{"action":"created","comment":{"url":"https://api.github.com/repos/rapid7/metasploit-framework/pulls/comments/30741227","id":30741227,"diff_hunk":"@@ -111,25 +110,69 @@ def dos_host(ip)\n     print_status(\"#{ip}:#{rport} - DOS request sent\")\n   end\n \n+  def potential_static_files_uris\n+    uri = normalize_uri(target_uri.path)\n \n-  def check_host(ip)\n-    return Exploit::CheckCode::Unknown if get_file_size(ip) == -1\n+    return [uri] unless uri[-1, 1] == '/'\n \n-    uri = normalize_uri(target_uri.path)\n-    res = send_request_raw({\n-      'uri' => uri,\n-      'method' => 'GET',\n-      'headers' => {\n-        'Range' => \"bytes=0-#{upper_range}\"\n-      }\n-    })\n-    if res && res.body.include?('Requested Range Not Satisfiable')\n-      return Exploit::CheckCode::Vulnerable\n-    elsif res && res.body.include?('The request has an invalid header name')\n-      return Exploit::CheckCode::Safe\n-    else\n-      return Exploit::CheckCode::Unknown\n+    uris = [\"#{uri}welcome.png\"]\n+    res  = send_request_raw('uri' => uri, 'method' => 'GET')\n+\n+    return uris unless res\n+\n+    site_uri = URI.parse(full_uri)\n+\n+    Nokogiri::HTML(res.body).xpath('//link|//script|//style|//img').each do |tag|\n+      %w(href src).each do |attribute|\n+        begin\n+          attr_value = tag[attribute]\n+\n+          next unless attr_value && !attr_value.empty?\n+\n+          uri = site_uri.merge(URI.encode(attr_value.strip))\n+\n+          next unless uri.host == vhost || uri.host == rhost\n+\n+          uris << uri.path if uri.path =~ /\\.[a-z]{2,}$/i # Only keep path with a file\n+        rescue => e","path":"modules/auxiliary/dos/http/ms15_034_ulonglongadd.rb","position":86,"original_position":86,"commit_id":"202a77fc129c72465d87b09d99a93840fa899bb6","original_commit_id":"202a77fc129c72465d87b09d99a93840fa899bb6","user":{"login":"erwanlr","id":1668843,"avatar_url":"https://avatars.githubusercontent.com/u/1668843?v=3","gravatar_id":"","url":"https://api.github.com/users/erwanlr","html_url":"https://github.com/erwanlr","followers_url":"https://api.github.com/users/erwanlr/followers","following_url":"https://api.github.com/users/erwanlr/following{/other_user}","gists_url":"https://api.github.com/users/erwanlr/gists{/gist_id}","starred_url":"https://api.github.com/users/erwanlr/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/erwanlr/subscriptions","organizations_url":"https://api.github.com/users/erwanlr/orgs","repos_url":"https://api.github.com/users/erwanlr/repos","events_url":"https://api.github.com/users/erwanlr/events{/privacy}","received_events_url":"https://api.github.com/users/erwanlr/received_events","type":"User","site_admin":false},"body":"I just don't want the scanner to be stopped due to something weird like an encoding issue or pretty much anything","created_at":"2015-05-20T19:46:54Z","updated_at":"2015-05-20T19:46:54Z","html_url":"https://github.com/rapid7/metasploit-framework/pull/5386#discussion_r30741227","pull_request_url":"https://api.github.com/repos/rapid7/metasploit-framework/pulls/5386","_links":{"self":{"href":"https://api.github.com/repos/rapid7/metasploit-framework/pulls/comments/30741227"},"html":{"href":"https://github.com/rapid7/metasploit-framework/pull/5386#discussion_r30741227"},"pull_request":{"href":"https://api.github.com/repos/rapid7/metasploit-framework/pulls/5386"}}},"pull_request":{"url":"https://api.github.com/repos/rapid7/metasploit-framework/pulls/5386","id":35855448,"html_url":"https://github.com/rapid7/metasploit-framework/pull/5386","diff_url":"https://github.com/rapid7/metasploit-framework/pull/5386.diff","patch_url":"https://github.com/rapid7/metasploit-framework/pull/5386.patch","issue_url":"https://api.github.com/repos/rapid7/metasploit-framework/issues/5386","number":5386,"state":"open","locked":false,"title":"Improves