dnrops
/
metasploit-framework
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Update redis file_upload to optionally FLUSHALL before writing 

This increases the chances that the uploaded file will be usable as-is
rather than being surround by the data in redis itself.
This commit is contained in:
Jon Hart 2016-08-31 14:27:18 -07:00
parent 219f643af2
commit b0e45341e5
No known key found for this signature in database
GPG Key ID: 2FA9F0A3AFA8E9D3
1 changed files with 9 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

10
modules/auxiliary/scanner/redis/file_upload.rb
View File

@ -40,7 +40,8 @@ class MetasploitModule < Msf::Auxiliary
[
OptPath.new('LocalFile', [false, 'Local file to be uploaded']),
OptString.new('RemoteFile', [false, 'Remote file path']),
OptBool.new('DISABLE_RDBCOMPRESSION', [true, 'Disable compression when saving if found to be enabled', true])
OptBool.new('DISABLE_RDBCOMPRESSION', [true, 'Disable compression when saving if found to be enabled', true]),
OptBool.new('FLUSHALL', [true, 'Run flushall to remove all redis data before saving', false])
]
)
end
@ -83,6 +84,13 @@ class MetasploitModule < Msf::Auxiliary
end
end
if datastore['FLUSHALL']
data = redis_command('FLUSHALL')
unless data.include?('+OK')
print_warning("#{peer} -- failed to flushall(); continuing")
end
end
# set a key in this db that contains our content
# XXX: this does not work well (at all) if the content we are uploading is
# multiline. It also probably doesn't work well if the content isn't