Land #12754, ForceExploit for 4.3BSD exploits

rapid7 · Dec 24, 2019 · e89a596 · e89a596
2 parents 337d18d + 01b6bc1
commit e89a596
Show file tree

Hide file tree

Showing 2 changed files with 15 additions and 2 deletions.
diff --git a/modules/exploits/bsd/finger/morris_fingerd_bof.rb b/modules/exploits/bsd/finger/morris_fingerd_bof.rb
@@ -55,6 +55,10 @@ def initialize(info = {})
     ))
 
     register_options([Opt::RPORT(79)])
+
+    register_advanced_options([
+      OptBool.new('ForceExploit', [false, 'Override check result', false])
+    ])
   end
 
   def check
@@ -71,14 +75,18 @@ def check
     end
 
     CheckCode::Safe
-  rescue Rex::ConnectionError => e
+  rescue EOFError, Rex::ConnectionError => e
     vprint_error(e.message)
     CheckCode::Unknown
   ensure
     disconnect
   end
 
   def exploit
+    unless check == CheckCode::Detected || datastore['ForceExploit']
+      fail_with(Failure::NotVulnerable, 'Set ForceExploit to override')
+    end
+
     # Start by generating our custom VAX shellcode
     shellcode = payload.encoded
 

diff --git a/modules/exploits/unix/smtp/morris_sendmail_debug.rb b/modules/exploits/unix/smtp/morris_sendmail_debug.rb
@@ -52,6 +52,7 @@ def initialize(info = {})
     register_options([Opt::RPORT(25)])
 
     register_advanced_options([
+      OptBool.new('ForceExploit',       [false, 'Override check result', false]),
       OptFloat.new('SendExpectTimeout', [true, 'Timeout per send/expect', 3.5])
     ])
   end
@@ -78,14 +79,18 @@ def check
     end
 
     checkcode
-  rescue Rex::ConnectionError => e
+  rescue EOFError, Rex::ConnectionError => e
     vprint_error(e.message)
     CheckCode::Unknown
   ensure
     disconnect
   end
 
   def exploit
+    unless check == CheckCode::Appears || datastore['ForceExploit']
+      fail_with(Failure::NotVulnerable, 'Set ForceExploit to override')
+    end
+
     # We don't care who the user is, so randomize it
     from = rand_text_alphanumeric(8..42)