detection of the MS15-034","user":{"login":"erwanlr","id":1668843,"avatar_url":"https://avatars.githubusercontent.com/u/1668843?v=3","gravatar_id":"","url":"https://api.github.com/users/erwanlr","html_url":"https://github.com/erwanlr","followers_url":"https://api.github.com/users/erwanlr/followers","following_url":"https://api.github.com/users/erwanlr/following{/other_user}","gists_url":"https://api.github.com/users/erwanlr/gists{/gist_id}","starred_url":"https://api.github.com/users/erwanlr/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/erwanlr/subscriptions","organizations_url":"https://api.github.com/users/erwanlr/orgs","repos_url":"https://api.github.com/users/erwanlr/repos","events_url":"https://api.github.com/users/erwanlr/events{/privacy}","received_events_url":"https://api.github.com/users/erwanlr/received_events","type":"User","site_admin":false},"body":"Currently only the /welcome.png is checked, however in practise, this file is barely there.\r\n\r\nFurthermore, some scanners like Nessus often fail to properly detect the issue, and when it's detected, the vulnerable file is not provided.\r\n\r\nI've improved the detection based on a script I created at work: https://github.com/RandomStorm/scripts/blob/master/ms15-034-checker.rb\r\n\r\nThe idea is to extract all potential static files from the index page and test them rather than just check the /welcome.png.\r\n\r\nOutput examples:\r\n\r\nVulnerable:\r\nw/o Verbose:\r\n```\r\nmsf auxiliary(ms15_034_ulonglongadd) > check\r\n\r\n[*] X.X.X.X:80 - Checking /static/banner.jpg [416] - Vulnerable\r\n[+] X.X.X.X:80 - The target is vulnerable.\r\n[*] Checked 1 of 1 hosts (100% complete)\r\n```\r\n\r\nwith verbose:\r\n```\r\nmsf auxiliary(ms15_034_ulonglongadd) > check\r\n\r\n[*] X.X.X.X:80 - Checking /welcome.png [404] - Unknown\r\n[*] X.X.X.X:80 - Checking /static/banner.jpg [416] - Vulnerable\r\n[+] X.X.X.X:80 - The target is vulnerable.\r\n[*] Checked 1 of 1 hosts (100% complete)\r\n```\r\n\r\n\r\nNot vulnerable:\r\nw/o verbose:\r\n```\r\nmsf auxiliary(ms15_034_ulonglongadd) > check\r\n[*] 192.168.1.24:80 - The target is not exploitable.\r\n[*] Checked 1 of 1 hosts (100% complete)\r\n```\r\n\r\nwith verbose:\r\n```\r\nmsf auxiliary(ms15_034_ulonglongadd) > check\r\n\r\n[*] 192.168.1.24:80 - Checking /welcome.png [400] - Safe\r\n[*] 192.168.1.24:80 - The target is not exploitable.\r\n[*] Checked 1 of 1 hosts (100% complete)\r\n```\r\n\r\n\r\nUnknown (Debian Server):\r\nw/o verbose:\r\n```\r\nmsf auxiliary(ms15_034_ulonglongadd) > check\r\n[*] 192.168.1.103:80 - Cannot reliably check exploitability.\r\n[*] Checked 1 of 1 hosts (100% complete)\r\n```\r\n\r\nwith verbose\r\n```\r\nmsf auxiliary(ms15_034_ulonglongadd) > check\r\n\r\n[*] 192.168.1.103:80 - Checking /wordpress-4.2/welcome.png [404] - Unknown\r\n[*] 192.168.1.103:80 - Checking /wordpress-4.2/xmlrpc.php [405] - Unknown\r\n[*] 192.168.1.103:80 - Checking /wordpress-4.2/wp-content/themes/twentyfifteen/genericons/genericons.css [200] - Unknown\r\n[*] 192.168.1.103:80 - Checking /wordpress-4.2/wp-content/themes/twentyfifteen/style.css [200] - Unknown\r\n[*] 192.168.1.103:80 - Checking /wordpress-4.2/wp-includes/js/jquery/jquery.js [200] - Unknown\r\n[*] 192.168.1.103:80 - Checking /wordpress-4.2/wp-includes/js/jquery/jquery-migrate.min.js [200] - Unknown\r\n[*] 192.168.1.103:80 - Checking /wordpress-4.2/wp-includes/wlwmanifest.xml [200] - Unknown\r\n[*] 192.168.1.103:80 - Checking /wordpress-4.2/wp-content/themes/twentyfifteen/js/skip-link-focus-fix.js [200] - Unknown\r\n[*] 192.168.1.103:80 - Checking /wordpress-4.2/wp-content/themes/twentyfifteen/js/functions.js [200] - Unknown\r\n[*] 192.168.1.103:80 - Cannot reliably check exploitability.