Re: wdbrpc_memory_dump.rb bug and question

[HD Moore <hdm () metasploit com>]

On 1/24/2012 10:46 AM, Robin Wood wrote:
> First the bug, I think this is because I set an offset but pointed it
> at a file that doesn't exist:
>
> [*] Attempting to dump system memory, starting at offset 0xaa84850
> [*] 10.21.2.30 Connected to VxWorks5.5.1 - Motorola E500 : Unknown
> system version ()
> [*] Dumping 0x10000000 bytes from base address 0x00000000 at offset
> 0x0aa84850...
> [-] Auxiliary failed: Errno::ENOENT No such file or directory -
> /Users/robin/.msf4/logs/vxworks_memory3.dump
> [-] Call stack:
> [-]   /Users/robin/src/msf/modules/auxiliary/admin/vxworks/wdbrpc_memory_dump.rb:75:in
> `initialize'
> [-]   /Users/robin/src/msf/modules/auxiliary/admin/vxworks/wdbrpc_memory_dump.rb:75:in
> `open'
> [-]   /Users/robin/src/msf/modules/auxiliary/admin/vxworks/wdbrpc_memory_dump.rb:75:in
> `run'
> [*] Auxiliary module execution completed
>
> Now the question, this memory dump is from a Dell OpenManage switch,
> can anyone tell me where to look for the user credentials once I've
> dumped all the memory?

This is a problem with your local filesystem - you may need to mkdir
/Users/robin/.msf4/logs/ first before running the module, as it didn't
succeed in opening the dump file.

You can set the output path with the LPATH option

-HD
_______________________________________________
https://mail.metasploit.com/mailman/listinfo/framework