Skip to content

Commit 0b74f98

Browse files
author
HD Moore
committed
Rescue errors and update credits
1 parent e05f4ba commit 0b74f98

File tree

1 file changed

+6
-2
lines changed

1 file changed

+6
-2
lines changed

modules/exploits/multi/http/rails_xml_yaml_code_exec.rb

Lines changed: 6 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -21,12 +21,16 @@ def initialize(info = {})
2121
processor of the Ruby on Rails application framework. This vulnerability allows
2222
an attacker to instantiate a remote object, which in turn can be used to execute
2323
any ruby code remotely in the context of the application.
24+
25+
This module has been tested across multiple versions of RoR 3.x, but does not yet
26+
work against 2.x versions of RoR.
27+
2428
},
2529
'Author' =>
2630
[
2731
'charlisome', # PoC
2832
'espes', # PoC and Metasploit module
29-
'toothfairy', # Anonymous contributor
33+
'lian', # Identified the RouteSet::NamedRouteCollection vector
3034
'hdm' # Module merge/conversion/payload work
3135
],
3236
'License' => MSF_LICENSE,
@@ -72,7 +76,7 @@ def detached_payload_stub(code)
7276
end
7377
else
7478
if ! Process.fork()
75-
eval(code)
79+
eval(code) rescue nil
7680
end
7781
end
7882
^.strip.split(/\n/).map{|line| line.strip}.join("\n")

0 commit comments

Comments
 (0)