\r\n[*] Checked 1 of 1 hosts (100% complete)\r\n```\r\n\r\nSome questions/remarks:\r\n- https://github.com/rapid7/metasploit-framework/blob/master/lib/msf/core/exploit/http/client.rb#L400 rhost shouldn't be replaced by vhost ? givent that if not supplied, the vhost is set to rhost\r\n- Is there a VHOSTS option ? As there is a RHOSTS, it would seem logical to also have the plural form of VHOST, useful especially in scanner mode","created_at":"2015-05-20T17:21:05Z","updated_at":"2015-05-20T19:46:54Z","closed_at":null,"merged_at":null,"merge_commit_sha":"a261925457b7ca6c3def73f3854fa90e4bd1dc2f","assignee":null,"milestone":null,"commits_url":"https://api.github.com/repos/rapid7/metasploit-framework/pulls/5386/commits","review_comments_url":"https://api.github.com/repos/rapid7/metasploit-framework/pulls/5386/comments","review_comment_url":"https://api.github.com/repos/rapid7/metasploit-framework/pulls/comments{/number}","comments_url":"https://api.github.com/repos/rapid7/metasploit-framework/issues/5386/comments","statuses_url":"https://api.github.com/repos/rapid7/metasploit-framework/statuses/202a77fc129c72465d87b09d99a93840fa899bb6","head":{"label":"erwanlr:ms15-034-better-checks","ref":"ms15-034-better-checks","sha":"202a77fc129c72465d87b09d99a93840fa899bb6","user":{"login":"erwanlr","id":1668843,"avatar_url":"https://avatars.githubusercontent.com/u/1668843?v=3","gravatar_id":"","url":"https://api.github.com/users/erwanlr","html_url":"https://github.com/erwanlr","followers_url":"https://api.github.com/users/erwanlr/followers","following_url":"https://api.github.com/users/erwanlr/following{/other_user}","gists_url":"https://api.github.com/users/erwanlr/gists{/gist_id}","starred_url":"https://api.github.com/users/erwanlr/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/erwanlr/subscriptions","organizations_url":"https://api.github.com/users/erwanlr/orgs","repos_url":"https://api.github.com/users/erwanlr/repos","events_url":"https://api.github.com/users/erwanlr/events{/privacy}","received_events_url":"https://api.github.com/users/erwanlr/received_events","type":"User","site_admin":false},"repo":{"id":35893273,"name":"metasploit-framework","full_name":"erwanlr/metasploit-framework","owner":{"login":"erwanlr","id":1668843,"avatar_url":"https://avatars.githubusercontent.com/u/1668843?v=3","gravatar_id":"","url":"https://api.github.com/users/erwanlr","html_url":"https://github.com/erwanlr","followers_url":"https://api.github.com/users/erwanlr/followers","following_url":"https://api.github.com/users/erwanlr/following{/other_user}","gists_url":"https://api.github.com/users/erwanlr/gists{/gist_id}","starred_url":"https://api.github.com/users/erwanlr/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/erwanlr/subscriptions","organizations_url":"https://api.github.com/users/erwanlr/orgs","repos_url":"https://api.github.com/users/erwanlr/repos","events_url":"https://api.github.com/users/erwanlr/events{/privacy}","received_events_url":"https://api.github.com/users/erwanlr/received_events","type":"User","site_admin":false},"private":false,"html_url":"https://github.com/erwanlr/metasploit-framework","description":"Metasploit