ -113,7 +112,7 @@ def run_host(ip)
113
112
sock . recv ( 2 )
114
113
packet_len -= 2
115
114
saptbl << [ source , destination , service ]
116
- while packet_len != 0
115
+ while packet_len > 0
117
116
sock . recv ( 13 )
118
117
packet_len -= 13
119
118
source , packet_len = get_data ( 46 , packet_len )
0 commit comments