dnrops
/
metasploit-framework
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Fix tcp_malformed_options_detection scoring 

Typo defaulted @vxworks_score and @ipnet_score to 100 instead of -100.
This commit also refactors the method to align with the others.
This commit is contained in:
William Vu 2019-10-14 21:00:52 -05:00
parent 3e0b58613a
commit 4a9a3604f6
1 changed files with 23 additions and 18 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

41
modules/auxiliary/scanner/vxworks/urgent11_check.rb
View File

@ -146,33 +146,38 @@ class MetasploitModule < Msf::Auxiliary
# IP destination address # IP destination address
pkt.ip_daddr = ip pkt.ip_daddr = ip
# TCP packet with malformed options # TCP SYN with malformed options
pkt.tcp_dst = port
pkt.tcp_flags.syn = 1 pkt.tcp_flags.syn = 1
pkt.tcp_dst = port pkt.tcp_opts = [2, 4, 1460].pack('CCn') + # MSS
pkt.tcp_opts = [1, 2].pack('CC') + # NOP
[2, 4, 1460].pack('CCn') + # MSS [3, 2].pack('CC') + # WSCALE with invalid length
[1, 2].pack('CC') + # NOP [3, 3, 0].pack('CCC') # WSCALE with valid length
[3, 2].pack('CC') + # WSCALE with invalid length
[3, 3, 0].pack('CCC') # WSCALE with valid length
pkt.recalc pkt.recalc
pkt.to_w res = nil
res = inject_reply(:tcp)
datastore['RetransmissionRate'].times do
pkt.to_w
res = inject_reply(:tcp)
break unless res
end
unless res unless res
@vxworks_score = 0 return @vxworks_score = 0,
@ipnet_score = 50 @ipnet_score = 50
return
end end
if res.tcp_flags.rst == 1 if res.tcp_flags.rst == 1 &&
@vxworks_score = 100 res.tcp_dst == pkt.tcp_src && res.tcp_dst == pkt.tcp_src
@ipnet_score = 100
return return @vxworks_score = 100,
@ipnet_score = 100
end end
@vxworks_score = 100 return @vxworks_score = -100,
@ipnet_score = 100 @ipnet_score = -100
end end
def tcp_dos_detection(ip, port) def tcp_dos_detection(ip, port)