Framework","fork":true,"url":"https://api.github.com/repos/erwanlr/metasploit-framework","forks_url":"https://api.github.com/repos/erwanlr/metasploit-framework/forks","keys_url":"https://api.github.com/repos/erwanlr/metasploit-framework/keys{/key_id}","collaborators_url":"https://api.github.com/repos/erwanlr/metasploit-framework/collaborators{/collaborator}","teams_url":"https://api.github.com/repos/erwanlr/metasploit-framework/teams","hooks_url":"https://api.github.com/repos/erwanlr/metasploit-framework/hooks","issue_events_url":"https://api.github.com/repos/erwanlr/metasploit-framework/issues/events{/number}","events_url":"https://api.github.com/repos/erwanlr/metasploit-framework/events","assignees_url":"https://api.github.com/repos/erwanlr/metasploit-framework/assignees{/user}","branches_url":"https://api.github.com/repos/erwanlr/metasploit-framework/branches{/branch}","tags_url":"https://api.github.com/repos/erwanlr/metasploit-framework/tags","blobs_url":"https://api.github.com/repos/erwanlr/metasploit-framework/git/blobs{/sha}","git_tags_url":"https://api.github.com/repos/erwanlr/metasploit-framework/git/tags{/sha}","git_refs_url":"https://api.github.com/repos/erwanlr/metasploit-framework/git/refs{/sha}","trees_url":"https://api.github.com/repos/erwanlr/metasploit-framework/git/trees{/sha}","statuses_url":"https://api.github.com/repos/erwanlr/metasploit-framework/statuses/{sha}","languages_url":"https://api.github.com/repos/erwanlr/metasploit-framework/languages","stargazers_url":"https://api.github.com/repos/erwanlr/metasploit-framework/stargazers","contributors_url":"https://api.github.com/repos/erwanlr/metasploit-framework/contributors","subscribers_url":"https://api.github.com/repos/erwanlr/metasploit-framework/subscribers","subscription_url":"https://api.github.com/repos/erwanlr/metasploit-framework/subscription","commits_url":"https://api.github.com/repos/erwanlr/metasploit-framework/commits{/sha}","git_commits_url":"https://api.github.com/repos/erwanlr/metasploit-framework/git/commits{/sha}","comments_url":"https://api.github.com/repos/erwanlr/metasploit-framework/comments{/number}","issue_comment_url":"https://api.github.com/repos/erwanlr/metasploit-framework/issues/comments{/number}","contents_url":"https://api.github.com/repos/erwanlr/metasploit-framework/contents/{+path}","compare_url":"https://api.github.com/repos/erwanlr/metasploit-framework/compare/{base}...{head}","merges_url":"https://api.github.com/repos/erwanlr/metasploit-framework/merges","archive_url":"https://api.github.com/repos/erwanlr/metasploit-framework/{archive_format}{/ref}","downloads_url":"https://api.github.com/repos/erwanlr/metasploit-framework/downloads","issues_url":"https://api.github.com/repos/erwanlr/metasploit-framework/issues{/number}","pulls_url":"https://api.github.com/repos/erwanlr/metasploit-framework/pulls{/number}","milestones_url":"https://api.github.com/repos/erwanlr/metasploit-framework/milestones{/number}","notifications_url":"https://api.github.com/repos/erwanlr/metasploit-framework/notifications{?since,all,participating}","labels_url":"https://api.github.com/repos/erwanlr/metasploit-framework/labels{/name}","releases_url":"https://api.github.com/repos/erwanlr/metasploit-framework/releases{/id}","created_at":"2015-05-19T16:08:17Z","updated_at":"2015-05-19T16:08:37Z","pushed_at":"2015-05-20T17:10:06Z","git_url":"git://github.com/erwanlr/metasploit-framework.git","ssh_url":"git@github.com:erwanlr/metasploit-framework.git","