Skip to content

Commit 6357104

Browse files
committed
Removing bullet points from module description
Due to the vagaries of various Metasploit module description viewers, we can't guarantee things like lists and bullet points render right. Descriptions should avoid using these things.
1 parent b457289 commit 6357104

File tree

1 file changed

+9
-11
lines changed

1 file changed

+9
-11
lines changed

modules/auxiliary/server/http_ntlmrelay.rb

Lines changed: 9 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -38,17 +38,15 @@ def initialize(info = {})
3838
'Version' => '$Revision:$',
3939
'Description' => %q{
4040
This module relays negotiated NTLM Credentials from an HTTP server to multiple
41-
protocols (currently it supports relaying to SMB and HTTP).
41+
protocols. Currently, this module supports relaying to SMB and HTTP.
4242
4343
Complicated custom attacks requiring multiple requests that depend on each
44-
other can be written using the SYNC* options. For example, a typical CSRF
45-
style attack might look like:
46-
47-
1) Set an HTTP_GET request with a unique SNYNCID
48-
2) Set an HTTP_POST request with a SYNCFILE, which contains logic to look
49-
through the database and parse out important values, such as the CSRF token
50-
or authentication cookies. It then sets these as configuration options
51-
3) Create a web page with iframes pointing at 1 and then 2
44+
other can be written using the SYNC* options. For example, a CSRF-style
45+
attack might first set an HTTP_GET request with a unique SNYNCID and set
46+
an HTTP_POST request with a SYNCFILE, which contains logic to look
47+
through the database and parse out important values, such as the CSRF token
48+
or authentication cookies, setting these as configuration options, and finally
49+
create a web page with iframe elements pointing at the HTTP_GET and HTTP_POSTs.
5250
},
5351
'Author' =>
5452
[
@@ -233,14 +231,14 @@ def parse_args()
233231
# this is useful for multi staged relay attacks
234232
# ideally I would use a resource file but it's not easily exposed, and this is simpler
235233
def sync_options()
236-
print_status("Dynamically evaling local ruby file: #{datastore['SYNCFILE']}")
234+
print_status("Dynamically eval()'ing local ruby file: #{datastore['SYNCFILE']}")
237235
# previous request might create the file, so error thrown at runtime
238236
if not ::File.readable?(datastore['SYNCFILE'])
239237
print_error("SYNCFILE unreadable, aborting")
240238
raise ArgumentError
241239
end
242240
data = ::File.read(datastore['SYNCFILE'])
243-
eval(data)
241+
eval(data) # WARNING: This can be insanely insecure!
244242
end
245243

246244
# relay creds to server and perform any HTTP specific attacks

0 commit comments

Comments
 (0)