From d8942b360b15a8c1bba5e822cade7f6aa5906b71 Mon Sep 17 00:00:00 2001 From: dmiller Date: Mon, 27 Feb 2017 16:42:50 +0000 Subject: [PATCH] Make sure there's some data to read. See #689 --- scripts/rmi-vuln-classloader.nse | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/scripts/rmi-vuln-classloader.nse b/scripts/rmi-vuln-classloader.nse index 132bb3f44..ca5d8e673 100644 --- a/scripts/rmi-vuln-classloader.nse +++ b/scripts/rmi-vuln-classloader.nse @@ -105,6 +105,10 @@ Default configuration of RMI registry allows loading classes from remote URLs wh -- 0x51 : Returndata return false, "No return data received from server"; end + -- Need to make sure we get a good chunk of data. It's going to be a java + -- stack trace. But if we don't get enough, I guess we can check with + -- whatever we get. + registry.out.dis:canRead(256) local data = registry.out.dis.bReader.readBuffer; if string.find(data, "RMI class loader disabled") == nil then