clone_url":"https://github.com/erwanlr/metasploit-framework.git","svn_url":"https://github.com/erwanlr/metasploit-framework","homepage":"http://www.metasploit.com/","size":1072097,"stargazers_count":0,"watchers_count":0,"language":"Ruby","has_issues":false,"has_downloads":true,"has_wiki":true,"has_pages":true,"forks_count":0,"mirror_url":null,"open_issues_count":0,"forks":0,"open_issues":0,"watchers":0,"default_branch":"master"}},"base":{"label":"rapid7:master","ref":"master","sha":"23c77adc6891c331d36974af4ea224b0324f7a81","user":{"login":"rapid7","id":1013671,"avatar_url":"https://avatars.githubusercontent.com/u/1013671?v=3","gravatar_id":"","url":"https://api.github.com/users/rapid7","html_url":"https://github.com/rapid7","followers_url":"https://api.github.com/users/rapid7/followers","following_url":"https://api.github.com/users/rapid7/following{/other_user}","gists_url":"https://api.github.com/users/rapid7/gists{/gist_id}","starred_url":"https://api.github.com/users/rapid7/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/rapid7/subscriptions","organizations_url":"https://api.github.com/users/rapid7/orgs","repos_url":"https://api.github.com/users/rapid7/repos","events_url":"https://api.github.com/users/rapid7/events{/privacy}","received_events_url":"https://api.github.com/users/rapid7/received_events","type":"Organization","site_admin":false},"repo":{"id":2293158,"name":"metasploit-framework","full_name":"rapid7/metasploit-framework","owner":{"login":"rapid7","id":1013671,"avatar_url":"https://avatars.githubusercontent.com/u/1013671?v=3","gravatar_id":"","url":"https://api.github.com/users/rapid7","html_url":"https://github.com/rapid7","followers_url":"https://api.github.com/users/rapid7/followers","following_url":"https://api.github.com/users/rapid7/following{/other_user}","gists_url":"https://api.github.com/users/rapid7/gists{/gist_id}","starred_url":"https://api.github.com/users/rapid7/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/rapid7/subscriptions","organizations_url":"https://api.github.com/users/rapid7/orgs","repos_url":"https://api.github.com/users/rapid7/repos","events_url":"https://api.github.com/users/rapid7/events{/privacy}","received_events_url":"https://api.github.com/users/rapid7/received_events","type":"Organization","site_admin":false},"private":false,"html_url":"https://github.com/rapid7/metasploit-framework","description":"Metasploit Framework","fork":false,"url":"https://api.github.com/repos/rapid7/metasploit-framework","forks_url":"https://api.github.com/repos/rapid7/metasploit-framework/forks","keys_url":"https://api.github.com/repos/rapid7/metasploit-framework/keys{/key_id}","collaborators_url":"https://api.github.com/repos/rapid7/metasploit-framework/collaborators{/collaborator}","teams_url":"https://api.github.com/repos/rapid7/metasploit-framework/teams","hooks_url":"https://api.github.com/repos/rapid7/metasploit-framework/hooks","issue_events_url":"https://api.github.com/repos/rapid7/metasploit-framework/issues/events{/number}","events_url":"https://api.github.com/repos/rapid7/metasploit-framework/events","assignees_url":"https://api.github.com/repos/rapid7/metasploit-framework/assignees{/user}","branches_url":"https://api.github.com/repos/rapid7/metasploit-framework/branches{/branch}","tags_url":"https://api.github.com/repos/rapid7/metasploit-framework/tags","blobs_url":"https://api.github.com/repos/rapid7/metasploit-framework/git/blobs{/sha}","git_tags_url":"https://api.github.com/repos/rapid7/metasploit-framework/git/tags{/sha}","git_refs_url":"https