Question

Forgive me guys, new to Ruby, actually this is the first lang I have taken up, so be gentle with me ok?

Writing a mod for Metasploit which will scan a system or net for 302/500 errors on the file ScriptResource.axd which can be used in further attacks.

It starts, it runs, then crashes with error:

msf  auxiliary(Scriptresource) > exploit

[*] hxxp://192.168.0.18:80 hxxp://192.168.0.18:80/scriptresource.axd?d=AAAAAAAAAAAAAAAAAAAAAA1 302
[*] hxxp://192.168.0.5:80 hxxp://192.168.0.5:80/scriptresource.axd?d=AAAAAAAAAAAAAAAAAAAAAA1 302
[*] hxxp://192.168.0.106:80 hxxp://192.168.0.106:80/scriptresource.axd?d=AAAAAAAAAAAAAAAAAAAAAA1 302
[*] hxxp://192.168.0.4:80 hxxp://192.168.0.4:80/scriptresource.axd?d=AAAAAAAAAAAAAAAAAAAAAA1 302
[*] hxxp://192.168.0.43:80 hxxp://192.168.0.43:80/scriptresource.axd?d=AAAAAAAAAAAAAAAAAAAAAA1 500
[*] hxxp://192.168.0.236:80 hxxp://192.168.0.236:80/scriptresource.axd?d=AAAAAAAAAAAAAAAAAAAAAA1 500
[*] hxxp://192.168.0.238:80 hxxp://192.168.0.238:80/scriptresource.axd?d=AAAAAAAAAAAAAAAAAAAAAA1 500
[-] Auxiliary failed: NoMethodError undefined method `code' for nil:NilClass
[-] Call stack:
[-]   /root/.msf4/modules/auxiliary/scanner/http/Scriptresource.rb:50:in `block in run_host'
[-]   /root/.msf4/modules/auxiliary/scanner/http/Scriptresource.rb:39:in `each'
[-]   /root/.msf4/modules/auxiliary/scanner/http/Scriptresource.rb:39:in `run_host'
[-]   /opt/metasploit-4.2.0/msf3/lib/msf/core/auxiliary/scanner.rb:92:in `block in run'
[-]   /opt/metasploit-4.2.0/msf3/lib/msf/core/thread_manager.rb:64:in `call'
[-]   /opt/metasploit-4.2.0/msf3/lib/msf/core/thread_manager.rb:64:in `block in 

Here is the Program:

require ‘rex/proto/http’
require ‘msf/core’

class Metasploit3 < Msf::Auxiliary

include Msf::Exploit::Remote::HttpClient
include Msf::Auxiliary::WmapScanDir
include Msf::Auxiliary::Scanner

def initialize(info = {})
    super(update_info(info,
        'Name'          => 'ScriptResource Scanner',
        'Description'   => %q{
            This module Will scan for the 302/500 response codes associated 
            with ScriptResource.axd on a traget machine or network.  This 
            file is required for ASP.Net Oracle Padding attack. 
        },
        'Author'        => [ 'MyChickenNinja' ],
        'License'       => BSD_LICENSE,))

    register_options(
        [
            OptString.new('PATH', [ true,  "The path  to identify vulnerable files", '/',
                ]
            )
        ], self.class)

end

def run_host(ip)

    cypher = ['scriptresource.axd?d=AAAAAAAAAAAAAAAAAAAAAA1']

    conn = false

    spath = datastore['PATH']

    cypher.each do |cy|
        queue << cy.strip

        begin
            crypt = cy
            res = send_request_cgi({
                'uri'       =>  spath+crypt,
                'method'    => 'GET',
                'ctype'     => 'text/plain'
            }, 20)

            if res.code == 500 or res.code == 302
                print_status("#{wmap_base_url} #{wmap_base_url}#{spath}#{crypt} #{res.code}")

            end

        rescue ::Rex::ConnectionRefused, ::Rex::HostUnreachable, ::Rex::ConnectionTimeout
            conn = false
        rescue ::Timeout::Error, ::Errno::EPIPE
        end

    end
end

end

Now its referring to the “res.code”. I see that, but I was under the impression that Metasploit handled res.code. Isn’t this confirmed by the fact I am getting res.code output before the program crashes? So now I am at a loss… Yes I looked at other Questions on the site here but usually the answer is that they are not defined. But Metasplot defines this variable.. So… ??

As I said, I’m new to Ruby so if I can get a kinda detailed answer, I would be greatly appreciate it.
Thanks!

Answer 1

Figured it out.
Just needed a blank rescue to handle nil responses.