Skip to content

Commit 0013db1

Browse files
committed
Fix a regression in the loop logic
1 parent f8dfaae commit 0013db1

File tree

1 file changed

+38
-36
lines changed

1 file changed

+38
-36
lines changed

modules/auxiliary/gather/ldap_esc_vulnerable_cert_finder.rb

Lines changed: 38 additions & 36 deletions
Original file line numberDiff line numberDiff line change
@@ -608,46 +608,48 @@ def print_vulnerable_cert_info
608608
vuln_certificate_details.each do |key, hash|
609609
techniques = hash[:techniques].dup
610610
techniques.delete('ESC3_TEMPLATE_2') unless any_esc3t1 # don't report ESC3_TEMPLATE_2 if there are no instances of ESC3
611-
next if techniques.empty? || !db
612-
613-
techniques.each do |vuln|
614-
next if vuln == 'ESC3_TEMPLATE_2'
615-
616-
prefix = "#{vuln}:"
617-
info = hash[:notes].select { |note| note.start_with?(prefix) }.map { |note| note.delete_prefix(prefix).strip }.join("\n")
618-
info = nil if info.blank?
619-
620-
hash[:ca_servers].each do |ca_fqdn, ca_server|
621-
service = report_service({
622-
host: ca_server[:ip_address],
623-
port: 445,
624-
proto: 'tcp',
625-
name: 'AD CS',
626-
info: "AD CS CA name: #{ca_server[:name]}"
627-
})
628-
629-
if ca_server[:ip_address].present?
630-
vuln = report_vuln(
611+
next if techniques.empty?
612+
613+
if db
614+
techniques.each do |vuln|
615+
next if vuln == 'ESC3_TEMPLATE_2'
616+
617+
prefix = "#{vuln}:"
618+
info = hash[:notes].select { |note| note.start_with?(prefix) }.map { |note| note.delete_prefix(prefix).strip }.join("\n")
619+
info = nil if info.blank?
620+
621+
hash[:ca_servers].each do |ca_fqdn, ca_server|
622+
service = report_service({
631623
host: ca_server[:ip_address],
632624
port: 445,
633625
proto: 'tcp',
634-
sname: 'AD CS',
635-
name: "#{vuln} - #{key}",
636-
info: info,
637-
refs: REFERENCES[vuln],
638-
service: service
639-
)
640-
else
641-
vuln = nil
642-
end
626+
name: 'AD CS',
627+
info: "AD CS CA name: #{ca_server[:name]}"
628+
})
629+
630+
if ca_server[:ip_address].present?
631+
vuln = report_vuln(
632+
host: ca_server[:ip_address],
633+
port: 445,
634+
proto: 'tcp',
635+
sname: 'AD CS',
636+
name: "#{vuln} - #{key}",
637+
info: info,
638+
refs: REFERENCES[vuln],
639+
service: service
640+
)
641+
else
642+
vuln = nil
643+
end
643644

644-
report_note({
645-
data: hash[:dn],
646-
service: service,
647-
host: ca_fqdn.to_s,
648-
ntype: 'windows.ad.cs.ca.template.dn',
649-
vuln_id: vuln&.id
650-
})
645+
report_note({
646+
data: hash[:dn],
647+
service: service,
648+
host: ca_fqdn.to_s,
649+
ntype: 'windows.ad.cs.ca.template.dn',
650+
vuln_id: vuln&.id
651+
})
652+
end
651653
end
652654
end
653655

0 commit comments

Comments
 (0)