Skip to content

Commit 280529f

Browse files
committed
Make some changes to the description
1 parent 3780b1b commit 280529f

File tree

1 file changed

+8
-8
lines changed

1 file changed

+8
-8
lines changed

modules/exploits/windows/http/hp_mpa_job_acct.rb

Lines changed: 8 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -19,15 +19,15 @@ def initialize
1919
'Description' => %q{
2020
This module exploits an arbitrary file upload vulnerability on HP Managed Printing
2121
Administration 2.6.3 (and before). The vulnerability exists in the UploadFiles()
22-
function from the MPAUploader.Uploader.1 control, loaded and used on server side.
22+
function from the MPAUploader.Uploader.1 control, loaded and used by the server.
2323
The function can be abused via directory traversal and null byte injection in order
24-
to achieve arbitrary file upload. In order to upload successfully the file cannot
25-
exist in the filesystem. On the other hand, files are written with the privileges of
26-
the Internet Guest Account (IUSR_*). The module tries to achieve code execution by
27-
uploading ASP code into the webroot folder, on locations where server side code is
28-
allowed. By default the /hpmpa/userfiles/ and subfolders are used, since IUSR_*
29-
write privileges are needed for some application functions. The user can specify an
30-
arbitrary location through the WEBFOLDER option.
24+
to achieve arbitrary file upload. In order to exploit successfully, a few conditions
25+
must be met: 1) A writable location under the context of Internet Guest Account
26+
(IUSR_*), or Everyone is required. By default, this module will attempt to write to
27+
/hpmpa/userfiles/, but you may specify the WRITEWEBFOLDER datastore option to provide
28+
another writable path. 2) The writable path must also be readable by a browser,
29+
this typically means a location under wwwroot. 3) You cannot overwrite a file with
30+
the same name as the payload.
3131
},
3232
'Author' => [
3333
'Andrea Micalizzi', # aka rgod - Vulnerability Discovery

0 commit comments

Comments
 (0)