Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[SeeRM 8836] Change boot.ini to win.ini #3751

Merged
merged 3 commits into from Sep 7, 2014

Conversation

wchen-r7
Copy link
Contributor

@wchen-r7 wchen-r7 commented Sep 4, 2014

This is for the following redmine issue:
https://dev.metasploit.com/redmine/issues/8836

Notice I'm using backslashes instead of forward slashes. Newer Windows boxes are okay with both, but older ones only allow backslashes.

To verify

  • Make sure all changes point to C:\Windows\win.ini
  • Try to recreate as many setups as possible for testing until either they're all covered, or you feel is enough.

@wchen-r7 wchen-r7 added the module label Sep 4, 2014
@jvazquez-r7 jvazquez-r7 self-assigned this Sep 6, 2014
@jvazquez-r7
Copy link
Contributor

There are a couple of modules using boot.ini for fingerprinting still. Worths to switch them or is this pull request okey as is?

  • auxiliary/admin/officescan/tmlisten_traversal.rb
    res = send_request_raw(
      {
        'uri'     => '/activeupdate/../../../../../../../../../../../boot.ini',
        'method'  => 'GET',
      }, 20)
  • exploits/windows/http/trackercam_phparg_overflow.rb
    boot = download('boot.ini')
    return if not boot

    case boot
      when /Windows XP.*NoExecute/i
        return "Windows XP SP2+"
      when /Windows XP/
        return "Windows XP SP0-SP1"
      when /Windows.*2003/
        return "Windows 2003"
      when /Windows.*2000/
        return "Windows 2000"
      else
        return "Unknown OS/SP"
    end

@jvazquez-r7 jvazquez-r7 removed their assignment Sep 6, 2014
@wchen-r7
Copy link
Contributor Author

wchen-r7 commented Sep 6, 2014

I just updated tmlisten_traversal.rb but I didn't change rackercam_phparg_overflow.rb, because the second on relies on boot.ini to gather information about the OS name, and win.ini does not have this kind of information.

@jvazquez-r7 jvazquez-r7 merged commit 44b9dc9 into rapid7:master Sep 7, 2014
@jvazquez-r7
Copy link
Contributor

Thanks @wchen-r7 , makes sense, just did a last commit to update the signature for win.ini on tmlisten_traversal c86d01a Landed!

@jvazquez-r7 jvazquez-r7 self-assigned this Sep 8, 2014
@wchen-r7 wchen-r7 deleted the boot_ini_fix branch August 22, 2016 16:22
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
Projects
None yet
Development

Successfully merging this pull request may close these issues.

None yet

2 participants