Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Update module stance instead of appending to it #11734

Closed
wants to merge 2 commits into from

Conversation

wvu
Copy link
Contributor

@wvu wvu commented Apr 16, 2019

This is a redux of the fixes #9387 and #9822.

While this is the correct solution, I think it's okay to keep the other code for safety.

Note that either the module or one of its mixins will need to set the appropriate stance. This fix simply makes stance a binary, so inheritance and mixin order are especially important now.

msf5 exploit(multi/http/struts2_rest_xstream) > pry
[*] Starting Pry shell...
[*] You are in exploit/multi/http/struts2_rest_xstream

[1] pry(#<Msf::Modules::Exploit__Multi__Http__Struts2_rest_xstream::MetasploitModule>)> stance
=> "aggressive"
[2] pry(#<Msf::Modules::Exploit__Multi__Http__Struts2_rest_xstream::MetasploitModule>)> aggressive?
=> true
[3] pry(#<Msf::Modules::Exploit__Multi__Http__Struts2_rest_xstream::MetasploitModule>)> passive?
=> false
[4] pry(#<Msf::Modules::Exploit__Multi__Http__Struts2_rest_xstream::MetasploitModule>)>
msf5 exploit(multi/http/struts2_rest_xstream) > run

[!] You are binding to a loopback address by setting LHOST to 127.0.0.1. Did you want ReverseListenerBindAddress?
[*] Started reverse TCP double handler on 127.0.0.1:4444
[-] The connection was refused by the remote host (127.0.0.1:8080).
^C[*] Exploit completed, but no session was created.
msf5 exploit(multi/http/struts2_rest_xstream) >

Please note that the default behavior of update_info is to convert to an array and append to it.

# If it's not an array, convert it to an array and merge the
# two
if (info[name].kind_of?(Array) == false)
curr = info[name]
info[name] = [ curr ]
end

#11711

@wvu
Copy link
Contributor Author

wvu commented Apr 17, 2019

I'm nixing this, since while I think an aggressive exploit (even if it uses passive code) is always aggressive, it is useful to see the distinct qualities, and I've already written the code to account for that.

@wvu wvu closed this Apr 17, 2019
@wvu wvu deleted the bug/stance branch April 17, 2019 18:37
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Development

Successfully merging this pull request may close these issues.

1 participant