@@ -43,7 +43,7 @@ def initialize
43
43
end
44
44
45
45
def peer
46
- peer = "#{ rhost } :#{ rport } "
46
+ "#{ rhost } :#{ rport } "
47
47
end
48
48
49
49
def get_response ( size = 8 )
@@ -54,13 +54,24 @@ def get_response(size = 8)
54
54
end
55
55
56
56
# Called when using check
57
- def check_host ( ip )
58
- print_status ( "Checking #{ peer } for DLSw exposure" )
57
+ def check_host ( _ip )
58
+ print_status ( "#{ peer } : Checking for DLSw exposure" )
59
59
response = get_response
60
-
61
- dlsw_header = [ "3148015b" ] . pack ( "H*" ) # => "\x31\x48\x01\x5b""
62
- if !response . blank? && ( response [ 0 ..3 ] == dlsw_header )
63
- print_good ( "#{ peer } : Detected DLSw protocol" )
60
+
61
+ if response . blank?
62
+ vprint_status ( "#{ peer } : no response" )
63
+ Exploit ::CheckCode ::Safe
64
+ elsif response [ 0 ..3 ] == "\x31 \x48 \x01 \x5b "
65
+ vprint_good ( "#{ peer } : Detected DLSw protocol" )
66
+ report_service (
67
+ host : rhost ,
68
+ port : rport ,
69
+ proto : 'tcp' ,
70
+ name : 'dlsw'
71
+ )
72
+ # TODO: check that response has something that truly indicates it is vulnerable
73
+ # and not simply that it responded
74
+ print_good ( "#{ peer } : leaked #{ response . length } bytes" )
64
75
report_vuln (
65
76
host : rhost ,
66
77
port : rport ,
@@ -70,11 +81,7 @@ def check_host(ip)
70
81
)
71
82
Exploit ::CheckCode ::Vulnerable
72
83
else
73
- if response . blank?
74
- vprint_status ( "#{ peer } : no response" )
75
- else
76
- vprint_status ( "#{ peer } : #{ response . size } -byte response didn't contain any leaked data" )
77
- end
84
+ vprint_status ( "#{ peer } : #{ response . size } -byte response didn't contain any leaked data" )
78
85
Exploit ::CheckCode ::Safe
79
86
end
80
87
end
@@ -86,9 +93,7 @@ def run_host(ip)
86
93
dlsw_data = ''
87
94
until dlsw_data . length > datastore [ 'LEAK_AMOUNT' ]
88
95
response = get_response ( 72 )
89
- unless response . blank?
90
- dlsw_data << response [ 18 ..72 ]
91
- end
96
+ dlsw_data << response [ 18 ..72 ] unless response . blank?
92
97
end
93
98
loot_and_report ( dlsw_data )
94
99
end
@@ -105,4 +110,3 @@ def loot_and_report(dlsw_leak)
105
110
print_status ( "#{ peer } : DLSw leaked data stored in #{ path } " )
106
111
end
107
112
end
108
-
0 commit comments