://api.github.com/repos/rapid7/metasploit-framework/git/refs{/sha}","trees_url":"https://api.github.com/repos/rapid7/metasploit-framework/git/trees{/sha}","statuses_url":"https://api.github.com/repos/rapid7/metasploit-framework/statuses/{sha}","languages_url":"https://api.github.com/repos/rapid7/metasploit-framework/languages","stargazers_url":"https://api.github.com/repos/rapid7/metasploit-framework/stargazers","contributors_url":"https://api.github.com/repos/rapid7/metasploit-framework/contributors","subscribers_url":"https://api.github.com/repos/rapid7/metasploit-framework/subscribers","subscription_url":"https://api.github.com/repos/rapid7/metasploit-framework/subscription","commits_url":"https://api.github.com/repos/rapid7/metasploit-framework/commits{/sha}","git_commits_url":"https://api.github.com/repos/rapid7/metasploit-framework/git/commits{/sha}","comments_url":"https://api.github.com/repos/rapid7/metasploit-framework/comments{/number}","issue_comment_url":"https://api.github.com/repos/rapid7/metasploit-framework/issues/comments{/number}","contents_url":"https://api.github.com/repos/rapid7/metasploit-framework/contents/{+path}","compare_url":"https://api.github.com/repos/rapid7/metasploit-framework/compare/{base}...{head}","merges_url":"https://api.github.com/repos/rapid7/metasploit-framework/merges","archive_url":"https://api.github.com/repos/rapid7/metasploit-framework/{archive_format}{/ref}","downloads_url":"https://api.github.com/repos/rapid7/metasploit-framework/downloads","issues_url":"https://api.github.com/repos/rapid7/metasploit-framework/issues{/number}","pulls_url":"https://api.github.com/repos/rapid7/metasploit-framework/pulls{/number}","milestones_url":"https://api.github.com/repos/rapid7/metasploit-framework/milestones{/number}","notifications_url":"https://api.github.com/repos/rapid7/metasploit-framework/notifications{?since,all,participating}","labels_url":"https://api.github.com/repos/rapid7/metasploit-framework/labels{/name}","releases_url":"https://api.github.com/repos/rapid7/metasploit-framework/releases{/id}","created_at":"2011-08-30T06:13:20Z","updated_at":"2015-05-20T18:25:55Z","pushed_at":"2015-05-20T18:35:44Z","git_url":"git://github.com/rapid7/metasploit-framework.git","ssh_url":"git@github.com:rapid7/metasploit-framework.git","clone_url":"https://github.com/rapid7/metasploit-framework.git","svn_url":"https://github.com/rapid7/metasploit-framework","homepage":"http://www.metasploit.com/","size":1072097,"stargazers_count":3790,"watchers_count":3790,"language":"Ruby","has_issues":true,"has_downloads":true,"has_wiki":true,"has_pages":true,"forks_count":3082,"mirror_url":null,"open_issues_count":208,"forks":3082,"open_issues":208,"watchers":3790,"default_branch":"master"}},"_links":{"self":{"href":"https://api.github.com/repos/rapid7/metasploit-framework/pulls/5386"},"html":{"href":"https://github.com/rapid7/metasploit-framework/pull/5386"},"issue":{"href":"https://api.github.com/repos/rapid7/metasploit-framework/issues/5386"},"comments":{"href":"https://api.github.com/repos/rapid7/metasploit-framework/issues/5386/comments"},"review_comments":{"href":"https://api.github.com/repos/rapid7/metasploit-framework/pulls/5386/comments"},"review_comment":{"href":"https://api.github.com/repos/rapid7/metasploit-framework/pulls/comments{/number}"},"commits":{"href":"https://api.github.com/repos/rapid7/metasploit-framework/pulls/5386/commits"},"statuses":{"href":"https://api.github.com/repos/rapid7/metasploit-framework/statuses/202a77fc129c72465d87b09d99a93840fa899bb6"}}}}