Skip to content

Commit a46975f

Browse files
committed
Fix read_reply to use get_once correctly
1 parent 5ab9f01 commit a46975f

File tree

1 file changed

+22
-5
lines changed

1 file changed

+22
-5
lines changed

modules/exploits/multi/misc/java_jdwp_debugger.rb

Lines changed: 22 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -175,13 +175,30 @@ def create_packet(cmdsig, data="")
175175

176176
# Reads packet response for JDWP protocol
177177
def read_reply(timeout = default_timeout)
178-
response = sock.get(timeout)
178+
length = sock.get_once(4, timeout)
179+
fail_with(Failure::TimeoutExpired, "#{peer} - Not received response length") unless length
180+
pkt_len = length.unpack('N')[0]
181+
if pkt_len < 4
182+
fail_with(Failure::Unknown, "#{peer} - Received corrupted response")
183+
end
184+
pkt_len = pkt_len - 4
185+
186+
response = sock.get_once(pkt_len, timeout)
179187
fail_with(Failure::TimeoutExpired, "#{peer} - Not received response") unless response
180-
pktlen, id, flags, errcode = response.unpack('NNCn')
181-
response.slice!(0..10)
182-
if errcode != 0 && flags == REPLY_PACKET_TYPE
183-
fail_with(Failure::Unknown, "#{peer} - Server sent error with code #{errcode}")
188+
while response.length < pkt_len
189+
partial = sock.get_once(pkt_len, timeout)
190+
fail_with(Failure::TimeoutExpired, "#{peer} - Not received response") unless partial
191+
response << partial
192+
end
193+
194+
fail_with(Failure::Unknown, "#{peer} - Received corrupted response") unless response.length == pkt_len
195+
196+
id, flags, err_code = response.unpack('NCn')
197+
response.slice!(0..6)
198+
if err_code != 0 && flags == REPLY_PACKET_TYPE
199+
fail_with(Failure::Unknown, "#{peer} - Server sent error with code #{err_code}")
184200
end
201+
185202
response
186203
end
187204

0 commit comments

Comments
 (0)