Skip to content

Commit 36066f8

Browse files
author
HD Moore
committed
Catch a few stragglers for double slash
1 parent 4d2147f commit 36066f8

File tree

3 files changed

+3
-7
lines changed

3 files changed

+3
-7
lines changed

modules/exploits/multi/http/axis2_deployer.rb

Lines changed: 1 addition & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -259,11 +259,7 @@ def cleanup_instructions(rpath, name)
259259
def exploit
260260
user = datastore['USERNAME']
261261
pass = datastore['PASSWORD']
262-
rpath = datastore['PATH']
263-
# ensure rpath has an initial /
264-
if not rpath =~ /^\//
265-
rpath = '/' + rpath
266-
end
262+
rpath = normalize_uri(datastore['PATH'])
267263

268264
success = false
269265
srvhdr = '?'

modules/exploits/windows/http/apache_mod_rewrite_ldap.rb

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -93,7 +93,7 @@ def exploit
9393

9494
print_status("Sending payload.")
9595
send_request_raw({
96-
'uri' => '/' + datastore['REWRITEPATH'] + trigger + payload.encoded,
96+
'uri' => normalize_uri(datastore['REWRITEPATH']) + trigger + payload.encoded,
9797
'version' => '1.0',
9898
}, 2)
9999
handler

modules/exploits/windows/http/xampp_webdav_upload_php.rb

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -75,7 +75,7 @@ def build_path
7575
if datastore['PATH'][0,1] == '/'
7676
uri_path = datastore['PATH'].dup
7777
else
78-
uri_path = '/' + datastore['PATH'].dup
78+
uri_path = normalize_uri(datastore['PATH'])
7979
end
8080
uri_path << '/' unless uri_path.ends_with?('/')
8181
if datastore['FILENAME']

0 commit comments

Comments
 (0)