Skip to content

Commit 5550e07

Browse files
committed
Implement suggested changes
1 parent 9f41937 commit 5550e07

File tree

3 files changed

+18
-6
lines changed

3 files changed

+18
-6
lines changed

lib/rex/proto/ms_nrtp/client.rb

Lines changed: 4 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -12,6 +12,7 @@ class Rex::Proto::MsNrtp::Client
1212
attr_reader :port
1313

1414
# @return [String] The server resource component of the URI string.
15+
attr_reader :resource
1516

1617
# @return [Boolean] Whether or not SSL is used for the connection.
1718
attr_reader :ssl
@@ -79,7 +80,7 @@ def recv
7980
MsNrtpMessage.read(@conn)
8081
end
8182
end
82-
return nil unless message.operation_type == 2 && message.content_length?
83+
return nil unless message.operation_type == Enums::OperationTypeEnum[:Reply] && message.content_length?
8384

8485
remaining -= elapsed_time
8586
body = ''
@@ -99,8 +100,8 @@ def send(data, content_type)
99100
content_length: data.length,
100101
headers: [
101102
{ token: MsNrtpHeader::MsNrtpHeaderUri::TOKEN, header: { uri_value: "tcp://#{Rex::Socket.to_authority(@host, @port)}/#{@resource}" } },
102-
{ token: 6, header: { content_type_value: content_type } },
103-
{ token: 0}
103+
{ token: MsNrtpHeader::MsNrtpHeaderContentType::TOKEN, header: { content_type_value: content_type } },
104+
{ token: MsNrtpHeader::MsNrtpHeaderEnd::TOKEN }
104105
]
105106
)
106107
@conn.put(message.to_binary_s + data)

lib/rex/proto/ms_nrtp/enums.rb

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,10 @@
1+
module Rex::Proto::MsNrtp
2+
module Enums
3+
OperationTypeEnum = {
4+
# see: https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-nrtp/e64b2561-defe-4fb5-865e-ea6706c1253d
5+
Request: 0,
6+
OneWayRequest: 1,
7+
Reply: 2
8+
}
9+
end
10+
end

modules/exploits/windows/misc/ivanti_agent_portal_cmdexec.rb

Lines changed: 4 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -51,10 +51,11 @@ def initialize(info = {})
5151

5252
def check
5353
cwd = execute_command('echo %cd%', 0)
54-
CheckCode::Safe unless cwd.to_s =~ /.:\\Windows\\System32/i
55-
CheckCode::Vulnerable
54+
return CheckCode::Safe('Command execution failed.') unless cwd.to_s =~ /.:\\Windows\\System32/i
55+
56+
CheckCode::Vulnerable("Command execution test succeeded. Current working directory: #{cwd}")
5657
rescue Rex::SocketError
57-
CheckCode::Safe
58+
CheckCode::Safe('MS-NRTP connection failed.')
5859
end
5960

6061
def exploit

0 commit comments

Comments
 (0)