@@ -38,17 +38,15 @@ def initialize(info = {})
3838 'Version' => '$Revision:$' ,
3939 'Description' => %q{
4040 This module relays negotiated NTLM Credentials from an HTTP server to multiple
41- protocols (currently it supports relaying to SMB and HTTP) .
41+ protocols. Currently, this module supports relaying to SMB and HTTP.
4242
4343 Complicated custom attacks requiring multiple requests that depend on each
44- other can be written using the SYNC* options. For example, a typical CSRF
45- style attack might look like:
46-
47- 1) Set an HTTP_GET request with a unique SNYNCID
48- 2) Set an HTTP_POST request with a SYNCFILE, which contains logic to look
49- through the database and parse out important values, such as the CSRF token
50- or authentication cookies. It then sets these as configuration options
51- 3) Create a web page with iframes pointing at 1 and then 2
44+ other can be written using the SYNC* options. For example, a CSRF-style
45+ attack might first set an HTTP_GET request with a unique SNYNCID and set
46+ an HTTP_POST request with a SYNCFILE, which contains logic to look
47+ through the database and parse out important values, such as the CSRF token
48+ or authentication cookies, setting these as configuration options, and finally
49+ create a web page with iframe elements pointing at the HTTP_GET and HTTP_POSTs.
5250 } ,
5351 'Author' =>
5452 [
@@ -233,14 +231,14 @@ def parse_args()
233231 # this is useful for multi staged relay attacks
234232 # ideally I would use a resource file but it's not easily exposed, and this is simpler
235233 def sync_options ( )
236- print_status ( "Dynamically evaling local ruby file: #{ datastore [ 'SYNCFILE' ] } " )
234+ print_status ( "Dynamically eval()'ing local ruby file: #{ datastore [ 'SYNCFILE' ] } " )
237235 # previous request might create the file, so error thrown at runtime
238236 if not ::File . readable? ( datastore [ 'SYNCFILE' ] )
239237 print_error ( "SYNCFILE unreadable, aborting" )
240238 raise ArgumentError
241239 end
242240 data = ::File . read ( datastore [ 'SYNCFILE' ] )
243- eval ( data )
241+ eval ( data ) # WARNING: This can be insanely insecure!
244242 end
245243
246244 # relay creds to server and perform any HTTP specific attacks
0 commit comments